Sorry Appin, We’re Not Taking Down Our Article About Your Attempts To Silence Reporters

Back in December, we wrote about Appin. We were not writing about the reports (of which there have been many) that the organization that started as a sort of cybersecurity training school, but morphed into a kind of hack-for-hire" scheme was involved in all sorts of nefarious activity. Rather we wrote about their (ab)use of the Indian court system to order Reuters to remove a big, detailed, investigative report on the company.

The history of Appin, and reporting on its involvement in hacking schemes, goes back a over a decade. Reports of Appin trying to hide and suppress such stories is a bit shorter but are abundant. And Appin has, at times, been quite successful, especially in trying to remove the name of the guy regularly accused of being behind Appin, Rajat Khare. See this SwissInfo report on how Qatar spied on the world of football," which was forced to remove Khare's name while leaving in Appin's.

Or how about the Bureau of Investigative Journalism story published in 2022, Inside the Global Hack-for-Hire Industry. An earlier version of that report names Khare. In April of 2023, the article was updated, and all mentions of Khare disappeared. There are many more examples as well.

Back in December, the Daily Beast finally had an article entitled Who is Killing all These Stories About a Controversial Tech Mogul?" highlighting how stories about Khare and Appin have a noticeable history of suddenly disappearing.

In a move that has press freedom campaigners troubled, Rajat Khare, co-founder of Appin, an India-based tech company, has used a variety of law firms in a number of different jurisdictions to threaten these U.S., British, Swiss, Indian, and French-language media organizations.

On Nov. 16, Reuters published a special investigation under the headline How an Indian startup hacked the world," detailing how Appin allegedly became a hack for hire powerhouse that stole secrets from executives, politicians, military officials and wealthy elites around the globe"-a claim that Khare strongly denies. Khare retained the powerhouse media assassin" firm Clare Locke LLP, which boasts on its website about killing stories," to send Reuters several legal threats over the past year about the story, according to two people familiar with the matter.

After the removal of the Reuters story, which at least involved an actual court order, others appeared to be bullied into submission as well. Perhaps most shockingly, Lawfare (who, of anyone, should understand how ridiculous this is) redacted their version of the story about Reuters pulling down its article, saying that they did so after receiving a letter notifying us that the Reuters story summarized in this article had been taken down pursuant to court order in response to allegations that it is false and defamatory. The letter demanded that we retract this post as well." And they did so, despite no legal basis:

Unsurprisingly, we also received similar demands. We received multiple emails claiming to represent Association of Appin Training Centers" legal department, and claiming (falsely) that by quoting the Reuters article (which we did not even do) we were also liable for violating the court order. Similar demands were also sent to our CDN provider, our domain registrar, and the domain registry.

The only thing we quoted from Reuters was their announcement about the removal - not from the original article. The other parts we quoted were from SentinelOne, the security research firm that Reuters used to analyze the data. At the time we wrote the article, SentinelOne's report remained online (it, too, has since been removed in light of a pending court order ... out of an abundance of caution").

In the meantime, though, all these attempts to pull down and hide the content appears to be causing a bit of a Streisand Effect. Beyond the Daily Beast article calling out the campaign, the website Distributed Denial of Secrets decided to republish the Reuters piece as part of its new Greenhouse" project, noting:

In response to the unacceptable censorship by Appin and the Indian courts, Distributed Denial of Secrets is launching a new initiative to combat censorship: the Greenhouse Project. The Greenhouse Project continues DDoSecrets' mission of ensuring the free transmission of data in the public interest by making the publisher of last resort' concept proposed by George Buchanan in 2007 a reality. By ensuring the reporting and source files are preserved, the Greenhouse Project builds on previous efforts creating a warming effect" to reverse the chilling effects of censorship.

In addition, the Freedom of the Press Foundation, Politico, and Columbia Journalism Review have all run stories on Appin's attempt to silence reporters. And, of course, all of this just keeps bringing more and more attention to the underlying claims about Khare and Appin. If Khare disputes those claims he could respond to them and refute them directly. Instead, he appears to be continuing a campaign of legal threats and dubious legal filings to seek to scare off reporters.

A few weeks back, we found out that our friends at Muckrock, the operators of DocumentCloud, had also received similar threats regarding documents hosted on that site.

Earlier this week, EFF sent a letter to the Association of Appin Training Centers, on behalf of both us and Muckrock, pointing out that the arguments they made in their letters to both of us did not appear to match what was in the actual court filing, which (1) does not clearly establish that the articles were defamatory based on the full evidence and a complete defense by Reuters, and (2) very clearly only apply to Reuters and Google. Furthermore, the letter points out that we are protected by the First Amendment, and any move to enforce a foreign order that violates the First Amendment would be barred under the SPEECH Act.

You can find Muckrock's article about this here. Andy Greenberg, at Wired, also has a story about this.

This kind of censorial bullying may work on other publications, but Techdirt believes that (1) important stories, especially around surveillance and hacking, deserve to be read and (2) it's vitally important to call it out publicly when operations like Appin seek to silence reporting, especially when it's done through abusing the legal process to silence and intimidate journalists and news organizations.

We want to thank David Greene and Aaron Mackey at EFF for their help with this.

To the Association of Appin Training Centers:

We represent and write on behalf of Techdirt and MuckRock Foundation (which runs the DocumentCloud hosting services), each of which received correspondence from you making certain assertions about the legal significance of an interim court order in the matter of Vinay Pandey v. Raphael Satter & Ors. Please direct any future correspondence about this matter to us.

We are concerned with two issues you raise in your correspondence.

First, you refer to the Reuters article as containing defamatory materials as determined by the court. However, the court's order by its very terms is an interim order, that the defendants' evidence has not yet been considered, and that a final determination of the defamatory character of the article has not been made. The order itself states this is only a prima-facie opinion and the defendants shall have sufficient opportunity to express their views through reply, contest in the main suit etc. and the final decision shall be taken subsequently.

Second, you assert that reporting by others of the disputed statements made in the Reuters article which itself is a violation of an Indian Court Order, thereby making you also liable under Contempt of Courts Act, 1971.' But, again by its plain terms, the court's interim order applies only to Reuters and to Google. The order does not require any other person or entity to depublish their articles or other pertinent materials. And the order does not address its effect on those outside the jurisdiction of Indian courts. The order is in no way the global takedown order your correspondence represents it to be. Moreover, both Techdirt and MuckRock Foundation are U.S. entities. Thus, even if the court's order could apply beyond the parties named within it, it will be unenforceable in U.S. courts to the extent it and Indian defamation law is inconsistent with the First Amendment to the U.S. Constitution and 47 U.S.C. 230, pursuant to the SPEECH Act, 28 U.S.C. 4102. Since the First Amendment would not permit an interim depublication order in a defamation case, the Pandey order is unenforceable.

If you disagree, please provide us with legal authority so we can assess those arguments. Unless we hear from you otherwise, we will assume that you concede that the order binds only Reuters and Google and that you will cease asserting otherwise to our clients or to anyone else.
--------------------
David Greene
Civil Liberties Director/Senior Staff Attorney
Electronic Frontier Foundation