Columbus whistleblower lawsuit violates First Amendment, digital rights group says

COLUMBUS, Ohio (WCMH) -- A digital advocacy group has backed the cybersecurity expert who helped shine a light on the massive Columbus cyberattack, accusing city officials of violating his rights.

After suing Connor Goodwolf for showing reporters what was publicly available in a dark web leak by the Rhysida ransomware group, City Attorney Zach Klein said over and over at a news conference that this is not about free speech, but rather about stopping him from accessing the stolen data. On Thursday, a Franklin County judge approved a temporary restraining order stopping Connor Goodwolf from accessing, downloading, or disseminating stolen city data.

Experts from the Electronic Frontier Foundation -- a nonprofit focused on defending civil liberties in the digital world and user privacy -- spoke with NBC4 about Goodwolf's situation. The groups' lawyers step in on certain cases, including representing a parent facing a copyright lawsuit from LifeWise.

EFF Free Speech and Transparency Litigation Director Aaron Mackey hasn't confirmed if the group would represent Goodwolf, who did not have an attorney listed as of Friday. But he did say the city's actions have a negative impact on the public learning about the dangers of data breaches.

"A core part of our work is making sure that the folks who are trying to do good in this world and try to build the internet to make it safer for all of us and to ensure that there are fewer data breaches, that they have the ability to do so and that they're not targeted for their work," Mackey said. 

Mackey had some strong words about the city’s move to stop Goodwolf’s work.

"It clearly violates his First Amendment rights to make sure that the public understands and is informed on this very significant privacy breach that is the result of what sounds like the city's own inaction or inability to properly secure its data," Mackey said. "Rather than thank this individual for coming forward and actually explaining to the public that this is a significant problem, the city has resulted to basically violating his First Amendment rights and claiming that what he's done is some sort of illegal act."

NBC4 pressed Klein was asked about the First Amendment ramifications Thursday, during his news conference about the lawsuit.

"This is not about speech," Klein said. "It's about the actual action of going on the keyboard, going into the dark web, gathering information, downloading it to your computer and then disseminating to people that are in the press and otherwise. This effect is to get him to stop downloading and disclosing stolen criminal records to protect public safety."

The city attorney said Goodwolf took this "to the next level" when the information accessed involved undercover officers and victims. The day before, the cybersecurity expert warned he just found a database belonging to Columbus Division of Police in the leak, which included graphic reports from crime investigations.

"This is a whole other escalation of law enforcement personnel, of potentially pending cases that involve suspects and witnesses, and that's why I think it is the escalation of which of this conduct what led us to this," Klein said. 

In that same press conference, Klein said it takes a lot of skill to access the city’s stolen data.

"It takes a level of sophistication to get to this information on the dark web. No one is going out there and simply just Googling 'dark web' to find this," Klein said. 

The EFF disagrees.

"It doesn't take any sophistication or vast technical knowledge to access that," Mackey said. "You can actually use a Google search to download a browser called Tor, which stands for 'the onion router,' and it allows you to actually access a lot of this material online. So it's as sophisticated as downloading an app on your phone."

Mackey and a lawyer NBC4 spoke with on Thursday used the word “chilling” to describe the city’s move.

"It appeared that the city was trying to shift blame for the fact that this data that is out there and available from its own failures to properly secure that information to an expert who is reviewing what is there for the purposes of informing the public and reporting on a story and information that is highly relevant, highly important," Organ Law Attorney Kirsten Fraser said. 

"I think what's happening here is incredibly chilling, and counterproductive to what I hope is the city's goal, which is the protection of the residents of Columbus' personal information," Mackey said.