• by Wendy Davis , Staff Writer @wendyndavis, March 7, 2011

A federal judge in California has issued a ruling that should alarm privacy and free speech advocates. The order, by Magistrate Judge Joseph C. Spero, allows Sony to obtain the IP address of all people who visited the site of hacker George Hotz since 2009. The order also allows Sony to discover other information, including the IP addresses and user names of visitors who streamed a private YouTube clip after Jan. 27.

The ruling was issued at the request of Sony, which recently sued Hotz for allegedly posting instructions telling users how they can jailbreak the PlayStation 3 in order to install Linux or other operating systems. Sony contends that Hotz violated the Digital Millennium Copyright Act as well as the Computer Fraud and Abuse Act -- though, as the digital rights group Electronic Frontier Foundation points out, information about the security flaw in Sony was widely circulated late last year after it was unveiled at the Chaos Communication Congress in Berlin.

Sony reportedly argued that it needed information about visitors to YouTube and Hotz's own site in order to show that he distributed the data and that his visitors came from California, which is where Sony wants the case litigated.

But neither reason should be strong enough to overcome the threat to users' rights posed by Spero's order. As the Electronic Frontier Foundation rightly argued in a proposed friend-of-the-court filing, Web users have a First Amendment right to view online material anonymously. Additionally, the federal Video Privacy Protection Act specifies that companies can't disclose the names of movie renters without their consent.

That's not to say that Web users' IP addresses or names can never be disclosed, but Spero doesn't appear to have even considered whether Sony could have gotten the information it says it needs without also violating Web users' privacy. Spero's order is in some ways reminiscent of a 2008 ruling in the YouTube/Viacom litigation. In that case, U.S. District Court Judge Louis Stanton set off a privacy furor when he directed YouTube to disclose screen names and IP addresses of people who watched Viacom videos. The companies later agreed that Google would anonymize the data before turning it over.