Jay Lewis Farrow v. John Does, 1-20

• Court: District Court, E.D. New York
• Decided: November 4, 2025
• Docket: 1:25-cv-06033
• Status: Unknown

Opinion

UNITED STATES DISTRICT COURT EASTERN DISTRICT OF NEW YORK --------------------------------------------------------------- X : JAY LEWIS FARROW, : Plaintiff, : MEMORANDUM AND ORDER

– against – : 25-CV-6033 (AMD) (PK) : JOHN DOES, 1-20, : Defendants. : --------------------------------------------------------------- X

A NN M. DONNELLY, United States District Judge: On October 28, 2025, the plaintiff, a Florida re sident and suspended attorney,1 filed this

action against 20 John Does alleging violations of the Computer Fraud and Abuse Act, 18 U.S.C.

§ 1030, the Electronic Communications Privacy Act, 1 8 U.S.C. § 2701, the Racketeer Influenced and Corrupt Organizations Act, 18 U.S.C. § 1962 (“Fe deral RICO Act”), Florida’s Racketeer

Influenced and Corrupt Organization Act, Fla. Stat. § 895.02 et seq. (“Florida’s RICO Act”), and

the All-Writs Act, 28 U.S.C. § 1651. (ECF No. 1.) Along with the complaint, the plaintiff filed an ex parte motion for a temporary restraining order and preliminary injunction, as well as a motion to seal the case. (ECF Nos. 2, 3.) For the reasons below, the plaintiff’s motions are denied. BACKGROUND The plaintiff initiated this action purportedly to stop a “years-long and ongoing Advanced Persistent Threat [] cyberattack targeting the legal system and those who operate within it.”

1 See https://www.floridabar.org/directories/find-mbr/profile/?num=625213 (last visited Nov. 4, 2025). The plaintiff is also a member of the New York bar. (ECF No. 1 ¶ 4.) (ECF No. 1 at 1.) The plaintiff asserts that the defendants — whose identities are unknown — are “sophisticated threat actors who have spent years infiltrating court networks, e-filing portals, law firm systems, and related digital infrastructure in order to sabotage active courts proceedings and undermine the administration of justice.” (Id.) He alleges that the defendants’ “tactics

include hijacking official court communications, manipulating electronic filings, and even threatening physical harm to coerce and intimidate” him. (Id.) These defendants “first infiltrated” his law firm network “no later than 2019,” and despite his efforts to remedy the issues, “repeatedly re-established footholds.” (Id. ¶ 17.) “[E]ssentially all” of the plaintiff’s “digital assets” were compromised, including “email accounts, cloud storage, and case management systems.” (Id. ¶¶ 19–20.) The plaintiff asserts that the defendants “manipulate[d] litigation proceedings that [he] was involved in, both as an attorney for clients and as a litigant himself,” and “built a parallel shadow network atop the legitimate judicial system – intercepting and altering communications and filings to engineer outcomes they desired.” (Id. ¶ 23.) The plaintiff conducted a “forensic investigation,” which “uncovered extensive overlaps

between the infrastructure used against him and the infrastructure identified in prior federal cyber crime cases.” (Id. ¶ 30.) He says that “many of the same Internet domain names and IP addresses that appear in [his] network logs and malware configuration files also appeared in court filings and evidence from those earlier cases.” (Id. ¶ 31.) In particular, he claims that the defendants in this case are “part of the same threat ecosystem” as the defendants in Microsoft Corp. v. Does 1-2, No. 23-CV-2447, 2023 WL 11984986 (E.D.N.Y. Apr. 19, 2023). (Id. ¶ 33.) There, the court issued a temporary restraining order, and later a preliminary injunction, to prevent John Doe defendants from using a proprietary software that infringed on the plaintiffs’ copyrights. Microsoft Corp., 2023 WL 11984986, at *2–3. The plaintiff relies on declarations from Microsoft Corp., and says that “many of [the] IP addresses” the experts in Microsoft Corp. identified “later showed up communicating with Plaintiff’s own systems.” (Id. ¶ 32.)2 The plaintiff also relies on a “December 5, 2024 Marlin Forensics Report” and “October 22, 2025 Cyber-N.E.T. Forensics (“CNF”) Expert Report,” which he says “corroborate the technical underpinnings of Defendants’ scheme.” (Id. ¶ 33.)3

The plaintiff also filed a “Declaration of Cyber-N.E.T Forensics Expert Forensic Team,” in which he is the declarant;4 he says his relevant experience includes being an “Expert Team Member and Associate of Cyber-N.E.T. Forensics,” “strategic associate and/or asset of the Joint Cyber Defense Collaborate,” “Chief Technology Officer of Farrow Law,” and the “Director of Incident Responses.” (ECF No. 2-2 ¶¶ 2–4.) He maintains that he worked with the “Marlin Technologies” and “CNF’s Team” “with respect to the preparation of each of their respective Reports” and that he “was present for each individual and independent extraction of files, artifacts and inspections of each of the computer endpoint machines.” (Id. ¶¶ 11–12.) He also claims to have met with the law firm that represented Microsoft in Microsoft Corp. (Id. ¶¶ 27–

2 The plaintiff bases his claim that venue is proper in this district on the Microsoft Corp.’s expert findings that the conduct in that case “spanned across various locations, including multiple nodes within this District.” (ECF No. 1 ¶ 32; see also id. ¶ 11 (“Venue is proper in the Eastern District of New York” because the defendants “made use of instrumentalities located in this District (including New York- based servers, domain registries, and networks) to carry out the acts alleged herein”).) But merely citing an expert’s conclusions in an entirely different case is not sufficient to show that the defendants in this case operate in this District, let alone the state of New York. Nor is the fact that the plaintiff is admitted to practice in New York state enough to establish venue. Even if it were, the plaintiff does not allege any connection to this District; he says only that he has “represented Clients residing in Putnam County,” which is not in this District, “with respect to their property interests in other parts of New York State, and with respect to business transactional matters relative to starting or joining business in New York State. And/or in Florida.” (ECF No. 2-1 ¶ 195.) The plaintiff is a Florida resident, and almost all of his allegations relate to his Florida bar disciplinary proceeding and his law practice in Florida. Thus, venue is almost certainly not proper in this District. 3 The plaintiff says that these reports were “concurrently filed” with his motion but they do not appear on the docket. Rather, the plaintiff cites and summarizes these reports in his complaint, motion, and declaration. 4 The plaintiff does not identify the other team members. 29.) Based on this experience, he “develop[ed] the method and means of extracting data from approximately 150 lawsuits, court filings, pdf documents, email header metadata, and tracking the same” and has become familiar with the “threat actor defendants who are the subject of this lawsuit and . . . highly likely to be the same group and/or some of the same individuals who

comprise the John Doe defendants” in Microsoft Corp. v. Does 1-2. (Id. ¶¶ 37, 48.) The plaintiff also filed an affidavit in support of his motion detailing the defendants’ supposed impact on the plaintiff’s disciplinary proceeding in Florida, which resulted in the plaintiff’s Florida bar license being suspended. (ECF No. 2-1.) The plaintiff alleges that he, his wife, and his law firm were the victims of “an ongoing advanced persistent threat cyber-attack,” which sabotaged his efforts to defend himself against the grievances filed against him. (Id. ¶¶ 48–50.) For example, he submitted a response to the bar organization’s grievance inquiry, but then was told that he had filed no response. (Id. ¶¶ 24–31.) Moreover, only part of his hand- delivered response was uploaded to the docket. (Id. ¶¶ 59–60.) He asserts that this was “evidence of the ongoing system compromises that were affecting the disciplinary process.” (Id. ¶ 50.) He engaged an “Expert ‘Team B’”5 to “investigate whether similar infiltrations into

Florida’s eFiling Portal could be found,” and thereafter “filed a Motion for Protective Order and Confidential Filing with the Florida Supreme Court, putting the court on notice of the irregularities and requesting an in camera review of particularly sensitive forensic evidence.” (Id. ¶¶ 63–64.) However, the Florida bar did not address the motion, so he delivered copies of the expert reports to the Florida bar by hand. (Id. ¶¶ 74–76.) The Florida bar did not acknowledge “the new evidence [he] had provided.” (Id. ¶ 79.) The plaintiff also cites times

5 The plaintiff does not identify this expert team, either. when he received automatic “out-of-office” emails from people he knew were not on vacation as evidence of suspicious behavior. (ECF No. 2-1 ¶ 39; ECF No. 2-2 ¶¶ 31–32.) The plaintiff received security warnings when he tried to get access to a federal magistrate judge’s order referring him to the grievance committee; this, the plaintiff says,

“suggested that the electronic transmission of the court’s order might have been tampered with or that the order was generated in a compromised environment.” (ECF No. 2-1 ¶¶ 82–84.) He also received a forged email from a member of the Florida bar offering to dismiss his disciplinary proceeding. (Id. ¶¶ 97–105.) The plaintiff “collected and documented technical evidence showing irregularities in the emails being sent from court and Bar addresses.” (Id. ¶ 115.) When the Florida Supreme Court ultimately ordered that he be suspended from the practice of law in Florida, the order “was notably anomalistic.” (Id. ¶¶ 128–29.) The plaintiff’s motion for a temporary restraining order seeks essentially the same relief as his complaint: (1) suspension of the defendants’ domains and servers, (2) an order compelling relevant third parties to assist “clean[ing] up malware and fraud,” (3) an order compelling the

defendants to meet with “Microsoft DCU experts” to ensure compliance with the TRO, and (4) sealing the case.6 STANDARD OF REVIEW “[A] preliminary injunction is an extraordinary and drastic remedy, one that should not be granted unless the movant, by a clear showing, carries the burden of persuasion.” Sussman v.

6 The complaint includes the following additional requests for relief: (1) an injunction requiring the defendants to “comply with all cyber-threat containment protocols recommended” in the CNF Report and the Marlin Forensics Report; (2) an injunction “compelling an independent, Court-supervised security audit and temporary shutdown of certain Florida state legal technology platforms” that the defendants compromised; (3) an injunction “staying the effect of the Florida Supreme Court’s Order” suspending the defendant from the practice of law in Florida; and (4) declaratory judgment recognizing the final judgment in Microsoft Corp. as binding on the defendants. (ECF No. 1 at 39, 42–46.) Crawford, 488 F.3d 136, 139 (2d Cir. 2007) (quoting Mazurek v. Armstrong, 520 U.S. 968, 972 (1997)) (emphasis in original); see also Free Country Ltd v. Drennen, 235 F. Supp. 3d 559, 565 (S.D.N.Y. 2016) (“[A] TRO, perhaps even more so than a preliminary injunction, is an ‘extraordinary and drastic remedy, one that should not be granted unless the movant, by a clear

showing, carries the burden of persuasion.’” (quoting JBR, Inc. v. Keurig Green Mountain, Inc., 618 F. App’x 31, 33 (2d Cir. 2015)). In the Second Circuit, “it is well established that the same legal standard generally governs the issuance of preliminary injunctions and TROs.” Aziz v. Butt, No. 25-CV-5789, 2025 WL 2243632, at *1 (S.D.N.Y. Aug. 6, 2025). “A party seeking a TRO, like one seeking a preliminary injunction, must typically show four elements: (1) a likelihood of success on the ultimate merits of the lawsuit; (2) a likelihood that the moving party will suffer irreparable harm if a TRO is not granted; (3) that the balance of hardships tips in the moving party’s favor; and (4) that the public interest is not disserved by the relief granted.” Drennen, 235 F. Supp. 3d at 565. A TRO is “never awarded as of right,” and whether to grant such relief “rests in the sound discretion of the district court.” Id. (citations omitted).

While “[i]t is well established that a court is ordinarily obligated to afford a special solicitude to pro se litigants,” it is also well established that “a lawyer representing himself ordinarily receives no such solicitude at all.” Tracy v. Freshwater, 623 F.3d 90, 101–02 (2d Cir. 2010); see also United States v. Pierce, 649 F. App’x 117 n.1 (2d Cir. 2016) (the rule that lawyers receive no solicitude “extends to disbarred attorneys”); Parent v. New York, 485 F. App’x 500, 502–03 (2d Cir. 2012) (“[A]s a suspended attorney with over twenty years of experience litigating civil rights cases, [the appellant] is not entitled to such ‘special solicitude.’” (citation omitted)). DISCUSSION I. Motion for Temporary Restraining Order The plaintiff’s motion for a temporary restraining order is denied because the plaintiff does not show irreparable harm or a likelihood of success on the merits.

a. Irreparable Harm “The showing of irreparable harm is perhaps the single most important prerequisite for the issuance of a temporary restraining order.” Coronel v. Decker, 449 F. Supp. 3d 274, 281 (S.D.N.Y. 2020) (citation omitted) (cleaned up). A plaintiff seeking a temporary restraining order “‘must show that, on the facts of their case’ and in the absence of the requested injunction, they will suffer a harm that ‘cannot be remedied after a final adjudication, whether by damages or a permanent injunction.’” Id. (quoting Salinger v. Colting, 607 F.3d 68, 81–82 (2d Cir. 2010)). “[T]he movant must make a concrete showing that it will suffer an injury that is neither remote nor speculative, but actual and imminent.” Talk to Me Prods., Inc. v. Lanard Toys, Inc., No. CV-92-2998, 1992 WL 266930, at *2 (E.D.N.Y. Sep. 25, 1992). Irreparable harm “is

measured in terms of the harm arising during the interim between the request for an injunction and final disposition of the case on the merits.” Jayaraj v. Scappini, 66 F.3d 36, 40 (2d Cir. 1995). Thus, a “finding of irreparable harm cannot be based solely upon past conduct.” Geminatio, Inc. v. Hustad, No. 25-CV-361, 2025 WL 1220233, at *4 (N.D.N.Y. Apr. 28, 2025) (citation omitted). To start, much of the harm the plaintiff alleges is not personal to the plaintiff. For example, he asserts that “cyber attackers were exploiting attorney credentials within various court systems.” (ECF No. 2-1 ¶ 123.) He mentions “instances where attorneys (including those not directly involved in my cases) appeared in court dockets or service lists without clear reason, possibly as placeholders inserted by the threat actors.” (Id.) But a plaintiff does not have standing “to vindicate the constitutional rights of some third party.” Iannucci v. City of New York, No. 02-CV-6135, 2007 WL 879628, at *3 (E.D.N.Y. Mar. 21, 2007); see also Bandler v. Town of Woodstock, No. 18-CV-128, 2019 WL 5616956, at *7 (D. Vt. Oct. 31, 2019) (“Plaintiff

cannot rely on harms inflicted on third parties not before the court.”), aff’d, 832 F. App’x 733 (2d Cir. 2020).7 The alleged harm that is specific to the plaintiff is mostly based on conduct that allegedly occurred in the past. For example, he alleges interference in the Florida bar disciplinary proceeding, but that proceeding has concluded. His only allegation of future harm is related to the possibility of him losing his “ability to practice law in New York,” which would prevent him from “earning a living or being employed.” (ECF No 2-1 ¶ 194.) But the chance that the plaintiff might lose his law license in New York because of cyber attackers manipulating his ability to represent clients in New York is entirely speculative.8 The plaintiff has not met his burden of making a “concrete showing that [he] will suffer an injury that is neither remote nor

speculative, but actual and imminent.” Talk to Me Prods., Inc., 1992 WL 266930, at *2. b. Likelihood of Succes on the Merits The plaintiff has also not established a likelihood of success on the merits or sufficiently serious questions to the merits of his claims. The plaintiff relies on expert declarations from an entirely different case — Microsoft Corp. v. Does 1-2 — to support his allegations that the

7 This rule has two limited exceptions — when “the party asserting the right has a ‘close’ relationship with the person who possess the right” or “there is a ‘hindrance’ to the possessor’s ability to protect his own interests,” Bandler, 2019 WL 5616956, at *7 — but the plaintiff does not claim that either exception applies. 8 It may be that the plaintiff’s suspension in Florida could affect his license in New York, but that is not grounds for a TRO. defendants intercepted and manipulated his law firm systems and his communications with the state and federal courts in Florida.9 Even more conclusory is the plaintiff’s suggestion that hackers were responsible for his suspension from the practice of law in Florida. Nor are the results of plaintiff’s investigation, described in his declaration, sufficient to establish that the

“threat actors” were behind the disappearance of his responses to grievances, or that the “out-of- office” messages from people who were not on vacation were evidence of malign forces at work. Because there is no nexus between the harm the plaintiff alleges and the defendants, the plaintiff has not demonstrated a likelihood of success on his claims. See Isaac v. Peace, No. 23-CV- 6275, 2023 WL 7352434, at *2 (E.D.N.Y. Oct. 11, 2023) (the plaintiff “cannot demonstrate a likelihood of success on the merits of her claim” because there is “no apparent nexus between the harm of which [the plaintiff] complains and any act or omission by [the defendant]”); Spagnuolo v. Am. Cas. Co. of Reading, Pennsylvania, No. 24-CV-60422, 2024 WL 3537512, at *6 (S.D. Fla. July 1, 2024) (“[T]o satisfy their burden of showing a likelihood of success on the merits, [the plaintiff] must make an adequate showing of a nexus between the unlawful conduct and the

responsible individuals . . . . At present, there is no such evidence that connects the conduct alleged . . . with any of the Defendants.” (citation omitted)).10

9 Indeed, in Microsoft Corp., the plaintiffs sought an injunction preventing the defendants from maliciously using a proprietary software called Cobalt Strike, where the plaintiffs owned the registered trademark in the software itself, or the copyrights in the code and other material related to the software. 2023 WL 11984986, at *2. The plaintiff has no connection to Cobalt Strike or the plaintiffs in that case. 10 The plaintiff represented the plaintiff in Spagnuolo, which involved claims that are similar to the claims in this case. Spagnolo moved for a temporary restraining order based in part on alleged cyber-attacks in violation of the Federal RICO Act and Florida’s RICO Act. 2024 WL 3537512, at *1. The court denied the motion, finding that the plaintiff’s allegations did not amount to a violation of Florida’s RICO Act, the TRO motion did not relate to the requested relief in the complaint, and the plaintiff did not show a likelihood of success. Id. at *3–6. II. Motion to Seal “In considering a motion to seal, the court undertakes a three-part analysis. First, the court must determine whether the document is in fact a judicial document . . . . Second, once the Court finds that the document is a judicial document, the court must determine the weight of the

presumption that attaches . . . . Third, once the Court has determined the weight to accord the presumption of public access, it must determine whether competing considerations outweigh the presumption.” Xerox Corp. v. Conduit Glob., Inc., No. 21-CV-6467, 2025 WL 586244, at *3 (W.D.N.Y. Feb. 24, 2025). “Pleadings . . . are Judicial records subject to a presumption of public access.” Bernstein v. Bernstein Litowitz Berger & Grossmann LLP, 814 F.3d 132, 139– 40 (2d Cir. 2016). “The public and the press have a ‘qualified First Amendment right to . . . access certain judicial documents.’” Lugosch v. Pyramid Co. of Onondaga, 435 F.3d 110, 120 (2d Cir. 2006) (quoting Hartford Courant Co. v. Pellegrino, 380 F.3d 83, 91 (2d Cir. 2004)). Although judicial documents “may be kept under seal if . . . higher values . . . so demand,” such restrictions require “specific, on the record findings” that “closure is essential to preserve higher

values and is narrowly tailored to serve that interest.” Id. at 120, 124 (citations omitted); see also Bernstein, 814 F.3d at 141 (“A finding that a document is a judicial document triggers a presumption of public access, and requires a court to make specific, rigorous findings before sealing the document or otherwise denying public access.” (citation omitted) (cleaned up)). To determine whether competing considerations outweigh the presumption, the court weighs factors such as “the danger of impairing law enforcement or judicial efficiency and the privacy interests of those resisting disclosure.” Czornyj v. Henderson, No. 22-CV-10069, 2023 WL 2478353, at *2 (S.D.N.Y. Mar. 13, 2023). The plaintiff claims that the case must be sealed “to ensure that the Defendants do not learn about this lawsuit or the TRO application before the Court can act.” (ECF No. 3-1 ¶ 3.) He says he has “substantial reason to believe that the Defendants are actively watching for any signs that their operations have been discovered” so “any public mention of a lawsuit against them could quickly come to their attention.” (Id. ¶ 4.)11 He argues that if the defendants find out

about the lawsuit, they will destroy evidence, take steps to conceal their identities, and evade effective TRO relief by “rerout[ing] their malicious operations,” which would cause continued harm to the plaintiff and third parties. (Id. ¶ 5.) The public’s right to access to the courts outweighs the plaintiff’s concerns. The plaintiff has not identified any danger to law enforcement or privacy interests that need protection. See Czornyj, 2023 WL 2478353, at *2. Nor is there a need to protect the confidentiality of sensitive business information. See New York Knicks, LLC v. Maple Leaf Sports & Ent. Ltd., No. 23-CV- 7394, 2024 WL 3237563, at *13 (S.D.N.Y. June 28, 2024) (“The demonstration of a valid need to protect the confidentiality of sensitive business information, such as pricing and compensation

information, may be a legitimate basis to rebut the public’s presumption of access to judicial documents.” (citation omitted)). Thus, the motion to seal is denied. CONCLUSION For these reasons, the plaintiff’s motions for a temporary restraining order and to seal the case are denied. The Clerk of Court is respectfully directed to remove the electronic restrictions currently in place that limit access to the complaint and motions.

11 He does not appear to allege that the defendants have interfered with his filings in this Court. The plaintiff is ordered to show cause by November 10, 2025 as to why venue is proper in this Court, and why the case should not be dismissed or transferred to a federal district court in Florida. The Clerk of Court is respectfully directed to mail a copy of this Order to the plaintiff and

to note the mailing on the docket. Although the plaintiff paid the filing fee to bring this action, the Court certifies under 28 U.S.C. § 1915(a)(3) that any appeal from this order would not be taken in good faith, and therefore, IFP status is denied for the purpose of an appeal. See Coppedge v. United States, 369 U.S. 438, 444–45 (1962).

SO ORDERED. _ _s_/_A_n_n__ M__._ D__o_n_n_e__ll_y________ ANN M. DONNELLY United States District Judge

Dated: Brooklyn, New York November 4, 2025