SiteLock LLC v. GoDaddy.com LLC

Opinion

WO

SiteLock LLC, No. CV-19-02746-PHX-DWL

Plaintiff, ORDER

v.

GoDaddy.com LLC,

Defendant. Pending before the Court is GoDaddy’s motion to reopen fact discovery for the limited purpose of issuing certain third-party subpoenas. (Doc. 623.) For the following reasons, the motion is granted in part and denied in part. The history of this case, which has been pending for over four years, is familiar to the parties and laid out in previous orders. (See, e.g., Doc. 435.) In a nutshell, in 2013, SiteLock and GoDaddy entered into a contract under which GoDaddy agreed to market and sell SiteLock’s website security services to GoDaddy’s customers. In this action, SiteLock accuses GoDaddy of various contractual breaches, as well as Lanham Act and state-law violations. As relevant here, in April 2018, SiteLock’s parent company, Innovative Business Services, LLC (“IBS”), entered into a securities purchase agreement (the “SPA”) with SiteLock Intermediate Holdings, LLC (“SIH”). (Doc. 583-4 at 4; Doc. 607-1.) SIH, in turn, was affiliated with an investment fund known as “ABRY.”1 The exact nature of this affiliation is not clear from the record. However, at some point, SiteLock Group Holdings, LLC (“SGH”) (i.e., “an entity owned by funds managed by ABRY”) owned equity interest in SIH. (Doc. 594 at 2.)2 Pursuant to the SPA, SIH acquired “all of the equity” of IBS. (Doc. 594-1 ¶ 2; Doc. 607-1.)3 Neill Feather and Thomas Serani both signed the SPA as “Members” (i.e., “holders of options to purchase membership interests” of IBS listed in Annex II) on behalf of Unitedweb Holdings, LLC (“Unitedweb Holdings”). (Doc. 607-1 at 6, 60-61.)4 When the SPA was executed, Unitedweb Holdings owned the majority of shares of IBS. (Id. at 80; Doc. 79-2 at 4, 10, 51.) Both the SPA and the SPA Schedules also refer an entity called Unitedweb, Inc. (“Unitedweb”), which is “an Affiliate of Member Unitedweb Holdings.” (Doc. 607-1 at 79; Doc. 607-2 at 12.) On April 30, 2019, SiteLock initiated this action against GoDaddy. (Doc. 1.) During discovery, SiteLock produced the schedules to the SPA (the “SPA Schedules”) but not the SPA itself. (Doc. 491.)5 Fact discovery closed on February 26, 2021. (Docs. 22, 250.)6

1 As discussed in a previous order, it appears two entities existed: “ABRY Partners, LLC and ABRY Partners II, LLC.” (Doc. 614 at 2 n.2.) For ease of reference, the Court follows the parties’ lead and refers to ABRY Partners, LLC and ABRY Partners II, LLC collectively as “ABRY.” 2 According to SiteLock, although SGH sold its equity interest in SIH to another entity, Sectigo, Inc., SGH retains an interest in this case pursuant to a litigation funding agreement between SGH and Sectigo, Inc. (Doc. 594 at 2.) 3 “Immediately after the transaction, SiteLock . . . was a wholly-owned, indirect subsidiary of [SIH] and remained a wholly-owned, direct subsidiary of [IBS].” (Doc. 594-1 ¶ 2.) 4 At all relevant times, Serani was SiteLock’s “Chief Channel Officer”; in this role, Serani “was responsible for managing SiteLock’s relationship with GoDaddy throughout the entirety of that contractual relationship.” (Doc. 371-1 ¶ 1.) Feather is the “co-founder and former Chief Innovation Officer” of SiteLock. (Doc. 595 ¶ 1; Doc. 66 ¶ 1.) 5 Among other things, the SPA Schedules describe some of SiteLock’s claims against GoDaddy and the contractual relationship between the two entities. (Doc. 588 at 7.) 6 The original case management order is lodged at Doc. 22. However, it has been modified numerous times through this litigation, including by Docs. 44, 75, 83, 99, 176, 203, 247, 250, 315, 318, 336, 353, 398, 408, 413, 420, 425, 430, 442, 450, 456, 464, 485, Trial was set for November 1, 2022. (Doc. 444.) In the weeks leading up to the trial date, the parties exchanged drafts of the proposed final pretrial order. (Doc. 543 at 1.) During this process, GoDaddy raised (for the first time) the issue of subject-matter jurisdiction, asserting that SiteLock “may” lack standing based on the theory that, as part of the SPA transaction, SiteLock assigned the legal claims asserted in this action to ABRY. (Doc. 551 at 3; Doc. 589 at 12.)7 On October 10, 2022, in an attempt to refute this claim, SiteLock produced a redacted copy of the SPA. (Doc. 588 at 8.) On October 24, 2022, GoDaddy moved for Rule 37 sanctions, arguing that the just-produced SPA was responsive to several requests for production (“RFPs”) that GoDaddy had served on SiteLock during discovery. (Docs. 566-68.) After full briefing (Docs. 578, 582), the Court held a hearing to address, inter alia, GoDaddy’s motion for sanctions. (Doc. 587.) During the hearing, GoDaddy argued that if the SPA had been timely disclosed, “there would have been an opportunity to seek additional discovery.” (Doc. 593 at 68-69.) Ultimately, the Court found that “SiteLock should have produced the SPA earlier[] and that the failure to do so was a discovery violation.” (Id. at 98.) The Court further found that the violation was neither substantially justified nor harmless. (Id. at 102-06.) After some discussion with the parties about the appropriate remedy, the Court vacated the November 1, 2022 trial date, authorized GoDaddy “to depose Feather and/or Serani to explore the topics raised in the late-disclosed materials,” and ordered the parties “to meet and confer regarding the timing of the depositions, any request by GoDaddy for further undisclosed documents related to the SPA, and the mechanics of rescheduling the trial date.” (Doc. 587.) On November 9, 2022, GoDaddy sent SiteLock additional discovery requests for documents related to the SPA. (Doc. 600 ¶ 3; Doc. 600-2.) GoDaddy also stated: “[T]o

496. 7 Ultimately, the Court rejected GoDaddy’s standing challenge on the merits. (Doc. 614 at 11-18.) the extent SiteLock claims it does not have possession, custody, or control of any of the documents discussed above, GoDaddy intends to serve subpoenas as necessary, including, but not limited to, subpoenas on deal counsel, [ABRY], IBS, SIH, Unitedweb Holdings, LLC, and Unitedweb, Inc.” (Id. at 2.) In response, SiteLock produced some additional discovery but objected to many of GoDaddy’s requests. (See generally Doc. 600-3.) After conferring, the parties determined that they were at an impasse about several issues (see, e.g., Docs. 600-4 through 600-6) and, on February 2, 2023, filed dueling motions related to the dispute. (Docs. 597-600.) As relevant here, GoDaddy moved to compel SiteLock to produce documents responsive to seven discovery requests, five of which sought materials related to the SPA. (Docs. 598-600.) In response, SiteLock opposed the five requests for documents related to the SPA as seeking discovery that is irrelevant, disproportionate, and, at least to some extent, outside of SiteLock’s custody and control. (See generally Doc. 610.) On May 10, 2023, the Court issued a lengthy order addressing, among other things, GoDaddy’s motion to compel. (Doc. 614.) As for the five discovery requests for documents related to the SPA, the Court generally agreed with GoDaddy that, to the extent the SPA contains relevant representations, the requested materials related to those representations are also relevant. (See, e.g., id. at 36.) However, the Court narrowed four of the five requests—each of which sought materials related to various sections of the SPA—to focus on the specific representations within those sections that are relevant to this litigation (the “Key Representations”). (Id. at 35-40.) As for SiteLock’s argument that it lacks custody or control over documents possessed by IBS, SIH, Unitedweb Holdings, Unitedweb, ABRY, and SGH (as well as their respective law firms), the Court concluded that GoDaddy failed to establish that SiteLock has legal control over documents possessed by those entities. (Id. at 42-54.) Finally, as for GoDaddy’s assertion that it intended to “file a motion for leave to issue subpoenas to SIH, IBS, and their respective deal counsel for the SPA Documents,” the Court concluded that the issue was not yet ripe. (Id. at 54, quoting Doc. 599 at 12 n.6.) However, the Court also stated: [W]ithout prejudging the merits of any future motion, the Court notes that it is generally inclined to allow GoDaddy to subpoena third parties to obtain documents related to the SPA (or, at least, documents that touch upon the Key Representations identified above). Although it is not clear that the SPA is terribly important to this litigation and the Court is wary of further extending the timeline for this case, the Court is also sympathetic to GoDaddy’s position—SiteLock created the need for additional discovery by failing to produce a responsive document and, if SiteLock had timely produced the SPA, GoDaddy would have had the opportunity to issue follow-up subpoenas. Additionally, once GoDaddy became aware of the need to seek additional SPA-related documents, it was forced to confront a confusing maze of issues related to corporate control. Although the Court has largely resolved those control issues against GoDaddy here, it is important not to lose sight of the bigger picture—had SiteLock timely produced the SPA, as it was required to do, all of these complicated issues could have been resolved in an orderly fashion without imperiling the trial date. SiteLock only has itself to blame for the delay that working through these issues has produced. (Id.) On June 8, 2023, GoDaddy filed the pending motion to modify the case management order “to reopen fact discovery for the limited purpose of allowing GoDaddy to issue third-party subpoenas to the entities that are likely to have possession, custody, or control of documents and correspondence related to the [SPA].” (Doc. 623 at 1.) The motion is now fully briefed. (Docs. 627, 628.) I. Legal Standard A motion to modify the deadlines set forth in the scheduling order is governed by Rule 16(b)(4)’s “good cause” standard. Johnson v. Mammoth Recreations, Inc., 975 F.2d 604, 607-08 (9th Cir. 1992). This “standard primarily considers the diligence of the party seeking the amendment.” Id. at 609. “Although the existence or degree of prejudice to the party opposing the modification might supply additional reasons to deny a motion, the focus of the inquiry is upon the moving party’s reasons for seeking modification.” Id. “If that party was not diligent, the inquiry should end.” Id. II. The Parties’ Arguments GoDaddy “requests that this Court reopen discovery for the limited purpose of issuing third-party subpoenas to the entities that have possession, custody, or control of documents and correspondence of the SPA-related documents at issue,” including SIH, IBS, Unitedweb Holdings, Unitedweb, ABRY, and SGH, as well as other unnamed entities if those entities “have possession, custody, or control of the documents at issue.” (Doc. 624 at 2 & n.3.) GoDaddy argues that SiteLock’s failure to timely produce the SPA provides good cause to reopen discovery for this purpose. (Id. at 9.) Citing City of Pomona v. SQM N. Am. Corp., 866 F.3d 1060 (9th Cir. 2017), GoDaddy contends that “[c]ourts in the Ninth Circuit apply a multi-factor test when considering whether good cause exists to amend a scheduling order to reopen discovery, including for limited purposes,” and further contends that all but one of the factors weigh in favor of finding good cause here. (Id. at 8-9.) More specifically, GoDaddy argues: (1) it diligently sought discovery related to the SPA by propounding discovery requests to which the SPA was responsive and then, after SiteLock belatedly produced the SPA on the eve of trial, filing several motions that requested SPA-related discovery; (2) the trial, which has now been rescheduled for February 6, 2024, is not “imminent”; (3) “SiteLock will not be prejudiced if GoDaddy has the opportunity to issue third party subpoenas to obtain the categories of documents this Court already held GoDaddy is entitled to,” especially “given that SiteLock contends those documents are outside of its control”; (4) “GoDaddy could not have foreseen the need to subpoena third-parties for documents related to the SPA because SiteLock did not produce the SPA before the close of discovery”; (5) the proposed subpoenas seek “the same categories of documents that this Court already held to be relevant and proportional to the needs of this case, in the context of seeking those documents from SiteLock directly”; and (6) “SiteLock’s opposition is insufficient to justify denying GoDaddy the opportunity to seek documents related to the SPA from third parties, especially given that SiteLock’s own discovery violations prevented GoDaddy from doing so before the discovery deadline.” (Id. at 9-14.) GoDaddy also contends that SiteLock should be required “to pay GoDaddy’s fees and costs associated with this Motion” because “this Motion falls within the scope of the Court’s Order awarding GoDaddy its fees and costs associated with its Motion for Sanctions and the depositions of Feather and Serani,” and, in any event, “[s]o long as SiteLock continues to resist all efforts to cure its discovery violations, it should bear the resulting fees and costs, particularly given that its conduct has delayed resolution of this matter by a year and a half already.” (Id. at 14-15.) SiteLock opposes GoDaddy’s request. (Doc. 627.) As for diligence and foreseeability, SiteLock argues that “GoDaddy did not diligently pursue discovery of the 2018 SPA during discovery despite being on notice of the existence of that agreement (and having the text of certain provisions) by at least June 2020.” (Id. at 2-3.) As for relevance, SiteLock argues that “[t]he discovery GoDaddy seeks from third parties is unlikely to reveal relevant evidence, much less evidence that meets the ‘heightened’ relevance standard that applies ‘in the context of nonparty subpoenas.’” (Id. at 3, citation omitted. See also id. at 4 [“Moreover, GoDaddy has not shown that the materials it seeks are not duplicative of the materials SiteLock produced.”].) As for prejudice and proximity to trial, SiteLock argues that “GoDaddy’s broad requests are likely to trigger discovery fights and motions practice” because “GoDaddy plans to seek documents from lawyers and those lawyers are likely to assert those documents are privileged” and that such “fights” “risk[] further delaying SiteLock’s trial.” (Id.) Finally, SiteLock notes that the fact that it opposes GoDaddy’s motion “also weighs against reopening discovery.” (Id.) At a minimum, SiteLock requests that the Court limit the requested discovery to “the entities that signed the SPA” (i.e., IBS and SIH) and to “the documents that GoDaddy is unable to obtain from SiteLock itself.” (Id. at 4.) SiteLock also asks the Court to “set more reasonable deadlines for GoDaddy to serve its discovery and file any motions to compel.” (Id. at 4-5.) As for costs, SiteLock disputes GoDaddy’s contention that “the Court has already awarded it costs associated with this Motion” and contends that “GoDaddy is not otherwise entitled to fees” because the relief requested was overbroad and “SiteLock’s opposition to reopening discovery is justified.” (Id. at 6.) In reply, GoDaddy contends that it “can hardly be faulted for not pursuing discovery related to materials that SiteLock hid from view,” noting that “[t]his Court has consistently rejected [SiteLock’s diligence arguments] as impermissible burden shifting.” (Doc. 628 at 1, 3.) GoDaddy also argues that “after successfully convincing this Court that relevant documents were outside of SiteLock’s control, SiteLock is judicially estopped from taking the position that third-party discovery is unwarranted or duplicative.” (Id. at 1-2.) Additionally, GoDaddy emphasizes that the Court “already found that the Key Representations meet Rule 26’s low bar for relevance.” (Id. at 5, internal quotation marks and citation omitted.) As for prejudice, GoDaddy contends that “[i]f not for SiteLock’s discovery violations, it would have incurred th[e] same costs during the original fact discovery period.” (Id. at 6.) Turning to SiteLock’s requests for alternative relief, GoDaddy contends that “[i]f this Court grants SiteLock’s request to restrict third-party subpoenas to IBS and SIH, without any guarantee that these entities still exist, much less control all the responsive documents at issue, then there is a significant risk that further issues of corporate control would lead to lengthy discovery disputes, requiring an additional modification of the [case management order] and potentially delaying trial.” (Id. at 2.) As for the applicable deadlines, GoDaddy contends that, although it “fully intends to serve initial subpoenas promptly after discovery is reopened for limited purposes, . . . there is no guarantee that it will be possible for GoDaddy to achieve service on all . . . entities within just 10 days.” (Id. at 9, emphasis omitted.) GoDaddy further contends that it needs “sufficient time to issue follow-up subpoenas” to avoid “the need to engage in further motion practice.” (Id.) III. Analysis GoDaddy asks the Court to modify the case management order to reopen discovery for the limited purpose of issuing third-party subpoenas to “entities that are likely to have possession, custody, or control of documents and correspondence related to the [SPA],” including SIH, IBS, Unitedweb Holdings, Unitedweb, ABRY, and SGH. (Doc. 623 at 1.) According to GoDaddy, this list of entities is “not exclusive to allow for similar third party subpoenas to be issued if other entities . . . have possession, custody, or control of the documents at issue.” (Id. at 1 n.2.) The proposed third-party subpoenas seek materials responsive to five document requests: 1. Drafts or redline versions of the SPA exchanged between, on the one hand, SiteLock, IBS, UnitedWeb Holdings, LLC, Unitedweb, Inc., or their deal counsel and, on the other hand, ABRY, SIH, or their deal counsel; 2. Due diligence materials related to the SPA, including, but not limited to, documents “uploaded to the ‘data room’ used to collect materials during due diligence on the transaction[]” . . . that concern or relate to the Key Representations of the SPA and the Disclosure Schedules thereto; 3. Correspondence between, on the one hand, SiteLock, IBS, UnitedWeb Holdings, LLC, UnitedWeb, Inc., or their deal counsel and, on the other hand, ABRY, SIH, or their deal counsel, concerning the transaction that ultimately culminated in the SPA, including, but not limited to, preliminary deal discussions prior to the exchange of drafts of the SPA, but limited to correspondence that concerns or relates to the subject matters reflected in the Key Representations of the SPA and the Disclosure Schedules thereto; 4. Internal SiteLock correspondence, meaning correspondence involving SiteLock, IBS, UnitedWeb Holdings, LLC, and/or Unitedweb, Inc., excluding privileged communications, concerning the transaction that ultimately culminated in the SPA, but limited to correspondence that concerns or relates to the subject matters reflected in the Key Representations of the SPA and the Disclosure Schedules thereto; and 5. Documents that Neill Feather or Tom Serani relied upon in making the Key Representations of the SPA and the Disclosure Schedules thereto. (Id. at 1-2, reformatted.) GoDaddy adopts the definition of “Key Representations” provided in the Court’s May 10, 2023 order. (Id. at 1 n.3.) A. Good Cause As noted, a case management order “may be modified if it cannot reasonably be met despite the diligence of the party seeking the extension.” Zivkovic v. S. Cal. Edison Co., 302 F.3d 1080, 1087 (9th Cir. 2002) (internal quotation marks and citation omitted). “If the party seeking the modification was not diligent, the inquiry should end and the motion to modify should not be granted.” Id. (internal quotation marks and citation omitted). Additionally, both sides agree that the factors identified in City of Pomona v. SQM N. Am. Corp., 866 F.3d 1060 (9th Cir. 2017), inform the modification analysis, so the Court will follow their agreed-to approach. Cf. United States v. Sineneng-Smith, 140 S.Ct. 1575, 1579 (2020). Considering the relevant factors, the Court concludes that GoDaddy was diligent and that the modification request is, in the main, justified. As discussed at length during the October 31, 2022 hearing, the SPA was responsive to one of GoDaddy’s discovery requests (i.e., RFP 2) and arguably subject to production pursuant to the Mandatory Initial Discovery Pilot Project (“MIDP”). Nevertheless, even though SiteLock produced the SPA Schedules during discovery (Doc. 491), it did not produce the SPA itself. Only after GoDaddy (informally) disputed the existence of subject-matter jurisdiction, by arguing that SiteLock had assigned the legal claims asserted in this action to ABRY, did SiteLock belatedly produced a redacted copy of the SPA. Two weeks later, on October 24, 2022, GoDaddy filed its first request for additional discovery related to the SPA (via its motion for sanctions).8 (Docs. 566-68.) After the Court held that SiteLock’s failure to produce the SPA was an unjustified and prejudicial discovery violation and ordered the parties to meet and confer regarding additional SPA-related discovery (Doc. 587 at 2), GoDaddy actively engaged in meet-and-confer efforts until the parties came to an impasse about several issues (see, e.g., Docs. 600-1 through 600-6). On February 2, 2023, GoDaddy again requested additional discovery related to the SPA (via its motion to compel). (Docs. 598- 600.) One of the disputed issues addressed in that motion (and responsive briefing) was whether SiteLock had custody or control over documents possessed by SIH, IBS, Unitedweb Holdings, Unitedweb, ABRY, and SGH such that, to obtain the requested materials, GoDaddy might need to issue third-party subpoenas. (Doc. 599 at 8-12; Doc. 610 at 6-11.) On May 10, 2023, the Court issued an order holding, among other things, that GoDaddy’s discovery requests for materials related to the SPA were, at least in large part, proportional and sought relevant information. (Doc. 614 at 33-42.) However, the Court also concluded that GoDaddy had not established that SiteLock had custody or control over documents possessed by IBS, SIH, Unitedweb Holdings, Unitedweb, ABRY,

8 Given the then-looming trial date, it is difficult to fault GoDaddy the 14-day delay between the late production and its motion. or SGH and noted that, although the issue was not before the Court, it seemed likely that GoDaddy was entitled to subpoena those entities for information related to the SPA. (Id. at 42-54.) Thus, as of May 10, 2023, GoDaddy was on notice that third-party subpoenas would be required to obtain SPA-related discovery from IBS, SIH, Unitedweb Holdings, Unitedweb, ABRY, and SGH. On May 18, 2023, only eight days later, GoDaddy’s counsel emailed SiteLock’s counsel, stating in relevant part: “GoDaddy intends to file a motion for leave to issue subpoenas to third parties, including SIH, IBS, and their respective deal counsel. . . . Given the Court’s indication [in its May 10, 2023 order] that it is inclined to grant GoDaddy leave to subpoena third parties, please let us know whether SiteLock will stipulate to a modification of the Case Management Order for that purpose.” (Doc. 625-1 at 4-5.) On May 23, 2023, after a follow-up email from GoDaddy’s counsel, SiteLock’s counsel stated: “SiteLock will not stipulate to a modification of the [case management order].” (Id. at 3.) On June 8, 2023, after some additional discussion between the parties, GoDaddy filed the pending motion. (Docs. 623-25.) On its face, this timeline demonstrates diligence. SiteLock’s argument that the two-year delay between the close of fact discovery (in February 2021) and this motion establishes a lack of diligence on GoDaddy’s part is remarkably unpersuasive. SiteLock contends that GoDaddy is at fault because it failed to affirmatively request documents related to the SPA from third parties during discovery. (Doc. 627 at 2-3.) More specifically, SiteLock emphasizes that for several reasons, GoDaddy was “on notice of the existence of [the SPA]” by June 2020 and also that GoDaddy “did seek some third-party discovery concerning the 2018 SPA but made a strategic choice not to pursue more.” (Id.) However, at the October 31, 2022 hearing, the Court rejected this line of reasoning as impermissible burden-shifting. (Doc. 593 at 101.)9 Likewise, here, given the Court’s

9 Specifically, the Court stated: “To the extent SiteLock attempts to fault GoDaddy for not asking for the entire SPA when it only received the [SPA Schedules], this is burden shifting. It was SiteLock’s obligation to comply with its discovery obligations and it didn’t do that. It’s particularly unpersuasive in light of the fact that we had motion to compel litigation regarding issues touching on these things, and in response to that SiteLock represented to [the Court] and to GoDaddy that there’s nothing else to disclose and they had met all their obligations. It’s hard to get that type of representation and then have much sympathy for the argument that it was up to GoDaddy to ask for what hadn’t been previous finding that the requested materials related to the SPA are relevant and that “this relevance only became apparent after SiteLock’s late disclosure of the SPA” (Doc. 614 at 35-38), faulting GoDaddy for not pursuing the requested third-party discovery earlier in this litigation would constitute impermissible burden-shifting. Accordingly, the lion’s share of the two-year delay (i.e., from February 2021 to October 2022) was caused by SiteLock’s discovery violation, not by a lack of diligence on GoDaddy’s part. In contrast, since SiteLock produced the SPA, GoDaddy has diligently attempted to obtain additional discovery related to the agreement—via both informal meet-and-confer efforts and formal motions practice. Although the Court acknowledges that, at some points, GoDaddy has requested relief that is overbroad (and, thus, SiteLock’s opposition to those particular requests was substantially justified), the bottom line is that these disputes would not have occurred at such a late date but for SiteLock’s discovery violation.10 SiteLock also argues that the SPA (and thus, the requested discovery) “is, at best, tangentially relevant to this case.” (Doc. 627 at 3.) However, as GoDaddy notes (Doc. 624 at 12-13), the proposed subpoenas seek materials that the Court has already determined are relevant (albeit in the context of GoDaddy requesting these materials from SiteLock itself)—the five proposed discovery requests are identical to the five SPA-related requests discussed in the Court’s May 10, 2023 order except that, consistent with the Court’s reasoning in that order, GoDaddy has limited the requests to focus on the “Key Representations” in the SPA. (Compare Doc. 623 at 1-2 [proposed requests] with Doc. 614 at 29 [original document requests] and id. at 36-38 [Key Representations].) The Court’s previous conclusions about the relevance of the materials sought by these requests were not based on the fact that SiteLock was the subpoenaed party. (See, e.g., id. at 34-35 [“[T]he Court found the SPA was relevant because it contained information regarding the Reseller Agreement’s termination date, SiteLock’s claims against GoDaddy, and whether disclosed.” (Doc. 593 at 101.) 10 SiteLock asserts the same arguments with respect to whether the need for this additional discovery was foreseeable. (Doc. 627 at 2-3.) For the same reasons as with diligence, the Court disagrees with SiteLock’s logic. any entity was infringing SiteLock’s trademarks. . . . Even if expressed in drafts, any comments touching upon the same subjects would remain relevant.”]; id. at 36 [“[T]he Court agrees with GoDaddy that, to the extent the SPA contains relevant representations, the materials underlying those representations (and related correspondence) are also relevant.”].) Thus, to the extent relevance plays a role in the Court’s good-cause determination, it weighs in favor of allowing GoDaddy to issue the proposed subpoenas. In a related vein, SiteLock argues that a “heightened” relevance standard applies because GoDaddy seeks to reopen discovery for the purpose of issuing third-party subpoenas. (Doc. 627 at 3-4.) The trouble with this argument is that the only question currently before the Court is whether “good cause” exists to modify the Court’s scheduling order under Rule 16, not the ultimate propriety of the proposed discovery under Rule 45. SiteLock does not identify (nor can this Court find) any legal authority for the proposition that Rule 45’s heightened relevance standard applies to Rule 16 motions such that the “good cause” analysis considers whether the party seeking to modify the scheduling order is doing so for the purpose of issuing third-party subpoenas (as opposed to some other purpose).11 The fact that SiteLock may lack standing to challenge the proposed third-party subpoenas on relevance grounds12 also undermines SiteLock’s arguments on this point. 11 Indeed, all of the cases upon which SiteLock relies to support its relevance arguments involved Rule 45 motions to quash or modify third-party subpoenas; none address “good cause” under Rule 16. See, e.g., R. Prasad Indus. v. Flat Irons Env't Sols. Corp., 2014 WL 2804276, *2 (D. Ariz. 2014); Oyenik v. Corizon Health Inc., 2014 WL 12787872, *1 (D. Ariz. 2014). 12 See, e.g., Anstead v. Va. Mason Med. Ctr., 2023 WL 34505, *2 (W.D. Wash. 2023), reconsideration denied, 2023 WL 1433650 (W.D. Wash. 2023) (“This Court agrees with other district courts in the Ninth Circuit that a party generally lacks standing to object to a subpoena served on a third party on grounds of relevance or undue burden.”); Thao v. Lynch, 2023 WL 2480860, *2 (E.D. Cal. 2023) (the “general rule” is that a party “lacks standing to object to [third-party] subpoenas on grounds of relevance or undue burden”); Redick v. Lowes Home Ctrs., LLC, 2022 WL 3717996, *2 (E.D. Cal. 2022) (“The Ninth Circuit has yet to address the question of whether a party has standing to bring a motion to quash since usually only the subpoenaed non-party may move to quash. The general rule, however, is that a party has no standing to quash a subpoena served upon a third party, except as to claims of privilege relating to the documents being sought.”) (citation omitted); Jiae Lee v. Dong Yeoun Lee, 2020 WL 7890868, *5 (C.D. Cal. 2020) (“[O]nly the party to which the subpoena is directed has standing to object to the requests on the grounds that they are irrelevant, vague, overbroad, duplicative, unduly burdensome, etc.”). See generally 1 Gensler, Federal Rules of Civil Procedure, Rules And Commentary, Rule 45, at 1216 (2018) (“[T]he prevailing view is that . . . a non-recipient party cannot move to SiteLock also argues that “GoDaddy’s broad requests are likely to trigger discovery fights and motions practice” and, thus, likely to further delay the trial, which would prejudice SiteLock. (Doc. 627 at 4.) This argument is unpersuasive for several reasons. First, the trial is set for February 6, 2024. Although this litigation has been marked by an unusual number of dispute-related delays, the Court is hopeful that six months will be ample time to complete the proposed third-party discovery. Second, SiteLock’s contention that GoDaddy’s requests are likely to result in further motion practice (presumably by the third parties, although perhaps by SiteLock as well) and thus threaten the trial date is speculative. Third, the need to modify the case management order arose as a result of SiteLock’s failure to comply with its discovery obligations. Thus, to the extent SiteLock incurs costs and delays associated with the proposed discovery, the Court is not particularly sympathetic. Also, as GoDaddy notes (Doc. 628 at 6), there is no indication that, if SiteLock had timely disclosed the SPA and GoDaddy had, in turn, issued timely third-party subpoenas, the costs associated with those subpoenas would be significantly different. Accordingly, the Court agrees with GoDaddy that both the potential prejudice to SiteLock and the proximity to the trial date favor reopening discovery for this limited purpose. With that said, the Court is wary of GoDaddy’s open-ended request to subpoena any “entit[y] that [is] likely to have possession, custody, or control of documents and correspondence related to the [SPA].” (Doc. 623 at 1.) GoDaddy contends that such “flexibility in permissible subpoena targets” is necessary to “mitigate the risk that discovery disputes could delay trial.” (Doc. 628 at 8.) For several reasons, this argument is unavailing. First, the Court is not persuaded by GoDaddy’s argument that such flexibility will prevent future motions practice. Given the vague description of the entities GoDaddy seeks to reserve the right to subpoena—i.e., those “that are likely to have possession, custody, or control of documents and correspondence” related to the SPA (Doc. quash or modify a subpoena on relevance, cost, or proportionality grounds. But many courts . . . then hold that the non-party recipient can challenge the scope of the subpoena by seeking a protective order under Rule 26(c). The protective order mechanism is appropriate so long as the party is asserting its own interests—e.g., its interest in keeping the scope of discovery reasonable—rather than the interests of the subpoena target.”). 623 at 1)—as well as the hard-fought nature of this litigation, it seems more probable that allowing GoDaddy to subpoena an unknown number of unidentified entities would lead to more discovery disputes (for example, disputes over which entities fall within this definition), not fewer. Second, and in any event, although the Court appreciates and shares GoDaddy’s interest in efficient litigation and avoiding future motions practice, the request to reopen discovery for the purpose of issuing third-party subpoenas to unidentified third parties is effectively a modification request based on hypothetical future events that may or may not occur. It is thus premature. See, e.g¸ Hyun Ju Shin v. Yoon, 2019 WL 1255242, *9 (E.D. Cal. 2019) (“Defendants’ speculative assertion that they will need to ‘search for new documents,’ ‘make further settlement efforts,’ amend their counter-complaint, and file relevant motions, is premature and fails to demonstrate good cause for amending the Scheduling Order.”); Davis v. Ramen, 2010 WL 1791253, *2 (E.D. Cal. 2010) (“It is not yet clear that Plaintiff will be unable to meet the deadlines set forth in the scheduling and discovery order. Thus, Plaintiff’s request for a modification of the scheduling and discovery is premature.”). For these reasons, the Court concludes that GoDaddy has demonstrated good cause to reopen discovery for the limited purpose of issuing third-party subpoenas (requesting the five categories of documents identified in this order) to IBS, SIH, ABRY, Unitedweb Holdings, Unitedweb, and SGH. However, GoDaddy has not established good cause to reopen discovery for the purpose of issuing the same subpoenas to unidentified other entities. B. SiteLock’s Requests For Alternative Relief In the latter half of its response, SiteLock requests several forms of alternative relief. First, SiteLock requests that the discovery be limited to the parties to the SPA—i.e., SIH and IBS. (Doc. 627 at 4-5.) This request is unavailing. When formulating its May 10, 2023 order, the Court spent a significant amount of time attempting to understand the corporate relationships among the various entities discussed in relation to the SPA, including IBS, SIH, ABRY, Unitedweb Holdings, Unitedweb, SGH, and SiteLock itself, and, like GoDaddy, was confronted with a “confusing maze of issues related to corporate control.” (Doc. 614 at 54.)13 SiteLock had an opportunity to explain these corporate relationships (and why ABRY, Unitedweb Holdings, Unitedweb, and SGH are not relevant to the SPA) but did not do so.14 SiteLock’s other arguments in favor of this limitation also miss the mark. For example, SiteLock objects to the subpoenas as “overbroad” and likely to cause an “undue burden” on the third parties. (Doc. 627 at 5.) However, as with relevance, it is not clear that SiteLock would have standing to challenge the third-party subpoenas on such grounds. As for SiteLock’s contention that some of the entities at issue are unlikely “to have responsive documents” (Doc. 627 at 5), such speculation does not change the fact that GoDaddy was deprived of the ability to timely issue the subpoenas at issue by SiteLock’s discovery violation. SiteLock’s argument that “GoDaddy’s request to also subpoena SIH’s and IBS’s deal counsel is . . . improper and should be rejected because GoDaddy has made no showing that either law firm has responsive, non-privileged documents that are not available from other third parties” (Doc. 627 at 8) fails for the same reason.15 The Court also rejects SiteLock’s request to “prohibit GoDaddy from seeking duplicative discovery by requiring GoDaddy to review SiteLock’s recent production of SPA-related documents prior to subpoenaing third parties.” (Doc. 627 at 5.) Although the Court agrees with GoDaddy (Doc. 628 at 4-5) that this argument is difficult to reconcile with the position SiteLock took in opposing GoDaddy’s motion to compel (i.e., that

13 To be clear, to the extent GoDaddy attempts to rely on the Court’s previous remark about the complexity of these corporate relationships as a justification for reopening discovery to allow GoDaddy to subpoena unidentified entities, the Court is not persuaded. GoDaddy has the burden of showing that good cause exists to modify the scheduling order and the mere possibility that other entities with ties to the SPA could exist is not sufficient. 14 As for SiteLock’s argument that the Court should limit the discovery to IBS and SIH because those are “the two parties GoDaddy initially identified when previewing its intention to subpoena third parties” (Doc. 627 at 5), this argument is unpersuasive. GoDaddy was not obligated to “preview” the particulars of its future (and at that time, hypothetical) discovery-related requests. 15 Also, in its reply, GoDaddy clarifies that it is not seeking permission to issue subpoenas to deal counsel. (Doc. 628 at 8 n.5.) SiteLock lacks control over documents possessed by the third-party entities), it is unnecessary to determine whether that inconsistency warrants judicial estoppel because SiteLock’s argument fails on the merits. To the extent subpoenaed third parties wish to challenge GoDaddy’s requests on this ground, they may do so under Rule 45. However, given that SiteLock likely would not have standing to raise this argument via a motion to quash, the subpoenas have not yet been issued, and whether the discovery is “duplicative” is not clearly implicated by Rule 16’s “good cause” standard,16 the Court does not find it appropriate to limit GoDaddy’s ability to seek discovery via third-party subpoenas on this ground.17 SiteLock also argues that “if the Court reopens discovery, then the Court should impose stricter deadlines on GoDaddy’s service of subpoenas in order to ensure that the parties are able to complete discovery sufficiently in advance of trial.” (Doc. 627 at 5.) In a proposed order attached to its motion, GoDaddy proposes a 45-day deadline for service of the third-party subpoenas and a 90-day deadline for motions related to the third-party subpoenas. (Doc. 623-1 ¶¶ 4-5.) In response, SiteLock suggests a 10-day service deadline and a 30-day motions deadline. (Doc. 627 at 5-6.) In reply, GoDaddy argues that “SiteLock’s proposed schedule would all but guarantee the need for future modifications of the [case management order]” and explains that its proposed deadlines will provide the recipients with “a reasonable time to respond to its subpoenas” and will then allow it to “review the responses and produced documents.” (Doc. 628 at 9-10, internal citation omitted.) 16 Theoretically, whether a party has been “diligent” might be influenced by whether the discovery sought is duplicative. Here, however, GoDaddy asserts that, as of June 8, 2023 (i.e., when GoDaddy filed its motion), SiteLock had “not yet produced any documents pursuant to the Court’s May 10, 2023 Order.” (Doc. 624 at 1 n.2.) Although it appears that SiteLock has since produced additional discovery (Doc. 627-1 ¶ 3), this development does not undermine GoDaddy’s showing of diligence. 17 Moreover, as a practical matter, it is not clear how such a limitation would work. Would GoDaddy have to provide each subpoenaed party with a list of documents that are both responsive to the requests but already in GoDaddy’s possession? Would the subpoenaed parties, in turn, have to sift through all of the responsive discovery in their possession, custody, or control to determine which documents GoDaddy already has access to before producing the discovery? On the one hand, GoDaddy’s point that an extended timeline would allow “for meet-and-confer efforts to resolve discovery disputes without court intervention” (Doc. 628 at 10) is well-taken.18 Indeed, in its response opposing modification, SiteLock emphasizes that GoDaddy’s requests are “highly likely to trigger meritorious privilege objections from [the subpoenaed] parties.” (Doc. 627 at 1.) Ideally, if such issues arise, they could be dealt with via informal meet-and-confer efforts rather than formal motions practice. On the other hand, the Court agrees with SiteLock that GoDaddy’s proposed deadlines may create unnecessary delays. Accordingly, in its discretion, the Court will impose the following deadlines: (1) for service, 30 days from the date of this order; (2) for motions practice, 60 days from the date of this order. C. Costs GoDaddy argues that (1) “this Motion falls within the scope of the Court’s Order awarding GoDaddy its fees and costs associated with its Motion for Sanctions and the depositions of Feather and Serani”; and (2) in the alternative, under Rule 37, “[a]n award of fees and costs is justified by SiteLock’s past discovery violations in failing to timely produce the SPA, not directly by SiteLock’s opposition to the present Motion.” (Doc. 624 at 14.) In response, SiteLock argues that the Court’s October 31, 2022 order awarded GoDaddy only “its fees and costs associated with bringing the motion and its fees and costs associated with the depositions” and “did not authorize GoDaddy to obtain additional documents from non-parties in advance of those depositions—much less award GoDaddy fees associated with seeking those documents.” (Doc. 627 at 6.) SiteLock also argues that “GoDaddy is not otherwise entitled to fees” because the relief requested is “unwarranted and, at the very least, overbroad.” (Id.) First, the Court disagrees with GoDaddy’s contention that its previous order prospectively awarded GoDaddy the costs and fees associated with this (and any other future SPA-related) motion. On October 31, 2022, the Court held: “GoDaddy is awarded

18 Without prejudging the merits of any future discovery dispute, the Court encourages GoDaddy to litigate in a manner that is consistent with this goal. its fees and costs associated with bringing the motion [for sanctions] and its fees and costs associated with the depositions [of Feather and Serani].” (Doc. 587 at 2.) Even if SiteLock’s discovery violation gave rise to both the earlier motion for sanctions and the pending motion, the Court’s earlier award did not encompass the fees and costs associated with future motions. On GoDaddy’s logic, it would have been entitled to its costs and fees associated with its previous motion to compel (Docs. 598-600), but for the reasons explained in the May 10, 2023 order, the Court determined that, in its discretion, cost-shifting was inappropriate under Rule 37(a)(5)(C). (Doc. 614 at 56-57.) Second, to the extent GoDaddy seeks costs and fees under Rule 37, it is not clear that Rule 37 applies here. The Court has already sanctioned SiteLock for its failure to timely disclose the SPA. (Doc. 587.) That GoDaddy now seeks to amend the scheduling order to allow for additional third-party discovery as a result of that violation does not justify a second round of sanctions for the same violation. SiteLock’s refusal to stipulate to GoDaddy’s proposed modification of the scheduling order (such that, to obtain the modification, GoDaddy was required to seek court-ordered relief) is not itself a discovery violation for which Rule 37 sanctions would be appropriate.19 GoDaddy does not provide legal authority for (or reasoned analysis supporting) such an application of Rule 37. Finally, even if fees were theoretically available under Rule 37, the Court would decline to award them in its discretion because GoDaddy did not obtain all of the relief it sought—instead, as discussed, SiteLock was justified in opposing at least some aspects of GoDaddy’s modification request.

19 A plain reading of the subdivisions of Rule 37 that GoDaddy invokes in support of its cost-shifting request supports this conclusion. Subdivision (a)(5) discusses “Payment of Expenses” (and “Protective Orders”) where a “Motion for an Order Compelling Disclosure or Discovery” is granted, denied, or granted in part and denied in part. Here, GoDaddy filed a motion to modify the scheduling order, not a motion to compel. Subdivision (b)(2) addresses sanctions for “Failure to Comply with a Court Order.” Here, SiteLock’s refusal to stipulate to a modification of the scheduling order does not violate a court order. Subdivision (c)(1) addresses a party’s failure to “provide information or identify a witness as required by Rule 26(a) or (e).” The Court has already issued sanctions for SiteLock’s discovery violation. Although the discovery violation is relevant to the issues discussed in this order, and thus indirectly led to this motion practice, GoDaddy’s motion is nothing more than a request to modify the scheduling order. 1 Accordingly, IT IS ORDERED that GoDaddy’s motion to amend the case management order (Doc. 623) is granted in part and denied in part. The case management order is amended as follows: (1) Within 30 days of the issuance of this order, GoDaddy is permitted to serve third-party subpoenas on each of the following entities: STH, IBS, ABRY, Unitedweb Holdings, Unitedweb, and SGH. (2) The deadline for motions related to the third-party subpoenas is 60 days from the issuance of this order. (3) All other deadlines in the case management order remain unchanged. Dated this 20th day of July, 2023. Lm ee” f t _o———— Dominic W. Lanza United States District Judge

-20 -