One of the first challenges was the Zeran v. American Online case where a business owner was harmed but was never able to compel AOL to provide the identity of the person creating the harmful content. Forcing platforms to provide identity information in pursuit of legal action would allow action against the formally anonymous poster. As it stands today, an anonymous person (or botnet) can post whatever they want with no fear they will be exposed.

https://en.wikipedia.org/wiki/Zeran_v._America_Online,_Inc.