The Helping Hand of Cooperation over Search Terms

October 29, 2010

The Defendants in Romero v. Allstate Ins. Co., opposed a motion to compel to confer with the Plaintiffs over search terms.  Romero is an employment class action against Allstate involving alleged coercion to convert employees into independent contractors without their original benefits. Romero v. Allstate Ins. Co., 2010 U.S. Dist. LEXIS 111985 (E.D. Pa. Oct. 21, 2010).

The Plaintiffs’ Motion to Compel would have required the Defendants to meet and confer over “additional relevant custodians and search terms, and what searches Allstate  conducted in the past, ‘so that Plaintiffs receive all relevant documents concerning the Release.’” Romero, at *38.

The Defendants resisted, arguing that they were “under no obligation to provide plaintiffs with a list of the search terms Allstate has employed in the past or the method by which Allstate searched for responsive materials.” Romero, at *38-39.

The Defendants furthered argued that such search history was privileged attorney work product protected from disclosure.  Romero, at *39.

The Court agreed with the Defendants a little….and disagreed with them a lot more.

The Court cited both the meet and confer requirements under Federal Rule of Civil Procedure Rule 26(f) and the Sedona Conference.

As the Court cited from Aguilar v. Immigration & Customs Enforcement Div., 255 F.R.D. 350, at *358:

The Federal Rules of Civil Procedure, case law, and the Sedona Principles all further emphasize that electronic discovery should be a party-driven process. Indeed, Rule 26(f) requires that the parties meet and confer to develop a discovery plan. That discovery plan must discuss “any issues about disclosure or discovery of [ESI], including the form or forms in which it should be produced.” Fed. R. Civ. P. 26(f)(3)(C) (emphasis added). In fact, the commentary to the rule specifically notes that whether metadata “should be produced may be among the topics discussed in the Rule 26(f) conference.” Fed. R. Civ. P. 26(f) advisory committee’s note, 2006 amendment.

            Romero, at *39.

Citing the Sedona Conference:

Cooperation . . . requires . . . that counsel adequately prepare prior to conferring with opposing counsel to identify custodians and likely sources of relevant ESI, and the steps and costs required to access that information. It requires disclosure and dialogue on the parameters of preservation. It also requires forgoing the short term tactical advantages afforded one party to information asymmetry so that, rather than evading their production obligations, parties communicate candidly enough to identify the appropriate boundaries of discovery. Last, it requires that opposing parties evaluate discovery demands relative to the amount in controversy. In short, it forbids making overbroad discovery requests for purely oppressive, tactical reasons, discovery objections for evasive rather than legitimate reasons, and “document dumps” for obstructionist reasons. In place of gamesmanship, cooperation substitutes transparency and communication about the nature and reasons for discovery requests and objections and the means of resolving disputes about them.

Romero, at *40.

The Court held it was reasonable to order the parties to meet and confer on search terms the Defendants intended to use, custodians to be searched, date ranges and “any other essential details about the search methodology…”  Romero, at *41-42.

The Court stated that the conferring on the search terms would “eliminate duplicative discovery and help ensure that the searches remain narrowly focused on the core issues present in this case.”  Romero, at *42.

The Court further held that any search term development was not protected by the work product doctrine, stating the search methodology “goes to the underlying facts of what documents are responsive to Plaintiffs’ document requests and does not delve into the thought processes of Defendants’ counsel.” Romero, at *42.

Bow Tie Thoughts

Parties should meet and confer over search terms, determine custodians and date ranges to make their search and production of discovery as effective as possible.  This will save time, increase efficiency and certainly reduce the cost of litigating motions to compel.



Sanctions for Spoliation Are Not Made on Hunches

October 25, 2010

In an employment discrimination case, the Defendant claimed the Plaintiff intentionally destroyed data off her personal computer and audio tapes. 

The Defendant sought the dismissal of the Plaintiff’s lawsuit and claimed they had spent $150,000 because of the alleged discovery violations.  Coburn v. PN II, 2010 U.S. Dist. LEXIS 110613 (D. Nev. Sept. 30, 2010).

The dispute centered on the Plaintiff’s personal computer.  The Defendants wanted it forensically examined. The Plaintiff had legitimate privacy concerns with any such investigation.  Coburn, at *2. 

The Court ultimately ordered a forensic examination of the personal computer, with the following requirements:

            The Forensic Examiner would act as an officer of the Court.

            The parties entered a “highly detailed” Stipulated Protective Order, which the Court codified as an order.

            The parties agreed to a service provider for the examination.

            Coburn, at *2-3. 

The Forensic Examination

The Court-Appointed computer forensic examiner made a clone of the hard drive and ran a keyword search of the cloned hard drive.  Coburn, at *3. 

Ironically, the search terms were made without the Plaintiff or her attorney and only the Defense counsel and the forensic investigator.  Coburn, at *3. 

The forensic investigator testified that the keywords were developed to find “the right information but at the same time tries to eliminate having a lot of false positives.” Coburn, at *3. 

The keyword search found 5,413 files and 7,669 emails, which contained at least one search terms. Coburn, at *4. 

3,946 of the 5,413 files were labeled as “Non-Standard Files.”  The “Non-Standard Files” meant that “portions of files that existed on the computer, but had been deleted prior to the creation of the Forensics Image.” Coburn, at *4.  Additionally, the Court-Appointed computer expert claimed that he could only retrieve portions of the files, because the computer system wrote over parts of the data.  Coburn, at *4-5. 

The computer expert opined that it was possible the files were deleted by a computer cleaning application (CCleaner), but it was likely they were manually deleted because of the number of files.  Coburn, at *5.  There was a significant inference this was the case, because the cleaning application was run two days before the Court ordered examination. Moreover, the application had been run twice since its installation and was not set to run automatically.  Coburn, at *5-6. 

Spoliation Argument

As one might expect, the Defendant argued the Plaintiff “not only failed to preserve relevant evidence after the duty to do so had arisen, she intentionally and repeatedly destroyed such evidence.” Coburn, at *6. 

The Defendant sought sanctions under Federal Rule of Civil Procedure Rule 37 and the Court’s own inherent power. The gravamen of the Defendant’s arguments were the following:

1) The running of the computer cleaning software on the Plaintiff’s home computer, which indicated intent to destroy relevant evidence and was a direct violation of the Forensic Order;

(2) The existence of the 3,946 Non-Standard Files, all of which contain keywords purportedly relevant to the litigation, indicated the Plaintiff regularly destroyed relevant evidence on her computer; and

(3) The Plaintiff destroyed relevant emails on her home computer between December, 2005 and April, 2006.

Coburn, at *7. 

The Plaintiff denied ever deleting a large number of files from her computer, but did not deny that the computer cleaning software may have run on the computer before the exam.  Coburn, at *7-8.  The Plaintiff argued that any deletion of data fell under the “safe harbor” provision of Federal Rule of Civil Procedure Rule 37(e). 

The Plaintiff admitted that she did delete email from her home computer, but she did so after saving the emails to specific folders on her computer.  Coburn, at *8. 

Going to the Cleaners

The Court held that running CCleaner did not alone justify a finding that the Plaintiff destroyed relevant ESI ”in bad faith, vexatiously, wantonly, or for oppressive reasons.” Coburn, at *13. 

The Court explained that it was not clear that running the cleaning software destroyed or overwrote computer files relevant to the lawsuit.  Coburn, at *12. 

Moreover, the Court was not sure who ran the cleaning software.  The Plaintiff denied operating the software herself or having someone do it for her.  Coburn, at *13. 

3,946 Non-Standard Files Did Not Show Intentional Destruction of Evidence

A battle of experts ensued over the issue of the 3,946 non-standard files.

The original Court-Appointed expert testified that there was intentional deletion of those files because of “the location of the search terms . . . on the computer” indicated “the original files that contained the search terms were once “active files.”  Coburn, at *13-14. 

The Court-Appointed expert further explained that “[b]ecause of the large volume of Non-Standard/Corrupted/Unallocated Clusters, it is likely that this content also included files that had been manually deleted.” Coburn, at *14. 

The Plaintiff’s expert countered, explaining that a computer that had been used for years would have thousands of non-standard files.  Coburn, at *14. 

As the Plaintiff’s expert explained, an internet browser can have thousands of cached files.  Moreover, an operating system can generate temporary files and logs.  Coburn, at *14.  This can make a computer run slowly (and usually to the end-user’s frustration).  Coburn, at *14. 

The Plaintiff’s expert explained that while such files might be “intentionally deleted,” that does not mean they were “volitionally deleted.”  Coburn, at *15.  A computer might delete files without any action from the user. Coburn, at *15.   

As the Plaintiff’s expert explained, “the raw number of Non-Standard Files/Corrupted Files/Unallocated Clusters in no way conveys how, when, or in what manner files were created, used or deleted.” Coburn, at *15.   

Keyword False Positive Results

The Court-Appointed Expert admitted that the number of keyword responsive files could have been inflated because he used the Plaintiff’s husband’s first and middle name as search terms.  Coburn, at *15-16.   

As the Court explained:

Notably, the papers submitted in this matter and the testimony adduced at the hearing indicate that nobody knows which keyword(s) are in any single Non-Standard File, and therefore how many of these files contain “false positives.” Pulte notes that when four or five of the Non-Standard Files were viewed during the hearing, one contained the string, “EEOC does not provide blank charge forms,” indicating that relevant evidence on Coburn’s computer had been deleted. None of the testimony adduced at the hearing, however, sheds light on the meaning of this file as it pertains to spoliation. The string could represent a temporary internet file created when a user looked at the EEOC website, or it could represent a portion of a document; if it was once a document, it could have been deleted by Coburn or it could have been deleted by Coburn’s husband, and there is no telling when. Pulte urges the court to derive from this EEOC fragment, that potentially one in four Non-Standard Files represents a relevant file which was intentionally destroyed by Coburn and to levy sanctions accordingly. This the court cannot do. To do so would be to levy sanctions on the basis of an evidentiary estimate or “hunch.”

Coburn, at *16-17.   

Email Production

The Defendants argued the Plaintiff failed to preserve email after the triggering date of the litigation. 

The Plaintiff argued she did not delete any email after the case had been removed to Federal Court.  Coburn, at *17. 

Prior to the litigation, the Plaintiff would email files/emails to her personal email account.  She would then save the file in a specific folder.  After the file was saved, she would delete any duplicate emails.  Coburn, at *17-18. 

The Court summed up the Defendants’ argument that their desire to have “more emails from a specific time period, is insufficient to support a claim that Coburn intentionally destroyed relevant evidence to be gained from the emails. Coburn, at *19. 

Destruction of Audio Tapes

The Plaintiff made several audio tapes with co-workers, which she destroyed because she thought the tapes were of poor quality.  Poor audio quality is not a reason to destroy evidence.  Coburn, at *19-20. 

The Court noted that the destruction of the audio tapes was not done with the intent to deprive the Defendants of the evidence.  As such, the Plaintiff was only sanction reasonable attorney’s fees of $1,500. Coburn, at *20.

Bow Tie Thoughts

Spoliation hearings are not witch trials.  There are numerous case examples where parties attempt to use the allegation of the destruction of electronically stored information to burn their opponents at the stake.   

I believe cases involving the alleged destruction of ESI will normalize.  Private individuals are not using content archiving systems one finds in Enterprise-level companies.  Many of these individuals will simply save files to their personal computers in folders, or even leave them in cloud-based email, or perhaps print messages as PDF’s.   The fact such ESI is not in Outlook for a forensic expert to collect does not perfunctory mean there is spoliation. 

When it comes to the destruction of evidence, courts will do what they have always done for the last 240 years: find justice.  As judges and attorneys become more technically knowledgeable, they will ask whether a party acted in a reasonable manner to preserve the data.  Additionally, there must be clear evidence of spoliation, not a hunch based on false-positive search term results.


The Return Line in e-Discovery

October 19, 2010

The Court in Radian Asset Assur., Inc. v. College of the Christian Bros. of N.M., wrestled with the issue of compelling the return of an imaged hard drive that had been produced in discovery in a lawsuit with a stipulated protective order. 

The Court required the hard drive returned and any copies destroyed.  Radian Asset Assur., Inc. v. College of the Christian Bros. of N.M., 2010 U.S. Dist. LEXIS 107983 (D.N.M. Sept. 24, 2010).

The Production

The Defendants produced a hard drive pursuant to subpoena and a Court order.   The Defendants thought they had deleted all the email on the hard drive, claiming they would only produce email responsive to Court ordered time frames and search terms.  Radian Asset Assur., at *3.

The Defendants also removed any files containing the names of their past attorneys subject to privilege.  Radian Asset Assur., at *3.

The Defendants also removed the folder of the college president’s assistant, claiming the data voluminous, irrelevant, and that anything responsive had already been produced. Radian Asset Assur., at *3.

A Discovery Gift

The Plaintiff’s expert took a look at the hard drive and found several presents waiting for him…

The college president’s secretary’s deleted folder and email were readily accessible. 

The Plaintiff’s expert claimed the data could have been easily restored.  Radian Asset Assur., at *4-5.

While the Plaintiffs did not restore or review the data, they did create a list of the allegedly deleted names and files for the Court’s review.  Radian Asset Assur., at *4-5.

The Plaintiff sought Court approval to review the data and return anything privileged to the Defendants.  Radian Asset Assur., at *5. 

 A High Earth Orbit Launch into Motion Practice

The Defendants wanted everything back, most likely after coming down from being launched into a high Earth orbit. 

The Plaintiffs argued the secretary’s data was not voluminous and was “only” 480 MB.  Moreover, there were file names that should have been produced in discovery.  Radian Asset Assur., at *6.  The Plaintiff also made several representations on the preservation of privilege and that the Defendant would not need to include any other ESI from the secretary in future ESI searches.  Radian Asset Assur., at *7. 

The Defendants had a very different outlook on the hard drive data.

The Defendant argued the Plaintiff was “invading” the attorney-client privilege on ESI that was specifically redacted from production.  Radian Asset Assur., at *7. 

The Defendant further argued that it produced a “redacted” hard drive as a professional courtesy before depositions.  Radian Asset Assur., at *7.  Moreover the hard drive was “provided in a readily-usable, readable format that did not require the use of computer forensic software or other investigative tools to review and search the unredacted files and information.”  Radian Asset Assur., at *7. 

The Defendant claimed the Plaintiff did not need their consultant to review the hard drive and did so “only if” the Plaintiff “wanted something more than it was being intentionally provided would it need to send the hard drive to its expert.” Radian Asset Assur., at *8. 

Without getting into the merits, the Court ordered the hard drive returned and any copies destroyed.  Radian Asset Assur., at *8. 

Bow Tie Thoughts

Parties need to understand the nature of computers and the challenges in producing what they consider to be “redacted” electronically stored information on a hard drive.  I personally think that redacting data on a computer hard drive for production is like trying to redact daylight; something will shine through.     

If a party is concerned with not producing specific data, instead of deleting folders and email on a forensically imaged hard drive, one option is to do a targeted collection of what you want to produce.  This avoids the issue “Did we delete everything?” issue.  Moreover, hoping the opposing party will not restore any data is a dangerous presumption.  Collecting specifically what needs to be produced is a better practice then deleting what you do not want to produce. 

This case could easily have been subject to Federal Rule of Evidence Rule 502 analysis on whether the data was inadvertently produced.  That analysis would have included whether the producing party took “reasonable steps to prevent disclosure” and “promptly took reasonable steps to rectify the error.”  Fed. R. Evid. Rule 502(b).  The test generally is 4 or 5 parts, including:

1. The reasonableness of the precautions taken in view of the extent of document production

2. Number of inadvertent disclosures

3. Magnitude of disclosures

4. Measures taken to mitigate the damages

5. Overriding interests of justice.

Merenda v. Detriot Med. Ctr., 2009 WL 454670 at *4 (E.D. Mich. 2009).

I think there could be an argument that merely deleting information on an imaged hard drive is unreasonable.  There are times when it might be acceptable, but given the level of forensic tools commercially available, that might not be a reasonable production.  This possibly could generate a large number of inadvertent disclosures and ultimately a waiver of any privilege.  While that was not the issue in this case, this issue will likely be litigated in the future.


Search Warrants for Facebook, iPods and Personal Computers

October 12, 2010

In a murder and arson case, the Defendant objected to search warrants that had been issued for his personal computer, BlackBerry, Facebook profile and iPod.  The Defendant claimed the affidavits supporting the warrants did not have any evidentiary nexus between the items to be searched and the alleged criminal activity.  State v. Gurney, 2010 Me. Super. LEXIS 96, at *6-7 (Me. Super. Ct. 2010).  The Defendant also argued the detective’s affidavit did not establish the Facebook profile belonged to the Defendant.  Id.

The Defendant surrendered to the police after the strangulation, decapitation and burning of his girlfriend’s body in his apartment.  Gurney, at *4. 

The police learned of the Defendant’s location after they stopped one of the Defendant’s friends, who ran a stop sign while driving his car.  The friend was on his cell phone talking to the Defendant at the time of the traffic stop.  The stopping officer spoke to the Defendant on the friend’s cell phone and informed the detectives of the Defendant’s location.  Gurney, at *4-5. 

When the Defendant was arrested, he had with him his BlackBerry, his personal computer in sleep mode and additional storage devices.  Gurney, at *7. 

The Court held that the Detective’s affidavit showed that there was a substantial basis that evidence related to any alleged criminal activity would be on the Defendant’s computer and BlackBerry.  First, the Defendant admitted to killing his girlfriend.  Secondly, the Defendant had used his computer to communicate through Facebook.  Third, the Defendant had been on the phone with his friend, justifying the belief evidence could be on the BlackBerry.  Gurney, at *7. 

The Court explained:

The justice could reasonably infer that Mr. Gurney had used his computer to communicate via his Facebook account or in other ways, that he had been using the computer shortly before being apprehended, and that he had used his Blackberry phone to call Mr. Bryant. It was likewise reasonable to believe that there was at least a fair probability that evidence relating to Mr. Gurney’s activities, whereabouts, communications, motives, plans, and state of mind could be stored within those devices. The motion to suppress evidence obtained from the Apple computer, Blackberry cellular telephone, and their attendant storage devices is denied.

Gurney, at *7-8. 

However, the Court suppressed any evidence found on the iPod.  Gurney, at *8.  The Court noted that the detective’s affidavit did not mention the iPod and there was no reason to believe any evidence related to the crime to be on the device.  Gurney, at *8. 

The Court explained the search of the Facebook account in greater detail.  The detectives interviewed the Defendant’s friend at his own home before the Defendant’s arrest.  The friend logged into Facebook with the detectives and was able to see the Defendant had recently logged into Facebook.  Gurney, at *8-9.    When the Defendant was later arrested, he had his computer with him in sleep mode.  Gurney, at *9. 

The Court held that the warrant issuing judge reasonably inferred that the police learned the Defendant’s identity from his friend. Moreover,  there was a strong likelihood the Defendant updated his Facebook account around the time of the victim’s death.  Gurney, at *9.  As such, a judge could find “…a strong probability the Facebook records would hold evidence of [the Defendant’s] contacts, locations, activities, motives, plans, and state of mind shortly before and after” the victim’s death.  Gurney, at *9. 

Bow Tie Thoughts

I found the facts of this case very disturbing. 

The Court’s reasoning in issuing the search warrants for the BlackBerry, laptop and Facebook are all very valid.  People live with technology touching almost every part of their lives.  Specifically issuing search warrants for each does make sense.  It also makes sense to suppress evidence that is not included in the affidavit for a warrant, such as the iPod in this case.


Phased Discovery: Undue Burden and Practical Proportionality

October 7, 2010

In a racial profiling case, the parties were in gridlock over custodians and date ranges to search of the electronically stored information.  Barrera v. Boughton, 2010 U.S. Dist. LEXIS 103491 (D. Conn. 2010).

After a meet and confer, the Plaintiffs proposed searching 40 custodians, with 80 key words from January 2004 to present.  Barrera at *8.

The Defendants objected, citing they had already produced over 900 email messages (none of which supported the Plaintiffs claims).  Barrera at *9.  Moreover, the Defendants’ estimated cost from their IT experts for conducting the Plaintiffs’ search would be over $60,000.  Barrera at *9. 

The Defendants proposed an initial search of three specific custodians from 2005 to 2007.  The Defendants estimated the cost to search at $13,000 to $15,000, which they argued the Plaintiff should pay.  Barrera at *9. 

The Plaintiffs wanted, at a minimum, another three custodians initially searched and maintained their position that 40 custodians needed to be searched.  Barrera at *9-10. 

The Court found that the electronically stored information from the 40 custodians was not reasonably accessible because of cost.  Barrera at *11-12, citing Fed. R. Civ. P. 26(b)(2)(B).  The Court also found that the Plaintiff had not demonstrated good cause in justifying the production of the “not reasonably accessible” ESI.  Barrera at *12. 

The Court ordered the parties to conduct a phased discovery approach, where the three custodians would be searched with the Plaintiff’s search terms from 2004 to 2007.  Barrera at *12.  The Court also denied any cost-shifting.  Barrera at *12. 

Bow Tie Thoughts

Proportionality is entering court opinions.  The Court’s order for phased discovery highlights a practical approach in searches of multiple custodians. 

However, the opinion is silent on whether the Defendants’ IT experts were in-house IT or a service provider. The opinion is also silent on how the data was being searched.  What technology were they using to conduct the searches?  How was the data stored?  While collecting data over six years might involve back-up tapes, searching three custodians with 80 keywords might be less than $15,000.

A colleague estimated the following workflow and cost:

The average person would have 5GB of email/data a year.  Provided there are three custodians and three years worth of data, there would be a total of 45GB.  The total time to cull down, index and run key words in DT Search would likely be twelve hours.  Assuming that the service provider was charging $200 an hour for the work (some service providers might be lower), the cost would be around $2,400.

Parties address e-Discovery challenges with the tools and resources they have on hand.  While the in-house IT expert might have the skills of a certified BMW mechanic on a company’s network, you would not ask that mechanic to tune-up a 747.  This is where the outside service provider is important, because they can use their tools, provide quality services and drive down costs.


Identifying Defaming Defendants with Expedited Subpoenas on Social Networking Sites

October 5, 2010

The Plaintiffs in 1524948 Alberta Ltd. v. John Doe 1-50 claimed they were the victims of trademark infringement, trade libel, defamation and intentional interference with contractual relationships. The Plaintiffs claimed the unknown Defendants used a website “to publish allegedly “false, defamatory and infringing statements and to conduct other unlawful activity targeted at Plaintiff and its website…” 1524948 Alberta Ltd. v. John Doe 1-50, 2010 U.S. Dist. LEXIS 100482 (D. Utah Sept. 22, 2010).

The Plaintiffs sought expedited discovery from Facebook and Twitter to identify the Defendants, so the Doe Defendants could be served with the lawsuit. 

Discovery does not commence until there has been a Federal Rule of Civil Procedure Rule 26(f) conference. 

If a party is seeking expedited discovery before the Rule 26(f) meet and confer, the moving party has the burden of showing good cause. 

Good cause exists where there are claims of unfair competition, infringement or physical evidence may be destroyed with the passage of time. 1524948 Alberta Ltd., at *1-3.

The Court found good cause to grant the Plaintiffs’ request for expedited discovery.  1524948 Alberta Ltd., at *3.     The Court cited that infringement cases warrant expedited discovery.  Moreover, the Court noted that the discovery was transitory in nature and was required for the case to go forward.  1524948 Alberta Ltd., at *3-4.

The Court specifically ordered:

…Plaintiff may serve subpoenas upon those advertising networks as outlined in its motion to discover the identity of Defendants. These subpoenas may seek the “user data, including origination information, contact and payment information, to identify those Defendants directly responsible for running advertising on the BPAW website as well as the recipient of the revenues realized by BPAW as a result of those advertisements,” but the subpoenas shall not request any revenue amounts. At this time the court is not persuaded that the amount of money Defendants received from advertising is necessary for Plaintiff to discovery their identity.

1524948 Alberta Ltd. v. John Doe 1-50, at *4-5.

Bow Tie Thoughts

One justification for expedited discovery includes the loss of “physical evidence from the passage of time.”  1524948 Alberta Ltd., at *1-3.  The transitory nature of data being both prolific and fragile is conceptually the same as physical evidence being lost from the passage of time.  It should not be a surprise if expedited discovery is ordered as a matter of standard procedure for these sort of online tort cases.


Follow

Get every new post delivered to your Inbox.

Join 47 other followers