Not As Sticky as Syrup: Searching IP Addresses in Vermont Without a Warrant

Vermont: Personally important because it is the State where I get many of my bow ties (along with the ones for the high school mock trial team I coach).

Vermont is legally relevant because it is the land of a state Supreme Court decision on whether you have a legitimate expectation of privacy in IP addresses and warrantless searches of MySpace and Verizon.

 

The Defendant in State v. Simmons was arrested for stealing a laptop.  The appeal focused on whether the subpoena to MySpace and Verizon was a violation of the Vermont Constitution, which offered broader protections then the 4th Amendment.  State v. Simmons, 2011 VT 69, NaN-P1 (Vt. 2011).

4th Amendment case law has held that “Internet users have no reasonable expectation of privacy in their subscriber information, the length of their stored files, and other noncontent data to which service providers must have access.” Simmons, P8, citing, United States v. D’Andrea, 497 F. Supp. 2d 117, 120 (D. Mass. 2007).

The detective investigating the theft of the two laptops got an anonymous tip that someone named “Graham” had one of the stolen laptops and was accessing his neighbor’s WiFi signal.  Simmons, P2.

The tip said the alleged thief lived on the same street as the victims who had their computers stolen.  Id.

The detective determined through public records the Defendant identity and that one of his neighbors (who had her laptop stolen) had a Verizon Internet account.  Id.

The detective conducted informal discovery on Myspace, finding someone by the same name as the Defendant, who lived where the laptops were stolen. Simmons, P3. The photos on MySpace resembled the Defendant’s DMV photo.  Id.

The detective served a subpoena MySpace for the Defendant’s IP address.  The information from MySpace showed the Defendant’s IP address was a Verizon address. Simmons, P3.

A second subpoena was issued to Verizon.

The records from Verizon showed the IP belonged to the neighbor who had her laptop stolen.

The Defendant did not have permission to use the neighbor’s WiFi and the evidence showed he had been accessing her wireless network.  Simmons, P4.

The detective then secured a search warrant for the Defendant’s home, where they found the stolen computer. Simmons, P5.

 

 

The Defendant moved to suppress the evidence, claiming the IP was private information that required a warrant under the US Constitution and Chapter 1, Article 11 of the Vermont Constitution.  The trial court denied the motion.  The appeal focused only on the Vermont Constitution.  Simmons, P6.

The Vermont Supreme Court affirmed the lower court’s ruling.  Simmons, P1.  The Court stated:

Nothing in our Article 11 rulings suggest that an internet subscriber address and frequency of use data, unembellished by any personal information, should be treated as private. Article 11 declares that “the people have a right to hold themselves, their houses, papers, and possessions, free from search and seizure.” Vt. Const. ch. 1, art. 11. Absent exigent circumstances not at issue here, Article 11 prohibits a warrantless search of “only those areas or activities that a reasonable person would conclude are intended to be private.”

Simmons, P14, citing State v. Geraw, 173 Vt. 350, 352, 795 A.2d 1219, 1221 (2002).

The Vermont Supreme Court then analyzed whether someone has a legitimate expectation of privacy in an IP address.

Under the Vermont Constitution, a person must have an actual expectation of privacy that society recognizes.  Simmons, P15, quoting Justice Harlan’s concurring opinion in Katz v. United States, 389 U.S. 347, 361 (1967).

The Court found that IP information could not reasonably be private.  As the Court explained:

Given the necessary and willing exposure of an Internet user’s access point identification and frequency of use to third party Internet service providers, such information cannot reasonably be considered confidential, especially when a provider such as MySpace openly declares a policy of disclosure. The information appears no more private than a phone number and the number of calls made, or a street address or post office box and volume of mail, neither of which could plausibly be considered private.

Simmons, P15.

Bow Tie Thoughts

It is important to remember this is a state Supreme Court opinion about a state Constitutional right.  However, the logic parallels Federal precedent.  Additionally, the case is scheduled for re-arguments and subject to revision.

The established trend in case law is that ISP information is not protected by the 4th Amendment.  Moreover, this information lacks actual content of communications.  Furthermore, the information is generally limited to IP addresses and number of times an account was accessed.

There will be many cases addressing privacy issues of electronically stored information, such as the warrantless GPS surveillance case to be heard by the United States Supreme Court.

How Undue Burden Can Reach Out and Touch a Requesting Party

In General Steel Domestic Sales, LLC v. Chumley, the Requesting Party sought production of 463,000 recordings of sales phone calls.  And like one of the old long distance commercials of the 1980s, the Requesting Party was left crying at the end. General Steel Domestic Sales, LLC v. Chumley, 2011 U.S. Dist. LEXIS 63803, 1-7 (D. Colo. June 15, 2011).

The Defendants requested all sales call recordings from the beginning of 2009 to support their counterclaim for commercial disparagement.  General Steel Domestic Sales, LLC, at *3-4.

The Defendants only identified two persons who received the alleged commercially disparaging statements and did not state any damages from the alleged conduct. Id.

The call data amounted to 1,551,652 files totaling 300 gigabytes. General Steel Domestic Sales, LLC, at *4. The Plaintiff’s director of information technology estimated the data was more than 463,000 recorded calls.  Id.

Making life a litigation support challenge, all of the calls were intermixed, including sales, attorney-client and other phone voice messages. Id.

The Plaintiff did not have any software to enable it to search the 463,000 calls to find the sales calls that could be responsive to the discovery request, because the call system was a custom software purchase.  The only way to search the recordings was the “hard way”: listen to each one. Id.

Based on the evidence before it, the Court determined the following:

Listening to the 463,000 calls would take approximately 7,716 hours, assuming each message was one minute long.

One person listening to each message for 40 hours a week would take 193 weeks to review (or 4 years).

Assuming the person doing call review would be paid the Colorado minimum wage of $7.36 an hour, the review would cost $56,000.00.

General Steel Domestic Sales, LLC, at *6-7.

The Court found the Plaintiffs demonstrated undue burden and denied the Defendant’s request to produce the call recordings, based on the technology limitations in searching the calls, cost to review and the fact attorney-client communications were inter-mixed with the sales calls. General Steel Domestic Sales, LLC, at *7.

Bow Tie Thoughts: Review Voicemail in Discovery?  You Will. 

e-Discovery won’t drift away.

There is more to electronic discovery than email.  Voicemail, social media and text messages all might be relevant to a lawsuit.  However, some of this electronically stored information might not be reasonably accessible because of undue burden or cost.  As seen before, Courts want specifics in understanding why ESI is too costly to produce. In this case, the Plaintiff demonstrated the burden of production.

Technology to review electronically stored information will continue to improve to search the different forms of electronically stored information.  There are several companies that conduct voicemail review, such as Nexidia. While searching this voicemail might have been unduly burdensome in the present case today, it might not be in the future.

Streaming Early Discovery in Online Music Infringement

The Plaintiffs filed a suit alleging copyright infringement against the online proprietors of Korean pop music website where the Defendants “post, organize, search for, identify, collect and index links to infringing material that is available on third-party websites,” which the Plaintiff claimed was a “a one-stop shop for infringing material.” DFSB Kollective Co. v. Jenpoo, 2011 U.S. Dist. LEXIS 62163, *1-2 (N.D. Cal. June 10, 2011).

The Plaintiffs sought early discovery on eight third-party service providers and “other necessary entities that may be uncovered during discovery” to identify the Doe Defendants, because the Defendants allegedly used false names on their various websites and social networking profiles. DFSB Kollective Co., at *2, 4. The service providers included:

SoftLayer;

Facebook;

Twitter;

Google;

MySpace;

DPS;

HostGator and

GoDaddy

DFSB Kollective Co., at *4.

Requirements for Early Discovery

Early Discovery may be allowed by a Court when there is “good cause” and “for the convenience of parties and witnesses and in the interests of justice.” DFSB Kollective Co., at *4, citing Fed. R. Civ. P. 26(d).

A Moving Party must show the following to conduct early discovery:

(1) Identify the defendant with enough specificity to allow the Court to determine whether the defendant is a real person or entity who could be sued in federal court;

(2) Recount the steps taken to locate the defendant;

(3) Show that its action could survive a motion to dismiss; and

(4) File a request for discovery with the Court identifying the persons or entities on whom discovery process might be served and for which there is a reasonable likelihood that the discovery process will lead to identifying information.

DFSB Kollective Co., at *4, citing Columbia Ins. Co. v. seescandy.com, 185 F.R.D. 573, 578-80 (N.D. Cal. 1999).

Downloading Good Cause

The Court found good cause for early discovery, because ISP subscriber logs are retained for a short time before the data is lost. DFSB Kollective Co., at *5. In short, time is of the essence to identify Doe Defendants with ISP information.

The Court outlined how the Plaintiffs had satisfied the four-factor test for conducting early discovery:

Defendants specifically identified e-mail addresses, user IDs, and account numbers.

The Defendants had hired investigators and presented the findings to the Court.

The Defendants established that the Complaint would likely to survive a motion to dismiss.

The Defendants demonstrated there was a reasonable likelihood that third-party discovery would produce identifying information, with a couple of big caveats.

DFSB Kollective Co., at *5-6.

The Court’s Terms & Conditions on Limited Discovery

The Court’s order was limited to six of the third-parties, because the Plaintiffs did not show a connection between MySpace and GoDaddy to the Defendant. DFSB Kollective Co., at *6-7. The Court noted that the MySpace account appeared dormant and contained no references to the Defendants’ website. Id.

Additionally, the Court limited the search into the different email addresses down to two, because those addresses appeared connected to the alleged infringing activity. DFSB Kollective Co., at *7.

Furthermore, the Court did not allow the Plaintiff to subpoena the Defendants’ financial institutions. Id.

The subpoenas were limited to the production of the names, addresses, phone numbers, e-mail addresses, and physical addresses associated with those accounts. Id.

No Tonkin Gulf Resolution for Production

Echoing the logic that enacted the War Powers Act, the Court refused to give an open-ended order where the Plaintiff could seek discovery from “other necessary entities that may be uncovered during discovery.” DFSB Kollective Co., at *7-8.

Pistols at Downloading: Dueling Procedures for Third-Party Service Providers

The third-party service providers subject to the discovery order were required to serve a copy of the subpoena on their affected subscribers. If the subscribers did not file a motion to quash, the third-parties would then produce the required information within 10 days. DFSB Kollective Co., at *8-9.

Bow Tie Thoughts

Early discovery from third-party service providers walks a delicate line between furthering the interests of justice and violating privacy laws. In this case, early discovery was absolutely required to identify the Doe Defendants. Early discovery from third-party service providers is often the only way to identify committing an online tort.

However, the idea of a Court giving a very open-ended Order to seek discovery from “other necessary entities that may be uncovered during discovery” should give everyone pause. Discovery requests are supposed to be narrowly tailored and reasonably particular against an entity; a blank check to seek discovery from un-named third-party service providers would be a very dangerous precedent. If a third-party is identified and has a causal connection to a case that may produce information to identify a doe defendant, a party should bring it before the Court for expedited discovery.

The other risk with early discovery is ordering the production of otherwise privileged information. For example, California has a state constitutional right to privacy which might apply in some cases. The Stored Communication Act protects the contents of email messages from production by a third-party. Financial information is also often protected by both Federal and State laws. While producing names, addresses, phone numbers, e-mail addresses, and physical addresses is within the interests of justice, Courts must guard against these procedures from being abused.

A Failure to Make Initial Disclosures

The Plaintiffs in Livermore v. Arnold failed to produce their initial disclosures by a Court ordered deadline. The Defendants sought production of the initial disclosures through email correspondence, only to have the Plaintiffs not respond to the disclosure request, but other issues in the email. Other attempts were also unanswered. The Defendants in turn brought a motion to compel under Federal Rule of Civil Procedure Rule 37. Livermore v. Arnold, 2011 U.S. Dist. LEXIS 59106, 1-2 (M.D. La. June 1, 2011).

The Plaintiffs did not file an opposition to the motion to compel their initial disclosures. Livermore, at *3.

Disclosure Obligations

Federal Rule of Civil Procedure Rule 26(a) requires parties must disclose the discoverable information that the disclosing party may use to support its claims or defenses. Livermore, at *4, fn 1. The Rule specifically requires:

(1) The name, address and telephone number of each individual likely to have discoverable information — along with the subjects of that information — that the disclosing party may use to support its claims or defenses, unless the use would be solely for impeachment;

(2) A copy — or a description by category and location — of all documents, electronically stored information, and tangible things that the disclosing party has in its possession, custody, or control and may use to support its claims or defenses, unless the use would be solely for impeachment;

(3) A computation of each category of damages claimed by the disclosing party; and

(4) For inspection and copying as under Rule 34, any insurance agreement under which an insurance business may be liable to satisfy all or part of a possible judgment in the action or to indemnify or reimburse for payments made to satisfy the judgment.

Livermore, at *4, fn 1, citing Fed. R. Civ. P. 26(a).

Federal Rule of Civil Procedure Rule 37(a)(3)(A) allows a party to bring a motion to compel and see sanctions against a party who does not make their initial disclosures. Livermore, at *4, citing Fed. R. Civ. P. 37(a)(3)(A).

Court Order

The Court ordered the Plaintiff to file their initial disclosure within 10 days. Additionally, the Plaintiffs were ordered to pay the Defendants’ attorneys fees and costs for bringing the motion to compel. Livermore, at *6-7.

The Court’s Order was based on Federal Rule of Civil Procedure Rule 26(a)’s mandatory requirement to provide their initial disclosures to support their claims or defenses. The fact the Plaintiffs did not respond to correspondence and the motion did not help their position. Livermore, at *5-6.

Bow Tie Thoughts

Case law has many examples of parties failing to disclose discoverable information that supports their claims or defenses. The failure to disclose such information means it is barred under Federal Rule of Civil Procedure Rule 37.

Determining such disclosures when there are 47,000 email messages is a significant challenge. Early Data Analysis tools can be very effective at narrowing this ESI to a manageable volume to decide which should be include in a party’s Rule 26(a) initial disclosures.

There are many products with these capabilities, such as the Nuix product suite or Lexis Nexis Early Data Analyzer.

Santa Clara Bar Association Expert Deposition Seminar

Go “On the Record” with the Santa Clara County Bar Association Civil Practice Committee’s new expert deposition seminar on June 22 at 6:00pm. To register, click here.

“On the Record” is a seminar with Judge Gregory Ward (retired), author of California Objections (James Publishing). After the brief introductory material by Judge Ward, 10 expert witnesses will be available with sample expert reports for mock depositions by the attendees. Experienced attorney coaches will assist the attendees in their mock examinations.

Attorney participants will have the opportunity to depose an expert witness from any one of the following areas:

> Electrical Engineering
> Fires & Explosions
> Computer Forensics
> Industrial Hygiene
> e-Discovery Search Term Efficiency
> Mechanical Engineering
> Advanced Materials

Join us for the latest on deposing experts in California. Learn a judge’s perspective on expert depositions and gain hands-on practice with experienced expert witnesses.

Part 1: 

Retired Superior Court Judge Gregory Ward will give a short overview of expert witness requirements, focusing on preparing to take an expert’s deposition.

Part 2: 

Attendees will divide into small groups for a practical exercise with attendees conducting 10-15 minute questioning of experts.

The experts will be from multiple subject areas to represent several practice areas. Each attendee will be given a one-page expert’s “report” to use in the mock deposition.

Facilitating the interactive groups of Part 2 are the following: Kristine Meredith, Nora Rousso, plus other attorneys to be announced.

Pricing:

SCCBA Member: $65.00
Non-Member: $149.00
SCCBA New Admittee (0-3 years in practice): 55.00

The False Declaration of Dismissal

How many times can a litigant ignore his discovery obligations before his misconduct catches up with him? The plaintiffs in this case failed to produce documents in response to a discovery request. Then they proceeded to violate not one but two judicial orders compelling production of the requested materials. After patiently affording the plaintiffs chance after chance, the district court eventually found the intransigence intolerable and dismissed the case as sanction. We affirm. Our justice system has a strong preference for resolving cases on their merits whenever possible, but no one, we hold, should count on more than three chances to make good a discovery obligation.

Circuit Judge Neil Gorsuch,

Lee v. Max Int’l, LLC, 638 F.3d 1318 (10th Cir. Utah 2011)

Courts do not like parties failing to comply with discovery orders.  Judges really do not like false declarations.  Combine those actions together and you end up with a dismissal.

The Plaintiffs in Lee v. Max Int’l, LLC, engaged in discovery misconduct that included an inadequate document production that drove the Defendants to file a motion to compel.  A magistrate judge issued a discovery order to produce the requested material.  A limited amount of information was produced, driving the Defendants to the courthouse again.  Lee, at *2-3.

The magistrate judge stopped short of dismissing the case and ordered the Plaintiffs to produce the requested discovery.  Lee, at *3.

Some discovery was produced; along with a declaration stating all discovery had been produced.  Lee, at *3.

The production lacked certain requested information, such as specifically requested tax information, and the Defendants went back to court.  Lee, at *3.

As one can imagine, the magistrate judge was not happy to see the Plaintiffs did not follow two court orders.  Lee, at *3.

The magistrate recommended the Plaintiffs’ complaint be dismissed, which the District Court did.  An appeal followed. Lee, at *4.

The Court of Appeals had no sympathy for the Plaintiffs.  Moreover, the Court of Appeals noted that “district courts enjoy ‘very broad discretion to use sanctions where necessary to insure . . . that lawyers and parties . . . fulfill their high duty to insure the expeditious and sound management of the preparation of cases for trial.’” Lee, at *4, citing In re Baker, 744 F.2d 1438, 1440 (10th Cir. 1984) (en banc).

The Court of Appeals recounted that the Plaintiffs had three chances to comply with the discovery requests.  First, was responding to the original request.  Second, after the first motion to compel. Finally, after the second motion to compel.  Lee, at *6-7. As the Court of Appeals explained:

[A] party’s thrice repeated failure to produce materials that have always been and remain within its control is strong evidence of willfulness and bad faith, and in any event is easily fault enough, we hold, to warrant dismissal or default judgment.

Lee, at *7.

However, there was another issue the bothered the Court of Appeals down to its core: A false declaration.

As the Court of Appeals explained:

Once the plaintiffs chose to declare — under penalty of perjury, no less — that their production of tax records was now compliant with the January 2010 order, the game was up. The court and defendants were entitled to take that sworn declaration to the bank, to rely upon it, to consider the matter closed. Yet, the plaintiffs produced the tax records only after Max uncovered the falsity of the declaration and only after Max was forced to file yet another motion concerning their production.

None of this should’ve been necessary. And none of this, in any reasonable sense, demonstrates “compliance” with the January 2010 order. Discovery is not supposed to be a shell game, where the hidden ball is moved round and round and only revealed after so many false guesses are made and so much money is squandered. 

Lee, at *11.

In the final analysis, the Court of Appeals found the District Court did not abuse its discretion in dismissing the Plaintiffs’ complaint.  Lee, at *15-16.

Bow Tie Thoughts

Few actions upset a court more than false declarations and failing to comply with court orders.  While courts prefer cases heard on their merits and loath issuing defaults, the threat of a default judgment is a very powerful sanction to ensure compliance with discovery responsibilities.

Sanctions for Back-Up Tapes & Reasonableness in Preservation

The Plaintiffs in Gaalla v. Citizens Med. Ctr., brought a sanctions motion for alleged spoliation of email stored on back-up tapes.  The parties and Court had never discussed the issue of back-up tapes until the Plaintiffs’ spoliation motion.  Gaalla v. Citizens Med. Ctr., 2011 U.S. Dist. LEXIS 57317, 2-3 (S.D. Tex. May 27, 2011).

The Plaintiffs’ motion sought everything up to the nuclear sanction of a default judgment for the alleged spoliation.  Gaalla, at *2.

The genesis of the Plaintiffs’ sanctions motion was the argument that the Defendants had a duty to preserve their “back-up” tapes, which were overwritten on a 7 or 14 day cycle after the filing of the lawsuit.  Id.

The Plaintiff elaborated that even if the deletion of the back-up tapes did not violate the duty to preserve, the alleged failure, combined with a “failure” to take snapshots of certain custodian email accounts, combined with “evidence” that some custodians deleted email messages at some point undefined point in the past, warranted harsh sanctions.  Gaalla, at *2.

The Defendants denied any violations of their duty to preserve, arguing that disaster recovery systems are “rarely” preserved after litigation begins.  Gaalla, at *3. Moreover, the Defendants had issued a litigation hold after the filing of the lawsuit and had taken “snapshots” of relevant email accounts.  Id.

The Court found it “doubtful” that the Defendants violated their duty to preserve.  As the Court explained, citing the “old” Zubulake standard:

[A] “litigation hold does not apply to inaccessible backup tapes (e.g., those typically maintained solely for the purpose of disaster recovery), which may continue to be recycled on the schedule set forth in the company’s policy. On the other hand, if backup tapes are accessible (i.e., actively used for information retrieval), then such tapes would likely be subject to the litigation hold. However, it does make sense to create one exception to this general rule. If a company can identify where particular employee documents are stored on backup tapes, then the tapes storing the documents of “key players” to the existing or threatened litigation should be preserved if the information contained on those tapes is not otherwise available. This exception applies to all backup tapes.”

Gaalla, at *4-5, citing Zubulake v. UBS Warburg LLC, 220 F.R.D. 212, 218 (S.D.N.Y. 2003).

The Court further held that even if the Defendants had violated their duty to preserve, there was no evidence of “bad faith” on their part, a requirement for spoliation sanctions.  Gaalla, at *5.  As the Court explained, the Defendants did enact a litigation hold and preserved evidence, including back-up tapes that could be searched.  Gaalla, at *6.

The Court held the Defendants had taken “reasonable preservation” in the context of the litigation with their litigation hold and preservation actions.  Gaalla, at *6.  Moreover, the Plaintiffs speculation that the Defendants deleted email messages was not evidence to warrant sanctions.  Gaalla, at *6-7.

However, the Court did issue additional preservation instructions:

(1) From May 25, 2011 until the Court orders otherwise, the e-mail accounts of all persons designated by Plaintiffs shall be retained through a “journaling” process on a regular basis (as described during the hearing), such that all e-mails are retained indefinitely, and not deleted permanently;

(2) From May 25, 2011 until the Court orders otherwise, the “disaster recovery first of month” e-mail files (available from November 1, 2009 to November 1, 2010) shall be preserved in their current state. Plaintiffs’ expert shall be allowed to search those emails, during normal business hours at the expert’s convenience. The parties shall agree on the e-mail accounts to be searched on the “disaster recovery first of month” system.

(3) Defendant shall search the e-mail accounts of three specific custodians and submit the results to Plaintiffs no later than June 4, 2011.

(4) The parties shall agree on a preservation order with respect to the e-mails of CMC employees identified by Plaintiff, and submit that order to the Court.

(5) Defendant shall pay the costs of the searches described above, subject to reconsideration based upon the results of this search. Plaintiffs, however, shall pay costs associated with their own expert. 

Gaalla, at *7-8

Bow Tie Thoughts

I believe the dogmatic view that back-up tapes are automatically inaccessible is obsolete.  Technology such as Index Engines allows for the affordable searching of this once “inaccessible” technology in 2003 or 2004.  Our challenge is it takes time for such products to be used by parties and argued before a judge.

This opinion is very refreshing because the Court made it very clear it relied on the principles that preservation should be “reasonable” and “proportional.”  There is no requirement that every hard drive in a lawsuit needs a total forensic image, but “whether what was done-or not done-was proportional to [the case] and consistent with clearly established applicable standards.” Gaalla, at *6, citing Rimkus, 688 F. Supp. 2d at 613.

The issue of back-up tapes and the collection of electronically stored information is best done in the meet and confer and not in a motion battle.  It is advisable that parties develop a data map so they understand where their data is located before discussing collection with their opposing party.  Additionally, attending the meet and confer with experts who can discuss the ways to collect such data can save time and cut the cost of slugging out preservation issues before the court.