Broken Trust Does Not Mean Discovery Sanctions

Parties end up in litigation often because trust has been broken. Distrust can make discovery in civil litigation even more of a legal brawl than anyone enjoys.

In Malone v. Kantner Ingredients, the Plaintiffs seriously did not trust the Defendants’ discovery productions.

The Plaintiffs alleged the Defendants failed to produce emails and transaction invoices located on a specific server. The Defendants were ordered to search the specific computer servers to determine if the imaging performed at the beginning of the case was complete. Malone v. Kantner Ingredients, 2015 U.S. Dist. LEXIS 41951, at *2-3 (D. Neb. Mar. 31, 2015).

The Defendants imaged the subject server and provided the full mirror image to the Plaintiffs. The Plaintiffs conducted their own analysis of the server compared to the prior production. The Plaintiff then brought a motion to show cause that alleged the Defendants’ council and paralegal failed to comply with the Court’s order. Furthermore, the Plaintiffs alleged the Defendants “destroyed or tampered with evidence, and provided untruthful information to the court regarding the existence of discovery requested by the plaintiffs.” The Plaintiff sought to recover the costs incurred by their own computer forensic expert in analyzing the supplemental server production. Malone, at *4.

The Court rejected the Plaintiffs’ arguments. The Court explained that the original order required “the defendants to determine if the server imaging performed by the defendants at the outset of the case was a full and complete imaging: It did not require the defendants to repeat their ESI review and production if the 2012 initial data imaging appeared to be full and complete.” Malone, at *5-6, emphasis added. The Court actually stated the Plaintiffs’ arguments “misconstrue[d] the intended meaning” of the original Court Order. Malone, at *6.

The Court explained that the Defendants actually exceeded the original Court Order by producing the imaged server to the Plaintiff. Malone, at *6, fn 4. Moreover, the server production contained all the emails, invoices, and associated metadata that the Defendants should have produced. Malone, at *6. Furthermore, the Plaintiffs’ use of their own expert was reasonable to “bring some closure to the ongoing ESI discovery battle.” Malone, at *6.

Magistrate Judge Cheryl Zwart also highlighted a maxim of discovery: the standard for productions is reasonableness, not perfection. Malone, at *7-9.

The fact mistakes were made in a production did not justify imposing sanctions; especially considering the fact the Plaintiffs had full access to the imaged server. Malone, at *8. The Court held that the Defendants’ attorney and paralegal did not “provide misleading or untruthful information to the court.” Furthermore, there was no evidence that the “Defendants, their counsel, or their counsel’s paralegal destroyed, hid, or purposefully (or even recklessly) failed to produce responsive ESI.” Malone, at *9. As such, the Court held that requiring the Plaintiffs to pay their own expert’s fees was a “reasonable method for sharing the cost of ESI discovery” in the dispute. Malone, at *8-9.

Judge Zwart did have some prolific words after the revelation that the parties did not discuss the collection or production of ESI at the beginning of the case: “Had those discussions occurred, the court believes all parties’ discovery costs would have been minimized.” Malone, at *6-7.

Bow Tie Thoughts

A little planning goes a long way. Parties should discuss the scope of discovery at a Rule 26(f) conference. Sources of electronically stored information, possible relevant data, and collection methodologies are important topics that can dramatically reduce discovery disputes.

Magistrate Judge Cheryl Zwart is now a judge to watch on eDiscovery cases. Judge Zwart did a masterfully job with the opinion in analyzing the facts of the case and law. Moreover, there is a nice footnote on the use of predictive coding being an accurate and more efficient method for document review, referencing both Nicholas Barry, Man Versus Machine Review: The Showdown Between Hordes of Discovery Lawyers and A Computer-Utilizing Predictive-Coding Technology, 15 Vand. J. Ent. & Tech. L. 343 (2013) and Maura R. Grossman & Gordon V. Cormack, Technology-Assisted Review in E-Discovery Can Be More Effective and More Efficient Than Exhaustive Manual Review, 17 Rich. J.L. & Tech. 11, P 5 (2011).

Advertisement

Stating Reality: Imaging a Hard Drive Makes a Copy

Taxation of cost cases do not generally have happy endings for recovering eDiscovery costs. The United States Court of Appeals for the Sixth Circuit issued a very important opinion on March 17, 2015 well grounded in the reality of civil litigation and the law where eDiscovery costs were recovered.

It also takes a swing at Race Tires, which is always a welcome read.

The Court of Appeals held that the cost of video deposition synchronization and transcript were properly taxed. Colosi v. Jones Lang LaSalle Ams., Inc., 2015 U.S. App. LEXIS 4184, 2-3 (6th Cir. Ohio 2015). The Trial Court had determined the synchronized video deposition was “reasonably necessary” and the opposing party never explained how the costs were either unreasonable or unnecessary. Id.

For anyone who has conducted deposition review, this is good news. I have spent many hours reviewing depositions and video depositions. “Reasonably necessary” is an understatement. Synced video depos allow you to understand the context of the testimony. A simple question and answer in a transcript can look harmless, but if the video shows the deponent turning bright red, biting his lip, and answering the question with his teeth clinched, you know that testimony is important.

From Yeslaw.net

The Court of Appeals further allowed the recovery of costs for imaging a hard drive. The Court stated:

Imaging a hard drive falls squarely within the definition of “copy,” which tellingly lists “image” as a synonym. And the name “imaging” describes the process itself. Imaging creates “an identical copy of the hard drive, including empty sectors.” The image serves as a functional reproduction of the physical storage disk. From the image file, one can access any application file or electronic document on the hard drive with all that document’s original properties and metadata intact. Id. If not actually made or formed in the image of the hard drive, we certainly regard it as such. Thus, a plain reading of the statute authorizes courts to tax the reasonable cost of imaging, provided the image file was necessarily obtained for use in the case.

Colosi, at *6, citing CBT Flint, 737 F.3d at 1328 (quoting The Sedona Conference, The Sedona Conference Glossary: E-Discovery & Digital Information Management 27 (Sherry B. Harris et al. eds., 3d ed. 2010)) and 1329-30.

I think it is extremely significant that the Court held that the imaging a hard drive “making a copy” and falls within the plain meeting of the taxation of costs statute.

The Court further stated that the Race Tires court “ignored § 1920’s text.” Colosi, at *8. The Court explained:

We need not ask whether imaging is the “functional equivalent” of making photocopies in the era before electronic discovery because—consistent with the 2008 amendments—the procedure comes within the ordinary meaning of “making copies of any materials.” While the Third Circuit rightly worried over expanding the scope of § 1920 to include expensive electronic discovery procedures not contemplated by Congress, this concern more appropriately pertains to the context-dependent question of whether the prevailing party necessarily obtained its copies for use in the case.

Colosi, at *8; Taniguchi, 132 S. Ct. at 2002—06 (beginning its interpretation of § 1920 with the ordinary meaning of words before examining statutory context).

The biggest take away from this case is a Court stated a reality of electronic discovery: an image of a hard drive is a copy.

Relevance, Social Media & Personal Computers

In an employment dispute, the Defendant sought access to the Plaintiff’s Facebook profile and personal computer. The case had involved several discovery disputes challenging the Plaintiff’s discovery productions. Potts v. Dollar Tree Stores, Inc., 2013 U.S. Dist. LEXIS 38795, 5-9 (M.D. Tenn. Mar. 20, 2013).

Among the discovery requests, the Defendant requested “Facebook and/or other social media data” and “Any computers or digital storage devices used by either Plaintiff during and after her employment with Defendant.” Potts, at *3.

The Plaintiff explained they had produced her day planner, documentation of “write-ups” and “store visits” from her employment and all emails relevant to the case. Potts, at *3-4.

The Plaintiff challenged the request for full access to the Facebook profile, arguing that the Defendants had failed to make a “threshold showing that publicly available information on [Facebook] undermines the Plaintiff’s claims.” Potts, at *4-5, citing Thompson v. Autoliv ASP, Inc., 2012 U.S. Dist. LEXIS 85143, 2012 WL 2342928, *4 (D. Nev. June 20, 2012).

The Plaintiff also objected to the request for the computer as unduly burdensome, because she had “produced” the relevant information from the computer. Potts, at *4.

The Court held that that Defendants did not make a showing that the Plaintiff’s public Facebook profile contained information that would reasonably lead to the discovery of admissible evidence. Potts, at *7. The Court based its findings on the Plaintiff’s discovery productions and case law. Id. The Court cited the following in their decision:

[M]aterial posted on a ‘private Facebook page, that is accessible to a selected group of recipients but not available for viewing by the general public, is generally not privileged, nor is it protected by common law or civil law notions of privacy. Nevertheless, the Defendant does not have a generalized right to rummage at will through information that Plaintiff has limited from public view. Rather, consistent with Rule 26(b) . . . [and decisional law] . . . there must be a threshold showing that the requested information is reasonably calculated to lead to the discovery of admissible evidence. Otherwise, the Defendant would be allowed to engaged in the proverbial fishing expedition, in the hope that there might be something of relevance in Plaintiff’s Facebook account.

Potts, at *6-7, citing Tompkins v. Detroit Metro. Airport, 278 F.R.D. 387, 388 (E.D. Mich. 2012).

However, the personal computer was another story.

The Court agreed the physical production of the computer could lead to admissible evidence, however the parties were ordered to “agree to a word search of Plaintiff’s computer by an agreed neutral party.” Potts, at *8.

Bow Tie Thoughts

Discovery requests are a mix of art and science. Drafting requests requires an attorney to consider the possible sources of ESI, analyze the case facts and draft the reasonably tailored request for discovery. This is easier said than done.

Attorneys really need to be thoughtful in drafting requests for electronically stored information on social media. Done too broadly, it can be the moral equivalent of demanding an MRI in a breach of contract case. At the end of the day, the requests must be for relevant ESI.

Personal computers are another story. A requesting part simply does not get to forage for evidence through someone’s computer. Courts put safeguards in place to avoid privacy from being invaded, such as neutral examiners and the opportunity for privilege review before production.

A good practice is to image a personal computer after a triggering event to preserve any possible relevant information. Costs for such imaging have come down considerably, ranging between $300 to $500 for service providers. This is a very worthy investment compared to the costs of motion practice or defending spoliation claims. Analysis of the contents, searching and processing will drive the cost up; however, talk with the service provider on how they charge for these services. It might be hourly or a flat rate.

Forensically Examining A Lawyer’s Computer

In a dispute over a will and deed transfer, a New York State Court ordered the examination of a lawyer’s computer.

The idea of an attorney’s computer being searched by third parties should scare lawyers to death.

The attorney objected on the grounds the examination would violate the attorney-client privilege and work-product doctrine for all of the attorney’s other clients.

The Court was also concerned about privilege issues and ordered the following examination:

The computer forensic examiner was directed to review the computer only for documents that refer to Rose Tilimbo and it must not examine files which would not likely lead to the discovery of evidence related to Rose Tilimbo.

In the event the forensic examiner inadvertently examined any information that was not related to Rose it is directed to immediately cease the examination of that file.

In the event that forensic examiner located documents that refer directly to Rose Tilimbo or appear to be related to the purported will or the alleged deed transfer, those documents shall be mailed to the parties’ attorneys.

The attorneys would have 14 days from the receipt of documents to object to disclosure to the movants by notifying counsel for the movants that he is objecting and sending the documents to the court for an in camera inspection together with the reasons for the objection.

In the event that no objections are made to the production of the documents or the court rules that the documents are to be disclosed the computer forensic examiner may thereafter submit the documents to movants’ counsel.

Matter of Tilimbo v. Posimato, 2012 N.Y. Misc. LEXIS 4027, at *13-14 (N.Y. Sur. Ct. Aug. 22, 2012) (Emphases added).

Bow Tie Thoughts

It is very good to see a state court judge address the privilege issues of how to examine a lawyer’s computer.

If you ask three different computer forensic examiners how they would comply with the Court Order, you would probably have three different answers. The right approach will depend on how data is stored and multiple other factors best left to the experts.

One option is to make a “mirror image” of the computer and then search for responsive data. This is likely the least desirable for the attorney, because the entire contents of his computer have now been copied and are in the hands of a third-party. Short of a protective order and the computer experts acting as court-appointed neutral examiners who return or destroy the mirror image at the end of the examination, this is least desirable from an attorney’s perspective.

There is software available where the attorney could effectively self-collect his client files. While this might provide the most piece of mind to the attorney, it likely causes the most stress for the requesting party. It also raises issues of how searches were conducted and can easily cast doubt on the adequacy of the collection.

Another option is for a targeted collection of the attorney’s hard drive. This might take more time then doing a mirror image of the hard drive, but provides more piece of mind to the attorney. The collection is based on search terms devised by the computer forensic expert and attorneys to specifically identify the relevant information. This conceptually is a good middle ground approach to both preserve the parties’ interests and the confidentiality of the attorney’s clients.

Instead of the computer forensic examiner “mailing” documents to the attorneys, a hosted repository is an option the parties and court should consider. The producing party could first review the responsive information for any privileged ESI, creating all the necessary information for a privilege log right in the database. The requesting party could then perform its own review and note any challenges to any asserted privileges. The Court itself could then review the information “in camera” and rule on any privilege issues without protracted motion practice.

The Fabric of Inadequate Search & Spoliation Allegations

In a case involving claims of copyright infringement of fabric design, the tapestry of the Plaintiff’s discovery production was challenged, including allegations the Plaintiff:

Neglected to search for and produce several categories of documents; and

Deleted relevant emails.

The Defendants sought an order permitting a forensic examination of Plaintiff’s computer files based on the allegations the Plaintiffs deleted relevant emails. Prestige Global Co. v. L.A. Printex Indus., 2012 U.S. Dist. LEXIS 63550, 6-7 (S.D.N.Y. May 3, 2012).

However, the Defendants/Counter Claimant claims did not have the abrasion resistance to withstand judicial review.

Spinning a Judicial Opinion

Judge James Francis IV is no textile apprentice when it comes to discovery disputes. The Court quickly found the Defendants failed to show the Plaintiff did not conduct an adequate search for discovery.  Prestige Global Co., at *7.

The Court explained that the Defendant relied on testimony from one witness who said she was not shown the Defendant’s discovery requests and that she was not asked to search for “many” of the documents identified in the requests. Id.

Judge Francis explained:

[T]here is no requirement that a particular witness, even one designated under Rule 30(b)(6), conduct her own search for documents. Counsel, working with whoever may be the relevant custodians, generally search for documents responsive to a discovery request, and, according to Family Dollar, that is precisely what occurred here. Furthermore, Family Dollar has identified by bates number the documents that it produced in each of the categories about which Printex complains.

Prestige Global Co., at *7-8.

The Court held the Defendant made no showing that the Plaintiffs had engaged in spoliation of evidence and could have warranted a forensic examination of a computer hard drive. Prestige Global Co., at *8-9.

Spoliation, in its simpliest terms, requires that a party violated the duty to preserve. Prestige Global Co., at *8-9. The duty arises when a party “reasonably anticipates litigation.” Prestige Global Co., at *9-10.

The Court held that there was no evidence that the emails subject to the spoliation claims were deleted when the Plaintiff could have reasonably anticipated litigation.  Prestige Global Co., at *10.

As the Court explained:

The garments containing the accused design were produced for the 2008 and 2009 seasons, and any e-mails relating to them were in all likelihood deleted by the end of 2009. Yet, Family Dollar had no preservation obligation until March 2011, when Family Dollar first learned of the claims because Printex filed suit against it in California. Therefore, no forensic examination is warranted.

Prestige Global Co., at *10-11.

Bow Tie Law

There are two interesting issues in this case: searching for responsive discovery and the duty to preserve.

On a fundamental level, the duties of competency and candor to the Court require adequate searches for relevant discovery.  However, in a company of 3,000 individuals, that does not necessarily mean that everyone in the company subject to the duty to preserve must conduct searches for responsive ESI.  Moreover, that could lead to the “fox guarding the henhouse” situation best avoided in eDiscovery.

The concept of “relevant custodians” is one that should not be forgotten by attorneys. Many companies have email and content management systems that records managers and/or ESI consultants can search for responsive ESI. This requires client interviews to determine the relevant custodians and understanding not just who was involved in the facts of the lawsuit, but any terms of art they used in communicating and what technology used in the normal course of business to communicate.

After a content management system is used to enact a litigation hold and export ESI for data reduction, there are several options for attorneys conducting review. Deploying software with data analytics that can learn from a skilled reviewer, enabling the software to “predict” other responsive ESI is one option; Early Case Data Assessment software is another to narrow a dataset to relevant ESI; at a minimum, attorneys should have the data de-duplicated and other data reduction strategies commonly used by litigation support providers before beginning traditional review.

The “triggering event” for the duty to preserve is a fact intensive exercise for many attorneys. They need to understand both their client’s data retention and destruction policies (let alone whether the client was following their policies) and when the duty to preserve began.

ESI that is destroyed as part of regular business operations without a duty to preserve is not subject to spoliation challenges. However, this requires that a party understands which of the 14,000 records retention laws in the US apply to their company; they follow their data retention/destruction policy; and that duty to preserve was triggered after data was destroyed in the regular course of business.

Imaging Personal Hard Drives Before Any Claims are Filed

A Defendant brought a motion to forensically image the Plaintiff’s “personal computing devices” before a cross complaint had been filed.  The motion was denied.  Han v. Futurewei Techs., Inc., 2011 U.S. Dist. LEXIS 104538 (S.D. Cal. Sept. 15, 2011).

The case was originally filed in California state court and removed to Federal Court.  The Defendant sought leave to file a cross-claim for the removal and copying of files from her company issued computer.  Han, at *2-3.

The Plaintiff claimed that when she was asked to return her company issued computer, she “cleaned up the hard drive and removed incidental personal files, as well as copied several files under an assumption she would receive a new computer.”  The Plaintiff claimed she did not know she was going to be terminated. Han, at *5.

The Defendant sought expedited discovery to image the Plaintiff’s personal computing devices with the following protocol:

1. The inspection and copying of the Plaintiff’s personal computing devices will be conducted by Defendants’ forensic expert.

2. The Plaintiff will provide any and all personal computers and external storage devices that were used by the Plaintiff or anyone acting on her behalf during her employment with the Defendant (“the devices”) to the Defendant’s expert by no later than the close of business on a date to be determined by the Court.

3. The Defendant’s expert will image and return the devices as expeditiously as possible. Plaintiff will leave the devices in the custody of the Defense expert for the time period necessary to image the devices . . . . A copy of the imaged devices will be provided to Plaintiff’s computer forensic firm, at Plaintiff’s expense.

4. All parties agree that Defendants, their counsel, and other representatives of Defendants, excluding the Defense expert, will not access the devices or ESI [electronically stored information],  except . . . pursuant to Court order.

5. The Defense expert’s imaging will capture all data and ESI contained on the devices, including, but not limited to, active files, deleted files, and the unallocated drive space. 

6. The Defense expert will analyze the devices to determine the presence of the Defendants files or data.

7. On a date to be determined by the Court, Plaintiff’s counsel will provide a list of search terms to the Defense expert containing the names of any and all individuals with whom Plaintiff may have had attorney-client privileged communications. Any documents containing these search terms will not be disclosed to Defendants. Instead, the identified documents will be placed on a privilege log, and the log will be provided to counsel for the Defendant.

8. Following the complete analysis of the computer, findings will be reported to Defendants.

9. The Defense expert and its representatives agree that they will not divulge any of the contents of Plaintiff’s Confidential Material to defense counsel, Defendants, or their representatives.

10. If  the Defense expert has questions regarding whether any particular information is Confidential Material, Huron will communicate with both Plaintiff and defense counsel jointly via conference call in regard to any such questions.

11. The Defense expert shall destroy all data and images regarding this matter in its possession within five business days after being notified in writing or electronic mail by counsel for each party that the case has been resolved or finally adjudicated.

Han, at *3-5.

The Plaintiff objected on the grounds the protocol entrusted the “Defendants alone to determine what is privileged or relevant, and denies Plaintiff’s counsel reciprocity to the data sought or the laptop that sparked the [counterclaim].” Han, at *5.

Moreover, the Plaintiff argued that her personal computer contained long list of privileged information, including attorney-client communications, online banking information, and correspondence with family.  Han, at *5-6.

The Plaintiff proposed the following protocol:

1. Plaintiff will provide counsel for Defendant a list of all relevant documents on the Plaintiff’s personal computer as determined by Plaintiff’s Certified Forensic Computer Examiner. Relevant documents will be defined as those copied or otherwise transferred as alleged in Defendant’s Motion for Leave to Amend Pleadings, Docket item [15].

2. Plaintiff will provide counsel for Defendant a copy on cd of all such documents retrieved by Plaintiff’s Certified Forensic Computer Examiner.

3. Plaintiff will have her Certified Forensic Computer Examiner work with Defendant’s forensic computer examiner on any further protocols needed, and Defendant will have its Certified Forensic Examiner work with Plaintiff’s forensic computer examiner on any further protocols needed.

4. Plaintiff, her counsel, and her Certified Forensic Computer Examiner are not to otherwise copy, forward, disclose, disseminate, sell, license, lease, transfer, make any use of, attempt to disclose or use, access or dispose of any of Huawei’s confidential, proprietary or trade secret information, specifically including any information that Plaintiff downloaded or copied that is not publicly available, without first filing with the magistrate [judge] under seal a request to do so. This prohibition shall not apply to Han making her personal computer(s) or external storage devices available for forensic review by Defendants as agreed by the parties or otherwise ordered by the court. This prohibition shall also not prevent Plaintiff from defending any allegations by Defendant against her as related to the proposed Counterclaim filed as Docket item [15].

Han, at *6-7.

Compelled Imaging of Hard Drives

The Court recounted established precedent that inspecting certain ESI raises “issues of confidentiality or privacy.”  Han, at *8.

Federal Rule of Civil Procedure Rule 34(a) was not intended “to create a routine right of direct access to a party’s electronic information system, although such access might be justified in some circumstances.” Han, at *8, citing Fed. R. Civ. P. 34 Advisory Comm. Notes, 2006 Amendment.

The Court recognized the “undue intrusiveness” from forensically examining a party’s hard drive. Moreover, Courts have a duty to guard against such examinations.  Han, at *8-9.  As the Court cited:

“[C]ompelled forensic imaging is not appropriate in all cases, and courts must consider the significant interests implicated by forensic imaging before ordering such procedures.”

Han, at *9, citing John B. v. Goetz, 531 F.3d 448, 460 (6th Cir. 2008).

The Court first held the Defendant’s discovery request was premature, having no relevance on the claims in the case, thus not within the scope of Federal Rule of Civil Procedure Rule 26(b)(1). Han, at *9.

The fact the parties were in litigation did not give the Defendant the “unfettered right to seek whatever it wishes” from the Plaintiff.  Han, at *9. As such, the information the Defendant sought would not be relevant unless the Court first allowed the Defendant to assert a counterclaim.  Id.

The Court further expounded on the premature nature of the examination request, because the Defendant had not demonstrated that mirror imaging was either necessary, justified or cited any authority for their protocol.  Han, at *10-11.

The Court noted the Defendant failed to offer anything to establish the Plaintiff was wrongfully in possession of confidential information.  Han, at *11.  Moreover, the Defendant had not established the Plaintiff’s “wiping” of files from her work computer was either improper or malicious.  Id.

As the Court stated:

Although Huawei attempts to place Han’s alleged actions under a cloud of suspicion, it has not provided an expert declaration or any other evidence supporting a conclusion that Han was doing anything other than what any conscientious employee would do when asked to return a company-issued computer. Huawei has provided no evidence or argument demonstrating the alleged copying, removal, and deletion of files was at all unusual or unexpected. It is perfectly conceivable that Han was “cleaning up” her laptop by, for example, deleting personal emails or files, deleting files no longer needed, or copying important files for placement on the new work laptop she expected to receive. Additionally, Huawei has not provided any employment agreements or work policies prohibiting the transfer or deletion of company files from one computer to another. Huawei simply assumes that because files were copied, transferred, and deleted, Han was necessarily engaged in nefarious conduct. Such an unsupported assumption does not entitle Huawei or its expert to unlimited access to Han’s personal computing devices.

Han, at *11-12.

The Court further explained that the Defendant’s collection protocol would encompass “non-responsive, irrelevant, and privileged information.”  Han, at *12. The Court recognized the Defendant was seeking any possible company confidential information that the Plaintiff might have had, but there were less burdensome ways to find the information, such as requests for production or interrogatories.  Id.

The Court stated that the Defendant’s proposed protocol would subject the Plaintiff’s confidential information to be needlessly examined.  Han, at *13.  Moreover, case law allowing mirror images of hard drives involve inconsistent or incomplete discovery responses, something that was not present in this case.  Han, at *13-14.

The Court found that the Plaintiff’s proposed collection protocol was reasonable, following the convention that the responding party determines what is “relevant, responsive, and protected by privilege or privacy interests.”  Han, at *15.

Bow Tie Thoughts

The compelled mirror image of a personal computer, to be done under the control of the requesting party, is as invasive as a strip search.  The examination literally exposes everything about a person, from banking history to tax information to emails sent on a dating site.  Such invasion flies in the face of discovery requirements preventing “oppressive” or “burdensome” questioning, let alone state constitutional privacy rights.

Courts are the guardians against such discovery practices.  While there are times when appropriate to mirror image a hard drive, the requesting party does not then march over the producing party like a conquered army from ancient times.  The producing party has the right to review for relevance, responsiveness and assert any privileges.  The requesting party claiming, “don’t worry, trust us” is simply not acceptable to protect an individual’s privacy interests.

The Confirmation of Existence…Of Responsive ESI

EEOC v. Jp Morgan Chase Bank, N.A., is gender discrimination case with multiple discovery disputes.  EEOC v. JP Morgan Chase Bank, N.A., 2011 U.S. Dist. LEXIS 34409, 6-7 (S.D. Ohio Mar. 30, 2011).

One request for production called for “[w]hatever hardware, software, files, metadata, and properties in Defendant’s possession that shows Aimee Doneyhue herself created the purported resignation letter dated 4/30/08.” JP Morgan Chase Bank, N.A., at *6.

The Defendant countered that the former employee’s computer had been reassigned and that the Defendant was “unable” to recover any responsive information, but would supplement their response if any ESI later recovered.  Id.

The EEOC argued this was inadequate, because the Defendant did not state if it “ever tried to recover an original or native file from a backup tape, archived document, or hard drive.”  JP Morgan Chase Bank, N.A., at *6-7.

The EEOC quoted testimony from the Defendant’s IT Director/Vice-President that the Defendant had the technology to forensically recover deleted documents from the former employee’s hard drive.  JP Morgan Chase Bank, N.A., at *7.

The Court agreed with the EEOC and granted the motion to compel.  It was not clear what steps the Defendant had taken to recover the responsive information.  Id. As the Court explained:

The EEOC is entitled to confirm whether or not this information exists, either through Chase’s own search or through production of the requested storage devices to the EEOC for examination.

JP Morgan Chase Bank, N.A., at *7.

Bow Tie Thoughts

It is unlikely a party will be required to prove a negative, such as data does not exist, however, a party must explain what steps were taken to preserve and search for responsive electronically stored information.

A Standard for Undue Burden: Excruciating, But Highly Educational and Useful, Detail

Discovery Balancing Acts in a War Zone

United States ex rel. McBride v. Halliburton Co., is a qui tam action over alleged fraudulent billing for services provided to the US military in Iraq.  The case involved inflated headcounts in Morale, Welfare and Recreation (“MWR”) facilities and fraudulent billing for those costs to the United States government.  United States ex rel. McBride v. Halliburton Co., 2011 U.S. Dist. LEXIS 6412, 1-2 (D.D.C. Jan. 24, 2011).

Balancing Search Terms and Undue Burden

The discovery disputes were numerous, and in his trademark detailed fashion, Magistrate Judge Facciola addressed each one in turn. 

One dispute centered on the collection and searching of additional custodians who were “cc-ed” on relevant emails was justified or unduly burdensome on the producing party. McBride, at *12-22. 

The Defendants initially searched 20 custodians for responsive electronically stored information.  McBride, at *12.  The Defendants voluntarily searched the data a second time with expanded keywords.  McBride, at *13-14. 

The Plaintiff demanded additional information, which promoted the Defendants to run another expanded search.  McBride, at *14-15.  The Defendants searched 230 custodians, which included all custodians in all litigation involving the Defendants.  McBride, at *15.  The uber-search of did not result any hits for the desired custodian the Plaintiff wanted in their request.  Id.  The Defendant took the position that since the emails were not found in the custodians the parties agreed to search; the Defendants did not need to conduct any more searches.  Id. 

The Plaintiff demanded the Defendants conduct additional searches of anyone who had been “cc-ed” on the already relevant email messages with the relevant reports.  McBride, at *15. 

The Defendants objected, claiming that search would add another 35 custodians.  Moreover, the Defendants estimated the search process would take months.  McBride, at *15-16. 

Judge Facciola stated a phrase that will cast a shadow of what must be demonstrated for an effective undue burden argument: “In excruciating, but highly educational and useful, detail.”

The Defendants’ manager for the e-Discovery group submitted a declaration that explained process of how data is collected from employees, which might include the following sources of ESI:

 (1) The employee’s hard disk drive, which can include the original disk drive, a “ghosted” image of the drive, and self-collected copies of the drive, of which [the Defendants] may possess none, one, or several collections for each identified custodian;

(2) Copies of current or former employees’ electronic data made at different points in time in response to various audits, inquiries, and litigation, which copies may include information no longer on the employees’ hard drive today (or was not on the hard drive at the time of his or her departure); and

(3) The employee’s mailbox or “homeshare” (personal network folder), with the possibility that there could be multiple existent copies of both the mailbox and homeshare if the employee was a custodian in other matters; indeed, there are multiple sources of such data, and it is not usual for more than a dozen to exist.

McBride, at *16-17. 

The Court explained that after the data was found, it was then copied in “a forensically appropriate manner to preserve its metadata and prevent its alteration.” McBride, at *17. 

The collection of data in the US involved data being sent to a service provider from storage; however, things would be a little trickier for the data in Iraq.  McBride, at *17. 

The overseas ESI would need to be shipped back to the United States or harvested over network connections.  Id.  The collection over a network would take days from just one custodian.  The Defendants’ e-Discovery manager estimated that each custodian had 15 to 20 gigabytes of data.  Collecting the data could take two to ten days for each custodian.  McBride, at *17-18. 

The workflow would then include processing the data and de-duplication for review.  McBride, at *18.   The data would then be searched for relevance and privileged.  Id.

Utility vs. Cost of Searches

The Court gave a very succinct summary of discovery cost analysis: 

All discovery, even if otherwise permitted by the Federal Rules of Civil Procedure because it is likely to yield relevant evidence, is subject to the court’s obligation to balance its utility against its cost. Fed. R. Civ. P. 26(b)(2)(C). More specifically, the court is obliged to consider whether (1) the discovery sought is unreasonably cumulative or duplicative, or obtainable from a cheaper and more convenient source; (2) the party seeking the discovery has had ample opportunity to obtain the sought information by earlier discovery; or (3) the burden of the discovery outweighs its utility. Id. The latter requires the court to consider (1) the needs of the case; (2) the amount in controversy; (3) the parties’ resources; (4) the importance of the issues at stake in the action; and (5) the importance of the discovery in resolving the issues. Fed. R. Civ. P. 26(b)(2)(C)(iii).

McBride, at *18-19.   

The Court recognized a significant factor in favor of production: “Claims of fraud in providing services to military personnel raise important, vital issues of governmental supervision and public trust.” McBride, at *19.

However, the parties had spent $650,000 in discovery.  The “king’s ransom” in Judge Facciola’s words did not include attorneys’ fees. McBride, at *19.

The discovery already produced included two million paper documents, thousands of spreadsheets and half a million emails.  Id.

The Court denied the Plaintiff’s motion, because the Plaintiff had not demonstrated that the email messages not already produced were “critical to her proof.” McBride, at *19-20.  As such, the cost of the collection and search outweighed its utility. McBride, at *20.  In the words of the Court, “there is no showing whatsoever from what has been produced that those emails not produced will make the existence of some crucial fact more likely than not.”  Id.

The Federal Rules of Civil Procedure vs. Common Law Spoliation

The Plaintiff argued that the Defendants would violate a preservation order if they could not produce email messages from a specific custodian and should be sanctioned accordingly.  McBride, at *21.    The Court began its analysis with the following: 

It is important to keep separate, and not conflate, two distinct concepts: whether an additional search for certain information should be conducted, and whether or not the inability to find certain information should be sanctioned. The first is a question of interpreting the Federal Rules of Civil Procedure, while the second is a matter of the application of the common law principle of spoliation.

McBride, at *21.    

The Plaintiff’s sanction argument effectively would have a producing lose their right to argue against additional searches under Federal Rule of Civil Procedure Rule 26(b)(2)(C)(iii) if the producing party could not produce data they were asserted to preserve.  McBride, at *21-22.    

As the Court stated:

If that were true…then even an entirely innocent loss of information would deprive the party who occasioned the loss of reliance upon the balancing of the factors in Rule 26(b)(2)(C)(iii) to argue against an additional search. There is nothing in the Federal Rules that could possibly justify such an extraordinary sanction, and thereby rob Rule 26(b)(2)(C)(iii) of its intended universal application.

McBride, at *22.    

Bow Tie Thoughts

Proving undue burden requires specific documentation of the process used to collect data; where the data is location; time involved in collecting the ESI; and estimated cost.  While judges across the country will not be applying an “excruciating detail” test, parties need to demonstrate undue burden with evidence.

Discovery in a Flash (Drive)

Flash drives were the center of a discovery dispute in a trade secret dispute between high-speed printer service providers. OcÉ N. Am. v. McS Servs., 2011 U.S. Dist. LEXIS 5403 (D. Md. Jan. 20, 2011).

The Plaintiff sought a forensic image of the flash drives, because the devices contained their software alleged used by the Defendants.  OcÉ N. Am., at *3.

Discovery was expedited in advance of a preliminary injunction hearing.  Pursuant to Court Order, the Defendants allowed the Plaintiff’s expert to image 21 laptop computers at issue in the dispute over several days.  However, on the third day, the Defendants told the Plaintiff’s expert their office was closing and the Plaintiff’s expert was not allowed to image the 15 flash drives.  OcÉ N. Am., at *3.

The Plaintiff in turned filed a motion to compel before the preliminary injunction hearing, which was denied because, “[a]lthough [the thumb drives are] ultimately discoverable, such discovery is not necessary on an expedited basis to prepare for a preliminary injunction hearing.” OcÉ N. Am., at *4.

The parties agreed to a Stipulated Preliminary Injunction that provided for a neutral third-party to take possession of the flash drives and forensically image them.  Once imaged, the flash drives were destroyed, leaving only the forensic image of the electronically stored information on the 15 flash drives. OcÉ N. Am., at *4-5.

As expected, the Plaintiff wanted access the data from the forensically imaged flash drives.  The Defendants opposed on several grounds, including the novel argument that the Plaintiff never requested the forensically imaged information, just the flash drives in discovery, which now no longer existed.  OcÉ N. Am., at *5-6.

The Defendants’ arguments were vaporized by the Court in a flash.  The Court explained that when the Plaintiff requested the flash drives, “it sought not the physical device but rather the ESI contained therein.” OcÉ N. Am., at *10. The Court stated:

As a matter of practical concern, therefore, if the original thumb drives were discoverable, Capsicum’s forensic images of the thumb drives must also be discoverable, and Océ need not propound a new discovery request for what amounts to the exact same information.

OcÉ N. Am., at *10.

Bow Tie Thoughts

The Court summarized the basics of producing electronically stored information in its reasoning:

            Producing Party creates an image of responsive ESI

            Producing Party reviews ESI for production

            Producing Party produces filtered responsive files

            OcÉ N. Am., at *10.

The key issue in producing electronically stored information is the information, not necessarily the device containing the information.  A party is very hard pressed to create a forensic copy of information that was requested and then claim the information was never requested, because the device that originally contained the information no longer exists.

Production of Litigation Hold Letters & Imaging Hard Drives

In an action initiated by an insurance company, the Defendant sought various discovery from the Plaintiff.  Am. Gen. Life Ins. Co. v. Billard, 2010 U.S. Dist. LEXIS 138570 (N.D. Iowa Dec. 29, 2010).  Two issues pertained to the production of litigation hold letters and forensically imaging hard drives.

Litigation Hold Letters

The Defendant sought information regarding the Plaintiff’s obligation to enact a litigation hold.  Am. Gen. Life Ins. Co., at *17.

The Plaintiff objected at first on relevance and privilege, however, admitted someone might have deleted “an email” (which implies a single message).   Am. Gen. Life Ins. Co., at *18.

The Plaintiff’s attorney made several representations at the hearing:

1)    The Plaintiff would produce any non-privileged and responsive documents that exist.

2)    The attorney received and had not reviewed the Plaintiff’s document retention protocols prior to the hearing.

3)    The Plaintiff had such a “comprehensive method” for preserving ESI, a litigation hold letter might not have been needed. 

Am. Gen. Life Ins. Co., at *18.

The Court did not address the representation that a litigation hold letter was not needed because of a “comprehensive” preservation method.  However, the Court did order the Plaintiff to produce any litigation hold letters or state no preservation notices were sent to the Plaintiff’s employees.  Am. Gen. Life Ins. Co., at *18.

Forensic Imaging a Hard Drive

The Defendant sought the forensic imaging of all hard drives/storage devices used by two of Plaintiff’s employees.  Am. Gen. Life Ins. Co., at *19.

The Plaintiff (rightly) objected on privilege and relevancy grounds.  Am. Gen. Life Ins. Co., at *19.  The Plaintiffs also argued the hard drives contained “commercially sensitive information.” Am. Gen. Life Ins. Co., at *19. 

The Defendant did not cite any authority for the forensic imagining of the Plaintiffs’ hard drives.  As such, the Court held that without some proof that the “mirror imaging” would produce additional responsive ESI, the motion to compel was denied.  Am. Gen. Life Ins. Co., at *19. 

Bow Tie Thoughts

Letter writing might be a dying art, but sending a litigation hold is not.

It is a novel argument that a “comprehensive” data preservation system would eliminate the need to communicate the duty to preserve to a client.  While it is certainly plausible a corporate party could capture and archive all employee’s computer generated content, it is a hard sell such technology eliminates the obligation to inform a party to preserve evidence.  To be blunt, a party needs to be told of their duty to preserve relevant ESI to avoid “an email might have been deleted” situation. 

As for the forensic imaging of hard drives, there is no rule all preservation of data must be a full forensic image.  Data preservation must be done in a forensically defensible sound manner, which goes to the process, not a bit for bit image of a hard drive.  Technology continues to improve for targeted collections, in which selected folders and files are copied in a forensically defensible  process. For example, see products from PinPoint Labs, Paraben or Guidance, plus others, who sell such software and hardware.  Such collections reduce time to review ESI and avoid the imaging of non-responsive or otherwise protected information.