2009-03-05 8th and 10th Circuit Spoliation, Accessibility, Expedited Motion to Compel Imaging

Another week, and you guessed, it a spate of spoliation decisions: One from the 8th Circuit and a second from the District of Colorado (relying on 10th Circuit). Also, an "accessibility" decision (with a twist) from the Eastern District of Virginia, an expedited motion to compel imaging from the Southern District of Florida, and a Maryland Court of Appeals decision permitting the discovery of the identity of anonymous "internet communicants"

SWT

**************
Case: Insignia Systems, Inc. v News America Marketing In-Store
Citation: 2009 WL 483850 (D. Minn. 2009)
Date: 2009-02-25
Topics: Eighth Circuit spoliation standards, non-party destruction, ESI destruction by non-party during pendency of litigation

In this spoliation decision from the U.S. Court of Appeals for the 8th Circuit, defendant claimed that plaintiff had instructed a consultant preparing an "Investment Thesis" equity report to destroy all information used to prepare the report that was received by that third party. The consultant testified that it has destroyed all computer files in accordance with instructions for payment from plaintiff. Defendant then claimed that the non-party consultant’s testimony in connection with the preparation of the Investment Thesis was substantially compromised by the non-party’s destruction of all collateral materials (including, apparently, even the contract of engagement with plaintiff).


Eighth Circuit Spoliation Standards

The Court first turns to the traditional definition from Black’s Law Dictionary: "Spoliation is defined as the "intentional destruction, mutilation, alteration, or concealment of evidence"

The Court next articulates standards to establish spoliation for the 8th Circuit --- which, imo, appears to be a "pure" Federal common law position, which in turn means (at least imo) a universal approach to spoliation by all District Courts within the Circuit (compare 11th Circuit’s "advised" by state law principles approach, yielding potentially conflicting intra-circuit decisions). In requiring a finding actual intent, the Eighth Circuit appears to eschew the ordinary negligence standards adopted by the 2nd and other circuits.

"There must be a finding of intentional destruction indicating a desire to suppress the truth before an adverse inference instruction is justified. Morris v. Union Pac. R.R., 373 F.3d 896, 901 (8th Cir.2004)(emphasis added). A spoliation sanction requires a finding of "intentional destruction of evidence indicating a desire to suppress the truth, not the prospect of litigation." Greyhound Lines, Inc. v. Wade, 485 F.3d 1032, 1035 (8th Cir.2007)(citing Morris, 373 F.3d at 901). A court may rely upon inferences to find requisite intent on behalf of the spoliator to destroy the evidence and suppress the truth. Morris, 373 F.3d at 902."


Intentionality, Purposefulness and Obscuring the Truth

The spoliation bar set by the Eighth Circuit is set fairly high: The court notes that the "intentionality must be purposeful" and that the "purpose of the destruction must serve is the obscuring of truth."


Prejudice

The Court then goes on to state that intent must be combined with a finding of prejudice:
"Intent is rarely proved by direct evidence, and a district court has substantial leeway to determine intent through consideration of circumstantial evidence, witness credibility, motives of the witnesses in a particular case, and other factors." Id. at 901.Second, there must be a finding of prejudice to the opposing party before imposing a sanction for destruction of evidence. Dillon v. Nissan Motor Co., Ltd., 986 F.2d 263, 267 (8th Cir.1993)."


ESI Destruction During Litigation

Defendant also claimed (and it was admitted by plaintiff) that the plaintiff had instructed the non-party to destroy its ESI after litigation with plaintiff had commenced. The Court found that although the ESI was destroyed during after litigation had commenced, the Court:

"…did not find that the record shows that documents were destroyed as a result of any ongoing or anticipated litigation. As Insignia points out, "There is no reference in the Diracles letter to the litigation with News America, or any other litigation.""


Indication or Reasonable Inference for Motive to Destroy

Well, they were admitted destroyed after litigation had commenced, so whither this finding? The Court found that the record supported no indication or reasonable inference suggesting the report was prepared and destroyed due to pending litigation.

"Additionally, the Court is not persuaded by NAM's argument that CIRG's services were connected to this litigation through the discussions Insignia's Board had on these topics. See Defs.' Mem. 13. Upon review of both the Board meeting minutes from March 17, 2005 (Ex. C), and May 18, 2005 (Ex. F), the Court would note that both the CIRG report and the case in front of this Court were discussed, however, the Court holds there is no indication or reasonable inference that can be drawn from these meeting minutes that suggests the report was prepared and thereafter ordered to be destroyed due to the pending litigation."

Of course, without reference to the destroyed information that would be a difficult call, but the Court was apparently satisfied that no circumstantial evidence satisfying the intent-suppression-obscuring 8th Circuit spoliation standards.


No Prejudice Where Other Sources of Destroyed Documents Exist

The Court noted that the ESI was available to the defendant, as plaintiff had instructed the non-party to destroy the "copies" of what it had received, implying of course, that other copies (or originals) still existed under plaintiff’s custody or control.

Result: Defendant’s motion for adverse inference was denied.


***************
Case: Smith v. Slifer Smith & Frampton/Vail Associates Real Estate, LLC
Citation: 2009 WL 482603 (D. Colo. 2009)
Date: 2009-02-25
Topics: 10th Circuit Spoliation standards require bad faith destruction of relevant evidence, standard of review in U.S. Magistrate Judge’s Report and Recommendation is clear error and abuse of discretion, counsel’s letter of "investigation" of transaction triggered duty to preserve, use of secure wiping programs

In this decision from the U.S. District Court for the District of Colorado, U.S. District Judge Kane reviewed and approved the U.S. Magistrate Judge’s report and recommendation on plaintiff’s "Motion for Sanctions for Destruction of Evidence." In this case plaintiff’s counsel sent defendant a letter of inquiry and investigation in connection with a real estate transaction on May 19th 2006, and that May 19th 2006 (a date nearly six months prior to onset of litigation) was deemed to have triggered defendant’s duty to preserve. What follows is the timeline of what transpired after the action was commenced:

April 9, 2007 – Plaintiffs serve request for document production("RPD"); definition of "document" included:

""…computer data, including floppy disks, hard drives, tapes and other electronic media ... e-mails and any and all forms of communication communicating, preserving, recording and transmitting human thoughts whether written, printed, typeset or reproduced by any other means, which is now or formerly was in your possession.""

July 30, 2007 – Plaintiff serve second RPD, again asking for documents, including ESI, but also requesting inspection and sampling of a defendant’s Computers and…

"those databases identified in discovery in this case, including any email databases, any information or personal information management or similar program databases, and any backup tapes or databases."

October 15, 2007 – Defendants respond to RPDs and provide, inter alia, a CD containing a Forensic Toolkit ("FTK") report provided by defendant’s technical expert.

November 1, 2007 - "…included in a letter from defense counsel on November 1, 2007, was a description of the sources searched for ESI, which included four media drives residing on three of [defendant] Seibert's computers: SSF 1-2 and SSF 1-5 were two drives from Seiberts "Old Office PC," SSF 1-4 was from Seibert's "Home Computer," and another came from Seibert's laptop computer, SSF 1-1."

Defendants then disclosed that there were additional sources of potentially relevant information on one or more of one defendant principal’s other computers:

"included in a letter from defense counsel on November 1, 2007, was a description of the sources searched for ESI, which included four media drives residing on three of Seibert's computers: SSF 1-2 and SSF 1-5 were two drives from Seiberts "Old Office PC," SSF 1-4 was from Seibert's "Home Computer," and another came from Seibert's laptop computer, SSF 1-1"


Use of Wiping Utility During Pendency of Litigation

The facts then become a bit more intriguing: defendant had installed a wiping utility on his computers. There is almost always an "oops" in spoliation challenges --- this "oops" is a whopper. First, the tee-up: A wiping utility was admittedly installed on defendant’s computer

"[T]he parties do not dispute that Anti Tracks software was found on Seibert's home computer (SSF 1-4) and that the drive labeled SSF 1-2, Seibert's Old Office PCDisk 1, was not functional (See Docket No. 92 at 60)"

'Th[e] defendants' expert, Raphael Gorgal, stated in his report dated July 7, 2008, that the four systems were analyzed "to determine if secure deletion (wiping) software had been installed." (Docket No. 74-25 at 6). Gorgal found that "the executable files of a wiping program called Anti tracks" was on SSF-1-4, the home computer. He stated that the program's "advertised capabilities include the ability to automatically ‘erase recent document history, erase Windows temp, erase run history, erase search files history, erase search computers history, erase last logon history, erase network cache, erase telnet history, erase recycle bin, erase registry streams, and clear the Windows page file.’ It also offers the ability to securely delete information." (Docket No. 74-25 at 6). In addition, he reported that "[f]iles associated with the application were discovered on the drive image and have last accessed dates of 9/6/2007..." (Docket No. 74-25 at 6) (emphasis added)."

Why this turns out to be a whopper:

"[Defendant’s expert] further stated regarding orphaned files and folders: "9383 files and folders from the period 9/6/07 through 9/14/07, as identified by Last Accessed Date were found. These include default Windows folders including Program Files, Documents and Settings, registry entries, downloaded music from iTunes, and content from the Temporary Internet Files Folder. Two of the orphaned files are Outlook. pst files. Both .PSTs were included in the original data set of searched active files. Both are corrupt, and neither contains any whole recoverable mail data, even after being repaired using industry standard repair tools, however, can be searched via keyword." (Docket No. 74-25 at 9) (emphasis added). He also stated, "SSF-1-4 is missing key components of the registry; and of those intact, some key areas are missing. Thus, a specific/comprehensive analysis of user activity was therefore not possible. In its current state, the imaged computer (SSF-1-4) could not boot into Windows, and the Documents and Settings folder, the Program Files folder, and Recycler are empty...."
(Docket No. 74-25 at 10)"

It gets worse (for defendants):

"[A]n Anti-Tracks folder was created on August 17, 2006, which was after the May 19, 2006, letter from attorney Wendell Porterfield to defendant Seibert (Docket No. 74-2; Pls.' Ex. 1);"
"That the last-accessed date of September 6, 2007, was also after the May 19, 2006, letter from attorney Porterfield to Seibert; after the commencement of this action on November 2, 2006 (Docket No. 1); after the entry of the original Scheduling Order in this matter (Docket No. 12); after service of the plaintiffs' first RFP to Seibert and SSF on April 9, 2007 (Docket Nos. 74-4 and 74-5); after service of the plaintiffs' second set of RFP to defendants on July 30, 2007, which included RFPs for production of ESI (Docket No. 74-8), and just two days after responses were
served by defendants to that second set of RFP (Docket No. 74-9);"

"That moreover the last-accessed date of September 6, 2007, was just eight days before defendants created a forensic bit-stream image from the computer on September 14, 2007, from which defendants' expert found 9383 orphaned files and folders from the period 9/6/07 through 9/14/07, which was days before and on the date the forensic image was created"

"[F]ollowing the production of the defendants' expert report, which was produced after a motion to compel production of certain ESI (Docket No. 66) was filed by plaintiffs, the parties filed a Joint Motion to Amend the Scheduling and Discovery Order (Docket No. 72). In that motion, the parties, through counsel, stated, inter alia, "Material Facts. Subsequent to the filing of the Motion to Compel, Defendants endorsed and disclosed a report from their computer forensic expert, Raphael Gorgal, showing the presence of wiping or secure deletion software called ‘Anti Tracks' on and the deletion of a significant number of files from a computer drive owned by Defendant Seibert which had been subject to discovery in this case." (Docket No. 72 at 2, ¶ 3) (emphasis added)"


Wiping Utility Usage During Pendency of Litigation, Cont'd

Defendant's situation keeps worsening – keep in mind that all these activities occurred during the discovery period:

"[P]ursuant to that Order, plaintiff's expert, David Penrod, submitted a report in which he states that the Anti-Tracks folder "was created on August 17, 2006 at 11:11 AM. It was deleted on September 13, 2007 at 12:13 AM, just days before Mr. Gorgal [defendants' expert] created a forensic bit-stream image from it." (Docket No. 74-28 at 4, ¶ 8). Penrod recovered three "Internet shortcut files that link to Internet websites from which Anti-Tracks can be downloaded and information about its function obtained." (Docket No. 74-28 at 4, ¶ 12). All three "were created on August 17, 2006 at 11:11 AM.... They were deleted on September 6, 2007 at 7:44 AM. They were Modified on August 4, 2007. The exact cause of this modification is unknown, but may have been caused by a visit to the Anti Tracks website on the Internet." (Docket No. 74-28 at 5, ¶ 12)"

"[P]enrod further states, inter alia, in his affidavit with regard to Seibert's home PC (SSF 1-4) that Penrod recovered evidence of secure data deletion (file wiping) on SSF 1-4, EnCase includes a utility that searches a drive image for successive, uninterrupted sectors containing well known file wiping patterns. Consecutive sectors containing such patterns were recovered during this search..."

"The EnCase forensic program automatically recovered a total of 67,714 folders, files and individual system data streams as Lost Files. The Affiant analyzed the date and time stamps of these objects and determined that they had been deleted as part of a systemic effort to erase pertinent data. The erasures started on May 4, 2007 at 1:16 AM and continued every day until 11:02 AM on September 14, 2007, just before the entire operating system and its component parts was erased. Most of the erasures have the appearance of automated processes; many of those in August and September 2007, however, appear to be manual in nature..."


Good Wipe, Bad Timing

The Court notes (by way of the Magistrate Judge’s findings) that the wiping utility did serious impaired any forensic efforts:

"Files and objects deleted include but are not limited to hives and individual keys of the Windows Registry stored within System Restore Points, files and folders from the Documents and Settings directory, including Outlook PST files, and operating system data from the Windows directory.
While all these deletions seriously damage forensic recovery of evidence, no deletions are more damaging than those of the Windows Registry stored within the System Restore Points. Deletion of Restore Point files obliterates historical records that can be used by the forensic analyst to construct a chronology of system and user activity...."


A What-Never-to-Do (but was done) During Pendency of Litigation

Think things could get any worse for defendant? Think again. When a forensic examiner states "These files are no longer present" things aren’t looking up:

"The Affiant's analysis of EnCase's Lost Files bin revealed that two (2) Microsoft Outlook PST files had been deleted and corrupted. The Outlook PST files were both created on June 27, 2005. The principal file (Outlook.PST) was deleted on August 3, 2007. The secondary file
(OutlookHotmail-00000002.PST) was deleted on July 20, 2007...."

"The Affiant's analysis of EnCase's Lost Files bin revealed that approximately 9,500 files and folders, including critical system files, had been deleted between September 6 and 14, 2007. These files included the contents of the principal Windows operating system directories, containing critical files necessary for booting and running Windows. The contents of the following folders were deleted: Documents and Settings, Program Files, System Volume Information and Windows.... Documents and Settings contains User Profiles for each user with a registered logon to the computer. It also contains user created files, such as Word documents, digital photographs and email messages as well as other files such as the user's Internet History, Cache and Cookie files. This is a critical folder for forensics. It is completely empty.... "

"The System Volume Information directory contains several onboard services necessary for the efficient performance and restoration of the Windows operating system. This directory is part of System restore, a tool that allows the user to set points in time to which he or she can roll back the computer. The System Volume Information folder contains these points and associated information that makes them accessible. This is a critical folder for forensics as it contains a history of the computer that can be recovered by forensic tools. This folder is completely empty.... The Windows directory contains the Windows operating system files. Most importantly, it contains the Windows Directory, which is a central repository for all information about the operating system and its installed software and hardware components. The Windows Directory also contains event logs, which provide a chronological record of application, system, security and user events. Both the Registry and event logs are critical to effective forensic analysis."


The forensics piece de resistance:

"These files are no longer present."


Rebuttal Expert Testimony, Wiping Patterns, and the Battle of Experts

Defendant then called in a rebuttal expert to refute the findings of plaintiff’s expert.
"[P]ursuant to Judge Kane's Order of July 18, 2008 (Docket No. 73), defendants' rebuttal expert, David Cowan (Mr. Gorgal's coworker), submitted a rebuttal report dated August 21, 2008. (Docket No. 92-15, Defs.' Ex. N). Cowan does not agree with certain conclusions stated in Penrod's report."

"Cowan opines that EnCase script does not do what Penrod claims and that "[i]n fact, nowhere in the script source code does it reference, identify or test any ‘well known wiping patterns'." (Docket No. 92-15 at 4-5). Cowan further states that "CFL [Penrod's firm] is basing their technical argument that wiping occurred [sic] on SSF-1-4 and SSF1-2 on the consecutive sector script which does not operate as has been described in Mr. Penrod's report and does not in my opinion show that this or any drive has been wiped.""


And Make Sure that We Provide Another Explanation For What Appears to Be Reformatting

A second rebuttal expert’s report was provided by defendant, who apparently marched as ordered. What’s interesting is that the new expert’s rebuttal report did not rebut plaintiff’s expert report; rather it stated only that it could not be determined that the wiping patterns were the result of reformatting:

"[A]ttached to defendants' response to the instant motion is a new expert report from L. Aaron Phillipp of Navigent Consulting, Inc., responding to Penrod's opinion that the defendants intentionally reformatted the data drive labeled SSF 1-2 (Seibert's old office PC-disk 2) in an effort to prevent the plaintiffs from acquiring evidence against the defendants. (Docket No. 92-16, Defs.' Ex. O)."

"Phillipp concludes that he did not identify any evidence to support Mr. Penrod's assertion that Mr. Slifer's [sic] work computer was reformatted. As detailed in this report, in all cases on the SSF 1-2 hard drive, the markers which are a direct and inevitable result of formatting were either missing or damaged. In short, none of the artifacts which would indicate a proper or attempted reformatting had occurred could be identified. Rather, the state of the drive would indicate some kind of catastrophic failure, either caused by older hardware which was nearing the end of its life or some type of malware."

The Court wasn’t buying for two reasons:

The new expert’s rebuttal report was first not considered on procedural grounds. Nonetheless, and I am seeing more often in such decisions, the Magistrate Judge considers the report anyway, and considers it as having been rebutted nonetheless (to be clear, a rebuttal of a rebuttal of an expert report):

"Defendants have not provided any explanation for why a new expert report was suddenly submitted with their response. There has been no showing that the failure to submit Phillip's report in a timely manner was substantially justified or is harmless. Therefore, such report should not be considered in conjunction with the motion now at issue;

"[E]ven if Phillipp's report should be considered, the conclusion stated therein is rebutted by Penrod's subsequent declaration submitted by plaintiffs with their reply. (Docket No. 106-2). Furthermore, as correctly noted by plaintiffs in their reply, Penrod and Phillipps agree that all of the data on the old office PC was destroyed after May 10, 2007. Such loss of data could have been avoided if the data had been timely preserved by defendants. In addition, in his declaration, Penrod also methodically rebuts Cowan's August 21, 2008, report and conclusions and identifies purported misstatements in defendants' response concerning Penrod's conclusions"

"Seibert's August 22, 2008, deposition testimony (Docket No. 74-34) includes the following. His old office PC came from his brother in 2003 (Seibert Transcript at 17:4-7, 18:1) and remained at Seibert's office until October 2007 (20:4-10, 36:15-18). He was out of town for about 17 days in September 2007, and while he was gone, copies were made of the computer drives. (21:14-25-22:4). It was the primary computer he used for his work from 2003 through the summer of 2005 at which time he started using his lap top computer. (43:23-25; 44:1). After the summer of 2005, he still had that desktop PC in his office and turned it on from time to time if he was looking for a file that he could not find in his lap top computer. (44:8-13). There was no other place he kept electronic information relating to his work from the summer of 2003 through the summer of 2005. The information from his work related to this case was contained on that computer. (54:4-12)."

Of course, when other options run out, and one is backed into a corner, the next logical course of action is abject denial, or a plea of ingorance:

"Seibert does not know how the destruction of data on the computer occurred.(49:20-22, 50:12-15)." "He denies deleting or destroying any information from a computer since May 2006 that might related to this case. (17:18-22). He further denies installing, downloading, or using any wiping software on any computer. (59:18-20; 60:8-13). With regard to his home PC, from the time until it came into the house until September 2007, he had a habit of using it to check his SSF email. (71:4-9, 23-25; 72:1-8). He had access to that computer from September 6 to 8, 2007, at which time he went to Arizona. At that time his wife and two daughters were in the house, but they told him they have no knowledge about the Anti-Tracks software on the computer. (73:8-11; 75:15-18). He returned to Colorado on September 26 or 27, 2007.
(73:12-15). He does not know who installed the software, and he never used it. (75:18-23)"


10th Circuit Spoliation Standards

The U.S. Court of Appeals for the 10th Circuit is a "pure" Federal common law jurisdiction, and a successful spoliation requires a showing of intent and bad faith:

"[T]he general rule is that bad faith destruction of a document relevant to proof of an issue at trial gives rise to an inference that production of the document would have been unfavorable to the party responsible for its destruction." Aramburu v. Boeing Co., 112 F.3d 1398, 1407 (10th Cir.1997)."

"Mere negligence in losing or destroying records is not enough because it does not support an inference of consciousness of a weak case." Id."

"‘[B]ad faith’ is the antithesis of good faith and has been defined in the cases to be when a thing is done dishonestly and not merely negligently. It is also defined as that which imports a dishonest purpose and implies wrongdoing or some motive of self-interest." Cache La Poudre Feeds, LLC v. Land O'Lakes, Inc., 244 F.R.D. at 635"


Suspect Timing Creates Supports Conclusion that Defendant (or agent) Wiped Drive

While there was no direct identifying who destroyed the ESI, the Court found that sufficient circumstantial evidence to conclude that it was either the defendant, or someone acting on his behalf:

"[T]here is no smoking gun establishing who caused the loss of data on the two computers, but the evidence strongly supports the conclusion that that person was defendant Seibert or someone acting on his behalf."

The Court also found sufficient evidence to support a finding of bad faith, intent, and prejudice to the non-spoliating party:

"Nevertheless, the court finds that the plaintiffs have shown by a preponderance of the evidence that after the duty to preserve the ESI on Seibert's computers arose, the defendants failed to preserve evidence and, in fact, destroyed it in bad faith and intended to prevent disclosure of relevant evidence on Seibert's computers."

"This finding is primarily based upon the highly-suspect timing of the usage of Anti-Tracks on Seibert's home PC and the timing of the destruction of the hard drive on Seibert's old office PC. The reformatting of that hard drive (SSF 1-2-the old office PC) occurred after May 10, 2007, which coincides with the date of Seibert's first deposition on May 11, 2007, and the day after he provided responses to the plaintiffs' first set of RFP. Moreover, the last access date of the Anti-Tracks on the home PC was in early September 2007 right before the drive was to be imaged by defendants' expert for purposes of producing ESI. The inference can, and has been drawn by this court, that the timing of the destruction indicates that whoever was responsible knew that the evidence discovered would very well reveal information defendants did not want revealed".

ESI Destruction Occurred Post Action Commencement, Triggering Violation Duty to Preserve

"Furthermore, the timing of such destruction was after the commencement of this action, at which time the parties had an obligation to preserve such evidence "


Strict Standard of Proof Rejected

Interestingly enough, the Court relies on the 2d Circuit’s decision in Residential Funding v DeGeorge, 306 F. 3d 99, (2d Cir. 2002) (a negligence standard case) in articulating a flexible standard of proof in spoliation proceedings.

"Courts must take care not to hold[ ] the prejudiced party to too strict a standard of proof regarding the likely contents of the destroyed [or unavailable] evidence, because doing so would subvert the purposes of the adverse inference, and would allow parties who have ... destroyed evidence to profit from that destruction." Residential Funding Corp. v. DeGeorge Financial Corp., 306 F.3d 99, 109 (2d Cir.2002) (internal quotations omitted). "Where a party destroys evidence in bad faith, that bad faith alone is sufficient circumstantial evidence from which a reasonable fact finder could conclude that the missing evidence was unfavorable to that party.""

Egregious as defendant’s acts appear, the Court declined to impose terminating sanctions, and determined that under 8th Circuit standards, the imposition of an adverse inference instruction to the jury was a appropriate penalty:

"[W]hile the court finds that the destruction of evidence here was the result of willfulness and bad faith, upon consideration of the circumstances presented in the instant motion and the so-called " Ehrenhaus factors," FN3 the extreme, severe sanction of a dispositive sanction, namely, entry of default judgment (albeit tempting under the circumstances presented here) is not recommended. "Because dismissal with prejudice defeats altogether a litigant's right to access to the courts, it should be used as a weapon of last, rather than first, resort." Ehrenhaus v. Reynolds, 965 F.2d 916, 920 (10th Cir.1992) (internal quotation marks omitted). "Only when the aggravating factors outweigh the judicial system's strong predisposition to resolve cases on their merits is dismissal an appropriate sanction." Id. at 921…"


Tenth Circuit Standards For Terminating Sanctions

"FN3. 'Before choosing dismissal as a just sanction, a court should ordinarily consider a number of factors, including (1) the degree of actual prejudice to the defendant; (2) the amount of interference with the judicial process; ... (3) the culpability of the litigant, ... (4) whether the court warned the party in advance that dismissal of the action would be a likely sanction for noncompliance, ... and (5) the efficacy of lesser sanctions.'Ehrenhaus v. Reynolds, 965 F.2d 916, 921 (10th Cir.1992) (internal quotation marks and citations omitted)."

The Court then found that defendant’s acts prejudiced plaintiff’s case, and further cause plaintiffs to incur "considerable additional discovery expenses," and imposed an adverse inference, together with attorneys fees and costs.

District Judge Kane appears to have exerted some restraint, and no small amount of tact, in connection with this matter;

"Finally, I note Defendants and their counsel have employed ad hominem comments and sarcasm regarding Plaintiffs' counsel and impertinent descriptions of the Magistrate Judge's conduct and rulings in this matter.

Such are counterproductive to the objective of persuasion."

***************
Case: Cappetta v. GC Services Ltd. Partnership
Citation: 2009 WL 482439 (E.D.Va.2009)
Date: 2009-02-24
Topics: Producing party bears burden of showing "not reasonably accessible" in ESI dispute,
In this decision from the Eastern District of Virginia, U.S. Judge Luck noted that the Court had declined to order the production of defendant employee’s entire hard drive, pointing out that "such production would necessarily include information not relevant to the case…" The Court instead ordered defendant to generate and preserve a "mirror image" of the hard drive in order to prevent spoliation.

Takeaway: "Absent evidence of spoliation, the Court continues to deny Plaintiff's request for wholesale production of the hard drive."

But wait, wait. Defendant "bypassed two deadlines" to image the hard drive (or, to confirm that it had complied with the Court’s order to so image the drive.) Instead, it claimed that, more than six weeks after the last deadline, it was still "reviewing" the contents of the hard drive. (Query: Court order requires imaging and confirmation to court. How is a statement that contents of a drive are being reviewed in any way responsive to that Order?)

"The Plaintiff propounded the discovery to which the documents respond on August 27, 2008, meaning that the initial deadline to respond with any information from any employee lapsed in September 2008. Despite Defendant's contention otherwise during the February 23 hearing, the Court ordered Defendant to supplement its discovery responses to include responsive information from the hard drive no later than January 12, 2009. (Dec. 24, 2008 Mem. Op. Ex. A at 9, 14, 24, 31, 34, 36, 44.) Defendant now suggests that it believes it has produced all responsive documents otherwise, but that it intends to supplement its responses as its review of the hard drive continues. No documents from the hard drive had been produced as of the February 23 hearing."

The Court was not amused and required a bit more:

"Defendant will be ordered to produce a complete inventory of the contents of the hard drive at issue, including e-mails, to Plaintiff no later than February 27, 2009. During oral hearing, Defendant represented to the Court it believed it could meet this deadline. Defendant will also be ordered to produce all responsive documents located on the hard drive, updated discovery responses, and a concomitant privilege log, no later than March 6, 2009.FN3 Defendant is advised that to the extent it intends to withhold responsive information, including e-mails, on the basis of the attorney-client privilege and work-product doctrine, it must provide a detailed privilege log."

This matter is obviously a TBD…

***************
Case: Continental Group, Inc. v. KW Property Management, LLC
Citation: 2009 WL 425945 (S.D. FL 2009)
Date: 2009-02-20
Topics: Expedited motion to compel imaging of computers and electronic devices, orders to meet and confer, possession by plaintiff’s counsel of defendants’’ imaged drives pursuant to court order deemed not waiver of attorney client privilege.

Reading this case brings to mind the term "flay" (as in flaying the skin of the parties’ counsel) \. A statement like this appearing at the beginning of a discovery decision does not bode well for either party:

"The parties have been unable to cooperate to effect the imaging of the portable devices by today's deadline."

U.S. District Judge Cohn of the Southern District of Florida appears (and, I admit, appearances can be deceiving) to cut the parties some slack:

"The Court's Orders perhaps were unclear whether the filtering out of attorney client privileges documents applied to just the forensic word searching of the KW servers (to be done next week), or also to the portable computers to be imaged by today. Defendants believed such filtering was to apply to the portable devices and that the imaging should be escrowed until the filter process was agreed upon. Plaintiff believes the imaging of the portable devices was to be done by today.

The parties were unable to agree to a filtering protocol by today's deadline for imaging of the portable devices."

In ordering the imaging of defendant’s portable ESI storage drives, the Court also ruled that the possession by plaintiff’s counsel of these drives were to be considered "attorneys-eyes only," not a waiver of any attorney client privilege, although the Court did require the submission of a privilege log by defendants:

"The fact that Plaintiff has possession of the images taken off the portable devices, which are subject to Confidential-Attorney's Eyes Only classification, shall not be deemed to waive any attorney-client privilege should Defendants discover privileged material. Defendant shall serve a privilege log, if any, with respect to these two portable devices, upon Plaintiff's counsel by 4:00pm on Friday, February 27, 2009."


Compressed Time To Review Images No Prejudice to Requesting Party Under Circumstances

The Court noted that it considered the "few days" in which plaintiff could review potentially privileged material not to be prejudicial, and placed any blame for time compression on defendant. The Court noted that it was defendant’s failure to propose a specific filtering protocol rather than simple "escrow" the images prior to a sufficient time to review:

"The fact that this procedure means that Plaintiff's counsel will have a few days to view the images which may contain privileged material is not prejudicial to Defendants. Had Defendants proposed a specific filtering protocol before today's deadline, rather than a procedure to simply "escrow" the images prior to filtering, this situation would have been avoided."



Parties Directed to Cooperate to Include Filtering of Privileged Material

The Court however, also directed defendant to take initial steps in proposing such protocol with plaintiff’s counsel:

"Turning next to the issue of the forensic word search for the KW servers, for this issue the parties must cooperate to include a filtering of privileged material. In this regard, Plaintiff is correct that Defendants must propose a specific filtering protocol with the identity of any counsel who might have engaged in communications with these Defendants, and other terms which might indicate a potentially privileged communication, because this information is uniquely in the possession of the KW Defendants."

"Defendants shall propose such a specific protocol by 12 noon on Tuesday, February 24, 2009. The parties shall cooperate to finalize the word search and filtering protocol by close of business on Wednesday, February 25, 2007, in order for the searching and filtering to be completed by February 27, 2009."

Blognote:

I am going to start counting the occurrences of the term "cooperate" in these digests. This decision is one-plus page in length, and yet the word "cooperate appears --- 4 times, and so, I am pleased to introduce, the one and only "cooperation rating" system. The higher the number of occurrences in an eDiscovery decision, the less likely it is that the parties will have cooperated.

In other words (no pun intended) more is bad, fewer is good.

We’ll see how this proposed inverse proportion works out…

Cooperation Meter Rating: 4

***************
Case: Independent Newspapers, Inc. v. Brodie
Citation: --- A.2d ----, 2009 WL 484956 (Md. 2009)
Date: 2009-02-27
Topics: Maryland state court standard for review of discovery order, Motion for protective order prohibiting disclosure of "anonymous internet communicant."

Although not strictly an eDiscovery case, the decision of the Maryland Court of Appeals provides some insight as to the circumstances by which the identity of anonymous internet "communicants" may be the proper object of a discovery request:

"…this Court holds that, when a subpoena is challenged under a rule akin to Virginia Supreme Court Rule 4:9(c), a court should only order a non-party, Internet service provider to provide information concerning the identity of a subscriber (1) when the court is satisfied by the pleadings or evidence supplied to that court (2) that the party requesting the subpoena has a legitimate, good faith basis to contend that it may be the victim of conduct actionable in the jurisdiction where suit was filed and (3) the subpoenaed identity information is centrally needed to advance that claim. A review of the Indiana pleadings and the subject Internet postings satisfies this Court that all three prongs of the above-stated test have been satisfied as to the identities of the subscribers utilizing the four e-mail addresses in question."

***************