2009-06-07 Forensics to the Forefront; Also, Search Warrants (computer forensic searches, that is), Meet and Confer, Cooperation and Sanctions

Back in blog.

Forensics: Computer forensics moves to the forefront this week, with two decisions. The first, but Magistrate Judge John Facciola (DCDC), provides and in depth discussion of whether, and to what extent, forensic imaging will be permitted. The second, from the U.S. District Court for the District of Massachusetts, discusses how a forensic examination may be appropriate where the computer itself is “at the heart” of litigation. Also discussed is how privacy concerns may be addressed. This decision also provides a well articulated forensic computer examination protocol Computer Search Warrant: In another decision from Magistrate Judge Facciola, a discourse on the limits of warrants for computer searches. Neither strictly eDiscovery nor digital evidence, but criminal procedure fans might have an interest.
Cooperation: Coming soon to a court room near you. This decision from the U.S. District Court for the Eastern District of Michigan involves meet and confer requirements, discovery plans, and sanctions.

TMI (too much information) this week to include the two spoliation decisions in the queue. Stay tuned for midweek update.

SWT

Decisions:

Covad Communications Co. v. Revonet, Inc., --- F.R.D. ----, 2009 WL 1472345 (D.D.C. 2009)
In re Application for Search Warrant, Mag. No. 09-320 (D.D.C. 2009) Unpublished
Capitol Records, Inc. v. Alaujan, 2009 WL 1292977 (D. Mass. 2009),
Argus and Associates, Inc. v. Professional Benefits Services, Inc., 2009 WL 1297374 (E.D. Mich. 2009)


***********
Case: Covad Communications Co. v. Revonet, Inc.
Citation: --- F.R.D. ----, 2009 WL 1472345 (D.D.C. 2009)
Date: 2009-05-27
Topics: When forensic computer search permitted, search methods, database as well as content as evidence, forensic copy costs, cost imposition for computer forensics analysis, testability, Fed. R. Civ. P. 26(b(2)(C) balancing test required for ESI production challenges based on undue burden; Fed. R. Civ. P. Rule 26(g) certification violation as basis for forensic examination of email server

This latest installment from the Covad v Revonet case in the U.S. District Court for the District of Columbia comes to us courtesy of U.S. Magistrate Judge John Facciola. Before the Court were three issues for decision: Whether plaintiff should be allowed to conduct a forensic search of defendant’s computers; how the computers should be searched and last but never least, which party should bear the cost in connection with the forensic analysis.

Some context is appropriate here, and Magistrate Judge Facciola sums it up better than anyone else:

“…Revonet used a database called the Federated Database to house all of its sales lead information regardless of the source. Covad has alleged that Revonet took sales lead data-stored in the Federated Database-that belonged to Covad and gave it to other customers.” Covad Communications Co. v. Revonet, Inc., --- F.R.D. ----, 2009 WL 1472345, 1 (D.D.C. 2009)

The Court begins by noting that the database content as well as the evidence “within the database itself and elsewhere are at the very heart of this lawsuit.”

Blognote: This is the second time in two weeks that we’ve heard “heart of this lawsuit” or “heart of this litigation” Check out the Alaujan decision, below.

Database Search Protocol and Testability

The parties could not come to an agreement in connection with how the database was to be searched, and after attempts to negotiate as to how to search it failed, then brought the database issue to the Court. Each party then proposed its own proposal for searching the database, but the Court found them both wanting because of “untested factual assumptions.” This is one of the first decisions in which the notion of “testability” (which, in the opinion of this author and a rag-tag assemblage of others, is perhaps the critical element for determining the reliability of ESI) appears.

The Hearing - Defendant’s Expert

The Court set a hearing on the issue of database search, and heard expert testimony from both sides. Defendant’s expert testified that although he did not inspect the servers themselves, he did “spoke with a number of IT personnel” at defendant Revonet. Defendant’s expert testified that defendant had experienced a number of post-litigation commencement crashes, and further testified that “it would be risky to make a forensic copy of the servers because they are very old.” Defendant’s expert also estimated the cost to conduct the forensic copying at “$47,000, not including legal expenses associated with the actual forensic examination.”

The Court also states that Defendant’s expert makes no mention of individual computers:

“He [Revonet’s expert] did not discuss any individual computers, whether they exist, whether they should be imaged, or how much that might cost.” Id., 2009 WL 1472345 at 2.

The Hearing - Plaintiff’s Expert

The Court noted that plaintiff Covad’s expert, for his part, provided testimony contradicting Revonet’s expert’s assertions that a forensic analysis would be “extremely time consuming and expensive.”

Recall just above, how the Court mentions that defendant Revonet’s expert never discusses individual computers? Well, it turns out there was testimony from a defendant Revonet’s current “Director of Channel Sales Strategies” web-based access to the database from…individual computers.

Blognote: It is a bit hard to believe that defendant’s counsel was unaware of web based access to the database by individual computers, yet defendant’s expert discussed neither web based access nor individual computers in his testimony. Imo, “horizontal (my term) cooperation between counsel in discovery also requires in turn what I call “vertical” cooperation between counsel and client. Without such “vertical cooperation,” horizontal cooperation may be impeded, or even thwarted. Considered also in light of the Fed. R. Civ. P.’s continuing duty to supplement discovery responses, a failure by counsel, client (and expert) to cooperate might result in less than advantageous decisions from a court. Did that happen here? You can guess, but let’s first continue with the analysis.

The Court summary of plaintiff Covad’s expert's testimony:

“Finally, Covad called Scott Ellis, a forensic computer analyst, to testify as an expert witness. Ellis contradicted Purdue's contention that it would be extremely time consuming and expensive to make forensic copies of the drives. Ellis also testified that the fact that Revonet used a web-based interface for their salespeople to access the Federated Database was important because computers that access the Internet make temporary Internet cache files, so he would want to look at those PCs. He would also want to look at the PCs of IT Specialists who were moving data around. Ellis ultimately gave a rough estimate of $25,000 for the forensic investigation.” Id.

Takeaway: Forensic imaging pricing is not as monolithic as advertised.

Forensic Imaging and Forensic Search

First, kudos to M.J. Facciola for using the term “imaging” rather than “mirror imaging.” Modifying “imaging” with the word “mirror” is redundant at best, and capable of two meanings at worst.

The Court first distinguishes between conducting a forensic imaging, and conducting a “forensic search,” noting that the cost of forensic imaging small in comparison with the cost of searching the image itself, and determines that the creation of a forensic image benefits both parties:

“As an initial matter, Covad seeks to make forensic images of Revonet's drives and computers to preserve information as it currently exists. The expense associated with taking a forensic image is small compared with the cost of the forensic search itself and provides both parties and the Court with the best possible present depository of the crucial information in the database. The process is obviously not as time consuming as the forensic search itself and lessens some of the cost of forensic searching since the search can be done off-site rather than on the premises housing the servers or computers.” Id., at p. 4.

Further, it the Court takes a decidedly common sense approach to assertions of disruption:

“Any interference with business operations will be insignificant because I will require the searching to be done over a weekend.” Id.

Age Alone Does Not a Hard Drive Infirm Make

Ok, I admit to cutting my fair share of classics courses. Mangled English (mine) notwithstanding, the Court did not credit defendant’s expert opinion as to the riskiness of imaging a hard drive either at or even past its expected useful life:

While I appreciate that Revonet's servers are nearing or past their life span, I credit Ellis's testimony that age alone does not render the items so fragile that the process of taking the images will destroy the servers.” Id.

Magistrate Judge Facciola in what can only be described as impeccable logic, asserts that the defendant will in actuality benefit from the Court’s order directing such imaging. Well taken, for if defendant’s hard drives are so near to their demise, defendant Revonet would actually be taking a very potent disaster recovery pill – before the disaster occurs.

“Creating a forensic image is no more burdensome than using the server for everyday business activities and may ultimately benefit Revonet by creating a forensic record of its data before it uploads the data onto new servers, whether it rents the space (the so-called “cloud configuration”) or buys new ones.” Id.

Takeaway: Be very careful about what you wish your expert to emphasize. Oh, and file this under petard-hoisting; what not-to-do.

The Court also ruled that plaintiff’s expert would conduct both the forensic drive imaging as well as the search to conducted subsequent to that imaging. Remember those non-server type computers that were not discussed by defendant’s expert? Well, the Court remembered as well, and directed that

“Revonet shall permit Scott Ellis to make forensic images of inter alia, the following:

“… Personal Computers that interfaced with any of the above mentioned drives between the date when Covad and Revonet entered into a contract and December 31, 2006.” Id.

This means that, for defendant Revonet, the search party wasn’t quite over, and that it will need to disclose and present for forensic imaging any non-server type computer that may contain relevant ESI:

“If there is any dispute about whether a given computer was used during the relevant time period, Ellis shall make a forensic copy of the computer in any event and preserve it pending further order of this Court. The resulting forensic images will be safeguarded by Ellis who will preserve them inviolate. He shall only use these forensic copies of the devices or electronic depositories at issue to conduct forensic searches.” Id., at p. 5.

But wait, it gets better…

Forensic Searching

A little factual context is helpful here. Defendant Revonet “explained that its databases were housed in a back end database server, and that information was segregated by “campaigns” of which there were two involving Covad. Thus, defendant argued, the only campaign information to be searched should be restricted to the “two Covad campaigns.”

Not so, argued Covad. Plaintiff asserted that it needed full access to the forensic copies of the drives (we’ll come back to this point shortly):

“…[B]ecause [Covad] needs access to historical data about the database, not just the database itself. Much of that historical data will not be visible by looking at the database alone.”

Fed. R. Civ. P. Rule 34 Analysis

The Court begins with a discussion of the application of Fed. R. Civ. P. Rule 34 (request for production, inspection, etc., of documents and things) to electronically stored information, or ESI:

“Rule 34 permits a party to “copy ... electronically stored information” but is limited by Rule 26, which allows only for discovery of “any non-privileged matter that is relevant.”Fed.R.Civ.P. 26(b)(1).” Id.

Privileged vs. Confidential Information

Defendant Revonet apparently asserted that the information contained in the database (as well the database itself) was confidential, and therefore protected from disclosure in discovery. The Court then pauses for a short discourse on the difference between “privileged” information, which may, unless waived, be withheld from production, and “confidential information” which is not protected from disclosure by any privilege, but may be protected from public disclosure by way of well established judicially imposed restrictions:

"Rule 34 permits a party to “copy ... electronically stored information” but is limited by Rule 26, which allows only for discovery of “any non-privileged matter that is relevant.” Fed.R.Civ.P. 26(b)(1). FN2 Revonet does not argue that the information at issue is privileged, because it falls within a recognized common law privilege but only that it is confidential because it may expose information that Revonet is obliged by contract to keep confidential. Confidentiality is not a basis for withholding information in the ordinary course if it can be protected by a protective order (which I will gladly sign) restricting access to confidential information to certain persons and prohibiting its use for any purpose other than the limited purpose of the forensic copying and searching that I am ordering." Id.

Metadata Takes Center Stage

The Court’s next recognizes the importance of metadata as evidence qua evidence (and in this matter, critical evidence) rather than information that may be used to authenticate other evidence:

“Furthermore, the testimony of Purdue and Ellis suggests that there will likely be pieces of information located on the server but outside of the Federated Database that would tend to show what Revonet did with the data because of the way that SQL databases usually work and how the electronically stored information was used by Revonet. As I have explained, that information is certainly relevant. Indeed, it is the very heart of this lawsuit.” Id.

Blognote: And so, the transmogrification of metadata from “without value” (Sedona, pre-2008) to Aguilar v. DHS (2008)…to Covad. Imo, the definition of metadata has always been relational, and plastic. Data about data means more than “embedded,” “application,” or “system” metadata. What the Court in Covad supports is that, in the world of computer generated information, bits are bits. To a Word document, therefore, the Word program (the executable file) may be metadata. To the Word program, or executable file, the Word document is metadata.

Forensic Data Imaging

The Court next addresses the advisory committee’s comments to Fed.R. Civ. P. rule 34, which “cautions against making forensic examination the default,” noting, however, that the committee also “…encourages courts to ‘guard against undue intrusiveness’ Id.

The Court then provides some additional decisional authority heeding these cautions:

“Because these examinations raise issues of confidentiality and can produce thousands of documents that have to be reviewed for relevance and privilege, “compelled forensic imaging is not appropriate in all cases, and courts must consider the significant interests implicated by forensic imaging before ordering such procedures.” John B. v. Goetz, 531 F.3d 448, 460 (6th Cir.2008); see also White v. Graceland Coll. Ctr. for Prof. Dev. & Lifelong Learning, Inc., No. 07-CV-2319, 2009 WL 722056, at *7-8 (D.Kan. Mar. 19, 2009) (quoting Advisory Committee Notes to 2006 amendments for the proposition that forensic imaging is not appropriate in all cases and noting that courts permit imaging when there is trade secret or electronic evidence at issue, or where discovery responses suggest some inconsistency or impropriety).” Id. at p. 6

Forensic Search Distinguished From Forensic Inspection – Where the Real Burden Lies

Magistrate Judge Facciola then discusses what appears to be a heretofore unaddressed issue raised by the language of Red. R. Civ. P. 34, and explains that Rule 34 speaks to forensic imaging only, and not forensic searches (or, perhaps more correctly, searches of forensic images):

“The precise scope of the limitations suggested by the 2006 Amendment to Rule 34, as it applies to forensic inspection of a relevant object as opposed to a forensic search for documents, is unclear because the sections of that Rule denominated “Procedure” do not specify what, if any requirements, must be met before a court permits the inspection.” Id., at p. 6

The Court notes, however, that an ESI discovery request must, like any other discovery request, meet the requirements of Fed. Rule Civ. P. Rule 26, carrying with it the requirements in turn that, in the absence of good cause shown by a requesting party, a producing party may not provide ESI based on accessibility based assertions of burden or cost:

“The request must, however, be a request “within the scope of Rule 26(b).” Fed.R.Civ.P. 34(a).”

"Rule 26(b)(2)(B) provides that a party “need not provide discovery of electronically stored information from sources the party identifies as not reasonably accessible because of undue burden or cost.” Despite that showing, the court may nevertheless order discovery from such sources if the demanding party shows good cause. Id. In making this determination, the court must “consider the limitations of Rule 26(b)(2)(C).” Id. Those limitations are, of course, those that pertain to all discovery, whatever form it takes, and require a court to limit the extent of discovery if it determines that (1) the discovery sought is unreasonably cumulative or duplicative or can be obtained from other sources that are more convenient, less burdensome or expensive; (2) the requesting party has had ample opportunity to obtain the information by other discovery; (3) “the burden or expense of the proposed discovery outweighs its likely benefit, considering the needs of the case, the amount in controversy, the parties' resources, the importance of the issues at stake in the action, and the importance of the discovery in resolving the issues.” Fed.R.Civ.P. 26(b)(2)(C). Since the latter rule pertains to all discovery, whether forensic inspection of an object under Rule 34(a)(1)(A) should also be viewed through the prism of the data on it not being reasonably accessible under Rule 26(b)(2)(B) (that requires good cause to search for data that is not reasonably accessible) is of little moment.” Id.

Fed. R. Civ. P. Rule 26(b)(2)(C) Balancing Test Required to be Undertaken Where Challenges to Forensic Imaging Based On Undue Burden Are Made

This is hard (for me) and took several readings to understand. Or to believe I understand. The Court appears to take the position that while a showing of good cause may be required to defeat an assertion of undue burden for ESI production, a court’s determination involving such assertions (involving even what is reasonably accessible) “must” take into account the limitations of Fed. R. Civ. P. Rule 26(b)(2)(C).

“As a form of discovery, forensic inspection is unquestionably subject to the balancing required by Rule 26(b)(2)(C) whenever any discovery is challenged as an undue and unnecessary burden. I am therefore required to use that calculus to ascertain whether the forensic imaging should be permitted.” Id.

Got that?

Fed. Rule 26 (b)(2)(C) Balancing Analysis

Keep in mind that defendant Revonet did challenge plaintiff Covad’s request to forensically search defendants Federated Database server, and in support of its assertions, argued that:

(1) The servers in question were old and might crash;
(2) Defendant Revonet’s business would be disrupted while the search is conducted; and
(3) The requested search would disclose information that is subject to confidentiality agreements with other Revonet clients.

The Court wasn’t buying, and easily addresses each in turn. Note Magistrate Judge Facciola’s ability to zero in with laser like accuracy on arguments that while appearing to be facially supportable, are in essence spun with gossamer cloth. Nor does the Court mince words (or spend many) in making short shrift of defendant’s argument:

“None of these arguments are compelling. The searches will be done on copies of the forensic images, so the servers themselves will not be affected after the initial copies are made. The search will be conducted on the weekend and concerns about confidentiality can easily be alleviated through a protective order.” Id.

Blognote: It appears that defendant was perhaps a wee bit disingenuous in asserting that the search (rather than the creation) of the forensic images would threaten the stability or operation of the servers themselves. That said, I’m not sure why the Court felt the need to order that the search of the images be conducted on a weekend. By implication, there can be no disruption of business by the search of an image, rather than a search of the server itself, but I suspect the Court sought to forestall future additional assertions of burden. Defendant’s insistence that the search would result in the disclosure of non-party information subject to confidentiality agreements is also somewhat surprising, since (as the Court notes) these types of issues are typically and routinely addressed by protective orders.

Ok, back to Covad. Recall that the Court embarked upon a balancing analysis required by Fed. R. Civ. P. Rule 26(b)(2)(C). The balancing determination for defendant Revonet was made in just four sentences.

Not a good sign for defendant Revonet. Neither is the balancing analysis performed by the Court in determining plaintiff Covad’s need. The Court starts off with an ominous (for Revonet) determination-followed-by explanation. First, the determination, consisting entirely of a single sentence:

“On the other hand, the “needs of the case ... the amount in controversy ... the importance of the issues at stake in the action, and the importance of the discovery in resolving the issues,” Rule 26(b)(2)(C)(iii), surely establish that the potential benefit of the forensic search outweighs its burden.” Id.

Sole Source of Information Equates to No Alternative Method to Obtain Evidence

That the information sought could not be obtained from any other source is perhaps the most significant factor in the Court’s Rule 26(b)(2)(C) determination:

"First, there is simply no other way in which to seek this information, and it should establish once and for all what Revonet did with the Covad data that was in the Federated Database. Indeed, the investigation may have a determinative impact on whether this case will survive.” Id., at p. 7

Interestingly enough, the Court notes that the forensic imaging and search may well result in accelerated resolution of the case. Indeed, the Court appears to acknowledge that the transformation role of ESI in modern litigation:

“If the forensic imaging shows little use of the data from Covad by Revonet, Covad's financial motivation to continue this lawsuit may disappear or at least lead to an early settlement. If, on the other hand, the data contradicts Revonet's assertions, made throughout the lawsuit, that Revonet made little use of the Covad data, then the shoe will be on the other foot. In either event, the data simply must be found and analyzed before the parties and the Court can get their hands around what this case is truly worth. It is simply one of those perhaps unusual cases where paradoxically “the amount in controversy,” “the likely benefit,” and the “needs of the case” can only be ascertained by permitting the discovery sought.” Id.

Forensic Imaging as Tool for “Speedy and Just” Conclusion to Litigation

This is one of the first decisions in which forensic imaging is viewed not as the deployment of a cannon to kill a fly, but rather as a tool to streamline rather than impair the litigation process:

“Second, while the issues at stake in this commercial controversy may be not be of interest to any one but these litigants, they still have a right to its speedy and just conclusion, which, in my view, will be advanced by the forensic imaging. I know of no other way to examine the data and how it was used by Revonet.”

"Third, while Revonet's complaints at the hearing that it is in difficult financial circumstances may have merit, the forensic searching may produce the information it needs to decide how much more of its resources (including money for legal fees) to devote to this case."

Balance of Fed. R. Civ. P. Rule 26(b)(2)(C) Factors Favors Forensic Imaging and Search

Result: The Court determined that:

“…[On] balance, I conclude that Revonet's objections to the forensic searching, while meritorious, are overwhelmed by the necessity of the forensic searching that I am ordering.” Id.
Author’s Note: It should be kept in mind that forensic imaging (as contradistinguished from forensic search) is inexpensive, and getting less expensive on a per gigabyte basis. (As for search, tools are available to conduct ESI searches that are orders of magnitude cheaper than the “print and search” approach)" Id.

Forensic Examination of Email Servers

Plaintiff Covad also sought leave for permission to conduct a forensic examination of defendant Revonet’s email servers, providing three assertions in support therefore:

“(1) Revonet's e-mail production was facially incomplete;
(2) Revonet's email production suggests that it was using e-mail to give leads to clients; and
(3) Revonet's servers failed after litigation was initiated but before discovery commenced in earnest.”

The Court notes that allegations of deficient email production are legion, and then provides us with an excellent overview on when, and under what circumstances, a forensic examination of an email server will be permitted by a court:

"There is certainly authority for the proposition that if a party's e-mail production suggests that she is intentionally hiding things, or failing to take appropriate steps to respond to discovery, a forensic examination may be appropriate. Preferred Care Partners Holding Corp. v. Humana, Inc., No. 08-CV-20424, 2009 WL 982460, at *14-15 (S.D.Fla. Apr.9, 2009) (allowing forensic exam at producing party's expense because of discovery failings, inconsistencies and defendant's “print and purge” campaign); Peskoff v. Faber, 244 F.R.D. 54, 59 (D.D.C.2007) (allowing forensic examination because documents were conspicuously absent in certain time periods and
circumstances suggested that absence was the result of party's misconduct).” Id., at p. 8.

The Court also mentions that the right to forensic email examination is neither automatic nor unlimited:

“However, it does not automatically follow that every time a litigant alleges that the other party's electronic production is deficient in some regard the appropriate next step is to conduct a forensic examination. See Exec. Air Taxi Corp. v. City of Bismark, N.D., 518 F.3d 562, 569 (8th Cir.2008) (finding no deficiency with e-mail production to warrant forensic examination; party's mere suspicion not enough); Sup. Prod. P'ship v. Gordon Auto Body Parts Co., Ltd., No. 06-CV916, 2009 WL 690603, at *2-3 (S.D.Ohio Mar. 12, 2009) (refusing to allow forensic search as a sanction for discovery misconduct where party seeking exam had not provided any evidence that relevant e-mails had been lost or destroyed by inadequate litigation hold).” Id.

Poor Records Management Practices Alone Do Not Provide Basis for Forensic Email Server Examination

The Court make the point that poor records management does not, standing alone, provide the basis for granting leave to conduct a forensic examination of a party’s email servers.

“It is the rare case that a litigant does not allege some deficiency in the production of electronically stored information, particularly e-mail. All too many entities lack records management policies that are aggressively enforced, and records keeping may be a function not of an enterprise wide policy but determined by the idiosyncratic habits of the various users. In such a situation, the possibility that one user saved everything while another saved nothing may lead to curious gaps in the e-mails that are produced and an inability to explain why any are missing."

"While such productions cast little glory on the companies that produce them, I cannot find any authority in the cases to date that permit a court to conclude that allegations of deficiencies in themselves automatically require a forensic search whenever a party claims that there are, for example, fewer e-mails from a person or about a subject or transmitted in a given time than the party expected to find. This would result in forensic examinations in virtually every case, which would increase the cost of litigation involving electronically stored information markedly not only because of the cost of the examination itself, but also because it would yield information that would have to be sorted for relevance and privilege. Experience shows that the latter, involving expensive reviewing of “e-mail strings” by lawyers, paralegals or by vendors to whom the work has been outsourced, may dwarf the cost of the search.” Id.

Forensic Examination of Email Servers Require Assertion of Fed.R. Civ. P. Rule 26(g) Certification Violation

In what again appears to be a first, the Court imposes a requirement that a party seeking a forensic examination of another party’s email server must first assert that the producing party violated its Fed. R. 26(g) certification obligation:

“Fear of the consequences of consistently ordering forensic searches of e-mail servers should, at a minimum, require a showing that permits the finding, albeit based on circumstantial evidence, that the producing party has not complied with Rule 26(g) because the production is not “complete and correct as of the time it was made.” Fed.R.Civ.P. 26(g)(A).” Id.

Blognote: A Fed. R. Civ. P. Rule 26(g) certification violation can result (and in at least one other case has resulted) in sanctions to both counsel as well as client. See In re Simonson, 2008 WL 4830807 (Bktpcy. W.D. Wash. 2008) digested in EDDE 3).

Failure of Counsel to Cooperate Influences Court’s Forensic Examination Determination

Plaintiff Covad alleged that defendant Revonet’s email production was deficient, arguing that only four “external” emails had been produced. Plaintiff also “identified various deficiencies with search terms.”

On this issue, however, the Court made some ungentle observations about counsel’s failure to cooperate in connection with search term and protocol development, noting in particular that defendant Revonet asserted that Covad failed to respond to Revonet’s repeated requests that Covad suggest search terms.

"As evidence of Revonet's alleged shortcomings, Covad identified e-mails that had been produced recently, noted that only four external e-mails had been produced, and identified various alleged deficiencies with search terms. Notably, however, Revonet asked Covad's counsel repeatedly to suggest search terms, and Covad's counsel did not respond to any requests. Given that history it is unfair to allow Covad to fail to participate in the process and then argue that the search terms were inadequate. This is not the kind of collaboration and cooperation that underlies the hope that the courts can, with the sincere assistance of the parties, manage e-discovery efficiently and with the least expense possible. See The Sedona Conference Cooperation Proclamation (2008), available at http://www.thesedonaconference.org/content/tsc_cooperationproclamation.” Id., at p. 9

Result: The Court deferred its decision on forensic examination of certain email servers until the forensic examiner provided his report.

Forensic Examination of Email Server Ordered

The Court did permit the forensic examination of certain of defendant Revonet’s email servers. The Court’s first observed that one of defendant Revonet’s email servers crashed after litigation had been commenced, and that no backup had been made.

“The original Revmail one server that once resided in Sioux Falls crashed after this case had been filed, and there were no back-ups. Revonet had a responsibility to take reasonable steps to preserve relevant information once it had notice of litigation. While the destruction of e-mails here was clearly inadvertent, Revonet has a responsibility to take appropriate steps to try to recover those e-mails, and it is not clear that it has ever done so. Orrell v. Motorcarparts of Am., Inc., No. 3:06-CV-418, 2007 WL 4287750, at *7 (W.D.N.C. Dec. 5, 2007) (“The fact that plaintiff's home computer allegedly ‘crashed’-as opposed to having been ‘wiped’ as the work laptop was-in no way eliminates the Plaintiff's burden to do all she could under those circumstances to preserve evidence.”).” Id.

Bad juju. But wait, there’s more (and “more” email servers to boot):

Defendant’s “Retired” Email Servers

“There was no evidence presented regarding what efforts Revonet took to extract data from the two e-mail servers that have since been retired, particularly the first one, which crashed completely. Because we need to determine what, if any, data was lost before evaluating what effect the server crash had on the adequacy of production, Ellis should first examine the forensic images of Revmail one and Revmail two to determine whether it is possible to do a forensic search of either of them." Id.

Think you perhaps that your client’s assertions that certain of its email servers have crashed, or that certain other of its email servers are just too old and infirm to forensically image and examine, will stand against an assertion of deficient email production? Maybe, but maybe not, especially where a comparison of all available email servers might complete what might otherwise comprise an incomplete production:

“The only e-mail server that is currently operational at Revonet is Revmail. Thus, Revonet's document request responses would have come from searches run on Revmail. Revmail one and Revmail two were both in operation during the time when Covad and Revonet were working together. Thus, it is very possible that there were e-mails created during the time that Revmail one and Revmail two were operational that would be relevant to this case. What is not clear, however, is the degree to which data may exist on Revmail one or Revmail two that was not transferred to Revmail. Thus, a comparison should be made between Revmail one and Revmail and between Revmail two and Revmail to determine what, if any, data exists on the non-operational servers that does not exist on Revmail. These comparisons should yield the universe of e-mails that have not yet been considered for production (if Revmail one and Revmail two can be searched in their present states).” Id.

Yowch.

Individual PC’s Join The Search Party

Gee. We always speak of servers, and networks, and other such grandiose terms, but when the rubber hits the road, a mere PC almost always appears on the scene, and this case is no exception. The Court also directed the forensic examiner to image individual PCs, although it is unclear whether or not these PCs are networked:

"Like the Federated Database, the individual PCs are relevant because they may contain information that demonstrates how the relevant data was used at Revonet. Accordingly, Ellis shall create a forensic image of each PC and conduct a search of it to ascertain if it contains data that would tend to show

(1) Revonet's receipt of information from Covad, or
(2) Revonet's modification of the information from Covad, or
(3) Revonet's use of the information from Covad in the period
(a) from the date of the contract between Covad and Revonet until December 31, 2006, or
(b) from the date of the contract between Covad and Revonet to the present.

If he finds indications that such data exists, he shall report to the parties what indications he has found and whether he believes additional searches will yield additional data.” Id., at p. 10.

Costs and "Outcome-Determinative" Technology

The Court then addresses the issue of ESI discovery costs. The Court first relies on District Judge Scheindlin’s decision from the Zubulake decision set in noting that the producing party typically bears the cost of production:

“It has long been the presumption in this country that the producing party bears the cost of production and “[a]ny principled approach to electronic evidence must respect that presumption.” Zubulake v. UBS Warburg, LLC, 217 F.R.D. 309, 317 (S.D.N.Y.2003). “ Id., at p. 11

The Court, while recognizing that the cost of ESI production may increase as new technologies enter the eDiscovery arena, also recognizes that such technologies may provide evidence that is “outcome determinative.”

That said, the Court determines that the financial burden imposed by the cost of production in this matter are small, and requires that the producing party (defendant Revonet) bear the costs of production:

“Fortunately for me, the financial burden of “producing” electronic information in this case is relatively low, and I will require Revonet to bear that cost. When I say “producing,” however, I am referring to the costs of satisfying Revonet's obligations under the Federal Rules of Civil Procedure to either (1) make items available for examination, or (2) produce documents. See Fed.R.Civ.P. 34.” Id.

Stay tuned for further developments.

***********
Case: In re Application for Search Warrant
Citation: Mag. No. 09-320 (D.D.C. 2009)
Date: 2009-06-04
Topics: Criteria, bases for permitting search of computer, 4th Amendment

This decision is not a perfect fit into either an eDiscovery or digital evidence slot, but as it discusses computer searched within a criminal procedure context, it may be of interest to criminal procedure fans.

Here, Magistrate Judge Facciola opens up with a statement of concern about computer searches in a criminal procedure context. It appears that, from a magistrate judge’s perspective, the battle royale is always permission and scope against time. In other words, in an instance such as this, a judge is placed in the unenviable position of making a quick decision, because delay may result in destruction of evidence, and moot the issue.

“The questions of the proper scope of a search of a computer and the necessary showing to secure the search continue to trouble me. Unfortunately, the questions frequently arise on an emergency basis because the search must be conducted quickly if it is to be effective and prevent the obliteration of the data because the object of the police investigation suspects that the police may be coming.”

In this decision, M.J. Facciola was asked to reconsider his decision striking (1) a demand for the right to search all electronic storage devices and disks, and (2) to search “computers, software, hardware . . . to include any and all computer equipment . . .

The government’s bases for the request for reconsideration were that defendant had apparently used a word processing program to type a document in the first instance, and a reference to the sending of an email in the second. The Court notes that “other than these two indications” there was no indication that the alleged conspirators had used email to communicate with each other or using the computer to advance the conspiracy charged. To the contrary, the Court states:

“[T]he warrant application indicates that the conspirators advanced their purposes by speaking on the phone or in person.”

Mere Use of a Computer, Without More, Insufficient Basis to Grant Forensic Search of Computer

The Court’s take on the scope of the search requested is significant and imo, may also have privacy ramifications:

“In my view, the mere use of the computer on two occasions does not justify the intended forensic search of the entire computer and all peripheral storage devices. To conclude otherwise would mean that the government would have the right to search the memory of the computer and the storage devices not merely for the information they have probable cause to believe might be evidence of a crime, i.e., the e-mail and document referred to in the application, but for all the information they contain merely because there was use of the computer on two occasions. Without proof of a consistent use of the computer to communicate or otherwise advance the conspiratorial scheme, it cannot be said that the computer is being used as an instrumentality of a crime.”

Use of Computer for One Purpose Does Not Open Door to Forensic Examination of All Computer Contents

The Court rejects the premise that the use of a computer for purpose “A” opens the door to a forensic search of the computer for evidence of use for purposes other than “A”

“While it could be said that use on two occasions might suggest greater use, allowing the search on that basis leads ineluctably to the conclusion that the presence of a computer in certain premises and its use on a few occasions is an always permissible basis for a forensic search of its entire contents. I cannot accept that proposition for it appears to me to be the very general search that the 4th Amendment prohibits. It proceeds upon the premise that I reject: that use of a computer for one purpose provides justification not merely for other evidence of its use for that purpose but to search its entire contents.”


***********
Case: Capitol Records, Inc. v. Alaujan
Citation: 2009 WL 1292977 (D. Mass. 2009)
Date: 2009-05-06
Topics: Forensic imaging permitted where computer itself is at heart of litigation, privacy concerns, expert examination order

We can see a theme running through computer forensic examination challenge decisions, and that, succinctly put, a forensic examination (including imaging and search) will be permitted where the computer, or hard drive, is “at the heart” of the litigation.

In this copyright infringement case from the United States District Court for the District of Massachusetts (which predates the Covad decision, above) U.S. District Judge Gertner rules on defendant’s motion for a protective order involving a laptop and a desktop computer.

Here, plaintiffs sought to inspect defendant’s computers by way of creating forensically sound images of the hard drives of both defendant’s laptop and desktop computers:

“In particular, they seek to examine the two computers for evidence supporting their infringement claims by creating mirror-images of the hard-drives, which involves making an exact copy of the full contents of each drive for inspection by a forensic computer expert. Importantly, the computer that was originally used to download the songs identified by the Plaintiffs in the Complaint has been discarded or destroyed. Instead, the computers at issue were subsequently owned by the Defendant and, as Tenenbaum has conceded, were also used for file-sharing activities.” Capitol Records, Inc. v. Alaujan, 2009 WL 1292977, 1 (D. Mass. 2009)

Interestingly enough, plaintiffs apparently offered little or no opposition to defendant’s motion for protective order as it related to the laptop, and the Court denied plaintiff’s request in connection therewith.

In their opposition to the Motion for a Protective Order, the Plaintiffs barely address the Toshiba laptop; as a result, the Court sees no reason to permit its inspection.” Id.

Takeaway: If you request a forensic examination of a computer, be prepared to justify that request, and be well prepared in the face of the inevitable motion protective order.

So, this dispute centered on defendant’s desktop computer, which he took to college after engaging in alleged file-sharing on his parents’ home computer. Defendant admitted to using the computer for file-sharing activities.

Relevance as Basis for Permitting Forensic Examination of Computer

Plaintiffs argued in support of a broad search forensic search premised upon Fed. R. Civ. P. Rule 26(b) wide scope based upon notion of relevance:

“[Plaintiffs] argue that such evidence is relevant to the claims stated in the Complaint under Fed .R.Civ.P. 26(b) because it bears on where the identified songs were uploaded and potentially transmitted; and because it contains data likely to lead to admissible evidence of the Defendant's continuous and willful copyright infringement by virtue of his subsequent file-sharing.” Id.

Defendant, for his part, challenged plaintiffs’ assertions with the standard and now routine assertions of burden, privacy, and attorney client privilege.

“The Defendant objects that such disk-imaging is overbroad, unduly burdensome, would violate his privacy, and would jeopardize confidential attorney-client communications.” Id.

Imaging, Privacy Concerns, and the “Heart of Litigation”

The Court here first concedes that imaging (the Court uses the term “mirror” --- it’s ambiguous, and largely incorrect) of a computer hard drive raises privacy concerns, but that these concerns are overshadowed where the computer itself is at the center of litigation:

“While mirror-imaging poses serious privacy concerns, where the computer itself is at the heart of the litigation-where it is, in effect, an instrumentality of the alleged copyright infringement-it is plainly relevant under Fed.R.Civ.P. 26(b). This is particularly so given Tenenbaum's admissions and the scope of his defenses. The Gateway computer is one of the very devices used by the Defendant for file-sharing, as he admitted at his deposition. See Ameriwood Industries, Inc. v. Liberman, 2006 WL 3825291 at *4 (E.D.Mo.2006) (“[A]llegations that a defendant downloaded trade secrets onto a computer provide a sufficient nexus between plaintiff's claims and the need to obtain a mirror image of the computer's hard drive.”). His inability to remember relevant details of this file-sharing and his inconsistent discovery responses further open the door to the mirror-imaging that Plaintiffs seek.” Id.

Drive Imaging and Privacy Concerns

First, lest there be any doubt, a court has the authority to order the imaging of a computer drive. That said, it is interesting that the Court (the Massachusetts federal court) needs to reach out to district court decisions from Kansas and the Eastern District of California for authority:

“The Court has the authority under Fed.R.Civ.P. 34 and 26(b) to order mirror-imaging of a party's hard drive. See Balboa Threadworks, Inc. v. Stucky, 2006 WL 763668 (D.Kan.2006); Ameriwood Industries, 2006 WL 3825291; Communications Center, Inc. v. Hewitt, 2005 WL 3277983, at * 1 (E.D.Cal.2005).” Id.

Sufficient Nexus Between Computers and Claims Must Exist to Permit Imaging

What is of greater concern to the Court are defendant’s privacy interests in his computers, and District Judge Gertner notes that:

"The principal issue in these cases centers instead on concerns for defendants' privacy, especially where “the connection between the computers and the claims in the lawsuit are unduly vague or unsubstantiated in nature.” Balboa Threadworks, 2006 WL at *3. In the instant case, the Court finds that there is a sufficiently close connection between the Gateway computer, but not the Toshiba laptop, and the claims in this lawsuit.” Id.

While claims of privacy may be routinely asserted in a challenge to a request for a forensic imaging of a computer, such claims are routinely (and with increasing frequency) addressed with an appropriate protective order:

“It further concludes that the Defendant's privacy objections can be addressed through a robust protective order, as described in detail below. See Ameriwood Industries, 2006 WL 3825291; Arista Records, Inc. v. Tschirhart, Case No. 05-CA03720G, slip op. (W.D.Tex. Jan. 25, 2006) (ordering mirror imaging of file-sharing defendant's hard drive with protective order to preserve confidential and privileged information from disclosure).” Id., at p. 2.

That said, the Court determined that Plaintiffs’ proposed protective order was inadequate to protect defendant’s privacy concerns, which apparently were well articulated by defendant’s counsel:

“Mindful of the potential exposure of non-relevant personal information occasioned by mirror-imaging, the Court allows this discovery only subject to a Protective Order consistent with the terms provided below. The very technological reasons that necessitate a mirror-image of the entire hard-drive-i.e., the manner in which digital information is stored on the computer and the way in which “deleted” files are retained-also makes Plaintiffs' Proposed Protective Order markedly insufficient in light of the Court's substantial privacy concerns. See Decl. of Dr. Doug Jacobson, Exh. F to Pl. Opp. to Protective Order (document # 682-2). Because ‘deleted’ but non-relevant files no longer remain in the operating system's directory, the Defendant would be unable to designate them in the privilege log proposed by Plaintiffs.”

“Moreover, the categories of documents slated for exclusion by the Plaintiffs-attorney-client communications, student grades, unpublished research, and medical records-are woefully inadequate to cover the range of non-relevant personal information likely stored on the hard-drive.” Id.

The Rigorous Computer Forensic Examination Procedure

The Court adopts the Eastern District of Missouri’s Ameriwood approach in ordering a “more rigorous procedure” to be undertaken in connection with the forensic examination of defendant’s computer. The procedure is well articulated, and set forth in its entirety:

“A more rigorous procedure is provided here, as adapted from that used by the district court in Ameriwood Indus. Inc. v. Liberman, 2006 WL 3825291, at *4 (E.D.Mo.2006):

1. Plaintiffs shall select a computer forensic expert of their choosing to produce a mirror-image of the Gateway computer's hard-drive.”

2. The Expert and any assistants assigned to the computer inspection shall execute a Confidentiality Agreement agreed to by the parties and shall sign a copy of and abide by the Protective Order in place in this action.

3. The Defendant shall make the Gateway computer available to the Plaintiffs' Expert at his counsel's office at a mutually agreeable time within 10 business days of the approved Protective Order. The Expert shall make a mirror-image of the Gateway computer's hard-drive, a process which should require no more than several hours. He or she may not remove the Defendant's computer from the premises.

4. Only the Expert and his or her assistants assigned to this project are authorized to inspect, or otherwise handle the Defendant's computer or the mirror-image generated. No employee of the Plaintiffs, or their counsel, will inspect or otherwise handle the mirror-image produced. The Expert will also maintain all information in the strictest confidence. Furthermore, the Expert will maintain a copy of the mirror images and all recovered data and documents until 60 days after the conclusion of this litigation.

5. The Expert shall examine any recoverable file-sharing data on the mirror-image, including electronic records generated by file-sharing software and “metadata” associated with music files. Recoverable data includes ‘deleted’ files that no longer appear in the operating system's directory.

6. The Expert shall not examine any non-relevant files or data, including those belonging to the following categories: emails, word-processing documents, PDF documents, spreadsheet documents, image files, video files, or stored web-pages. On their face, none of these types of electronic files appear to have any established relevance to Tenenbaum's use of file-sharing software or allegedly infringing activities. As an added precaution, the Defendant shall also be permitted to designate any attorney-client communications or privileged work-product files in a Privilege Log provided to both the Expert and the Plaintiffs' counsel prior to inspection. These files shall be immediately deleted from the mirror-image by the Expert and, under no circumstances, may they be opened or their contents examined by the Expert.

7. Based on this inspection of the mirror-image, the Expert shall produce a report which describes the music files found on the computer and any file-sharing information associated with each one, as well as any other records of file-sharing activity. The report may also address any evidence that the hard-drive has been “wiped” or erased since the initiation of this litigation.

8. The Expert shall disclose this report only to the Defendant's counsel, who will have five business days to lodge any objections to the report based on privilege. Any such objections shall first be communicated in writing to Plaintiffs' counsel. If the parties cannot resolve any dispute themselves, the Plaintiffs shall file a Motion to Compel the production of the Expert's report. If there is no dispute, or the parties reach an agreement themselves, the Defendant shall promptly disclose the Expert's report to the Plaintiffs.

9. In resolving any Motion to Compel, the Court may require the Defendant to submit the Expert's report for review in camera. Id., pp. 2-3

***********
Case: Argus and Associates, Inc. v. Professional Benefits Services, Inc.
Citation: 2009 WL 1297374 (E.D.Mich. 2009)
Date: 2009-05-09
Topics: Meet and confer obligations, discovery plan, and sanctions

This decision from the U.S. District Court for the Eastern District of Michigan serves as a reminder that the courts are becoming increasingly impatient with counsel who, in the course of conducting discovery, fail to cooperate, or fail to provide an adequate discovery plan as required be Fed. R. Civ. P. Rule 26(f)(2) and Rule 26(f)(3)(C).

In ruling on the instant motion to compel, U.S. Magistrate Judge Hluchaniuk was less than impressed by the conduct of both plaintiff and defendant. In sum, plaintiff claimed that defendant had not disclosed the existence or availability of defendant’s web site that plaintiff now asserted was relevant to its claims of contract and other statutory breaches.

The first dart was aimed at the plaintiff. It seems that 10 months was a bit long to assert the need for, but not retain, the services of an expert:

“The record does not support plaintiffs' claim that they acted with due diligence regarding discovery in this case. A plaintiff has an affirmative duty to prove its case and should not file a complaint without some reasonable basis for doing so. As late as December of 2008, approximately 10 months after the complaint was filed, plaintiffs were still saying they needed the services of an expert to identify the instances in which they claim defendant breached some duty to process medical claims of plaintiffs' employees. If plaintiffs intended to rely so heavily on the services of an expert witness to prove their case, they should have retained the expert much earlier in the process than they did.” Argus and Associates, Inc. v. Professional Benefits Services, Inc., 2009 WL 1297374, 2 (E.D.Mich. 2009)

As for the defendant, the Court started off somewhat lightly, noting that there was no “real basis” for plaintiff’s claim that defendant misled them about the defendant’s web site:

“Further, there is no real basis for the claim that defendant misled plaintiffs with respect to the availability of Medi-Web. As pointed out by defendant, their responses to discovery requests identified the existence of the Medi-Web system and plaintiffs' experience with the system before the litigation made them aware of the system.” Id., at p. 3.

The defendant does not escape without some pointed criticism about its discovery behavior:
“While defendant did not intentionally mislead plaintiffs with respect to the availability of the Medi-Web system, its conduct in making the system available to plaintiffs was not exemplary. Parties to civil litigation are required to meet and confer with respect to discovery. Fed.R.Civ.P. 26(f).” Id.

The Court then joins with many of its sister district courts in reminding counsel that, yes, there is a duty to meet and confer, there is a duty to discuss a discovery plan, and yes, ESI discovery discussions are required to take place in satisfaction of these obligations. Here, the Court focuses its ire on both parties:

“The parties are required to “develop a discovery plan” that would reasonably include “disclosure or discovery of electronically stored information, including the form or forms in which it should be produced.” Fed.R.Civ.P. 26(f)(2) and (3)(C). Developing a reasonably complete discovery plan is the responsibility of both parties. The parties in the present case did not live up to the requirements of the rule. When the lawyers in this case conferred about discovery at the outset of the case, as the rule contemplates, the Medi-Web system, which clearly is within the definition of electronically stored information, should have been discussed and included in the discovery plan. It is the failure of the parties to do what the rule reasonably requires that brings us to this controversy.” Id.

Both parties in this case were at fault. Plaintiff, for its part, was tardy in responding to defendant’s discovery requests because it failed to retain the expert which it alleged was necessary to respond same. Defendant, for its part, failed to disclose the availability of a web site (now) alleged by plaintiff to be relevant.

The Court split the baby.

The plaintiff failed to disclose by a court imposed deadline (or seek extension thereof) in compliance with an order to compel, triggering the imposition of Fed. R. Civ. P. 37, the sanction for which would have been a limitation of proofs presented at trial in accordance with Fed. R. Civ. P. 37(a)(2)(B)(ii). Defendant’s actions, however, resulted in the moderation what would have been a more severe sanctions against the plaintiff:

“A court has discretion with respect to the imposition of sanctions where a party has failed to make disclosures. This Court informed plaintiffs that if the disclosures sought through the motion to compel were not made by January 16, 2009, the sanction to be imposed would be a limitation on the presentation of proofs at trial. This sanction is one available under Rule 37(b)(2)(A)(ii).” Id.

“Counsel for plaintiffs readily accepted this deadline and never attempted to obtain relief from that deadline when it became clear that the deadline would not be met. The undersigned believes that the sanction indicated in the December 31, 2008 order should generally be enforced. However, given the fact that defendant bears some of the fault for the Medi-Web information not being available at an earlier date, an exception will be made for any information relating to a breach of duty with respect to a claim processed by defendant that was not known to plaintiffs until after it had access to the Medi-Web system and only became known to plaintiffs as a result of access to Medi-Web.” Id.

“Plaintiffs will have the burden of proving that errors in processing of claims by defendant were either disclosed to defendant no later than January 16, 2009, or not known to plaintiffs until after, and as a result of, access to Medi-Web. Given the circumstances of this case and the above sanctions, no other sanctions will be imposed on any of the parties and costs or attorney fees will not be imposed.” Id.

Takeaway: Had defendant been more forthright, or better equipped to handle ESI discovery and disclosure, it might have been handed an “outcome determinative” evidentiary decision.

**********