The case: Defendants were former employees of Plaintiff company, and were alleged to have misused plaintiff’s proprietary client information, including a database, after leaving. Defendants, according to Plaintiff, used this information to solicit clients of their ex-employer in violation of the Computer Fraud and Abuse Act, the Connecticut Uniform Trade Secrets Act, the Stored Communications Act, and Connecticut common law’s prohibition of tortious interference with business relationships. Defendants asserted that they identified client information for solicitation through permissible means including internet searches and memory.
At Issue Here: Plaintiff filed a motion to compel defendants to submit their computers and media for production and inspection. Plaintiff further requested reasonable attorney’s fees and costs associated with its motion.
Discussion: Defendants productions in response to Plaintiff’s discovery requests, failed to include any e-mail, TJT’s Junxure client management database, or the Portfolio Center client invoicing database (allegedly stolen by Defendants). The Plaintiff sought the Defendants’ assurance that forensic imaging had been undertaken, noting concerns that relevant data was at risk of being erased through automatic deletion of temporary and inactive files. Defendants’ counsel conceded that the Defendants had no intention of imaging any of their computer devices, causing Plaintiff to file the motion to compel. After the Plaintiff filed its motion, Onsite IT Consulting performed imaging of TJT Financial’s computer devices and business laptops used by Defendants McMullan, Cook, and McFadden.
Pursuant to a subpoena, the Charles Shwabb Corp., a custodian of assets for TJT Financial, produced email correspondence from Defendant McMullan and Cook’s personal email account and computer that was not produced as part of the Defendants’ response to Genworth’s discovery requests. The correspondence reflects the Defendants’ submission of Genworth client data and information to Schwab, while still employed by Genworth, as part of efforts to establish TJT Capital and secure Genworth clients for the new entity.
During the proceeding, Defendant McMullan testified that, prior to the start of the instant litigation, he discarded the personal computer onto which he downloaded ACT client information and from which he conducted correspondence with Schwab in anticipation of his departure from Genworth and the formation of TJT Financial. Testimony further reflected however, that the disposal of the personal computer may have occurred after Genworth submitted letters to the Defendants to preserve all relevant documents in anticipation of litigation.
Court’s Analysis: The court began by noting that Rule 34 and Rule 26(b)(2)(B) “strongly suggested” that on such requests is discretionary and should take into account substantive considerations of the burden and expense of the request. . . . and that such relief is entirely within the discretion of the Court to grant or deny.
Defendants contended that the Plaintiffs have “not proffered a sufficient basis with which to justify its demands.” The court referred to FRCP 26(b)(1), however, to quote the rule that a party is entitled to discover any unprivileged matter relevant to a party’s claim or defense, where the discovery “appears reasonably calculated to lead to the discovery of admissible evidence.”
Referring to Rule 34(a) the court noted that a party is required to “produce and permit the party making the request . . . to inspect, copy, test, or sample any . . . electronically stored information.” This right is counter-balanced, however, by a responding party’s confidentiality or privacy interests. A party is therefore not entitled to “a routine right of direct access to a party’s electronic information system, although such access might be justified in some circumstances.”
In defining the extent of discovery to afford to a party, a court should: consider the relationship between the plaintiff’s claims and the defendants’ computers and, in some cases, whether the defendant has fully complied with discovery requests, in determining how the requested electronic discovery should proceed. Even in cases where courts have nonetheless adopted procedures to protect privilege and privacy concerns (quoting Calyon v. Mizuho Securities USA Inc., No. 07 CIV0224IRODF, 2007 U.S. Dist. LEXIS 36961, 2007 WL 1468889, at *3 (S.D.N.Y., May 18, 2007).
The court found persuasive the opinion from Ameriwood Industries, Inc. v. Liberman, No. 4:06 CV 524-DJS, 2006 U.S. Dist. LEXIS 93380, 2006 WL 3825291, at *3, *6 (E.D. Mo. Dec. 27, 2006), amended by 2007 U.S. Dist. LEXIS 98267, 2006 WL 685623 (E.D. Mo. Feb. 23, 2007).
Courts have been cautious in requiring the mirror imaging of computers where the request is extremely broad in nature and the connection between the computers and the claims in the lawsuit are unduly vague or unsubstantiated in nature. For example, a party may not inspect the physical hard drives of a computer merely because the party wants to search for additional documents responsive to the party’s document requests. [A court has previously] declined to allow the examination of any ESI other than the information that had been deleted because the requesting party had not demonstrated that the producing party was unwilling to produce relevant evidence. [Evidence] raises the question of whether defendants have in fact produced all documents responsive to plaintiff’s discovery requests. Furthermore, in cases where a defendant allegedly used the computer itself to commit the wrong that is the subject of the lawsuit, certain items on the hard drive may be discoverable. Particularly, allegations that a defendant downloaded trade secrets onto a computer provide a sufficient nexus between the plaintiff’s claims and the need to obtain a mirror image of the computer’s hard drive.
The Ameriwood court therefore concluded that because the defendants were accused of using “the computers, which [were] the subject of the discovery request, to secrete and distribute plaintiff’s confidential information. How and whether defendants handled those documents and what defendants did with the documents [were] certainly at issue.” The court then adopted the Ameriwood three step protocol for imaging, discovery, and disclosure for hard drives.
Ameriwood Imaging and Production Protocol:
- Imaging:The parties select a computer forensic expert who, operating pursuant to a confidentiality agreement, inspects, copies and images the targeted computer systems at a “non-disruptive” time. The expert provides a detailed report of the “equipment produced and expected.”
- Recovery:The expert recovers, from the mirrored images, all available targeted file types. In Ameriwood, these consisted of word-processing documents, incoming and outgoing email messages, presentations, and files, including “deleted” files. The expert provides the recovered documents in a reasonably convenient and searchable form to the producing party’s counsel, with notice to the requesting party.
- Disclosure:Producing party’s counsel reviews the recovered files for privilege and relevance, supplements earlier responses, creates or appends to a privilege log, and produces relevant non-privileged documents to opposing counsel.
Post Process Note: The court is merely describing a micro version of any e-discovery review project, in which data must first be collected, filtered, reviewed, and finally produced. While the court describes the process as three steps, we prefer to break it down a little differently, as visually depicted in the figure below. Even with the slight increase in granularity below, we note that the process can continue be visually depicted in far more detail than we choose to do.
Neutral Forensics Expert Needed:
The court reasoned that the instant case was sufficiently analogous to Ameriwood to warrant using the imaging protocol. Factors present mandating the use of a neutral forensics expert included:
- One of the defendants used his personal computer and personal e-mail address to download, access, and transmit the Plaintiff’s proprietary information without a scintilla of a reasonable expectation to his entitlement thereto.
- One of the defendants admitted that he spoliated evidence when he discarded a personal computer after having been advised by counsel that he had no right to the data that he had downloaded whille employed by Plaintiff;
- Defendants’ testimony on handling electronic media and on how they had obtained the information at issue in the case had been impeached, indicating inaccuracy or deception on the part of defendant.
Cost-Shifting Analysis:
Producing party contended that they should not be forced to pay for the forensics expert, because they had already hired an expert (although they did not image the drives of the systems at issue here). They also claimed that they were unable to pay. The court was unconvinced by their arguments. The court noted that producing party had initially refused to image any of their systems, and only relented once the motion to compel had already been filed with the court. The motion to compel was only filed once producing party admitted they did not intend to image any of their systems. Their initial refusal was “wholly unjustified” as they “tacitly admitted” by their belated engagement of an expert. The court assigned the producing party 80% of the costs, and the requesting party 20%.
Conclusion:
The court ordered the following:
- Granted the Plaintiff’s motion to compel forensic imaging to be performed by a neutral court-appointed expert.
- Producing party was required to submit the targeted systems for inspection by a specific date.
- The expert is to format the targeted data types in an appropriate structure and provide producing party’s counsel access for privilege and responsiveness review.
- Cost is distributed, as described above, 80% for producing party, 20% for requesting party.
- Reasonable attorney fees awarded to requesting party, pending a detailed accounting of those costs.
- Further sanctions will be imposed should producing party again fail in their obligations.
Genworth Fin. Wealth Mgmt. v. McMullan, 267 F.R.D. 443 (D. Conn. 2010)
Post Process 