Advanced Criminal Investigations and Intelligence Operations

by Unknown

In this case, both parties requested a preservation order for documents

  to be used as evidence. Finding no definitive test outlining when to grant a preservation order, the district court formulated the following factors to consider: (1) the level of concern for the continuing existence and integrity of the evidence, (2) the possibility of irreparable harm to the party requesting the preservation order in the absence of a preservation order, and (3) the ability to maintain and preserve the evidence in question.

  The defendant’s motion was denied based on the fact that it could not

  show the likelihood that the material sought to preserve was actual y in

  danger of being destroyed. The plaintiff’s motion was denied because it

  would have been better filed as a motion to compel and did not even allege the possible destruction or degradation of the evidence, which it sought to preserve.

  The court discussed the third prong of electronic evidence, saying that

  evidence stored on a floppy disk or on a hard drive may not be hard to store, but that information contained within the hard drive may be difficult to store because of the possibility of degradation or deletion when new information is added and old information is deleted. The court went on to say that timing of a

  240

  Advanced Criminal Investigations and Intelligence Operations

  preservation order could be critical in those cases where preservation is difficult, especial y in cases where the person in possession of the hard drive is unaware that the information on the hard drive is evidence that needs to be preserved.

  Heriot v. Byrne, 2009 U.S. Dist. LEXIS 22552 (N.D. Ill. 2009); error in ESI production allows plaintiff to “claw back” documents.

  On cross motions to compel ESI production of documents related to

  a copyright infringement suit, the district court examined the application of Federal Rule of Evidence 502 in finding that the plaintiff’s disclosure was inadvertent and did not cause a waiver of the attorney–client privilege.

  The plaintiff alleged that the defendant’s made-for-TV documentary

  infringed its copyrights and unjustly enriched the defendant. In response to the defendant’s motion to compel ESI production, the plaintiff hired a vendor to electronically scan and provide optical character recognition for documents in its production. Due to the vendor’s error, 196 documents containing attorney–client communications were produced to the defendant.

  Within 24 hours of discovering the mistake, the plaintiff notified the defendant and the defendant sealed the documents for its motion to the court.

  The defendant argued that the plaintiff should not be permitted to claw back the documents in its ESI production. The parties disputed whether the newly amended Federal Rule of Evidence 502 applied and whether it would supersede the test formulated in the Seventh Circuit decision Judson Atkinson Candies, Inc., v. Latini-Hohberger Dhimantec, 529 F.3d 371, 387-88 (7th Cir. 2008).

  The court concluded that it must first determine whether the documents

  in question were privileged and then apply FRE 502. The Judson factors could, however, be used in the FRE 502 analysis.

  Here, the court examined the documents in question and found that

  the majority were protected by the attorney–client privilege. The court then applied FRE 502, finding that, even though a large percentage of the privileged documents were produced, the disclosure was inadvertent because the plaintiff used reasonable procedures to review the documents and the disclosure would not have occurred but for the vendor’s error. The plaintiff’s notice to the defendant was also reasonably prompt. Because the plaintiff had satisfied FRE 502, the court found that the disclosure did not waive the attorney–

  client privilege. Reasoning that it would be unfair to punish the plaintiff for a disclosure it neither caused nor anticipated, the court allowed the plaintiff to claw back the documents.

  United States v. Segal, 2004 WL 635065 (N.D. Ill. 2004); government ordered not to review defendant’s privileged electronic documents.

  The government seized 200 boxes of the defendant’s documents and a

  significant amount of the defendant’s electronic information, including several personal computers and backup tapes of the defendant’s payroll, fax, and accounting servers. The defendant moved for a return of all privileged

  Computer Forensics: Searches, Evidence, and Notice

  241

  information that was seized and to bar the government from using this information for any purpose. The motion was initially granted, but the court subsequently granted the government’s motion to reconsider.

  The court also ordered the defendant to create a privilege log. The

  defendant gave the court a privilege log containing 13,000 privileged communications. The defendants claimed that the government had reviewed

  privileged communications because it failed to use proper screening tech-

  niques. The defendant stated that the government could have screened the

  communications and separated out the privileged information by using

  commercial software or a third party. The defendant also pointed out that the government did not follow Department of Justice guidelines for searching seized materials.

  The court stated that for the defendant’s due process to have been vio-

  lated, the government’s violation of the defendant’s attorney–client privilege must “shock the court’s conscience.” The court laid out a three-part test to determine whether something shocks its conscience: (1) The government must have knowledge of the attorney–client privilege, (2) the government

  must make a deliberate intrusion into that relationship, and (3) there must be actual and substantial prejudice.

  The court held that although the government’s actions should not be

  condoned, they did not rise to a level that shocked the court, did not violate the defendant’s due process rights, and did not warrant the suppression of evidence that the plaintiff was seeking. The court did, however, order the government not to review documents from the privilege log or to present any of the documents from the privilege log without a court determination that those documents were not privileged.

  Portis v. City of Chicago, 2004 WL 1535854 (N.D. Ill. 2004); plaintiffs’

  electronic database discoverable as a “fact work product.”

  The plaintiffs filed a class action suit against the City of Chicago for

  detaining people for hours after the completion of administrative processes associated with noncustodial ordinance violations. The plaintiffs had created a database that organized the names and other information for individuals who would be considered as part of the class for purposes of the suit. The defendant filed a motion to compel access to this database, stating that it had a real need for the information and that it could not obtain the information in the database without undue hardship. Since the plaintiffs created the database in anticipation of litigation, the issue before the court was whether the database was fact work product or opinion work product.

  The court reasoned that since the information in the database was so

  extensive, it did not contain any specific insight into the plaintiffs’ legal strategy. Based on this, the court held that the database was fact work product and that sharing the database with the defendant would not seriously prejudice

  242

  Advanced Criminal Investigations and Intelligence Operations

  the plaintiffs. The court granted the defendant’s motion to compel and

  held that the defendants would have to split the costs of the creation of the database with the plaintiff.

  Notice

  Campbell v. General Dynamics Government Systems Corp. , 321 F.Supp.2d 142 (Mass. 2004); e-mail insufficient notification of mandatory arbitration for employee disputes.

  The plaintiff brought an action against his former employer alleging that he was wrongfully terminated due to his medical condition. T
he employer

  had the case removed to federal court and motioned to stay all federal court proceedings and compel arbitration pursuant to the defendant’s dispute

  resolution policy (DRP).

  The case turned on the issue of whether the defendant’s e-mail to its

  employees was sufficient notice that the employee would be giving up his

  right to use the federal judicial forum. The defendant offered an e-mail tracking log that showed that the plaintiff had opened the e-mail in question. The defendant offered this as evidence that the plaintiff had notice of the DRP.

  The plaintiff asserted that he had not read the e-mail and was not aware of the DRP.

  The court examined the e-mail and noted that the DRP was vaguely

  outlined in the bottom paragraph and that to get more specific information on the DRP, an employee would have had to click on the two links at the bottom of the message. The court noted that the defendant did nothing to verify that its employees had read or understood the e-mail and suggested that the defendant could have made its employees verify that they had read and understood the e-mail with a signature in the form of an electronic reply or an actual written signature. The court also said that the defendant could have had mandatory meetings with a sign in sheet where the DRP would be explained. The court ruled that the plaintiff did not have knowledge of the DRP and the defendant could not deprive him of his right to a federal judicial forum.

  As previously stated, you should always seek competent legal counsel

  before relying on case law or statutes that evolve and change. A proper con-temporary search of current case law and statutes should always be con-

  ducted before relying upon any source. The cases and statutes provided are current at the time this work was compiled and can serve as a starting point in researching any changes in the law.

  Computer Forensics

  Discovery and

  15

  Spoliation

  Discovery Issues

  In Re: A&M Florida Properties II, LLC, 2010 Bankr. LEXIS 1217 (S.D.N.Y.

  Bankr. Ct. April 7, 2010); monetary sanctions for failure to produce

  requested e-mails in a timely manner.

  During the discovery phase of a suit alleging the breach of a pur-

  chase and sale contract, the Bankruptcy Court for the Southern District of New York ordered monetary sanctions against the plaintiff and its counsel for their failure to timely produce requested e-mails that remained hidden due to a misunderstanding of the plaintiff’s e-mail retention procedures.

  Plaintiff GFI Acquisition sued American Federated Title Corporation for

  the alleged breach of their $41 million agreement for the sale of four properties. GFI alleged that American Federated failed to disclose certain lock-out features contained in loans GFI promised to assume upon the sale. At issue were several e-mails that American Federated had sent GFI that would allegedly demonstrate GFI’s knowledge of the loan terms.

  When GFI’s initial search did not produce the relevant e-mails,

  American Federated requested a more extensive search. GFI subsequently

  produced an additional 346 documents, but did not find the e-mails. The

  parties hired a joint computer forensic expert to search GFI’s e-mail system, but this search also failed to produce the e-mails that American Federated was sure GFI had in its possession.

  After the initial forensic search, GFI’s counsel discovered that GFI’s e-mail system allowed its users to archive e-mail. A second search of the archived e-mails discovered nearly 10,000 relevant e-mails previously undisclosed to American Federated. The joint computer expert produced a small portion

  of the new e-mails to American Federated and the rest to GFI for privilege review. However, due to further misunderstandings, GFI’s counsel failed to review the e-mails for more than 2 months. American Federated eventually

  received a full production, including the e-mails that it had expected in the initial production.

  American Federated filed a motion for sanctions, arguing that GFI had

  obstructed its discovery with unnecessary delays and costs. The court found both dismissal of GFI’s action and an adverse inference instruction too harsh, noting that there was no evidence that GFI or its counsel had acted in bad 243

  244

  Advanced Criminal Investigations and Intelligence Operations

  faith. Instead, monetary sanctions were warranted. The court reasoned that the initial production would have disclosed all relevant e-mail if GFI’s counsel had made a diligent effort to learn about and search all of GFI’s e-mail system, including the archived mails. Because counsel’s failure to investigate the e-mail system caused the need for additional motions and forensic searches, the court ordered GFI and its counsel to reimburse American Federated for both its motion costs and its half of the forensic searches.

  CE Design Ltd. v. Cy’s Crabhouse North, Inc. , 2010 U. S. Dist. LEXIS 59000

  (N.D. Ill. June 11, 2010); court orders supplemental expert report on new hard drive evidence.

  This case involved an alleged violation of the Telephone Consumer

  Protection Act (TCPA) due to the use of an automated fax advertisement service. Plaintiff CE Design sued under the TCPA after receiving an unsolicited fax advertisement for Cy’s Crabhouse via a third-party company, Business

  to Business Solutions (B2B). The Northern District of Illinois ordered the defendant’s computer expert to issue a supplemental report after the plaintiff disclosed a previously unproduced hard drive.

  During discovery, Cy’s Crabhouse requested all documents in CE

  Design’s possession relating to other TCPA suits involving B2B. At issue

  was a list of fax numbers utilized by B2B to send advertisements. B2B’s sole employee, Caroline Abraham, first asserted that she could not provide the requested fax numbers because they had been maintained by B2B’s parent

  company and she had lost any relevant data in a hard drive crash 2 years

  before. Counsel for Cy’s Crabhouse later learned, however, that Abraham had produced the requested information to CE Design’s counsel pursuant to a

  show cause order in a separate case involving B2B. Abraham had provided

  CE Design with backup tape data burned to a DVD, as well as the crashed

  hard drive. Cy’s Crabhouse later received a copy of the DVD but had not been granted access to the hard drive.

  Cy’s Crabhouse moved to dismiss as sanction for CE Design’s discov-

  ery violations, including the failure to produce the requested hard drive.

  Shortly after the motion was filed against it, CE Design produced the

  missing hard drive.

  The court found the failure to disclose the hard drive to be somewhat more substantial than the other alleged discovery violations. The court did not, however, find any prejudice to Cy’s Crabhouse because the hard drive had eventually been produced. Finding dismissal to be too severe a sanction, the court ordered Cy’s Crabhouse to submit a supplemental report from its computer expert based upon a forensic analysis of the hard drive. The court noted that it would assess the costs of the computer expert’s new report against CE

  Design if the hard drive data required material changes to the expert’s opinion in the case.

  Computer Forensics: Discovery and Spoliation

  245

  Custodian of Records v. State of Wisconsin ( In Re: Doe), 680 N.W.2d 792

  (Wis., 2004); subpoena ordering backup tapes for all government servers quashed for being overly broad.

  In a suit involving the criminal investigation of state legislators, the

  trial court issued a subpoena ordering the Legislative Technology Service Bureau (LTSB) to produce backup tapes for all 54 government computer

  servers, or alternatively, to extract all documents for certain named individuals. The order defined documents to include all digital computer information or data mai
ntained by the LTSB, including, but not limited to, all e-mail, electronic calendars, recycle bin files, temporary Internet files, and image files.

  On appeal, the Wisconsin supreme court quashed the subpoena as being

  unreasonable because it was overly broad. The court held the subpoena was overly broad because it compelled production of computer data from an

  entire branch of government, rather than requesting specific topics, document types, or time periods. The court also held that because the documents that the plaintiffs sought were computer records, “a key word search would not have been too difficult to incorporate into the subpoena.”

  Andrew Corp. v. Cassinelli, 2009 U.S. Dist. LEXIS 22105 (N.D. Ill. 2009); noncompliance with employment agreement causes competitor to cover costs.

  During an employment dispute in which an employer alleged a breach

  of a confidentiality agreement, the Northern District of Illinois found the defendant’s forensic analysis insufficient for its failure to report a list of responsive files.

  After the employee resigned from the plaintiff corporation and joined

  a competitor company, the plaintiff filed suit for breach of an employment agreement, under which the employee was prohibited from soliciting or

  servicing the plaintiff’s customers or sharing confidential information with new employers. The employee claimed that he had complied with the agreement and had maintained a record of all communications with the plaintiff’s customers, whom he referred to other associates at the competitor company.

  The court ordered limited discovery to determine if the employee and

  competitor had complied with the employment agreement. The competitor

  hired forensic experts to create a forensic image of the employee’s computer, which was then supplied to the plaintiff. In this forensic image, the plaintiff found seven e-mails containing its confidential information.

  The experts conducted a search of the competitor’s e-mail server and some of office computers, using 26 keywords from the e-mails discovered on the employee’s computer. The competitor asserted that the forensic experts had permanently deleted all 813 responsive documents discovered in its search.