by Unknown
252
Advanced Criminal Investigations and Intelligence Operations
After finding that the e-mail was protected by the attorney–client privi-
lege, the court applied FRE 502(b) on waiver, as interpreted in Heriot v.
Byrne, 2009 U.S. Dist. LEXIS 22552 (N.D.Ill.2009). Whether a disclosure was inadvertent and whether the holder of the privilege took reasonable steps to prevent disclosure are dependent on a number of considerations, including the number of documents and how they were reviewed prior to production.
Here, the defendant asserted that the e-mail was inadvertently produced
but had not presented any evidence informing the court of its efforts to
review and control the disclosure of documents. The failure to meet this burden constituted waiver of the attorney–client privilege. The court also held that the e-mail fell within the fiduciary exception and granted the plaintiff’s motion to compel production of the e-mail.
Schreiber v. Schreiber, 2010 N.Y. Misc. LEXIS 6058 (N.Y. Sup. Ct. June 25, 2010); NY.
During the discovery phase of a martial dispute, the New York Supreme
Court established guidelines for a search protocol to assist the forensic examination of the defendant-husband’s work computer. The court denied the
plaintiff’s motion to compel production of her husband’s work computer, reasoning that she was not entitled to unrestricted access. The court emphasized that the plaintiff would be permitted to renew her motion if she provided a search protocol that would adequately protect the defendant’s privileged and confidential information.
Spoliation
Allstate Insurance Co. v. St. Anthony’s Spine & Joint Institute, 2010 U.S.
Dist. LEXIS 11475 (N.D. Ill. 2010); failure to maintain electronic records suggests negligent spoliation.
In a case brought by an insurance company alleging fraud in insurance
claims, the defendant’s failure to maintain electronic patient records was enough to defeat his motion for summary judgment on a charge of negligent spoliation.
The insurance company alleged that the defendant chiropractor had
billed patients for unnecessary testing and for higher levels of service than were rendered. The insurance company suspected that the fraudulent activity began in 2000 when the defendant began use of a special x-ray technique believed to be unnecessary for chiropractic patients.
At issue were electronically stored x-rays and patient studies created in 2000 and 2001, which the defendant claimed he could not produce because
the computer hard drives containing the data had crashed. The insurance
company’s expert testified that the defendant had a professional and ethical responsibility to maintain the patient records.
Computer Forensics: Discovery and Spoliation
253
The court found that the expert’s testimony created a disputed material fact sufficient to defeat the defendant’s motion for summary judgment on the claim of negligent spoliation. The defendant’s inability to produce the records suggested negligent spoliation of evidence that he was under a duty to maintain.
Genworth Fin. Wealth Mgmt., Inc. v. McMullan, 2010 U.S. Dist. LEXIS
53145 (D.Conn. 2010); defendants ordered to pay imaging costs due to
willful spoliation.
The plaintiff, Genworth Financial Wealth Management, filed suit against
a group of former employees under the CFAA and the Connecticut Uniform
Trade Secrets Act, alleging that the employees stole the company’s client information database as part of a plan to set up a competing business. On the plaintiff’s motion to compel, the district court ordered the defendant employees to submit their personal computers to a neutral computer expert for mirror imaging and to pay 80% of the cost due to their intentional spoliation.
The plaintiff alleged that the employees had used its customer list to
solicit hundreds of its clients and to interfere with other business relationships. The defendants argued that they had collected the client information through permissible means and did not have the client database. One month before filing suit, the plaintiff notified the defendants of their duty to preserve electronic evidence. During discovery, however, the plaintiff determined one of the employees had recently discarded the computer on which he had allegedly downloaded the client database.
On the plaintiff’s motion to compel, the court found the defendants’
argument of independent col ection unconvincing, reasoning that the client data were very detailed and unlikely to be created from memory or mere
Internet searches. Noting that a mirror image of the relevant computer
equipment was the only way for the plaintiff to obtain the electronic evidence to which it was entitled, the court ordered the defendants to submit their computers to a neutral expert and to pay 80% of the associated cost.
The court rejected the defendants’ argument that they could not afford
to pay a neutral computer expert and agreed with the plaintiff that sanc-
tions may be warranted. The timing of the defendants’ disposal of a relevant computer suggested consciousness of wrongdoing and intentional spoliation.
The court agreed that the defendants may be subject to discovery sanctions if they did not fully comply with the order. It was unreasonable, the court said, to make the plaintiff seek a court order to obtain the electronic evidence to which it was already entitled.
Grochocinski v. Schlossberg, 402 B.R. 825, 2009 U.S. Dist. LEXIS 19523 (N.D.
Il . 2009); bankruptcy court affirms bad faith spoliation of electronic evidence.
On an appeal from the bankruptcy court, the district court affirmed an
order of sanctions for bad faith spoliation of electronic evidence. During a bankruptcy proceeding, the debtor’s trustee filed a complaint to recover two al egedly
254
Advanced Criminal Investigations and Intelligence Operations
fraudulent transfers of real estate made to the appel ants. The trustee then filed a motion to compel the production of electronic data related to the transfers.
A computer forensics expert was hired to mirror and analyze the appel-
lants’ hard drives. The expert discovered that one appellant had installed a disk-cleaning program and had used it to destroy at least 16,000 files. Another program was then installed to verify that the data had been deleted and new operating systems were installed on two of the hard drives.
On the trustee’s motion for sanctions, the bankruptcy court found that
the deletion amounted to spoliation. The court issued an adverse inference instruction and required the appellant to pay costs for counsel and the computer expert.
On appeal, the appellant argued that the bankruptcy court had failed to
make a finding that he acted in bad faith. The district court, reviewing for an abuse of discretion, deferred to the bankruptcy court’s finding that the appellant had acted with reckless disregard for his discovery obligations and affirmed the sanctions. Such a disregard was sufficient to establish bad faith and the imposition of sanctions were reasonable under the circumstances.
Grubb v. University of Il inois, 2010 U.S. Dist. LEXIS 78485 (N.D. Ill.
August 4, 2010); motion for sanctions for spoliation unsuccessful.
A university’s motion for sanctions for spoliation of evidence was unsuc-
cessful when it failed to show the spoliating party’s bad faith.
Plaintiff John Grubb, a professor at the UIC (University of Illinois,
College of Dentistry), was terminated, but just before he left, the information technology department contacted him to remove UIC software from Grubb’s
laptop computer. Grubb asked the employee to return in a few days so that he might supervise the work, fearing unauthorized access of unrelated confidential information on the laptop. When Grubb returned from lunch that
day, he dis
covered that the employee had accessed his laptop and removed
the UIC software without him being present.
Grubb subsequently contacted the American Board of Orthodontics
(ABO), which had issued him the laptop, and informed the board of his concern that confidential patient information had been accessed. Approximately 1 month later, a lawyer for ABO informed Grubb that he should stop using
the laptop so that any digital evidence concerning the incident would not be lost. When Grubb discussed the matter with an ABO computer specialist,
however, he was told that any data concerning the incident were likely lost due to his consistent use of the laptop in the interim month.
Four months later, ABO issued Grubb a new laptop. Grubb claimed
that he received a new laptop because he needed a faster machine with more memory. ABO’s computer technician initially made a mirror image of the
hard drive from Grubb’s old laptop but later wiped both the hard drive and the mirror image.
Computer Forensics: Discovery and Spoliation
255
Grubb eventually filed suit against UIC for unauthorized access of a
computer system under the CFAA. UIC moved for sanctions due to spoliation of evidence, arguing that the wiping of Grubb’s laptop hard drive had made it impossible to determine what actions the UIC employee had performed on Grubb’s laptop.
After determining that the appropriate standard of proof for a sanctions
motion is preponderance of the evidence, the district court held that UIC
could not show that Grubb had acted in bad faith, but had merely returned the laptop to its owner and not knowing at that time that ABO would delete all of the evidence contained on its hard drive. Additionally, ABO’s computer specialist told Grubb that any digital evidence of the incident that had once existed was likely lost due to Grubb’s continued use of the laptop. The court said that this opinion made it unlikely that any useable data were available when Grubb returned the laptop to ABO. The court denied UIC’s motion for
sanctions, reasoning that the preponderance of the evidence showed that no useable data were lost and that Grubb had not acted in bad faith.
Krumwiede v. Brighton Associates, U.S. District Court for the Northern District of Illinois Case No. 05 C 3003: Charles A. Krumwiede, an individual v. Brighton Associates, LLC, and Ismaeil C. Reyes, an individual; willful (deliberate) and bad faith spoliation of evidence.
What began as an employee’s claims for breach of an employment agree-
ment and back pay resulted in a counterclaim alleging tortuous interference, breach of noncompete and confidentiality duties, and violation of the Illinois Trade Secrets Act.
Brighton Associates claimed that Krumwiede went to work for a com-
petitor and misappropriated a business opportunity with a potential client.
Brighton sought to recover the laptop computer that Krumwiede used when
he worked for Brighton in order to determine whether Brighton’s data were improperly used. Krumwiede refused to produce the laptop despite Brighton’s preservation letter demanding that Krumwiede immediately cease using the
laptop and that any changes to the contents of the laptop would be regarded as deliberate spoliation of evidence.
After a motion to compel was filed by Brighton, the court ordered that a
neutral third-party computer forensics firm be allowed to inspect the computer. The firm (1) created a forensic copy of the hard drive, (2) issued a report identifying numerous instances of files accessed and deleted, (3) identified connections of external devices suggesting the transfer of files to other computers, (4) discovered instances of defragmentation, and (5) tracked activity of ZIP files with suspicious filenames that were deleted and overwritten.
Krumwiede attempted to suggest that Brighton’s counsel compromised
the neutrality of the consulting firm by coaching the firm’s employees and meddling in the expert’s report.
256
Advanced Criminal Investigations and Intelligence Operations
The court held that neither counsel’s contact nor prior dealings with the firm compromised the neutrality of the investigation and report, as evidenced by the consistency of the initial and final versions of the expert reports. The court also held that Krumwiede’s actions amounted to wil ful and bad faith spoliation of evidence and warranted a default judgment in favor of Brighton.
In deciding between default and lesser sanctions, the court considered
prejudice to Brighton, prejudice to the judicial system, deterrence, and punishment. Krumwiede’s conduct showed blatant contempt for the court and a
fundamental disregard for the judicial process that could only be adequately sanctioned with a default judgment. In addition, Brighton was entitled to an award of costs and fees relating to its motion for sanctions, including fees paid to Brighton’s attorneys and the consulting firm.
MasterCard, Inc. v. Moulton, 2004 WL 1393992 (S.D.N.Y. 2004); spoliation sanctions for negligent destruction of e-mail.
In an action to assert a copyright infringement claim, the plaintiff sought spoliation sanctions against the defendant because the defendant had negligently destroyed an e-mail that was pertinent to the litigation. The defendant and an employee of the defendant both testified that the server automatical y destroyed the e-mail that was over 21 days old and that neither of them had tried to print out or save the e-mail. The defendant could not comply with the discovery instructions because he could not produce those e-mails that were over 21 days old.
The plaintiff sought a sanction of a conclusive determination on the
issues of confusion by the public and dilution and tarnishment of the marks.
In the alternative, the plaintiff requested that the trier of fact be permitted to infer such conclusions from the destruction of the e-mails.
The court granted the sanction in the form of a jury instruction that
would allow the jury to infer that the defendant’s negligent destruction of the e-mail destroyed evidence of confusion by the public and dilution and tarnishment of the marks.
Pension Committee v. Banc of America Securities, 2010 WL 184312
(S.D.N.Y. Jan. 15, 2010); negligent conduct.
A party is negligent if it fails to meet its obligation to participate meaningful y and fairly in the discovery process. A party may be negligent even if it acted with good intentions. The fol owing conduct will likely be deemed negligent:
• Failure to obtain records from all employees (presumably relevant)
• Failure to take all appropriate measures to preserve evidence
• Failure to assess the accuracy and validity of selected search terms
When evidence is lost as a result of negligent conduct, the court will issue an adverse inference instruction only if the innocent party can prove that the lost evidence was relevant to its claims or defenses and that the loss prejudiced
Computer Forensics: Discovery and Spoliation
257
its case. The innocent party need not provide overwhelming evidence of such relevance or prejudice. The court may also shift the costs of production to or issue monetary fines against the spoliating party.
A party is grossly negligent if it fails to exercise even the most basic discovery obligations. The following conduct will likely be deemed grossly negligent:
• Failure to issue a written litigation hold to prevent the destruction of e-mail or backup tapes
• Failure to identify all key players
• Failure to collect records from all key players
• Failure to cease deletion of and/or collect from a former employee
(when his or her files remain in the party’s possession, custody, or
control)
• Failure to preserve backup tapes (when they are the sole source of
records or when they relate to the key players) and such records are
not av
ailable from a readily accessible source
When evidence is lost as a result of grossly negligent conduct, the court may issue either a mandatory presumption or a permitted presumption of relevance and prejudice. A mandatory presumption instructs the jury to presume that lost evidence would have been relevant to the innocent party’s claims or defenses and that the loss was prejudicial to its case. Such a presumption is rebuttable: the spoliating party may submit evidence to show that the lost evidence was not relevant to the innocent party’s claims or defenses. A permitted presumption, also known as a spoliation charge, is an instruction to the jury that it may, but need not, presume that the lost evidence was relevant and favorable to the innocent party. The presumption is also subject to the spoliating party’s rebuttal.
Most courts group willful, wanton, and reckless conduct into a single
category characterized by intentional conduct. A willful, wanton, or reckless party acts with either the purpose to destroy evidence or a conscious indifference to a high likelihood that evidence could be destroyed. The following conduct will likely be deemed willful, wanton, or reckless:
• Intentional destruction or deletion of evidence
• Intentional tampering with or falsification of evidence
When evidence is lost as a result of intentional conduct, the harshest sanctions may be applied, up to and including default judgment or dismissal.
Courts often, however, impose lesser sanctions, such as fines, adverse
instructions, or the preclusion of evidence offered by the spoliating party.
An adverse instruction imposed as a sanction for intentional spoliation will likely instruct the jury that certain facts detrimental to the spoliating party
258
Advanced Criminal Investigations and Intelligence Operations
are to be accepted as true, and the spoliating party will not be offered an opportunity to rebut the instruction.
Rambus, Inc. v. Infineon Techs. AG, 222 F.R.D. 280 (D. Va., 2004); document retention policy must be suspended when a party reasonably anticipates litigation.
In a patent infringement action, the defendant filed a motion to compel
production of various documents including those related to the plaintiff’s document retention policy. The defendant alleged that the plaintiff implemented a document retention policy, which provided for the destruction of documents that would have been harmful in litigation.
