Judges loath ordering the forensic imaging of personal computers. Here is a case where that was not a problem for the Court.
In Genworth Fin. Wealth Mgmt. v. McMullan, the Plaintiffs brought a motion to compel the Defendants to produce their computers for forensic imaging, plus a preservation order and attorneys’ fees for sanctions. Genworth Fin. Wealth Mgmt. v. McMullan, 2010 U.S. Dist. LEXIS 53145, 18-19 (D. Conn. June 1, 2010)
The case involved former employees who formed a competing company.
The Defendants started their new company with client data from the Plaintiff, allegedly in violation of the Computer Fraud and Abuse Act, the Connecticut Uniform Trade Secrets Act, the Stored Communications Act, and common law tortious interference with business relationships. Genworth Fin. Wealth Mgmt. at *4.
The Defendants claimed they identified all their business prospects from Internet searches and memory. Genworth Fin. Wealth Mgmt. at *4-5.
The Plaintiffs sent a preservation letter to the Defendants in August 2009. Genworth Fin. Wealth Mgmt. at *5. The lawsuit was filed in September 2009 and discovery propounded in November 2009 for electronically stored information and metadata. Id.
The Defendants did not produce any email, their client management database or their invoicing database. Genworth Fin. Wealth Mgmt. at *5.
The Plaintiff wanted confirmation that the Defendants’ computers were forensically imaged, out of the concern that ESI could be lost though routine operating procedures such as auto-delete. Genworth Fin. Wealth Mgmt. at *6.
However, the Defendants had no intention to forensically image any of their computers. Genworth Fin. Wealth Mgmt. at *6.
The Plaintiffs in turn brought the motion to compel, which prompted the Defendants seven days later to hire a consultant to image their business computers. Genworth Fin. Wealth Mgmt. at *6.
An evidentiary hearing produced some exciting emails…from the Defendants’ personal email accounts. Genworth Fin. Wealth Mgmt. at *6. ESI produced from Charles Schwab, the Defendants’ custodian of assets, showed data sent by one of the Defendants’ personal email accounts with Plaintiff’s data during the time while one of the Defendants was still employed by the Plaintiff. Genworth Fin. Wealth Mgmt. at *6. None of this information had been produced by the Defendants. Id. The data was used to establish the Defendants’ new company and secure clients. Id.
One of the Defendants “discarded” the personal computer he used with the Plaintiff’s data that was sent to Charles Schwab. Genworth Fin. Wealth Mgmt. at *6-7.
The computer was possibly “discarded” after the Plaintiff sent a preservation letter to the Defendants. Genworth Fin. Wealth Mgmt. at *7.
Discovery Rules Recap
A demanding party may request the inspection, testing or sampling of electronically stored information pursuant to Federal Rule of Civil Procedure Rule 34(a). Genworth Fin. Wealth Mgmt. at *8.
The right to access such ESI is balanced against the producing party’s privacy rights. Id. As stated in the 2006 Advisory Committee Notes, “a routine right of direct access to a party’s electronic information system, although such access might be justified in some circumstances.” Genworth Fin. Wealth Mgmt. at *8.
Searching Personal Computers
In determining whether to examine personal computers, the Court cited the following factors:
[C]onsider the relationship between the plaintiff’s claims and the defendants’ computers and, in some cases, whether the defendant has fully complied with discovery requests, in determining how the requested electronic discovery should proceed. Even in cases where courts have nonetheless adopted procedures to protect privilege and privacy concerns.
Genworth Fin. Wealth Mgmt. at *8, citing Calyon v. Mizuho Securities USA Inc., No. 07 CIV0224IRODF, 2007 U.S. Dist. LEXIS 36961, 2007 WL 1468889, at *3 (S.D.N.Y., May 18, 2007).
The Court further relied on Ameriwood Industries, Inc. v. Liberman, No. 4:06 CV 524-DJS, 2006 U.S. Dist. LEXIS 93380 (E.D. Mo. Dec. 27, 2006), amended by 2007 U.S. Dist. LEXIS 98267 (E.D. Mo. Feb. 23, 2007), where a prior court ordered a neutral expert to create a mirror image of a computer. Genworth Fin. Wealth Mgmt. at *9.
The Ameriwood court described the privacy concerns and justifications for inspecting a personal computer:
Courts have been cautious in requiring the mirror imaging of computers where the request is extremely broad in nature and the connection between the computers and the claims in the lawsuit are unduly vague or unsubstantiated in nature. For example, a party may not inspect the physical hard drives of a computer merely because the party wants to search for additional documents responsive to the party’s document requests. [A court has previously] declined to allow the examination of any ESI other than the information that had been deleted because the requesting party had not demonstrated that the producing party was unwilling to produce relevant evidence. [Evidence] raises the question of whether defendants have in fact produced all documents responsive to plaintiff’s discovery requests. Furthermore, in cases where a defendant allegedly used the computer itself to commit the wrong that is the subject of the lawsuit, certain items on the hard drive may be discoverable. Particularly, allegations that a defendant downloaded trade secrets onto a computer provide a sufficient nexus between the plaintiff’s claims and the need to obtain a mirror image of the computer’s hard drive.
Genworth Fin. Wealth Mgmt. at *10-11, citing Ameriwood, 2006 U.S. Dist. LEXIS 93380 at *4.
The Ameriwood court devised a three-part image & production protocol:
1) “Imagining”: The parties select a computer forensic expert to image the computer(s). The forensic expert is bound by a confidentiality agreement.
2) “Recovery”: The work performed by the forensic expert to recover data off the computer, such as email messages, Word documents and deleted data.
3) “Disclosure”: Defense counsel allowed to review the production for privilege and responsiveness prior to production.
Genworth Fin. Wealth Mgmt. at *11-12, citing Ameriwood, 2006 U.S. Dist. LEXIS 93380 at *5-7.
The Court found that forensic imaging of the Defendants’ computer by a neutral expert was the only way the Plaintiff could review the Defendants’ email and other ESI. Genworth Fin. Wealth Mgmt. at *12-13. The Court followed the reasoning from Ameriwood and crafted a similar remedy.
The Defendant had used his own computer to download and email the Plaintiff’s business property while setting up a competing business. Genworth Fin. Wealth Mgmt. at *13. Moreover, the Defendant admitted that he destroyed evidence when he deposed of his personal computer in a trash can. Genworth Fin. Wealth Mgmt. at *14.
Making things worse for the Defendant (and better for the Plaintiff), the Defendant provided false testimony on the timing of his emails to Charles Schwab and the destruction of his computer. Genworth Fin. Wealth Mgmt. at *13-14.
The client data the Defendants used was also highly detailed and specific. The Court found that the Defendants recreating the client list from memory to be far-fetched. Genworth Fin. Wealth Mgmt. at *14.
The fishy story, if not outright lies, probably made the Court’s order all the easier to issue.
The Court Order
The Court found that the Plaintiff had offered enough evidence that there was a nexus between the Defendants’ computers and the claims in the lawsuit to justify a mirror image of the hard drives. Genworth Fin. Wealth Mgmt. at *14-15.
The Court provided a detailed order, requiring the following:
1) The parties select a neutral expert who would be bound by a confidentiality agreement. Genworth Fin. Wealth Mgmt. at *17.
2) The Defendants would make all responsive computers, and personal devices, available to the expert. Genworth Fin. Wealth Mgmt. at *17-18.
3) The expert was to image the computers and organize the data in a reasonably searchable form. The data was to be provided to the Defendant and notice given to the Plaintiff. Genworth Fin. Wealth Mgmt. at *18.
4) Set time for the Defendants to review the data for privilege and responsiveness. The Defendant was also ordered to produce a privilege log that complied with the Federal Rules of Civil Procedure. Genworth Fin. Wealth Mgmt. at *18.
5) Cost allocation of 80% for the Defendants & 20% for the Plaintiff for the computer expert. Genworth Fin. Wealth Mgmt. at *18.
6) Attorneys fees for the Plaintiff. Genworth Fin. Wealth Mgmt. at *18-19.
7) The blunt order that the “Defendants shall meet their data preservation and production obligations and will face further sanction for failure to comply with such requirements.” Genworth Fin. Wealth Mgmt. at *19.
Bow Tie Thoughts
Federal Judges despise the idea of ordering the forensic image of a personal computer. However, if a requesting party can show a nexus between the claims of a lawsuit and the producing party’s computer, chances are good they can they will be able to get relevant data off of the machine. Throw in the destruction of evidence and a shady story, it is almost a guarantee. Lying to the judge never ends well.
There is a big “however”: The requesting party does not get to simply forage through the producing party’s computer. Courts will go to great lengths to protect privacy interests. One way to protect these privacy interests is to appoint a neutral third-party expert who is subject to a confidentiality agreement to image the machine. Even then, the producing party will have an opportunity to review for privilege.
I have worked cases exactly like this and once I found the traffic between old company and new during employment with old company it actually openned the door to see new company computers. This has also applied to individuals that used their work computer for personal use and had sent company data to their personal email from work computer – this also openned the door to access personal computer for specific content. I have always found that by gaining access to the personal computer all data/content found under agreed search order would first go to the individuals attorney for possible privilege and omitions.