In an employment discrimination case, the Defendant claimed the Plaintiff intentionally destroyed data off her personal computer and audio tapes.
The Defendant sought the dismissal of the Plaintiff’s lawsuit and claimed they had spent $150,000 because of the alleged discovery violations. Coburn v. PN II, 2010 U.S. Dist. LEXIS 110613 (D. Nev. Sept. 30, 2010).
The dispute centered on the Plaintiff’s personal computer. The Defendants wanted it forensically examined. The Plaintiff had legitimate privacy concerns with any such investigation. Coburn, at *2.
The Court ultimately ordered a forensic examination of the personal computer, with the following requirements:
The Forensic Examiner would act as an officer of the Court.
The parties entered a “highly detailed” Stipulated Protective Order, which the Court codified as an order.
The parties agreed to a service provider for the examination.
Coburn, at *2-3.
The Forensic Examination
The Court-Appointed computer forensic examiner made a clone of the hard drive and ran a keyword search of the cloned hard drive. Coburn, at *3.
Ironically, the search terms were made without the Plaintiff or her attorney and only the Defense counsel and the forensic investigator. Coburn, at *3.
The forensic investigator testified that the keywords were developed to find “the right information but at the same time tries to eliminate having a lot of false positives.” Coburn, at *3.
The keyword search found 5,413 files and 7,669 emails, which contained at least one search terms. Coburn, at *4.
3,946 of the 5,413 files were labeled as “Non-Standard Files.” The “Non-Standard Files” meant that “portions of files that existed on the computer, but had been deleted prior to the creation of the Forensics Image.” Coburn, at *4. Additionally, the Court-Appointed computer expert claimed that he could only retrieve portions of the files, because the computer system wrote over parts of the data. Coburn, at *4-5.
The computer expert opined that it was possible the files were deleted by a computer cleaning application (CCleaner), but it was likely they were manually deleted because of the number of files. Coburn, at *5. There was a significant inference this was the case, because the cleaning application was run two days before the Court ordered examination. Moreover, the application had been run twice since its installation and was not set to run automatically. Coburn, at *5-6.
Spoliation Argument
As one might expect, the Defendant argued the Plaintiff “not only failed to preserve relevant evidence after the duty to do so had arisen, she intentionally and repeatedly destroyed such evidence.” Coburn, at *6.
The Defendant sought sanctions under Federal Rule of Civil Procedure Rule 37 and the Court’s own inherent power. The gravamen of the Defendant’s arguments were the following:
1) The running of the computer cleaning software on the Plaintiff’s home computer, which indicated intent to destroy relevant evidence and was a direct violation of the Forensic Order;
(2) The existence of the 3,946 Non-Standard Files, all of which contain keywords purportedly relevant to the litigation, indicated the Plaintiff regularly destroyed relevant evidence on her computer; and
(3) The Plaintiff destroyed relevant emails on her home computer between December, 2005 and April, 2006.
Coburn, at *7.
The Plaintiff denied ever deleting a large number of files from her computer, but did not deny that the computer cleaning software may have run on the computer before the exam. Coburn, at *7-8. The Plaintiff argued that any deletion of data fell under the “safe harbor” provision of Federal Rule of Civil Procedure Rule 37(e).
The Plaintiff admitted that she did delete email from her home computer, but she did so after saving the emails to specific folders on her computer. Coburn, at *8.
Going to the Cleaners
The Court held that running CCleaner did not alone justify a finding that the Plaintiff destroyed relevant ESI “in bad faith, vexatiously, wantonly, or for oppressive reasons.” Coburn, at *13.
The Court explained that it was not clear that running the cleaning software destroyed or overwrote computer files relevant to the lawsuit. Coburn, at *12.
Moreover, the Court was not sure who ran the cleaning software. The Plaintiff denied operating the software herself or having someone do it for her. Coburn, at *13.
3,946 Non-Standard Files Did Not Show Intentional Destruction of Evidence
A battle of experts ensued over the issue of the 3,946 non-standard files.
The original Court-Appointed expert testified that there was intentional deletion of those files because of “the location of the search terms . . . on the computer” indicated “the original files that contained the search terms were once “active files.” Coburn, at *13-14.
The Court-Appointed expert further explained that “[b]ecause of the large volume of Non-Standard/Corrupted/Unallocated Clusters, it is likely that this content also included files that had been manually deleted.” Coburn, at *14.
The Plaintiff’s expert countered, explaining that a computer that had been used for years would have thousands of non-standard files. Coburn, at *14.
As the Plaintiff’s expert explained, an internet browser can have thousands of cached files. Moreover, an operating system can generate temporary files and logs. Coburn, at *14. This can make a computer run slowly (and usually to the end-user’s frustration). Coburn, at *14.
The Plaintiff’s expert explained that while such files might be “intentionally deleted,” that does not mean they were “volitionally deleted.” Coburn, at *15. A computer might delete files without any action from the user. Coburn, at *15.
As the Plaintiff’s expert explained, “the raw number of Non-Standard Files/Corrupted Files/Unallocated Clusters in no way conveys how, when, or in what manner files were created, used or deleted.” Coburn, at *15.
Keyword False Positive Results
The Court-Appointed Expert admitted that the number of keyword responsive files could have been inflated because he used the Plaintiff’s husband’s first and middle name as search terms. Coburn, at *15-16.
Notably, the papers submitted in this matter and the testimony adduced at the hearing indicate that nobody knows which keyword(s) are in any single Non-Standard File, and therefore how many of these files contain “false positives.” Pulte notes that when four or five of the Non-Standard Files were viewed during the hearing, one contained the string, “EEOC does not provide blank charge forms,” indicating that relevant evidence on Coburn’s computer had been deleted. None of the testimony adduced at the hearing, however, sheds light on the meaning of this file as it pertains to spoliation. The string could represent a temporary internet file created when a user looked at the EEOC website, or it could represent a portion of a document; if it was once a document, it could have been deleted by Coburn or it could have been deleted by Coburn’s husband, and there is no telling when. Pulte urges the court to derive from this EEOC fragment, that potentially one in four Non-Standard Files represents a relevant file which was intentionally destroyed by Coburn and to levy sanctions accordingly. This the court cannot do. To do so would be to levy sanctions on the basis of an evidentiary estimate or “hunch.”
Coburn, at *16-17.
Email Production
The Defendants argued the Plaintiff failed to preserve email after the triggering date of the litigation.
The Plaintiff argued she did not delete any email after the case had been removed to Federal Court. Coburn, at *17.
Prior to the litigation, the Plaintiff would email files/emails to her personal email account. She would then save the file in a specific folder. After the file was saved, she would delete any duplicate emails. Coburn, at *17-18.
The Court summed up the Defendants’ argument that their desire to have “more emails from a specific time period, is insufficient to support a claim that Coburn intentionally destroyed relevant evidence to be gained from the emails. Coburn, at *19.
Destruction of Audio Tapes
The Plaintiff made several audio tapes with co-workers, which she destroyed because she thought the tapes were of poor quality. Poor audio quality is not a reason to destroy evidence. Coburn, at *19-20.
The Court noted that the destruction of the audio tapes was not done with the intent to deprive the Defendants of the evidence. As such, the Plaintiff was only sanction reasonable attorney’s fees of $1,500. Coburn, at *20.
Bow Tie Thoughts
Spoliation hearings are not witch trials. There are numerous case examples where parties attempt to use the allegation of the destruction of electronically stored information to burn their opponents at the stake.
I believe cases involving the alleged destruction of ESI will normalize. Private individuals are not using content archiving systems one finds in Enterprise-level companies. Many of these individuals will simply save files to their personal computers in folders, or even leave them in cloud-based email, or perhaps print messages as PDF’s. The fact such ESI is not in Outlook for a forensic expert to collect does not perfunctory mean there is spoliation.
When it comes to the destruction of evidence, courts will do what they have always done for the last 240 years: find justice. As judges and attorneys become more technically knowledgeable, they will ask whether a party acted in a reasonable manner to preserve the data. Additionally, there must be clear evidence of spoliation, not a hunch based on false-positive search term results.