A Defendant brought a motion to forensically image the Plaintiff’s “personal computing devices” before a cross complaint had been filed. The motion was denied. Han v. Futurewei Techs., Inc., 2011 U.S. Dist. LEXIS 104538 (S.D. Cal. Sept. 15, 2011).
The case was originally filed in California state court and removed to Federal Court. The Defendant sought leave to file a cross-claim for the removal and copying of files from her company issued computer. Han, at *2-3.
The Plaintiff claimed that when she was asked to return her company issued computer, she “cleaned up the hard drive and removed incidental personal files, as well as copied several files under an assumption she would receive a new computer.” The Plaintiff claimed she did not know she was going to be terminated. Han, at *5.
The Defendant sought expedited discovery to image the Plaintiff’s personal computing devices with the following protocol:
1. The inspection and copying of the Plaintiff’s personal computing devices will be conducted by Defendants’ forensic expert.
2. The Plaintiff will provide any and all personal computers and external storage devices that were used by the Plaintiff or anyone acting on her behalf during her employment with the Defendant (“the devices”) to the Defendant’s expert by no later than the close of business on a date to be determined by the Court.
3. The Defendant’s expert will image and return the devices as expeditiously as possible. Plaintiff will leave the devices in the custody of the Defense expert for the time period necessary to image the devices . . . . A copy of the imaged devices will be provided to Plaintiff’s computer forensic firm, at Plaintiff’s expense.
4. All parties agree that Defendants, their counsel, and other representatives of Defendants, excluding the Defense expert, will not access the devices or ESI [electronically stored information], except . . . pursuant to Court order.
5. The Defense expert’s imaging will capture all data and ESI contained on the devices, including, but not limited to, active files, deleted files, and the unallocated drive space.
6. The Defense expert will analyze the devices to determine the presence of the Defendants files or data.
7. On a date to be determined by the Court, Plaintiff’s counsel will provide a list of search terms to the Defense expert containing the names of any and all individuals with whom Plaintiff may have had attorney-client privileged communications. Any documents containing these search terms will not be disclosed to Defendants. Instead, the identified documents will be placed on a privilege log, and the log will be provided to counsel for the Defendant.
8. Following the complete analysis of the computer, findings will be reported to Defendants.
9. The Defense expert and its representatives agree that they will not divulge any of the contents of Plaintiff’s Confidential Material to defense counsel, Defendants, or their representatives.
10. If the Defense expert has questions regarding whether any particular information is Confidential Material, Huron will communicate with both Plaintiff and defense counsel jointly via conference call in regard to any such questions.
11. The Defense expert shall destroy all data and images regarding this matter in its possession within five business days after being notified in writing or electronic mail by counsel for each party that the case has been resolved or finally adjudicated.
Han, at *3-5.
The Plaintiff objected on the grounds the protocol entrusted the “Defendants alone to determine what is privileged or relevant, and denies Plaintiff’s counsel reciprocity to the data sought or the laptop that sparked the [counterclaim].” Han, at *5.
Moreover, the Plaintiff argued that her personal computer contained long list of privileged information, including attorney-client communications, online banking information, and correspondence with family. Han, at *5-6.
The Plaintiff proposed the following protocol:
1. Plaintiff will provide counsel for Defendant a list of all relevant documents on the Plaintiff’s personal computer as determined by Plaintiff’s Certified Forensic Computer Examiner. Relevant documents will be defined as those copied or otherwise transferred as alleged in Defendant’s Motion for Leave to Amend Pleadings, Docket item [15].
2. Plaintiff will provide counsel for Defendant a copy on cd of all such documents retrieved by Plaintiff’s Certified Forensic Computer Examiner.
3. Plaintiff will have her Certified Forensic Computer Examiner work with Defendant’s forensic computer examiner on any further protocols needed, and Defendant will have its Certified Forensic Examiner work with Plaintiff’s forensic computer examiner on any further protocols needed.
4. Plaintiff, her counsel, and her Certified Forensic Computer Examiner are not to otherwise copy, forward, disclose, disseminate, sell, license, lease, transfer, make any use of, attempt to disclose or use, access or dispose of any of Huawei’s confidential, proprietary or trade secret information, specifically including any information that Plaintiff downloaded or copied that is not publicly available, without first filing with the magistrate [judge] under seal a request to do so. This prohibition shall not apply to Han making her personal computer(s) or external storage devices available for forensic review by Defendants as agreed by the parties or otherwise ordered by the court. This prohibition shall also not prevent Plaintiff from defending any allegations by Defendant against her as related to the proposed Counterclaim filed as Docket item [15].
Han, at *6-7.
Compelled Imaging of Hard Drives
The Court recounted established precedent that inspecting certain ESI raises “issues of confidentiality or privacy.” Han, at *8.
Federal Rule of Civil Procedure Rule 34(a) was not intended “to create a routine right of direct access to a party’s electronic information system, although such access might be justified in some circumstances.” Han, at *8, citing Fed. R. Civ. P. 34 Advisory Comm. Notes, 2006 Amendment.
The Court recognized the “undue intrusiveness” from forensically examining a party’s hard drive. Moreover, Courts have a duty to guard against such examinations. Han, at *8-9. As the Court cited:
“[C]ompelled forensic imaging is not appropriate in all cases, and courts must consider the significant interests implicated by forensic imaging before ordering such procedures.”
Han, at *9, citing John B. v. Goetz, 531 F.3d 448, 460 (6th Cir. 2008).
The Court first held the Defendant’s discovery request was premature, having no relevance on the claims in the case, thus not within the scope of Federal Rule of Civil Procedure Rule 26(b)(1). Han, at *9.
The fact the parties were in litigation did not give the Defendant the “unfettered right to seek whatever it wishes” from the Plaintiff. Han, at *9. As such, the information the Defendant sought would not be relevant unless the Court first allowed the Defendant to assert a counterclaim. Id.
The Court further expounded on the premature nature of the examination request, because the Defendant had not demonstrated that mirror imaging was either necessary, justified or cited any authority for their protocol. Han, at *10-11.
The Court noted the Defendant failed to offer anything to establish the Plaintiff was wrongfully in possession of confidential information. Han, at *11. Moreover, the Defendant had not established the Plaintiff’s “wiping” of files from her work computer was either improper or malicious. Id.
As the Court stated:
Although Huawei attempts to place Han’s alleged actions under a cloud of suspicion, it has not provided an expert declaration or any other evidence supporting a conclusion that Han was doing anything other than what any conscientious employee would do when asked to return a company-issued computer. Huawei has provided no evidence or argument demonstrating the alleged copying, removal, and deletion of files was at all unusual or unexpected. It is perfectly conceivable that Han was “cleaning up” her laptop by, for example, deleting personal emails or files, deleting files no longer needed, or copying important files for placement on the new work laptop she expected to receive. Additionally, Huawei has not provided any employment agreements or work policies prohibiting the transfer or deletion of company files from one computer to another. Huawei simply assumes that because files were copied, transferred, and deleted, Han was necessarily engaged in nefarious conduct. Such an unsupported assumption does not entitle Huawei or its expert to unlimited access to Han’s personal computing devices.
Han, at *11-12.
The Court further explained that the Defendant’s collection protocol would encompass “non-responsive, irrelevant, and privileged information.” Han, at *12. The Court recognized the Defendant was seeking any possible company confidential information that the Plaintiff might have had, but there were less burdensome ways to find the information, such as requests for production or interrogatories. Id.
The Court stated that the Defendant’s proposed protocol would subject the Plaintiff’s confidential information to be needlessly examined. Han, at *13. Moreover, case law allowing mirror images of hard drives involve inconsistent or incomplete discovery responses, something that was not present in this case. Han, at *13-14.
The Court found that the Plaintiff’s proposed collection protocol was reasonable, following the convention that the responding party determines what is “relevant, responsive, and protected by privilege or privacy interests.” Han, at *15.
Bow Tie Thoughts
The compelled mirror image of a personal computer, to be done under the control of the requesting party, is as invasive as a strip search. The examination literally exposes everything about a person, from banking history to tax information to emails sent on a dating site. Such invasion flies in the face of discovery requirements preventing “oppressive” or “burdensome” questioning, let alone state constitutional privacy rights.
Courts are the guardians against such discovery practices. While there are times when appropriate to mirror image a hard drive, the requesting party does not then march over the producing party like a conquered army from ancient times. The producing party has the right to review for relevance, responsiveness and assert any privileges. The requesting party claiming, “don’t worry, trust us” is simply not acceptable to protect an individual’s privacy interests.