IT Tech’s Fast-Talk Had Zero Persuasive Value with Judge

A district court judge in Connecticut recently rejected defendant’s explanation as to why the hard drives of key employees contained only zeros, and imposed sanctions for spoliation.  Jane Doe v. Norwalk Community College, 2007 WL 2066496, 2007 LEXIS 51084 (D. Conn. July 16, 2007).  

First some background of this “Jane Doe” case. The main defendant here is a state community college.  The plaintiff is a student alleging her college was negligent in its retention and supervision of a professor who sexually assaulted her.  The now “former professor” is also a defendant, but with no legal representation.  The student was permitted to file suit as ”Jane Doe” to protect her privacy. 

After two years of litigation, Jane Doe persuaded the court that the college was withholding electronic evidence.  The school was ordered to produce the computers of key witnesses for inspection by Doe’s computer forensic expert, Dorran Delay of DataTrack Resources.  The expert inspected the college computers over a two day period. Here is where the case gets interesting. Delay’s inspection showed that several of the computers had no data: they were literally all zeros.

Jane Doe’s next move was to file a motion for sanctions based on spoliation of evidence.  She alleged that “the hard drives of key witnesses in this case were scrubbed” or “completely ‘wiped’ of data.” This led to a flurry of affidavits by Doe’s expert, Delay, and the counter-expert used by the college, its own in-house Information Technology Technician, Wyatt Bissell. Of course, the experts did not agree. Bissell came up with a laundry list of excuses for why two computers were “full of nothing.” He tried saying it was the wrong computer, then that it was not wiped at all, just imaged. Then, as a last resort, he settled on the best excuse of many an IT Tech, that the “all zeros” problem was simply the result of “computer failure.”

The judge responded by scheduling two evidentiary hearings.  At these hearings, Delay, Bissell, and other witnesses testified and were cross-examined about the many suspicious circumstances surrounding the missing ESI.  Further, at one of the hearings, the college offered the expert testimony of another of its employees, Mr. Olsen, the Information Technology Systems Manager.  It did not help much.  Among other things, both Bissell and Olsen testified that they did not think the state’s two-year document retention policy applied to them or “normal computer usage,” directly contradicting the hearing testimony of their boss, the Dean.  The testimony of the defense experts was rejected by the court as not credible, and overall, they only served to make a bad situation worse.

District Court Judge Janet Hall not only rejected the defense expert testimony, she rejected the legal arguments of defense counsel as well.  One of the more clever arguments they made, to no avail, was that they could not put an effective hold in place without revealing the true name of Jane Doe. Judge Hall said they should have contacted plaintiff’s counsel and tried to work that out.  Defense counsel’s arguments as to when the duty to preserve commenced were also given zero value.  It seems as if the attorneys’ credibility was completely nullified by the specious testimony of their experts. 

In the end, Judge Hall granted Jane Doe’s motion, and awarded an adverse jury instruction based on the grossly negligent failure of the college to preserve ESI.  She also awarded Doe her expert witness’s costs, which, I suspect, will be quite large. 

In a case like this an adverse inference instruction is almost always fatal to the defense.  For all practical purposes, even though the case has not yet been tried, it has already been lost because of e-discovery. The only real question still remaining has to do, once again, with zeros.  How many will be added to the judgment or settlement?

Although this is all well and good, to me the most interesting aspects of this case are its computer forensic, geek-type technicalities.  First of all, the forensic expert, Delay, and the college IT technician, Bissell, could not agree on whether the computers had been ”wiped.”  Delay opined that the “all zeros” condition of the hard drives showed that they had been intentionally wiped or scrubbed of all data.  Footnote 3 of the opinion explains that:

According to Delay, wiping is a “process that overwrites existing data on the hard drive, making this information unrecoverable.”

 Bissell’s counter explanation is set forth in footnote 6: 

At the Hearing, Wyatt Bissell indicated that he disagreed with the term “scrubbed,” which overwrites a hard drive, completely eliminating all data from it. Instead, Bissell testified the correct word to use is “imaged”–that is, NCC’s [the college] technology modifies the structure of the hard drive, without scrubbing it.

Bissell also testified:

. . . that Delay’s results, i.e., that it appeared that this particular hard drive had been “scrubbed” were because Schmidt’s hard drive was in the process of failing, which can produce inconsistent or corrupt results.

The court did not believe Bissell and found that the computers had been “scrubbed’ or “wiped.”  Judge Hall explained what she meant by these terms in footnote 11:

By “scrubbed” or “wiped” the court means more than overwriting or “reimaging;” it means eliminating all data from the hard drive, such that none of the old data can be read or still remains on it.

It is hard to see how you can reach any other conclusion when presented with a computer hard drive filled with all zeros. That is what most (but not all) data scrubbing programs are designed to do. (For an example of one such program, GhostSurfer, see my blog of June 7, 2007, GhostSurfer Wipe Out Leads to Jail Order Sanction in Bankruptcy Court.)  Most data erasure software physically writes zeros (or ones, or random combinations) to all sectors of a hard drive and thereby completely writes over and erases everything, even residual data existing outside of any organized file structures.  This process is also known as “shredding,” and among Mac users is called “zeroing all data.”  Supposedly there is expensive equipment available that allows for the recovery of segments of a hard drive even after it has been zeroed out.  For that reason, many data shredding programs provide for multiple wipes with various types of random patterns of data filling.  This will defeat even the spy agencies who own such equipment, and so meets the Department of Defense specifications for destruction of sensitive data.  (The really top secret stuff is physically destroyed, cut up into tiny bits (no pun intended), and then dumped into multiple land fills.)

To better understand how this kind of disk wiping works, you need to recall that all computers operate and store information in bits of either one or zero, electrically on or off.  This is the binary code.  Recall also that eight of the on-or-off bits together comprise a byte.  A typical hard drive today has hundreds of billions of bytes.  Thus if a hard drive, or any other ESI device, contains all zeros, or all ones for that matter, it contains absolutely no information at all.   Information can only be stored when both ones and zeros are used in the almost innumerable possible permutations.  This all-zero condition does, however, tell you that the disk has been intentionally wiped.  Contrary to Bissell’s testimony, a computer which has been imaged, or is subject to failures of some kind, would not contain all zeros.  Some information, some combinations of ones and zeros among the billions of bits on a hard drive would remain.  Judge Hall explains how this applies to the case as follows:

Delay found that it contained all 0’s, indicating that every sector had been overwritten. Delay testified that, if the drive had data on it but was failing, as Bissell testified, then data would be seen on it with Delay’s forensic software, which instead recognized that the hard drive was unpartitioned and contained no data. Moreover, Seaborn’s new computer had traces of other users’ information on it, thus showing an inconsistent result in NCC’s process of re-imaging hard drives. Even if it was consistent with NCC’s policy, the fact that Seaborn’s new computer showed other users’ information indicates that “imaging” does not eliminate everything from a hard drive, but leaves some data from old users on it, prompting the question why Seaborn’s old computer–or Schmidt’s computer–did not have any evidence of other users on it. The answers provided by the defendants–a failing drive or “re-imaging”–are rejected by the court as not credible. 

The irregularities in PST files that Delay uncovered are another factor worth mentioning that led Judge Hall to suspect that relevant evidence had been intentionally destroyed by several of the college employees.

Additionally, Delay found the Microsoft Outlook PST files, which house electronic mailboxes, of four individuals had inconsistencies “that indicate [ ] that data has been altered, destroyed or filtered.” Id. at ¶ 6. For example, Professor Skeeter’s PST file contained no Deleted Items and only one Sent Item and the Inbox and Sent Items contained data starting August 2004, “even though other activity is present starting in 2002.” Id. at ¶ 8.

Bottom line, if you are an IT Tech, or expert of any kind, do not try to fast-talk a federal judge with “computerese” and specious theories.  It may fool your boss, and many attorneys, and make you look good for a while, but it will not work in court, and could get you in serious trouble.  If mistakes were made, then admit it. Don’t try to cover it up with technical jargon.  The best advice is to tell the truth and play it straight.  Also, be careful what you say in an affidavit or expert report.  You never know when you may be required to testify at trial to back it up.  You will then be subject to cross-examination, sometimes by a very skilled and knowledgeable attorney, and contradicted by a well-credentialed expert. Finally, from the attorney’s perspective, it is rarely a good idea to do what defense counsel did in this case, and go into an evidentiary hearing on complex IT issues without an impartial outside expert.  It is too dangerous to rely solely on the client’s own IT staff.  As this Jane Doe opinion shows, they can zero out your case real fast.

Judge Trash-Talks the Government for its Discovery Abuses

The United States Court of Federal Claims began a recent opinion imposing sanctions against the government for spoliation by quoting the old saying:

“One man’s trash is another man’s treasure.”

United Med. Supply Co., Inc. v. United States, 2007 WL 1952680 (Fed. Cl. June 27, 2007).  The saying was invoked because the government had shredded much of the plaintiff’s valuable evidence.  After the quote, the Court immediately launched into a high-level righteous rant about the government’s spoliation.

Aside perhaps from perjury, no act serves to threaten the integrity of the judicial process more than the spoliation of evidence. Our adversarial process is designed to tolerate human failings - erring judges can be reversed, uncooperative counsel can be shepherded, and recalcitrant witnesses compelled to testify. But, when critical documents go missing, judges and litigants alike descend into a world of ad hocery and half measures - and our civil justice system suffers.

To guard against this, each party in litigation is solemnly bound to preserve potentially relevant evidence. In this government contract case, defendant violated that duty not once or twice-but repeatedly, over many years, and in sundry ways, leading to the destruction of many admittedly relevant documents. Most disturbingly, some of these documents were destroyed even after the court conducted its first spoliation hearing. While defendant apologizes profusely for what it claims is the “negligence” of some of its employees and for making repeated misstatements to the court as to the steps that were being taken to prevent spoliation, it, nonetheless, asseverates that the court should not-indeed, cannot-impose spoliation sanctions because defendant did not proceed in bad faith. While defendant may be wrong in asserting that it acted in good faith, it most certainly is wrong in thinking that it can recklessly disregard its obligations to preserve evidence without legal consequence.

Id. at *1.

The Judge describes a parade of discovery horribles, recounting in detail the blunders and misrepresentations by the Department of Justice, its attorneys and staff, and the Department of Defense.  Although the case involves some emails and other electronic records, the main spoliation here is from good old-fashioned shredding.  Hundred of boxes of paper documents, including email print-outs, were thrown away for years after suit was filed.  My favorites horribles in the parade include:

• Making false statements to plaintiff and the Court that a complete search had been made, and all responsive documents had been produced, when in point of fact the government had only searched eight of the eighteen facilities. Defense counsel blamed that one on a bad paralegal. Id. at *3, *4, *15.
• Sending some of the preservation notices to key players 5 to 6 years after the suit was filed. Id. at *4, *12.
• Destroying documents both before and after the preservation notices. Id.
• Failing to preserve relevant records for five years after the government had notice of plaintiff’s claim. Id. at *12.
• Sending evidence to the garbage dump even after the Court’s first hearing on spoliation. Id.

The Judge goes on to speak loudly about the need to punish the government and others for this kind of discovery spoliation.  The long and scholarly opinion speaks of the need to send a message of deterrence and impose sanctions, even without proof of bad faith, as that is often an elusive and difficult thing to prove.  The strong words include the following that we are likely to see quoted again in the future.

Guided by logic and considerable and growing precedent, the court concludes that an injured party need not demonstrate bad faith in order for the court to impose, under its inherent authority, spoliation sanctions. Several reasons lead to this conclusion. For one thing, it makes little sense to talk of a general duty to preserve evidence if, in fact, the breach of that duty carries no real legal ramifications. Requiring a showing of bad faith as a precondition to the imposition of spoliation sanctions means that evidence may be destroyed wilfully, or through gross negligence or even reckless disregard, without any true consequences. . . . Second, imposing sanctions only when a spoliator can be proven to have acted in bad faith defenestrates three of the four purposes underlying such sanctions-to protect the integrity of the fact-finding process, to restore the adversarial balance between the spoliator and the prejudiced party, and to deter future misconduct-and severely frustrates the last, to punish. These objectives are hardly served if the court, in effect, is constrained to say to the injured party-”sorry about that, but there is nothing I can do, except to let you present your case, such as it remains.” Indeed, while some commentators have asserted otherwise, the history of the spoliation doctrine suggests that it was not designed solely to punish those who consciously destroy inculpatory documents, but also to address the manifest unfairness inherent in the loss of relevant evidence. Even if such sanctions were once rooted in an inference of consciousness of a weak case, that is neither the controlling rationale nor the prevailing rule nowadays. Finally, adopting a bad faith standard when the court is operating under its inherent authority creates an incongruity between the sanctions available for spoliation depending upon whether-or not-a discovery regime has been established that would trigger Rule 37. This incongruity could be viewed as encouraging the earlier destruction of evidence-a race to the shredder, so to speak. . . .

Id. at *10.

It is the duty of the United States, no less than any other party before this court, to ensure, through its agents, that documents relevant to a case are preserved. Indeed, while not entering into the calculus here, a good argument can be made that, as the enforcer of the laws, the United States should take this duty more seriously than any other litigant. Unfortunately, in the case sub judice, irrefutable evidence demonstrates that over an extended period of time, the United States, acting through at least some of its employees, recklessly disregarded that duty, thereby undoubtedly damaging plaintiff’s ability to present its case in this matter and disrupting the orderly administration of this proceeding. Weighing the seriousness of the fault here, as well as its impact on plaintiff and the integrity of the judicial process, the court concludes that it must impose spoliation sanctions against the United States.

Id. at *15.

After such tough talk, you would expect the opinion to conclude with the imposition of many harsh and stinging penalties to sanction the government for its skullduggery. Perhaps an order to jail, as in the bankruptcy case described in my Blog of July 7, 2007, or the entry of a default judgment,  or at the very least, the imposition of an adverse inference as in the Optowave case discussed in the Blog of November 11, 2006.  You would be wrong! 

Instead, the 18-page opinion ends with a sanction that merely limits the government’s cross examination of plaintiff’s experts, and provides for some reimbursement of fees and costs incurred by plaintiffs on discovery. Perhaps this is a stronger penalty than it appears. I don’t know, but certainly the plaintiff was disappointed by this seemingly wimpy outcome, especially after such a big build-up in the first 16 pages of the decision.  Apparently, one judge’s harsh sanction is another’s slap on the wrist.

The Judge did not give the plaintiff the default judgment it wanted because, in his words, of the lack of ”any proof suggesting that the destruction of the records was purposeful and designed to obscure the truth.” Id. at *17.  Does that sound like the same judge?   I can just hear some would-be-spoliators’ glee, saying that discovery sanctions are just a paper tiger, there is no real need to preserve evidence.  The worst thing that can happen is a stern lecture, just some trash talk, and little more.  But don’t kid yourself; that would be serious mistake, especially if you are not the Department of Justice.  The next judge could have a different favorite saying, such as “Speak softly and carry a big stick.”  In that case, watch out: jail time or default could be a harsh reality for this kind of discovery behavior.

Second Edition of The Sedona Principles and the Need for Proportionality

The Sedona Conference  this week published the second edition to The Sedona Principles: Best Practices Recommendations & Principles for Addressing Electronic Document Production (June 2007).  As a Sedona Conference member, I may be somewhat biased, but it is safe to say that everyone in the e-discovery world considers The Sedona Principles a key document for understanding electronic discovery and best practices.  This is especially true of the judiciary, who play an active role in Sedona.  Many district court judges across the country cite to The Sedona Principles and consider it to be authoritative.  The new  Principles can be downloaded for free at the Sedona website, so long as the copy is for your personal use only. 

If you have not read the first edition published in 2004 (with annotations revised in 2005), I strongly recommend you now go ahead and read this new and improved second edition.  To those who have studied the original Sedona Principles, relax, the 14 Principles remain the same, although they have been reworded somewhat.  This is a refined and updated version, not a radical rewrite, which is hardly necessary or appropriate after only three years.  But, you will still want to download and begin using this new version ASAP.  It is a significant improvement over the first edition in several respects. 

First, and most importantly, the second edition now ties directly into the new Federal Rules of Civil Procedure, most of which were significantly influenced by the Principles. The interface between the 14 Principles and the new rules is well explained. All of the Principle Commentaries have been updated and refined, but especially the Commentaries for Principle 12 on metadata, and Principle 14 on the imposition of sanctions. The Resources and Authorities provided with each Comment have been updated to include several new e-discovery cases and articles. In the process the total text has grown 30%, from 56 to 73 pages (excluding Appendixes). Finally, the second edition is more user-friendly and better written than before. For instance, it now includes a handy chart in the front that lists Topics correlating to the Principles, Federal Rules, and Sedona Commentary.

The new Preface makes the point that the Conference tried to keep the “rule of reasonableness” foremost in mind when writing and revising these e-discovery principles and best practices.

That rule is embodied in Rule 1 of the Federal Rules of Civil Procedure (courts should secure the just, speedy and inexpensive determination of all matters) and is applied through former Rule 26(b)(2) (now renumbered as Rule 26(b)(2)(C) - proportionality test of burden, cost and need) and in many state counterparts. The rule of reasonableness means that litigants should seek - and the courts should permit - discovery that is reasonable and appropriate to the dispute at hand while not imposing excessive burdens and costs on litigants and the court.

The best practices recommended by Sedona must always be tempered by proportionality. In other words, what may be reasonable for a ten million dollar case may be impractical for a routine case that barely makes the federal jurisdictional minimum.  That point is also embodied in Principle 2, which counsels application of the proportionality standard in making a costs-versus-needs analysis to determine what e-discovery efforts are appropriate. The Preface goes on to expand upon this point as follows:

Electronic discovery is a tool to help resolve a dispute and should not be viewed as a strategic weapon to coerce unjust, delayed, or expensive results. The need to act in good faith also extends to the efforts taken to reasonably preserve relevant electronic information, to the form of the production, and to the allocation of the costs of the preservation and production. All discovery issues should be considered in light of the nature of the litigation and the amount in controversy, as well as the cost, burden, and disruption to the parties’ operations.

If only all counsel would remember and follow these wise dictates, and judges would enforce them, we would all be better off. The reality is, many litigants are misusing e-discovery as a strategic weapon, including the so-called “weapons of mass discovery” as discussed in my June 20, 2007, Blog on discovery of computer RAM memory.

This is a key point for me, and so I am pleased that the newly revised Comment 2.b. now emphasizes how the total costs of e-discovery must be considered, not just the costs of retrieval and production:

Costs cannot be calculated solely in terms of the expense of computer technicians to retrieve the data but must factor in other litigation costs, including the interruption and disruption of routine business processes and the costs of reviewing the information. Moreover, burdens on information technology personnel and the resources required to review documents for relevance, privilege, confidentiality, and privacy should be considered in any calculus of whether to allow discovery, and, if so, under what terms. In addition, the non-monetary costs (such as the invasion of privacy rights, risks to business and legal confidences, and risks to privileges) should be considered. Evaluating the need to produce electronically stored information often requires that a balance be struck between the burdens and need for electronically stored information, taking into account the technological feasibility and realistic costs involved.

Comment 2.b. at page 17 of Sedona Principles.

This point about hidden costs needed to be emphasized.  It has been overlooked multiple times in the last several years, especially by over-reaching plaintiffs and less-discerning judges.  The disruption and privacy factors are hard to quantify, but are very real and burdensome. Further, the cost of review is skyrocketing out of control, despite some attempts to export the work to low paid hourly lawyers in India.  The attorney fees incurred to review ESI for relevance, privilege, confidentiality, and the like, now constitute the bulk of all e-discovery expenses. The estimates I have seen range from a low of 40% to a high of 60% of total e-discovery costs. 

All of these costs, especially review expenses, should, in my opinion, be considered by the courts in any proportionality analysis of whether to allow discovery, or to shift the costs of discovery.  These costs should be considered regardless of whether or not the ESI at issue is “reasonably accessible.” Unfortunately, Rule 26(b)(2)(B) does not expressly say that.  It provides for cost-shifting only if the ESI is inaccessible. For that reason, a request for accessible ESI that would impose unreasonable expenses on the producing party must be opposed on the proportionality test under Rules 1 and 26(b)(2)(C), Federal Rules of Civil Procedure, and Sedona Principle 2. Only in this way can the integrity of the judicial system be protected from the intentional misuse of e-discovery to force settlements based on expense avoidance, instead of merit.

GhostSurfer Wipe Out Leads to Jail Order Sanction in Bankruptcy Court

A debtor in a bankruptcy was recently caught destroying evidence using a popular software program called GhostSurf.  United States v. Krause (In re Krause), 2007 WL 1597937, 2007 Bankr. LEXIS 1937 (Bankr. D. Kan. June 4, 2007).  The debtor was an attorney representing himself.  The case proves the old adage that “a lawyer who represents himself has a fool for a client.”  The lawyer used GhostSurf to try to wipe all incriminating evidence from his computers before producing them to the government.  His GhostSurf wipeout failed, and he was ordered to jail as a result.

The lawyer-debtor owed over three million dollars in back taxes and claimed poverty. He resisted e-discovery at first, but was eventually ordered to produce his computers for imaging and inspection by the government’s forensic experts. Immediately after the court order, the lawyer installed GhostSurf on his computers and used it to super-delete thousands of files from his hard drives. This software is designed to allow anonymous internet surfing.  It includes an application called “Tracks Cleaner,” which tracks and cleans files in all applications. It is similar in operation to another well known file shredding  program called “Evidence Eliminator” discussed in Kucala Enterprises, Ltd. v. Auto Wax Co., Inc., 2003 WL 21230605 (N.D. Ill. 2003).

The bankruptcy court’s description of GhostSurf’s “super-deletion” functions is very informative.  It makes it easier to understand the differences between: (1) simple deletion, where you just delete a file or email one time; (2) ”double deletion” where you delete a file, and then also empty the trash; and, (3) ”super-deletion”, the method employed by GhostSurfer and other software like it.  Super-deletion is designed to meet Department of Defense specifications for total file shredding, beyond the reach of forensic experts.  The different types of file deletions and data remanence can be very confusing. The following excerpt from Judge Nugent’s 30-page opinion sheds some needed light on the subject:

GhostSurf is designed to wipe or eradicate data and files as part of its protective and security functions.  . . . in such a way that the data is actually overwritten, precluding the ability to recover or restore the files and data. Both experts agreed that when a user “deletes” files from a hard drive, the data remains intact. The act of deletion merely eliminates the “pointer” that allows the computer to locate the data on the hard drive. By using data recovery software, that data may be extracted (as, indeed, some has been in this case). An additional step is necessary to eradicate this data entirely. GhostSurf performs this function by overwriting the file with a new file that contains no bytes of data and is named in a manner inconsistent with Windows operating system naming conventions. Rather than simply eliminating the pointer to the data, the actual recording of the data on the hard disk is erased (like taping over an existing tape recording).

Deleted e-mail leaves a different set of tracks. When a user “deletes” an e-mail in Outlook Express, the “fields” are deleted and sent to the trash or recycle bin. What remains on the hard drive are the HTML internet codes that define the fields, font, graphics, etc. of each message. What also remains is the actual e-mail message. When the trash bin is emptied, the matter itself is deleted. Because e-mail files are internet files, each time they are accessed, a temporary internet file (”temp file”) is created. Thus, even though the e-mail itself is deleted, the temp file remains on the hard drive, unless it is wiped.  . . .

Taylor testified that GhostSurf wipes files by searching the hard drive for files that Windows “no longer knows about” because they have been previously deleted, and writing data over those locations with random data to obscure it from undeleting. Once the files are overwritten in this fashion, an undelete utility cannot recover them.  . . .  According to the GhostSurf User’s Manual, the application may be set to erase files using different strength algorithms. If the weaker algorithms are used, the manual suggests “nearly all” of the targeted files will be erased. In short, GhostSurf is a very powerful tool that Krause could easily have used to purge files and data from his computers before turning them over to the Trustee.

Id. at *5, *7

The popular file wiping program did its job effectively.  Following Department of Defense computer file erasure protocols, it erased the files multiple times, rewrote the affected hard drive space with zeros, and set up fake file names.  Bottom line, there was no way to recover these files.  They were super-erased, and the forensic experts could not restore them.

But, the lawyer slipped up in at least two ways, and his scheme to destroy evidence was exposed.  First, he did not hide his use of the GhostSurf software very well.  It was easy for the forensic experts to see how many files were deleted and when (right after the order).  Second, a few of the files were not visible to GhostSurf, probably because they were “orphan files,” and so they were not super-deleted by GhostSurf.  Id. at *9.  As a consequence a few temporary internet email and web browser files were not wiped from on the hard drives. These files showed that the bankrupt debtor had recently traveled to Zurich, Switzerland to pursue investment opportunities, and suggested that he had substantial, secret offshore assets.

It is interesting to note that even though the metadata showing dates had been deleted along with the files, the forensic experts were still able to prove that they were very recent, and thus very relevant. They used an ingenious method to date these files.  The debtor’s computers used Norton Antivirus software.  It keeps its own log of all files checked for viruses when downloaded from the Internet.  The Norton logs they located did not have download time information, but the forensic experts were still able to prove that the erased files had been recently downloaded.  They could do that because the logs showed that a recent version of the software had been used to inspect these files. Id.

When a motion for sanctions for spoliation brought all of this to the attention of the bankruptcy court, the judge gave the lawyer-debtor a choice. He could either turn in backups of his computers that contained the deleted files, or go to jail. Either way the judge also ordered him to turn in his passport, entered a partial default judgment, ordered the repayment of $59,710 to the estate, and entered other sanctions.

To reach this result, the court had to consider and reject a series of excuses offered by the debtor to try to explain the wipe-out of so much evidence from his computers.  He offered the classic hard drive crash excuse, and also claimed that he only used GhostSurf for legitimate purposes, a type of routine, good faith destruction argument under Rule 37(f).  Here is the actual language of Chief Bankruptcy Judge Robery Nugent in Kansas City disposing of these arguments:

Based upon the evidence presented here, it is clear that Krause (a licensed Kansas lawyer) violated his duty to preserve electronic evidence. He candidly admitted that he never reviewed his hard drives to determine if he had electronic evidence that was responsive to the Government’s RFP. In fact he took the belated and frivolous position that the RFP did not encompass electronic evidence. He continued his routine practice of deleting e-mails. Finally, he made no claim that he deactivated or uninstalled the GhostSurf wiping software program upon service of the Government’s adversary complaint or RFP. Nor is Krause saved by his alleged computer crashes. One, those crashes occurred several months after the adversary was commenced and the Government’s document requests were served. If he had backed-up his computers, he has not been forthcoming with the back-up data or files. Two, once Krause restored the computers, he again installed GhostSurf and ran the wiping program on both computers.

id. at *20. 

When a litigant responds to an e-discovery request by installing and using a super-deletion type of software program such as GhostSurf for the first time, they will probably be hoisted by their own petard.  Once uncovered, such actions provide compelling proof of intentional destruction of evidence.  In the words of the court:

The deliberate and intentional use of a wiping software program such as GhostSurf and the timing of its use further leads the Court to the inescapable conclusion here that Krause willfully and intentionally destroyed electronically stored evidence. Although Krause professed earnest concern for the protection and security of his computer files and personal and financial information, he testified to no incidents where his computer or internet security had been previously compromised while using other standard security software or protective measures (e.g. Norton Antivirus) that were also loaded on his computers. No evidence was presented that these standard non-wiping security protections were inadequate for Krause’s use of his computers. Apparently, no previous experience or incident prompted him to go out and buy a software wiping program such as GhostSurf 2006. Nor was any credible evidence presented that Krause had run GhostSurf or any other wiping software program on his computers at any period of time prior to the commencement of the adversary complaint in November 2005. The Court concludes that Krause purchased the GhostSurf 2006 wiping program after the adversary complaint was filed and after the duty to preserve attached. He installed and ran it. This constitutes a willful or intentional spoliation of evidence.

Id. at *21. 

The producing party here argued that new Rule 37(f) provided him protection from sanctions because he claimed that his use of GhostSurf was routine, and made in good faith to try and protect his privacy.  The lawyer-debtor argued that he always super-deleted his files in this way.  The evidence on this was weak at best.  The defense was obviously a ruse, as the software was never even installed until after the order compelling discovery.  In any event, even assuming he had routinely used GhostSurf before the order, the Rule 37(f) safe harbor would still not apply.  In these circumstances, after the Order to produce is entered, and probably well before then, when suit is filed, or even contemplated, the producing party is obliged to suspend such file deletion.  In Judge Nugent’s words:

Nor can Krause claim that his use of GhostSurf 2006 was a good faith “routine operation” of his computers. With the 2006 amendments to the Federal Rules of Civil Procedure, a party enjoys a safe harbor from sanctions where electronic evidence is “lost as a result of the routine, good-faith operation of an electronic information system.” Fed.R.Civ.P. 37(f). . . . . . 

The undisputed evidence established that Krause’s hard drives were far from being at full capacity thus making it improbable that electronic information was being overwritten or deleted by routine operation of his computers. Just as a litigant may have an obligation to suspend certain features of a “routine operation,” the Court concludes that a litigant has an obligation to suspend features of a computer’s operation that are not routine if those features will result in destroying evidence. Here, that obligation required Krause to disable the running of the wiping feature of GhostSurf as soon as the preservation duty attached. And it certainly obligated Krause to refrain from reinstalling GhostSurf when his computers crashed and he restored them.

Id.

In this case there was strong evidence of bad faith, intentional destruction of evidence, and that the files deleted were crucial to the case. In these circumstances, a court will usually impose severe sanctions on the spoliating party.  The reasoning is well explained in this case:

Because no one will ever know what was on those computers before they were wiped and purged with GhostSurf, the Trustee and the Government have been severely prejudiced in the prosecution of their claims against Krause. It may have irretrievably lost relevant and probative evidence that supports their case against Krause. A sampling of some of the orphan files and temporary internet files that the Trustee was able to salvage from Krause’s hard drives suggest that Krause has been engaged in significant internet activity during the pendency of this case related to investments, more involvement with additional entities, use of off-shore contacts and conduits to conduct business and financial activities and trafficking in frozen assets. Because the computers appear to be the “nerve center” of Krause’s business interests, including all of the alleged “sham” entities of which he denies ownership, their alteration significantly harms the Trustee’s and the Government’s ability to go forward and show Krause’s connection. The Trustee has shown enough from the salvaged e-mails and temporary internet files, however, to persuade this Court that the electronic evidence purged by Krause would have been relevant to these proceedings. The Court infers that the lost electronic evidence is relevant, as it is entitled to do, because of Krause’s willful and intentional destruction of it.

Id. at *22.  

Spoliation misconduct should never be tolerated in any court, but it is especially harmful in bankruptcy proceedings.  In my opinion Judge Nugent was correct to react in a strong and forceful manner to protect the integrity of the system.  As he explained:

Krause’s willful misconduct with respect to the spoliation of electronic evidence and turnover of his computers cuts to the heart of a chapter 7 bankruptcy debtor’s duties, far more onerous than those of a litigant involuntarily snarled in civil litigation. The Bankruptcy Code and Rules are designed to prevent, not foster, a game of “hide the pea” with the Trustee. The Court has repeatedly warned Krause about the repercussions of not making full, complete, and accurate disclosure and not cooperating with the Trustee. [FN88] The Court has progressively conditioned Krause’s conduct, without success. There is nothing left for the Court to do now but administer sanctions that mirror the egregiousness of his conduct. . . . . The willful destruction of electronic evidence has supported the most severe of sanctions, including entry of judgment against a defendant and dismissal of a plaintiff’s case.  [FN89]

Krause’s running of the GhostSurf wiping program after being ordered to produce electronic evidence and before turnover of his computers is simply inexcusable.

Id. at *23. 

The bankruptcy court then entered a whole series of sanctions against the debtor-attorney, including an order to turn over information and computers, and gave him ten days to comply.  To make it clear that he meant business, Judge Nugent included the promise of jail should the lawyer-debtor fail to full comply:

3. If after a period of ten (10) days Krause has not satisfied the foregoing sanctions:

(a) default judgment will be entered against Krause declaring that the Krause Children’s Trusts I, II, III, IV and V are his nominees and property of the estate subject to turnover; and

(b) a bench warrant will issue for Krause’s apprehension and he will be incarcerated until he complies with these orders.

Id. *25.

After imposing sanctions for spoliation, the court went on to find that the debtor was also in contempt for violation of the court’s original discovery order, and other violations.  For this reason, the court also entered essentially the same sanctions based on contempt.  Id. at *26-28.

I checked the docket sheet after the entry of this order.  It appears that the lawyer-client has since given himself better advice.  The docket indicates that he turned in his passport, produced computers and backups apparently as ordered, and filed an appeal.  We will wait to see how this is handled on appeal, and whether the spoliating lawyer is able to remain out of jail.