“Book ‘em Danno”: Hawaiian Judge Sanctions Company for Trusting its Top Officers after One Wipes His Laptops, Allegedly to Hide Porn

A federal court in Hawaii recently imposed severe sanctions against a company for facilitating spoliation by trusting its top officers not to intentionally destroy evidence. In re Hawaiian Airlines, Inc., Debtor; Hawaiian Airlines, Inc. v. Mesa Air Group, Inc., 2007 WL 3172642 (Bkrtcy. D. Hawai’i, Oct. 30, 2007).  Defendant’s Chief Financial Officer panicked after he received a litigation hold notice and wiped files from his laptops. The plaintiff later claimed these files would have proved its case. The CFO said no, he was just trying to hide porn, but the judge didn’t believe him, and threw the book at ‘em instead.

The defendant, a regional airline company, Mesa Air Group, Inc., was sued by a bankrupt competitor for an alleged breach of a confidentiality agreement. Mesa responded by sending out a written legal hold notice. The notice instructed key players to preserve all ESI on their computers that might be relevant. Mesa timely sent out the first hold notice to its top three officers the day after the suit was filed. It trusted that they would comply with the notice and the law. It trusted that they would not act in bad faith and intentionally destroy relevant evidence.

Big mistake, according to United States Bankruptcy Judge Robert F. Faris. The defendant should not have trusted its employees, even its top officers. It should have assumed they might disobey the hold notice and the law. Mesa should have assumed its people would respond to a hold notice by destroying evidence, not preserving it. It should not only have sent out a hold notice, it should have made backup copies of the hard drives of all of its employees who might have discoverable ESI on their computers. That way, if they responded to the hold notice by deleting incriminating evidence, the company would still have a backup copy of everything to produce to the other side. (For this strategy to work the company would have to make these copies in a stealthy manner before the hold notice was sent.)

To do any less than that was, according to Judge Faris, to “facilitate” the spoliation of evidence, subjecting the company to severe sanctions; in this case, multiple adverse inferences and a fee award. The sanctions were imposed in this case even though the CFO acted alone, and there was no evidence that Mesa or its attorneys “knew of or condoned” the destruction of evidence.

According to Judge Faris, Mesa should have distrusted its Chief Financial Officer and assumed that he would destroy all relevant evidence on his three company computers (two lap tops and a virtual drive on a server) as soon as he found out about this lawsuit. On the oft chance their CFO had something incriminating to hide, and was willing to break the law to hide it, Mesa should have made copies of his various computer hard drives, and not simply relied upon a written notice. In Judge Faris’ words: 

13. Mesa could have taken reasonable steps that would have prevented, or mitigated the consequences of, Mr. Murnane’s destruction of evidence. For example, Mesa could have made a backup of Mr. Murnane’s H drive and the hard drives of Laptop 1 and Laptop 2 promptly after HA filed suit. Doing so would not have been costly, burdensome, or unduly disruptive of Mesa’s business. Instead, Mesa simply told Mr. Murnane to preserve all evidence and trusted him to comply. Even though Mr. Murnane was a valued, trusted, high level employee of the company, Mesa could and should have taken reasonable steps to prevent all of its employees from doing wrongful and foolish things, like destroying evidence, under the pressure of litigation. Because Mesa failed to take such steps, Mesa facilitated Mr. Murnane’s misconduct.

It is true that the imaging of two laptops and a virtual drive would not, in and of itself, have been terribly burdensome or expensive. But does that justify the mandatory stealth imaging of all impacted employees? Mesa is an airline of over 5,000 employees, generating revenues of over $1.4 billion per year. The opinion states that only three employees were sent the original preservation hold notice, the three top officers of Mesa: the CFO, CEO and the President. If in fact only three custodians were involved throughout, which to me seems unusual, then the court’s low cost and burden argument has some merit, even if it is still questionable on policy and practical grounds. But if other hold notices were later sent out to dozens of additional ESI custodians, which to me seems more likely, then the court’s economic analysis is flawed.

The policy of mistrust is also, in my view, not well considered. Although hindsight is 20/20, how was Mesa to have known when suit was filed that its Chief Financial Officer might destroy evidence? There is nothing in the opinion to suggest he was anything other than a trusted and reliable senior management employee. If Mesa could not trust its Chief Financial Officer, then it could not trust anybody. By this logic, in every lawsuit Mesa would have to image the computers of all key witnesses and ESI custodians who might have discoverable ESI in them. Any of them might do “wrongful and foolish things” under the pressure of litigation. Where would this lead? I am reminded of the quote by Ralph Waldo Emerson: “Our distrust is very expensive.” The copying of dozens, if not hundreds, of computers can become very expensive. Is it really reasonable to expect large organizations to always act out of mistrust and fear that it might have a renegade employee, one who is willing to break the law and destroy evidence? Is it really fair to hold that an employer facilitated its employees’ bad faith destruction of evidence, simply because it did not copy all potentially impacted computers as soon as a suit was filed?

Also, as a practical matter, how was Mesa supposed to have copied its top officers’ computers before they had notice of the law suit, and thus an opportunity to delete files from these computers? They are the first ones to learn of a suit like this, and are necessarily involved in discussions with the lawyers on what to do, who should be provided with a hold notice, and the like. Is it realistic to require legal counsel to copy everything on the computers of the top officers of a company any time a suit is filed where they might be involved as a witness? Should in-house counsel be required to do so surreptitiously, even before the officers are told about the lawsuit? I doubt they would last very long if they did! Such extreme measures should, in my opinion, only be employed in very rare circumstances where there is strong evidence that the action is required, that otherwise there is a substantial likelihood evidence will be destroyed. Even then, it should be used with caution. The extreme process of imaging all computers should never be used in a case such as this, where there is no advance warning of possible spoliation, much less a strong showing of likely destruction of evidence.

Beyond the questionable holding, the facts underlying this case are interesting on a number of levels, including the technical “geek” perspective. Mesa’s CFO was said to be “an experienced and knowledgeable computer user.” He installed a program called System Mechanic Professional 6 on both of his company owned laptops, and used it to super-delete files from them. He attempted to disguise the timing of these deletions by changing the dates on the computers before he ran the software. He did not know that forensic analysis can easily detect such system clock changes. The CFO also stored files on a company server, called his “H drive,” but he did not use special software to super-delete any files there. Some files on his “H drive” were deleted, and apparently could not be later restored due to normal usage, but were recovered from backup tapes of the server. These and other technical details are explained by the Court:

System Mechanic has a subprogram called DriveScrubber2 that permanently deletes files from a computer.

7. When an active file (a file that a user can view) is deleted on a computer using the Windows operating system, the data comprising the file is not erased; instead, the file is removed from the “index” of all active files on the disk, and the disk space that contains the deleted file is gradually written over as new files are written to the disk. A person with the appropriate skill and software can analyze the bits of data left on the “unallocated space” of the drive (the portions of the disk that, according to the “index,” do not contain active files) and reassemble some or all of the deleted files. “Disk wiping” programs like DriveScrubber2 render deleted files unrecoverable by writing meaningless data (usually repeated strings of hexadecimal characters) to the unallocated space of the disk, permanently eliminating the residue of previously deleted files.

Later forensic exams of the CFO’s laptop computers could not recover the  super-deleted files, but they did prove that Drive Scrubber was used after the hold notice was received. The exams also revealed a clumsy attempt to conceal the disk wipes by changing the system clock to a time before the hold notice. As to the files ordinarily deleted from the network server “H drive,” Mesa was able to recover “many, if not all” of them by restoring the backup tapes of that drive. Some of the restored files were relevant, but none were “smoking guns.” 

The CFO did come up with a creative defense to his actions. He claimed he was trying to hide the fact that he had been viewing “adult materials.” Judge Faris did not believe this testimony. For one thing, Mesa’s CEO, who the judge said was a good friend of the CFO (and thus obviously trusted him), testified that his friend had ”told him he had wiped the hard drives in order to conceal adult content on his computers.” Still, according to Judge Faris:

It was absolutely clear from Mr. Ornstein’s words and demeanor on the witness stand that he did not believe Mr. Murnane’s “adult content” explanation.

I do not know what the CEO’s demeanor was like when he testified about his friend’s excuse - no doubt he was embarrassed - but obviously the CEO believed him or he would not have offered the story. Also, the opinion admits that evidence was offered that the CFO’s laptop was previously found to have adult content in two prior incidents in 2003 and 2004. But Judge Faris was more impressed by the facts that no adult materials were found on the laptops now, nor on the “H drive”, and the IT tech who “regularly worked” on the laptops testified that he had never seen adult content on the computers. 

Also, Judge Faris commented that the CFO never took the stand to testify, and he found that:

It is not credible to suggest that a high-level officer and busy person such as Mr. Murnane would have done a mundane task like this himself rather than leaving it to Mesa’s IT department.

That does not have the ring of truth to me. If a person, no matter what his rank, has the time and indiscretion to view porn on his company laptop, then it does not surprise me that he also has time to wipe it clean, and would not want talkative IT employees to do it for him. No one, especially a “high-level officer,” would want to entrust such a sensitive, and potentially embarrassing task to the company’s IT department. The super-deletion process is not really too hard or time consuming, as the judge here seems to recognize by calling a “mundane task.” So it is not at all surprising that someone would want to do it themself, much less “not credible.”

The timing of the CFO’s deletions of alleged “adult materials” was too suspicious. There were also several indications that the CFO had taken and used confidential information of the bankrupt Hawaiian Airlines, and thus Mesa had breached the confidentiality agreement as alleged. These other facts seemed to color the court’s analysis of the spoliation motion and conclusions that:

b. The confidentiality agreement provides that “Mesa shall be responsible for any breach of this agreement by Mesa’s employees, officers and Representatives….” Mesa should also be responsible for the intentional destruction by one of its highest ranking officers of evidence that could have shown whether Mesa complied with that agreement.

c. Mesa could have prevented Mr. Murnane from destroying evidence, or at least limited his ability to destroy evidence, by taking reasonable, inexpensive, and non-burdensome steps. Mesa failed to do so and is responsible for the consequences of that failure.

For these and other reasons, Judge Faris granted plaintiff’s motion for sanctions, imposed multiple adverse inferences and taxed fees, but stopped short of entry of a default judgment as plaintiff had requested.

Federal Judge Tries Experimental Method to Resolve a Major e-Discovery Dispute in Non-Adversial Manner

District Court Judge William Haynes, Jr., in Nashville recently tried to move litigants out of a traditional adversarial approach to e-discovery, and into a more cooperative kumbaya mode. How did he do it? He scheduled a hearing and requested all of the attorneys and their IT experts to be present. Then when they arrived, he asked all of the lawyers to leave so that the experts could work things out in peace. I kid you not!

Judge Haynes faced a frustrating maze of technical disagreements on e-discovery issues when he took over a politically charged class action from another judge. He hoped that if the parties’ computer experts could just talk amongst themselves about the complex technical issues, without the “help” of all of the lawyers, they could solve the problems, and reach an agreement. John B. v. Goetz, 2007 WL 3012808 (M.D. Tenn. Oct. 10, 2007), and the 187 page Memorandum Opinion (”Memo”) filed with it (which can be downloaded here in four parts: pages 1-47; pages 48-94; pages 95-144, and pages 145-187) (not yet published).

At first Judge Haynes’ surprise tactic worked beautifully. The lawyers went away quietly, the technical experts remained in the courtroom, and by day’s end they had reached an agreement on a number of issues, including a list of fifty keywords to search the defendants’ computers. In Judge Haynes’ words:

In reliance upon precedents in this district involving complex matters, the Court directed the parties’ computer experts to confer, without the presence of their counsel, to develop a protocol and/or memorandum of understanding to address the cited problems with electronic discovery. The “experts only conference” was held without objection by any counsel and yielded positive results that were appreciated by the parties’ counsel.

Memo pgs. 39-40. The experts’ agreement was made on the record and later converted to a stipulated Order.

Judge Haynes seemed to be onto something here. By simply requiring experts to hash out agreements on technical e-discovery issues by themselves, these disputes could be resolved quickly and relatively inexpensively. Judge Haynes’ idea to transcend the adversarial process, at least for purposes of e-discovery, is in line with that of most experts. They all agree that complex e-discovery issues do not lend themselves to effective solution in the adversarial model. Complex technical issues are best solved with a degree of cooperation and transparency previously unheard of in our adversarial system. The Bench and Bar are being pushed in this new, and some would say “radical,” peaceful-collaborative direction out of necessity. The traditional “hide the ball” model simply does not work in complex ESI discovery. It frequently costs the parties far more than the case is worth, and can produce huge, time consuming, and sometimes outcome dispositive mistakes.

The judge had the right idea, but clearly the method he employed (ordering the attorneys to leave) was doomed to failure, especially in a very political case like this. Since the parties and their counsel did not initiate the departure, their return with a vengeance was inevitable. Still, kudos to the Judge for trying. Perhaps in another case the “expert only” courtroom dialogue technique might work, especially if it is not imposed upon the parties by the judge.

But in this Tennessee case, after a promising start, the experiment quickly failed. When Defendants later conducted the keyword search, they decided not to follow the agreement/order. Instead, “Defendants unilaterally selected two search terms and insisted upon a date-limited search.” Defendants’ lawyers later argued that they had no choice but to depart from the agreement of their experts, and use only 2 search terms, instead of 50, because they were rushed for time due to a pending evidentiary hearing on another issue. Later, the defense attorneys added a new argument, that the 50-term search would be too costly, that it would have produced far more ESI than the State could ever afford to review. (Odd their experts never thought of that.)

When the court heard these reports, it scheduled another “experts only” conference for April 11, 2007, “to define the parties’ technical disputes and to implement the Court’s Orders requiring the production of responsive ESI.” Memo pgs. 41-42. At the commencement of this second “no lawyers allowed” conference, two lawyers appeared and objected to their exclusion. These objections were overruled, and the conference proceeded without attorneys, but with a court reporter. The transcript was later filed under seal. The Judge only appeared and participated in the “expert only conference” to announce protocol for the conference and to hear the experts’ reports on their progress.” Memo pg. 42.

Once again, the “no lawyers allowed” courtroom conference purportedly went very well, and the experts reached a number of new agreements. At the conclusion of this hearing the Judge directed the defendants’ lead expert “to prepare a written summary of the experts’ agreements and to circulate that document among all experts for comment and to file that report with the Court.”

After the conference, the lawyers got involved again, and, as the Court puts it, “disputes resurfaced.” The Plaintiffs then renewed their earlier motion to compel. The Court gave up on the “experts only” approach, and instead scheduled a full evidentiary hearing, a mini-trial on e-discovery issues with everyone invited, experts and lawyers alike.

Before I go into e-discovery findings and holdings that came out of this trial, a little background into the case itself is needed. This is a class action to require the State of Tennessee, and the health care providers under contract with the State, to provide the children of Tennessee with the minimum health care required by federal law. The case started in 1998, at which time Tennessee and other Defendants almost immediately consented to a judgment. Six years later, the Judge assigned to the case, Judge Nixon, held that the State Defendants had consistently violated the terms of the Consent Decree, and disobeyed a series of his orders. Judge Nixon was clearly upset with Tennessee’s willful non-compliance and hard ball discovery tactics. The situation deteriorated to such an extent that in late 2005, Judge Nixon felt he had to recuse himself from the case.

In February 2006, the new judge assigned to the case, Judge Haynes, scheduled his first hearing to discuss the case status. At that conference, one of the Defendants many attorneys “announced that the Defendants had achieved compliance with the Consent Decree.” Memo pg. 34. This announcement thereafter triggered a new round of discovery from the Plaintiffs seeking evidence of the claimed compliance, including extensive ESI production. This led to a series of motions and arguments on e-discovery that prompted Judge Haynes to try his “expert only” conference tactic.

As discussed, these “no lawyers allowed” conferences succeeded at first, but ultimately failed when the lawyers took over again. Most of the 187 page October 10, 2007, Memorandum consists of a very complete listing of the parties’ evidence, and the court’s findings and holdings. The two page Order accompanying the Memorandum provides instructions on what the parties are to do thereafter. John B. v. Goetz, 2007 WL 3012808 (M.D. Tenn. Oct. 10, 2007).

The Memorandum begins by agreeing with the Plaintiffs that the 1998 Consent Decree required production of the State’s “electronic data files” as needed to verify compliance. In spite of this, the Defendants never sent out a legal hold notice until 2004. Even then, there was no followup to the notice, no attempts were made to implement the hold, or to verify compliance. In the words of the Court:

. . . the proof is that Defendants left their employees to decide on their own what to retain without evidence of any written instruction or guidance from counsel on what is significant or material information in this complex action.

Memo pg. 126. The State could not even show who it sent the notice to, much less verify that there was adequate compliance.

Some of the key custodians testified that they were not sure they ever received a notice, and never made any special efforts to preserve the relevant ESI on their computers, or in their departments. There was also evidence of computers wiped after employees left and other evidence that computer files were destroyed. Moreover, the State’s standard six month ESI retention policy was not suspended. This resulted in an automatic deletion of ESI on almost a daily basis.

Fifty of the key custodians produced no emails at all, including the Governor and several of the named defendants in the case. Further, a privilege review had never been conducted for most of the ESI that was collected. The Defendants said that such a privilege review was too burdensome, and of course, they would not produce ESI without first reviewing for privilege. So virtually no ESI production was ever made, just reams of paper documents, including printouts of email.

The paper production was obviously incomplete, and deprived the plaintiffs of all metadata. The Plaintiffs wanted native files with metadata intact. Defendants argued that they had to produce in paper so that they could Bates stamp everything to ensure authenticity, and that you cannot Bates stamp a native file. The Judge saw through that, and pointed out that “‘Hash coding’ can be attached to metadata to ensure its integrity.” Memo pg. 137. See my law review article, HASH: The New Bates Stamp, 12 Journal of Technology Law & Policy 1 (June 2007), for much more on that topic.

This Memorandum Opinion is very long. So you could go on and on describing the nearly never ending parade of horribles, including exaggerated estimates by Defendants’ experts of the costs of compliance, but you get the point. The Memo also includes 83 pages of legal conclusions, discussing a wide variety of e-discovery legal issues, including the new rules, and relying heavily on Zubulake. Memo pgs. 102-185. (So much for the “heartlands are unlikely to follow Manhattan” argument.)

The Court’s handling of Defendants’ undue burden argument is interesting. Memo pgs. 139-142. The Court found that Defendants’ “unduly exaggerated” the projected costs of their ESI collection and privilege reviews. Further, the Court was convinced that Defendants could reduce their projected costs by the use of keyword searches for privilege review and by sampling. Nevertheless, the Court accepted Defendants’ numbers for purposes of the undue burden analysis. Defendants argued that the 50 key word search performed on 50 key custodians would produce 493 gigabytes of ESI, equivalent to 15 million pages of documents. They claimed it would cost them $10 million to collect and review these documents.

The Court did not find these costs unreasonable in view of the number of plaintiffs in the class. Since the class size was more than 550,000 children, “the unit cost for this ESI discovery is approximately 25 pages per class member at a cost of $16.66 per Plaintiff class member.” The Court acknowledged that this analysis might not be reasonable in a typical discovery situation, but pointed out that this motion to compel discovery was made in the context of enforcement of a judgment, and there had already been “repeated judicial findings of the Defendants’ violations of childrens’ rights.” Memo. pg. 141.

Even assuming the ESI discovery imposed an undue burden on Defendants, the Court said it would still compel discovery in view of the total equities of the case, that Plaintiffs had established good cause under Rule 26(b)(2)(C)(i)(ii) and (iii). Memo pg. 143, 148-152. In short, the benefits that are likely to accrue to the 550,00 children from the discovery far outweigh the monetary burden to the State, especially since the court has already determined that the rights of these children to medical care under federal law has been violated by the State. The “think of the children” argument is indeed very powerful and colors this whole opinion.

The Defendants also argued that the Plaintiffs should pay for at least part of the discovery expenses. The Judge found this argument “outrageous,” pointing out that the class was composed of “550,000 children whose economic resources are non-existent.” Memo pg. 150. All of the factors in the rule, and in Zubulake I,were addressed and all were found to favor the ESI production demanded by Plaintiffs. Memo 148-152.

The Court also addresses many types of privilege issues: attorney client, work product, joint defense, deliberative process, and state statutory privileges. Memo pgs. 53-176. The defense arguments were all rejected.

The Court concluded by reserving ruling on the issue of sanctions until completion of the ESI discovery ordered.

As mentioned, a two page Order was issued at the same time as the Memorandum Opinion. John B. v. Goetz, 2007 WL 3012808 (M.D. Tenn. Oct. 10, 2007). Here the Court grants Plaintiffs’ renewed motion to compel and ordered a series of specific actions in connection with the mandated ESI production, including the following:

It is ORDERED that the Defendants shall provide complete responses to the Plaintiffs’ discovery requests for ESI with the agreed search terms, the designated key custodians and for the time period of June 1, 2004 to the present within one hundred (100) days from the date of entry of this Order. The ESI required under this Order and responsive to Plaintiffs’ discovery requests shall include all metadata as well as all deleted information on any computer of any of the Defendants’ designated key custodians.

I for one am very skeptical that Defendants will meet this 100 day deadline, and expect another round of delays, and possibly appeals, probably resulting in some kind of settlement. The next paragraph of the order gets very specific in its dictates, and raises my favorite subject.

Given the need for hash coding of the ESI, Brent Antony’s limited formal computer training and the Defendants’ position about possible alteration of ESI, the Plaintiff’s expert, Thomas Tigh or his designee shall be present for the Defendants’ ESI production and shall provide such other services to the Defendants as are necessary to produce the metadata, as ordered by the Court. Mr. Tigh or his designee shall inspect the Defendants’ computer system to assess whether any changes have been made to hinder the ESI production required by the Consent Decree or previously Order by the Court.

This reference to hash is puzzling. Hash coding is a standard procedure for all competent e-discovery vendors and this process should be well known to any computer expert, regardless of their level of formal training. I am not sure, but the comment appears to be a dig at one of the defense experts. The Court goes on in the next paragraph to say:

Given the intensity and sensitivity of these discovery disputes, the Court is considering the appointment of a monitor who has the Court’s confidence and is likely to be acceptable to all parties to serve as monitor to oversee the Defendants’ and MCCs’ ESI production.

The appointment of a “monitor” or a special master in contested e-discovery cases appears to be a coming trend, especially when the technical issues are complicated, and counsel and the court’s IT proficiency is limited. I expect to see more appointments like this in the future, at least until such time as counsel are able to transition from the adversarial model for e-discovery issues. In my experience, outside of Sedona, that is not likely to happen any time soon, so the role for special e-discovery masters is likely to grow quickly and last a long time.

POSTSCRIPT: The Court in fact later appointed a monitor, former United States Magistrate Judge Ronald J. Hedges from New Jersey. He was assigned the difficult task of overseeing the State of Tennessee’s court-ordered ESI production. He is one of the best possible people to be assigned this task, and it will be interesting to see how he does.

So far there has not been much for him to do aside from read briefs. In later motions the Court clarified that the Plaintiff’s expert, along with the monitor, could inspect the ESI storage devices of the fifty key custodians, and enter the state’s premises to do so. The Plaintiff’s expert was also allowed to make full forensic copies of the computers involved, including the Governor’s computers. The U.S. Marshall was ordered to accompany the inspection so that these orders could be peacefully effectuated.

Not too surprisingly, the State then filed emergency appeals to the Sixth Circuit to try and prevent these inspections, including a petition for a writ of mandamus. On November 26, 2007, the Appeals Court stayed the District Court’s Order pending further briefing and ruling by the Sixth Circuit.

So far at least, the attempt in this case to force a truce by ordering the attorneys away, has done nothing but add fuel to the fire. It will be very interesting to see what the Sixth Circuit now has to say about all of this.

SECOND POSTSCRIPT: The Sixth Circuit said no, you’ve gone too far, and reversed. John B. v, Goetz, __ F.3d __, 2008 WL 2520487 (6th Cir. June 26, 2008). The Sixth cited concerns about comity and excessive intrusion into state government and the privacy rights of non-parties, namely the many government employees whose computers, including home computers, were subject to seizure by federal officials. The Sixth Circuit found a “demonstrable abuse of discretion” by the District Court which justified the extraordinary remedy of a writ of mandamus. The mandamus set aside all of the forced forensic imaging orders, but expressed no opinion on any of the other provisions of the District Court’s orders.

Judge Rogers delivered the opinion of the Court which was joined in my Judge Gibbons. Judge Cole wrote his own, separate concurring opinion. Here is Judge Rogers explanation of the reversal.

The orders at issue here compel the imaging and production of various state-owned and privately owned computers and electronic devices, and that media will almost certainly contain confidential state or private personal information that is wholly unrelated to the TennCare litigation. Plaintiffs are correct that the discovery orders merely call for the imaging of the relevant media and that the district court has yet to determine how to proceed with respect to the information contained on that media. Nevertheless, the mere imaging of the media, in and of itself, raises privacy and confidentiality concerns. Duplication, by its very nature, increases the risk of improper exposure, whether purposeful or inadvertent. Further, counsel for plaintiffs conceded at oral argument that the information contained on the hard drives, including information not related to this litigation, must eventually be accessed to determine relevance.

Judge Rogers was then careful to point out that the District Court’s discovery orders not only covered computers and devices of the defendants, but also computers and devices in the custody of individuals who were not party to the litigation. The language suggests that the Court may have reached a different result if the order had been limited to the litigants.

Although the over-intrusive imaging order was reversed as clearly erroneous, the basic premise behind the discovery order was affirmed, namely the defendants’ duty to preserve computer evidence. I am pleased to say that the Appeals Court relied heavily upon the Sedona Conference writings to affirm this fundamental law:

*9 As a general matter, it is beyond question that a party to civil litigation has a duty to preserve relevant information, including ESI, when that party “has notice that the evidence is relevant to litigation or … should have known that the evidence may be relevant to future litigation.” See Fujitsu Ltd. v. Fed. Express Corp., 247 F.3d 423, 436 (2d Cir.2001); see also Zubulake v. UBS Warburg LLC, 220 F.R.D. 212, 216-18 (S.D.N.Y.2003); The Sedona Principles: Best Practices, Recommendations & Principles for Addressing Electronic Document Production, Second Edition 11, 28 (The Sedona Conference Working Group Series, 2007), available at http:// www.thesedonaconference.org/content/miscFiles/ TSC_PRINCP_2nd_ed_607.pdf. It is the responsibility of the parties to ensure that relevant ESI is preserved, and when that duty is breached, a district court may exercise its authority to impose appropriate discovery sanctions. See Fed.R.Civ.P. 37(b), (e); The Sedona Principles, supra, at 70 (noting that sanctions should be considered only if the court finds a clear duty to preserve, a culpable failure to preserve and produce relevant ESI, and a reasonable probability of material prejudice to the adverse party).

Although the duty to preserve ESI is now “beyond question,” the power of courts to compel preservation by court ordered forensic examinations is less clear. here is the explanation of the Sixth Circuit, which once again relies heavily upon the Sedona Conference.

There is less clarity, however, surrounding the question of a district court’s authority to compel the forensic imaging and production of computer hard drives as a means by which to preserve relevant electronic evidence. Because litigants are generally responsible for preserving relevant information on their own, such procedures, if at all appropriate, should be employed in a very limited set of circumstances. Cf. The Sedona Principles, supra, at 33 (noting that, because all litigants are obligated to preserve relevant information in their possession, preservation orders generally must be premised on a demonstration that a real danger of evidence destruction exists, a lack of any other available remedy, and a showing that the preservation order is an appropriate exercise of the court’s discretion). In this case, the district court ordered the forensic imaging predominantly for preservation purposes, explaining that “[t]hese Orders were to protect against the Defendants’ destruction of responsive information in light of the Defendants’ persistent refusals to produce ESI in violation of the Court’s orders.” In so doing, the district court committed a clear error in judgment.

The Sixth Circuit then lays out some of the leads cases, pro and con, in the area of forensic imaging. This is a scholarly opinion, as you would expect from a Circuit Court, and is worth seeing their summary of the law on this issue:

To be sure, forensic imaging is not uncommon in the course of civil discovery. See Balboa Threadworks, Inc. v. Stucky, No. 05-1157-JTM-DWB, 2006 WL 763668, at *3 (D.Kan. March 24, 2006). A party may choose on its own to preserve information through forensic imaging, and district courts have, for various reasons, compelled the forensic imaging and production of opposing parties’ computers. See, e.g., Ameriwood Indus., Inc. v. Liberman, No. 4:06CV524-DJS, 2006 WL 3825291, at *3-*6 (E.D.Mo. Dec. 27, 2006), amended by 2007 WL 685623 (E.D.Mo. Feb. 23, 2007); Cenveo Corp. v. Slater, No. 06-CV-2632, 2007 WL 442387, at *1-*3 (E.D.Pa. Jan. 31, 2007); Frees, Inc. v. McMillian, No. 05-1979, 2007 WL 184889, at *2 (W.D.La. Jan. 22, 2007). Nevertheless, “[c]ourts have been cautious in requiring the mirror imaging of computers where the request is extremely broad in nature and the connection between the computers and the claims in the lawsuit are unduly vague or unsubstantiated in nature.” Balboa Threadworks, 2006 WL 763668, at *3;see also Balfour Beatty Rail, Inc. v. Vaccarello, No. 3:06-CV-551-J-20MCR, 2007 WL 169628, at *2-*3 (M.D.Fla. Jan. 18, 2007); Diepenhorst v. City of Battle Creek, No. 1:05-CV-734, 2006 WL 1851243, at *2-*4 (W.D. Mich. June 30, 2006). As the Tenth Circuit has noted, albeit in an unpublished opinion, mere skepticism that an opposing party has not produced all relevant information is not sufficient to warrant drastic electronic discovery measures. See McCurdy Group, LLC v. Am. Biomedical Group, Inc., 9 F. App’x 822, 831 (10th Cir.2001). And the Sedona Principles urge general caution with respect to forensic imaging in civil discovery:

*10 Civil litigation should not be approached as if information systems were crime scenes that justify forensic investigation at every opportunity to identify and preserve every detail…. [M]aking forensic image backups of computers is only the first step of an expensive, complex, and difficult process of data analysis that can divert litigation into side issues and satellite disputes involving the interpretation of potentially ambiguous forensic evidence.

The Sedona Principles, supra, at 34, 47. Thus, even if acceptable as a means to preserve electronic evidence, compelled forensic imaging is not appropriate in all cases, and courts must consider the significant interests implicated by forensic imaging before ordering such procedures. Cf. Fed.R.Civ.P. 34(a) Advisory Committee Note (2006) (”Courts should guard against undue intrusiveness resulting from inspecting or testing [electronic information] systems.”).

The Sixth Circuit then explains how the District Court departed from this precedent and intruded too far into the privacy rights. The Court noted that there had been no showing of intentional destruction of ESI, nor proof of refusal to preserve ESI in the future. (There had, however, been a strong showing of negligent destruction and ongoing obstruction for years, but the Sixth Circuit seemed to gloss over these inconvenient facts.) The Court also suggests that the District Court had several other options that it did not explore first.

The district court’s compelled forensic imaging orders here fail to account properly for the significant privacy and confidentiality concerns present in this case. …

Even so, the record lacks evidence that defendants have intentionally destroyed relevant ESI in the past, and nothing in the record indicates that defendants are unwilling, or will refuse, to preserve and produce all relevant ESI in the future. Furthermore, forensic imaging is not the only available means by which the district court may respond to what it perceives to be discovery misconduct. The district court maintains authority to impose sanctions for discovery violations under the federal rules and pursuant to its inherent powers. Although we take no position regarding the propriety of sanctions in this case, such measures can be less intrusive than forensic imaging, and it is not apparent from the record that the district court has exercised its sanctioning authority. In fact, the district court expressly reserved discussion of sanctions in its October 9, 2007 opinion.

The Court then moves on to the extraordinary comity and federalism issues raised by the case by the Justice Department against various agencies of the State of Tennessee.

*11 Aside from these privacy and confidentiality considerations, this case raises other obvious issues that counsel against the forensic imaging procedures ordered by the district court. As directives to state officials, these orders implicate federalism and comity considerations not present in typical civil litigation. Many of the computers subject to the orders are in the custody of high ranking state officials, and these computers will contain information related to confidential state matters. Further, the orders call for federal law enforcement officers to accompany plaintiffs’ computer expert into state agencies–and, in some cases, the homes and offices of state officials– to effect the imaging. These procedures clearly do not take adequate account of federalism and comity considerations. If the use of federal law enforcement officers in matters of civil discovery is proper under some circumstances, those circumstances are not present here.

Certainly, state officials are not immune from complying with federal discovery mandates. However, where less intrusive means are available to address the perceived discovery violations of state parties, those means should be employed before resorting to inherently intrusive measures like forensic imaging, especially in cases where there is no evidence of purposeful or intentional destruction of relevant ESI. In light of the significant confidentiality and federalism concerns present in this case, the district court’s forensic imaging orders constitute the type of “demonstrable abuse of discretion” that warrants mandamus relief. See In re Wilkinson, 137 F.3d 911, 914 (6th Cir.1998).

The concurring opinion of Circuit Judge R. Guy Cole, Jr., sent a clear warning to the State of Tennessee that further delay and obstruction by state officials would not be tolerated, and next time he would support forced forensic imaging.

This case is unique, however, in that the court’s order includes the forensic imaging of computers in the custody of individuals not party to this matter, and that the order may lead to confrontations between federal marshals and state officials. Under these circumstances, I agree with the majority that, without evidence that Defendants intentionally destroyed relevant ESI in the past or that they are affirmatively unwilling to preserve all relevant ESI in the future, the district court should first employ less intrusive means to address the perceived discovery violations.

It is clear that the district court’s focus has been to assist the parties in forging a solution that would ensure that Tennessee’s children receive the benefits owed to them under the Consent Decree and federal law. Defendants’ continual noncompliance and acrimonious litigation practice has unfortunately steered this case away from such goal, with the costs borne by the judicial system and the citizens of Tennessee. The district court has thus far reserved the exercise of its wide discretion to hold Defendants in contempt or to impose monetary sanctions. If the district court resorts to such measures and Defendants nevertheless continue to disregard their undisputed duty to preserve and produce relevant ESI, the preservation order at issue in this case, in my view, may no longer be considered inappropriate.

The state has been warned, and further, although the forensic order was vacated, the order allowing inspection of defendants computer system (but not copying) was allowed to stand. The case continues and everyone in the e-discovery world will watch with interest, so too will the children of Tennessee. So much for  forced kumbaya litigation and trying to force lawyers out of the courtroom.

Litigation Survey Suggests Future of e-Discovery

A recent survey of over 300 corporate counsel on litigation issues suggests that the internal team approach to e-discovery is a fast growing trend for mid to large size companies. In 2007, these companies turned primarily to e-discovery vendors to help form and support these teams, not outside counsel.  I predict the internal team approach will continue, but in coming years, the dynamics will change. Corporations will rely more on independent law firms and consultants to help them operate these teams, rather than e-discovery vendors. Vendors will still be core members of the team, but the lead will be assumed by impartial experts with nothing to sell but their time.

The study in question was sponsored by Fulbright & Jaworski. It surveyed 253 U.S. corporate counsel and 50 U.K. corporate counsel. A copy of the Fulbright & Jaworski Fourth Annual Litigation Trends Survey Findings can be downloaded after filling out a short questionnaire.

Although this is the fourth year Fulbright has commissioned this survey, it is difficult to extrapolate trends because the demographics of the companies surveyed change each year. For instance, companies with over $1 billion in gross revenues made up 39% of the survey in 2007, but in 2006 they comprised 53%, and in 2005 only 29%. Also, the report does not provide details of the study. For these and other reasons, my suppositions of future trends based on this report could be all wrong. On the other hand, this survey provides a unique glimpse of corporate boardroom attitude to litigation that cannot be found anywhere else, and gives us some factual basis on current events upon which future trends can be predicted.

The 2007 survey included American and British companies ranging in revenue size from less that $100 million (25%), to between $100 - $999 million (36%), to over $1 billion (39%).  Many different industrial sectors are included (although financials are heavily weighted), and a little more than half of the companies are public.

The survey begins by confirming what most litigation attorneys already knew, that litigation overall is down. Still, the number of larger cases, those with $20 million or more at issue, remained about the same as last year. The types of lawsuits that are of most concern to corporate counsel are labor/employment, followed by contracts, regulatory and personal injury. This is the same as prior years. The most active jurisdictions are, once again, Texas, California and East Coast/New England.

An entire chapter of the survey report is devoted to “E-Discovery / Document Production.” The survey at page 22 first notes that e-discovery as an issue of concern is spreading from larger organizations to mid-size and smaller corporations.

The biggest change in e-discovery from 2006 to 2007 is in the percentage of companies using outside e-discovery vendors. For U.S. companies it jumped from 37% to 51%, and for U.K. companies, it spiked from 8% to 71%. The percentage of companies retaining law firms with special expertise in e-discovery also increased, but much more modestly. For U.S. companies, it increased from 26% to 30%, and for U.K. companies, from 17% to 32%. Still, this means that almost one-third of the companies surveyed retain law firms, at least in part, for their e-discovery expertise, and demonstrates a consistent growth in this area.

The survey asked a related question as to whether a company has retained, or is now considering retaining, special national or regional e-discovery counsel “specifically for e-discovery issues that arise in matters.” Here is the survey report on this key question:

Taking the survey sample as a whole, those answering in the affirmative jumped from 17% in 2006 to 42% in 2007. It appears companies in the U.K., in particular, are embracing the concept. There were also equally significant increases across the three company size categories.

When you delve more deeply into these statistics, however, you discover a few very interesting surprises not apparent from this summary. First, although the overall increase was from 17% to 42%, the U.S.-based companies only increased from 18% to 39%, while the U.K.-based companies increased from 14% to 60%.  Not too surprising when you consider the U.K. is still a few years behind the U.S. in e-discovery. But what is surprising is that most of the increase from 17% to 42% came from companies with under $100 million in revenues. They increased from 10% to 69%.  That is a sevenfold increase!

Even more surprising, however, is that the larger companies supposedly reversed this trend altogether. The $100 - $999 million size companies decreased retention of national e-counsel from 91% to 31%, and the $1 billion and up size companies decreased from 77% to 48%. 

I view these numbers with some skepticism, but assuming they are valid, I think they suggest a trend to internal corporate e-discovery teams. First of all, it is extremely unlikely that 91% of midsized companies, and 77% of large companies, in fact employed national or regional e-counsel in 2006. No way! The question posed apparently stated “have or considered retaining” national or regional e-counsel. If these statistics are valid, this must mean that many of the larger companies considered going the national e-counsel route in 2006, and then rejected it. Apparently these companies opted instead to employ vendors, and that is one reason why vendors overall saw such a high growth rate in 2007.

To me these facts suggest that mid to large-size companies are starting to take their e-discovery work in-house, instead of relying on outside counsel to do it all for them. This supports what I am seeing, where many companies are starting to explore the option of creating internal e-discovery teams. These statistics suggest that most are now relying on outside vendors to help make it happen. Unlike many law firms, vendors have been quick to realize a need for these services. To date, very few law firms have moved into the new team building approach I advocate.  Instead, most firms active in e-discovery still follow the entrepreneurial model of legal services that I discussed in the last “Star Trek” blog. Under this model, the law firm does everything for the client, including act as national or regional e-counsel. I doubt that this model will last much longer, and predict that in a few years only small companies will still support it.

Law firms may be slow to change, but they are smart. They will eventually respond to their clients’ needs, and embrace the new paradigm of e-discovery services promoted here. Under the e-discovery team model, outside counsel serve to empower their clients by helping them to form and operate their own e-discovery teams. As this change materializes, I expect the drastic growth rate in vendor usage to level off, or even reverse somewhat as attorneys move into this field.  Also, I would expect the use of national or regional e-counsel to increase again in the large and mid-size corporations, but this time based on a new client relationship and team functionality. The firms who help put the teams together will naturally stay and serve as national coordinating counsel, and speak for the internal teams that they helped organize and coach. 

Admittedly, there is a lot of speculation in these predictions because the question of internal e-discovery team formation was not asked in this survey. Hopefully it will be included in next year’s survey.

I acknowledge that there is another explanation for these statistics that does not support the trend to team based solutions. It could be that mid to large size companies are abandoning the national e-counsel idea in favor of hiring e-vendors to do everything, and doing little or none of the work themselves. This is probably true for some, but I doubt the majority are going this route. It is too expensive, and too risky, since it abdicates control to a third party of key responsibilities of a corporation’s legal and IT departments. Although some vendors would be happy to assume this responsibility, and charge plenty for it, most vendors I have talked to do not want that kind of responsibility. Instead, they seem to agree with the approach I advocate, and prefer to work with corporations to help them set up their own teams.

Smaller corporations with revenues less than $100 million may not have the resources to establish and run their own team, and it makes sense that they would instead rely on outside counsel to do it all for them, or on outside vendors. That would explain the overall spike in reliance on outside national e-counsel by smaller sized corporations, and also help explain the overall growth in vendor usage.

Another very interesting set of facts in the survey pertains to companies’ document retention and communication policies. This is the first year the survey has included these questions. The survey found that:

1. 54% of the companies allow instant messaging.
2. 24% allow the attachment of documents to instant messages.
3. 31% log or retain instant messages.
4. 40% retain voice mail.
5. 40% use technology to send voice mail to others via email.
6. 72% allow access to company network from home.
7. 48% allow use of outside email accounts from company  computers.
8. 40% have a chief privacy officer.

Further, although backup retention periods are said to vary widely, the median for all companies was approximately 60 days.

The survey also questioned companies about their attitude to the new rule changes. Twenty seven percent said it made “handling these issues in federal court more difficult” and only 18% believed it “made the process at least somewhat easier.” Sixty percent of both groups reported little change as a result of the new rules. That’s got to make the Rules Committee members cringe.

Asked about litigation holds, almost all (98%) of the $1 billion plus size companies claim to have one, and almost all size companies are now at least working on it. Eighty one percent of the U.S.  companies and 90% of the U.K. companies have reviewed or revised their hold policies in the past 12 months.

Thanks go to Fulbright & Jaworski for this survey and helping all of us to get a better hold on e-discovery.