In April, Damien Riehl brought us the story of the Eight Circuit’s ruling in Greyhound Lines, Inc. v. Wade that there was no abuse discretion in a trial court’s denial of sanctions for spoliation, where the movant failed to demonstrate intent and prejudice. In another post, last month, I discussed the precarious possibilities of forensics experts, who can ruin a case.
Bringing these two topics together, we have the case of Doe v. Norwalk Community College, where the U.S. District Court in Connecticut imposed spoliation sanctions for a party’s failure to prevent the destruction of evidence. Defendants sought shelter under safe harbor provision of Fed.R.Civ.P. 37(f), but the district court disallowed the defendants to take advantage of the provision, since they made no attempts to preserve relevant evidence. The credibility of the computer forensics experts (or non-experts, depending how one might characterize them) decided the outcome of this case. >> read more >>
After two years of litigation, plaintiff Jane Doe persuaded the court that the defendant college was withholding electronic evidence. The college was ordered to produce the computers of key witnesses for inspection by Doe’s computer forensic expert. The expert inspected the college computers over a two day period. Delay’s inspection showed that several of the computers had no data, they were literally all zeros. Doe then filed a motion for spoliation sanctions, alleging “the hard drives of key witnesses in this case were scrubbed” or “completely ‘wiped’ of data” and, which resulted in several affidavits by Doe’s expert and the college’s counter-expert (its in-house Information Technology technician).
The trial court scheduled two evidentiary hearings during which the experts testified and were cross-examined about the suspicious circumstances of the missing ESI. During one of these hearings, the college produced another alleged expert, the Information Technology Systems Manager. Both of the college’s experts testified, inter alia, that they did not believe that the state’s two year document retention policy applied to them or to “normal computer usage,” directly contradicting the hearing testimony of the college’s Dean and the college’s principle expert produced a litany of reasons for why two computers could be “full of nothing”: He began with the assertion that it was the wrong computer; then that it was imaged, but not wiped; and, as a last resort, that the “all zeros” problem was the result of “computer failure.” The most compelling and interesting aspect of the spoliation proceedings was the exposè of the term ”wiped.” 1
Plaintiff’s expert correctly stated that wiping is a “process that overwrites existing data on the hard drive, making this information unrecoverable,” and that the “all zeros” condition of the hard drives was indicative that the hard drive had been intentionally scrubbed of all data. Id. at n.3 This is because computers write and read information as binary bits of either ones or zeros (electrically ‘on’ or ‘off’). Any combination of eight ‘on’ or ‘off’ bits comprise a byte (a typical hard drive today has hundreds of billions of bytes). Information can only be stored when both ones and zeros are used in varying permutations. (Thus, if a hard drive or any other ESI device contains all zeros (or all ones), it contains no information). The college’s expert, took exception with the term “scrubbed,” and attempted to substitute the word “imaged,” where the college’s IT department modifies the structure of the hard drive (without scrubbing it). He further suggested that one particular hard drive, which may have appeared to have been “scrubbed,” was because it was in the process of failing, which he testified could produce inconsistent or corrupt results. Id. at n.6.
Unpersuaded, the court accurately defined “scrubbed’ or “wiped” as “more than overwriting or ‘reimaging;’ it means eliminating all data from the hard drive, such that none of the old data can be read or still remains on it.” Id. at 11. Contrary to the college’s expert’s testimony, a computer which has been imaged or one that is failing, would not contain all zeros. Some information (some combinations of ones and zeros among the billions of bits on a hard drive) would remain. The trial court explained it this way:
Delay found that it contained all 0’s, indicating that every sector had been overwritten. Delay testified that, if the drive had data on it but was failing, as Bissell testified, then data would be seen on it with Delay’s forensic software, which instead recognized that the hard drive was unpartitioned and contained no data. Moreover, Seaborn’s new computer had traces of other users’ information on it, thus showing an inconsistent result in NCC’s process of re-imaging hard drives. Even if it was consistent with NCC’s policy, the fact that Seaborn’s new computer showed other users’ information indicates that “imaging” does not eliminate everything from a hard drive, but leaves some data from old users on it, prompting the question why Seaborn’s old computer–or Schmidt’s computer–did not have any evidence of other users on it. The answers provided by the defendants–a failing drive or “re-imaging”–are rejected by the court as not credible.
The irregularities in PST files that Plaintiff’s attorney uncovered also led the trial court to suspect that relevant evidence had been intentionally destroyed by several of the college employees. He discovered the Microsoft Outlook PST files, which house electronic mailboxes, of four individuals had inconsistencies “that indicate [ ] that data has been altered, destroyed or filtered .” For example, one person’s PST file contained no Deleted Items and only one Sent Item and the Inbox and Sent Items contained data starting August 2004, “even though other activity is present starting in 2002.”
The trial court did not credit the testimony of the defense experts. Overall, they served to make a bad situation worse.
The trial court not only rejected the defense expert testimony but, it also rejected the legal arguments of defense counsel (including that an effective legal records hold could not be implemented without revealing the true name of Jane Doe). The court said defendant’s counsel should have conferred plaintiff’s counsel. Defense counsel’s arguments as to when the duty to preserve commenced were also not countenanced.
Ultimately, the court found that the defendants’ actions were at least grossly negligent and concluded that a party to litigation can only invoke the good faith provision when that party has taken affirmative steps to prevent the spoliation of evidence. The trial court granted Doe’s motion for an adverse jury instruction based on this grossly negligent failure of the college to preserve ESI and awarded Doe her expert witness’s costs.
This case aptly illustrates why the quality of experts can make or break a case. Don’t rely on an in-house or jack-of-all-trades IT Tech, who tries to fast-talk a judge with “computerese” and specious theories. It may fool many attorneys, but it is likely to not stand up under cross-examination by an attorney working with a qualified expert.
________________________
1See, e.g., United States v. Krause (In re Krause), 2007 WL 1597937, 2007 Bankr. LEXIS 1937 (Bankr. D. Kan. June 4, 2007) (A debtor, an attorney proceeding pro se in a bankruptcy, was caught destroying evidence using a popular software program)