Ruling Proves to Be Primer on eDiscovery Enforcement
Ruling Proves to Be Primer on eDiscovery Enforcement
Judge Paul Grimm’s recent opinion both a road map and commentary on spoliation, sanctions
Leonard Deutchman
The Legal Intelligencer
October 12, 2010
A federal judge’s most recent opinion in an ongoing matter provides remarkable insight into several issues that arise frequently in e-discovery.
Magistrate Judge Paul Grimm’s lengthy opinion in Victor Stanley Inc. v. Creative Pipe Inc., filed Sept. 9, is worth the read if only for its review and distillation of the case law regarding spoliation and remedies. But the opinion is newsworthy because it sets out a harsh remedy for the defendant whom he found had destroyed evidence, lied to the court and dragged out proceedings — civil contempt, with the defendant facing severe costs and fines or a two-year prison sentence if he fails to pay that fine.
The court’s focus upon and analysis of the costs — in time, money, effort, and expertise — of spoliation and dilatory tactics to the justice system is both spot on and timely. The lessons drawn from the reality underlying the court’s analysis, however, are discouraging.
Victor Stanley’s 2006 complaint alleged that Creative Pipe and its president, Mark Pappas, downloaded Victor Stanley design drawings and specifications from its website using the pseudonym “Fred Bass” and used those drawings improperly in competition with Victor Stanley. The complaint alleged copyright, patent, and unfair competition violations.
During four years of discovery, Pappas, in the court’s words, “engaged in a cat and mouse game to hide harmful ESI from production during discovery, repeatedly trying to stall or prevent VSI from discovering evidence that he improperly accessed or used VSI’s website or drawings.”
The court cited the following examples of delaying tactics used by Pappas:
• The defendants produced only two of what was later revealed to be 110 known “bass@aol.com” downloads of VSI drawings from a CPI computer;
• After the complaint was filed, Pappas asked “Federico,” a business contact in Argentina, to destroy all e-mail references to Victor Stanley and Pappas attempted to delete over 5,000 files that included e-mail correspondence with Federico and two Creative Pipe contacts that would have been involved in the production and importation of Victor Stanley products under Creative Pipe’s name. When the deletions were discovered, Pappas claimed to have moved the e-mails to a deleted items folder for “storage purposes,” a claim that the court not only found incredible, but one it could not imagine anyone would make “with a straight face.” Victor Stanley’s expert (more on this below) was able to recover the 5,000 files, and “Pappas eventually admitted that he accessed the VSI Library to look at the VSI drawings, and that he downloaded “some” of VSI’s files,” according to the court;
• Pappas delayed in producing relevant electronically stored information, or “ESI,” after Victor Stanley identified it and requested it in discovery, and he lied about the completeness of his ESI production;
• In 2007, Pappas swore that CPI had produced all nonprivileged ESI, but, in actuality, failed to produce 2,477 fully intact but “deleted e-mails,” 1,589 of which were between Creative Pipe and one of the aforementioned Creative Pipe contacts. They were not produced until 2009, after they had been identified by Victor Stanley’s expert, “with no help from defendants;”
• In 2007, CPI “were aware of a deleted internet form using the name ‘Fred Bass’” on Pappas’ home computer, but the form “neither came to light nor was produced until December 2009;”
• At least two of Pappas’ successful larger deletions of ESI occurred on the eve of scheduled discovery regarding the contents of Pappas’ work computer;
• Pappas deleted over 9,000 files from his work computer the afternoon before a scheduled discovery hearing;
• Although a forensic imaging of Pappas’ work computer was scheduled for the week of Feb. 21, 2007, he deleted almost 4,000 files on February 16 and 17, 2007, and someone ran Microsoft Window’s Disk Defragmenter program immediately afterward, rendering the files unrecoverable.
The court noted that in all of these instances, it had ordered Pappas to produce the ESI that he had not succeeded in destroying and the data was recovered. Thus, Victor Stanley suffered no “actual prejudice,” Grimm ruled. Pappas’ efforts, however, “clearly resulted in considerable delay in completion of discovery and expense associated with efforts to discover the nature and extent of the spoliation,” Grimm continued.
The court further criticized the defendants for failing to implement a litigation hold. Grimm pointed to evidence of the deletion of thousands of files as well as the use of applications that “wipe” or overwrite files so that they could not be recovered, not even using forensic tools. Moreover, Grimm detailed how examination of Pappas’ work computer, which was password-protected (making Pappas the sole likely user), showed 353 deletions of files in the days immediately following the filing of the complaint.
Grimm found CPI disposed of an external hard drive used by Pappas just before and after the complaint was filed. Forensic examination of Pappas’ work computer revealed that 62,071 files were transferred from it to the drive shortly before suit was filed. The work computer logged the transfer; the log was comprised of folders and files whose names suggested that they would have been highly relevant. To cite but one example, one transferred folder bore the name “CompetitorCAD” — that is, computer-aided design drawings of the work of competitors — and contained “hundreds of files.”
Grimm found a similar deletion of 9,282 files, with names that suggested high relevance, between the end of December 2006 — just after the court issued a stay of discovery order that commanded the parties not to destroy any potential discovery — and Feb. 1, 2007. Almost all of the deletions occurred on Jan. 31, 2007, the eve of the next discovery hearing.
The court also pointed to the use, by a user signing on Pappas’ work computer as “Pappas,” of a “Disk Cleanup” program — that is, a program that would overwrite the computer’s hard drive so that deleted files could not be recovered — on Feb. 7, 2007.
Between Feb. 2 and 16, 2007, the user had deleted 4,316 files, according to Grimm. On Feb. 17, after the deletions were completed, the user used a defragmentation application that would have rendered all of the deleted files irrecoverable, even by forensic tools. Grimm noted that some of the files, again, had names that suggested high relevance; many, for example, included “victor,” the plaintiff’s name.
The court further noted that the defendants ordered a new server two weeks after the complaint was filed and, in the transfer of data from the old to new server, lost data. Backup tapes from the old server, once restored, showed that files with, again, names that highly suggested relevance, had been lost in the transfer of data from the old to the new server, according to Grimm.
Finally, the judge noted that in July 2008 and August 2009, months after he had issued numerous preservation orders, someone at Creative Pipe used an application known as “Easy Cleaner” to overwrite data on the new server and another application, “CCleaner,” to overwrite entries into the “registry” — the folder that records transaction on a computer — on the new server.
FOUND OUT
In order for Grimm to make the findings he did, the following extraordinary set of events had to occur.
First, Victor Stanley had to move to make forensic images — that is, exact, verified copies — of Creative Pipe’s computers, with servers included, and to examine those computers. Further, Grimm had to grant the motion. Such motions are rarely granted. Discovery practice and rules are premised on the honor of the parties to produce discovery; such searches are highly intrusive and so rarely ordered.
Furthermore, such searches, and the resultant expert reports and testimony, can be very expensive, and so are rarely sought. Victor Stanley was, presumably, damaged financially by CPI prior to the action, thus causing plaintiff to file the complaint. To incur the additional costs of such searches is extraordinary.
Second, Grimm, faced with the competing testimony of Victor Stanley’s and Creative Pipes’ digital forensics experts, credited the testimony of Victor Stanley’s expert. What was extraordinary here was that Grimm credited Victor Stanley’s expert’s testimony describing how Creative Pipe’s IT Infrastructure worked. In other words, Grimm believed the plaintiff understood the defendants’ IT infrastructure better than the defendants did.
Third, and most extraordinary, Grimm was able to understand and marshal the forensic evidence so as to discredit the explanations defendants offered for the actions described above.
The explanations offered by defendants and their expert involved jargonized, technical answers which, pitted against the jargonized, technical testimony of plaintiff’s experts, would have led most judges to try to avoid making findings between the two experts. Grimm, however, dove deeply into the testimony and was able to recognize the gaps in defendants’ explanations.
Here are some examples:
As for the 353 user-initiated deletions of files from Pappas’ work computer, CPI claimed those files, while deleted from the work computer, were saved on the server and so not actually lost. CPI asserted that the work computer was “synchronized” to defendants’ server, such that the files were copied to the server and “still exist on the server.” The court, however, found that “the more believable evidence” ran “to the contrary.”
While Pappas had testified that he had deleted these files in order to save them (this when the old server was still being used), there was no testimony that any deleted files were migrated to the new server when it went into operation. Furthermore, while the new server was, apparently, synchronized with the work computers such that files would have been created on both the computers and the server simultaneously, CPI’s own expert testified that this was not the case with the old server, the one in place when the 353 files were deleted from the work computer. Finally, while CPI’s expert had made a forensic image of the new server, the defendants were not able to produce the 353 files from the server image. Thus, Grimm was able to understand, and reject, the defendants’ claim that the deleted files were actually saved elsewhere.
With regard to the loss of the external hard drive, Pappas testified to the same synchronization explanation. The court, however, was able to understand that at the time Pappas used the external hard drive, the work computer was not synchronized to the (old) server. Moreover, Grimm noted that when defendants made available their computers to their own expert, they did not disclose to her the existence of the external hard drives, and thus she did not image or search it. Finally, when testifying to the fate of the external hard drive, Pappas explained that he returned it without anyone backing up its contents to “Bob from Office Max” because he was “frustrated” by its automatic backup features, Grimm was able to dismiss defendants’ technical explanations, as well as Pappas’ “my dog ate my hard drive” testimony.
Turning to the 9,282 user-initiated deletions of files from Pappas’ work computer between Dec. 22, 2006, and Feb. 1, 2007, the court was able to refute Pappas’ explanation that he believed that his own expert had made the deletions and CPI’s expert’s testimony that what was deleted was simply copies of files residing elsewhere. Victor Stanley’s expert noted that the deleted files “could not have been a set of copies because, if that were the case, the files would have had been created minutes or seconds apart, whereas in reality, the files were created years apart.” As well, Victor Stanley’s expert pointed out that the deletions were “not done by someone who logged in remotely,” which is the only way the defendants’ expert could have made the deletions during that period, while “Pappas admitted he was present” at the defendants’ offices when they were made. Grimm, then, was able to understand plaintiff’s expert’s testimony as a refutation of Pappas’ attempt to explain away his conduct.
GOOD NEWS, BAD NEWS
Sifting through CPI’s proffered explanations for its actions, Grimm understood how Victor Stanley’s expert testimony not only established data destruction, but refuted the defendants’ innocuous explanations of that destruction. The court’s familiarity with e-discovery issues allowed it to evaluate complex expert testimony.
Moreover, Grimm fully appreciated just how much of the court’s time had to be devoted to the instant matter because of the dissembling of the defendants. It calculated the hundreds of hours that he and his staff of law clerks and interns had to devote to it, thus preventing them “from addressing deserving motions in other pending cases.” He also acknowledged Victor Stanley’s “attorney’s fees and costs associated not only with filing this motion, but also with respect to all efforts expended throughout this case to demonstrate the nature and effect of Pappas’s spoliation,” which Grimm concluded “likely will amount to a significant figure.” Reasoning that a busy federal prosecutor would not have the resources to prosecute Pappas for criminal contempt, and that such prosecution would require even more of the judiciary’s scant resources, the court instead found Pappas in civil contempt and ordered “that as a sanction, he be imprisoned for a period not to exceed two years, unless and until he pays to plaintiff” the aforementioned fees and costs.
Grimm’s remedy here is extraordinary. While producers of discovery will worry that the remedy, even if justified here, will be misapplied by other judges who do not appreciate the egregiousness of Pappas’ actions, such concerns cannot be allowed to outweigh not simply the imposition of justice in an individual case but the acknowledgement that the gamesmanship that has marked the responses to so many e-discovery requests must stop. That is the good news of Victor Stanley.
It is also the bad news. Or, better stated, the good news is predicated on the bad news that the only reason Grimm was able to reach his conclusions and fashion his remedy was because of the extraordinary events set forth above.
Victor Stanley took the money and time to fight. Many, many parties requesting e-discovery simply cannot afford to fight so long a battle — they cannot wait for a verdict to recoup the loss which led them to court to begin with, cannot afford the costly motions and cannot engage experts.
Moreover, Victor Stanley got lucky — it found itself before a judge who understood e-discovery.
For each such lucky requesting party, countless more find themselves before courts who are confused, indifferent to or hostile to all of that “computer stuff.” Reading the opinion in Victor Stanley, the defendants’ actions correctly appear to have been egregious, but the facts in that opinion were anything but obvious: experts took hundreds of hours to gather and analyze the evidence and the court took hundreds more to assimilate it. Unlike a gory murder scene, a computer crime scene doesn’t jump out at you.
So, the bad news is that there are many more Victor Stanley scenarios that go undetected than those that come to the surface, that the cost of bringing them to the surface makes doing so all but prohibitive, and that when such uncovering of evidence does take place, it is at a cost to all of the other litigants whose cases must sit. One can only hope that the good news of the contempt citation may persuade future parties from acting with the same disrespect for the legal process as did defendants here.
Leonard Deutchman is general counsel and administrative partner of LDiscovery, a firm based in New York City, Fort Washington, Pa., McLean, Va., and Chicago that specializes in electronic digital discovery and digital forensics. He is also an Adjunct Professor at Chestnut Hill College in Philadelphia.
