Showing 6 posts in Computer Forensics.

Delaware District Court Interprets Amended FRCP

The first Delaware opinion that has been issued that addresses either sanctions or proportionality under the new Federal Rules is GN Netcom, Inc. v. Plantronics, Inc.[1] Plaintiff GN Netcom, Inc. (“GN”) filed a motion for sanctions against defendant Plantronics, Inc. (“Plantronics”) after a long discovery dispute that centered around the “intentional and admitted deletion of emails” by one of Plantronics’s senior executives and his directives to other members of his team to delete emails. More ›

Looking Back on 2015: The 6 Most Important eDiscovery Cases in Delaware - Part 1

This is the first in a series of posts summarizing the 6 most important eDiscovery cases in Delaware in 2015.

In re: ISN Software Corporation Appraisal Litigation, C.A. No. 8388–VCG, Oral Argument on Petitioners Motion to Compel and Partial Rulings of the Court, April 27, 2015. More ›

Looking Back on 2014: The 7 Most Important eDiscovery Cases in Delaware - Part 4

This is the fourth in a series of posts summarizing the 7 most important eDiscovery cases in Delaware in 2014.

In re ISN Software Corporation Appraisal Litigation, C.A. No. 8388–VCG, Oral Argument on Petitioners' Third and Fourth Motions to Compel and Partial Rulings by the Court, September 12, 2014. More ›

[UPDATE] In Defense of Genger, Part II

UPDATE:

I hate to say I told you so, but...wait, no I don't.

Yesterday, the Delaware Supreme Court issued its opinion in this matter affirming the Court of Chancery's spoliation finding. The Court held the spoliation finding proper, because Genger took affirmative steps to overwrite unallocated space, saying:

We do not read the Court of Chancery’s Spoliation Opinion to hold that as a matter of routine document-retention procedures, a computer hard drive’s unallocated free space must always be preserved. The trial court rested its spoliation and contempt findings on more specific and narrow factual grounds—that Genger, despite knowing he had a duty to preserve documents, intentionally took affirmative actions to destroy several relevant documents on his work computer. These actions prevented the Trump Group from recovering those deleted documents for use in the Section 225…

Compare with my statements below that

The [Court of Chancery] opinion in this case does not require preservation of all unallocated space in every case. Genger was sanctioned because he took affirmative steps to overwrite unallocated space, in violation of the Court's order... [T]here is nothing in this opinion that creates any requirement to preserve unallocated space. Rather, the opinion only says you shouldn't go out of your way to destroy it.

I feel quite vindicated in my defense, considering there were some persons and organizations of import in the eDiscovery community lined up on the other side. Obviously, reasonable minds can disagree, especially in interpreting court decisions. Ultimately, I am thankful that the Supreme Court's decision should allay any fears created by certain interpretations of the Court of Chancery's spoliation decision.

ORIGINAL POST (2011-03-11 13:20:45):

I had almost given up on writing this post considering how long it has been since I posted In Defense of Genger, Part I and (more importantly) how long it has been since the publication of the posts I am taking issue with.  However, the ongoing confusion about this case has prompted me to action.

If you have read Part I, you are familiar with the Court of Chancery's decision in TR Investors LLC v. Genger, C.A. 3994-VCS (December 9, 2009) and with the allegations made by Leonard Deutchman, General Counsel at LDiscovery LLC, in a two-part post hosted by Law.com. <!--You also understand why there's a picture of Austin Powers.--> For those who are not familiar, Mr. Deutchman asserts that the Court got the decision wrong because it (1) does not understand the technology involved (Part 1) and (2) does not understand the law of eDiscovery (Part 2).

It's sufficient to say that I respectfully disagree with Mr. Deutchman on both charges. Rebutting his posts was a fun, interesting exercise for me, but it didn't seem terribly important. I saw it as an esoteric debate between eDiscovery geeks. That has changed, because, today, a prominent media outlet has published a post that elevates the confusion about this opinion and will cause unnecessary fear among corporate counsel.

The latest case of hand-wringing and confusion over this decision comes to us from none other than Forbes by way of Daniel Fisher's post "Delaware Ruling Would Require Massive Data Backups."  Mr. Fisher opens his post stating that:

A little-noticed decision by a Delaware court has the potential to impose huge costs on companies unless it is reversed, computer-security experts say...[e]xperts say retaining such data would be prohibitively expensive since the unallocated space is essentially a trash bin that is altered each time a key is tapped.

<!--Scary, huh?-->

Despite the fact that Mr. Fisher twice refers to "experts" (plural) as the source for these hyper-ventilations, his lone identified source for the post is Daniel Garrie, a lawyer and managing director at Focused Solution Recourse Delivery Group LLC , a computer consulting firm in Seattle. <!--Garrie and Deutchman are both lawyers with eDiscovery vendors. Is there anything to that?--> Mr. Fisher's post continues:

“It’s almost impossible for large companies with massive amounts of equipment to comply,” said Garrie... “I don’t even know if it’s possible,” said Garrie. “I mean, anything’s possible with enough money,” but companies would have to take bit-level images of their hard drives on a regular basis and store them somewhere, to be retrieved each time they are sued. That means all the time for most large companies. The costs would be “exponentially larger,” than current electronic discovery measures. “Several large global companies,” clients he declined to name, “have expressed concern.”

Let me clear up the confusion: The opinion in this case does not require preservation of all unallocated space in every case. Genger was sanctioned because he took affirmative steps to overwrite unallocated space, in violation of the Court's order and without first telling anyone. The routine, passive overwriting of unallocated space was NOT the cause for any sanctions here, so there is nothing in this opinion that creates any requirement to preserve unallocated space. Rather, the opinion only says you shouldn't go out of your way to destroy it. Big, BIG difference. <!--If there are doubts about the Court of Chancery's understanding of eDiscovery, please see their recently released "Guidelines for Preservation of Electronically Stored Information" that clearly embraces the principles of cooperation, reasonableness, and proportionality.-->

To Mr. Garrie's credit, he is consistent—he is co-author of an article in the Northwestern Journal of Technology and Intellectual Property that makes the same mistaken arguments, and he filed a brief with the Delaware Supreme Court arguing for reversal of the Genger opinion. I obviously disagree with Mr. Garrie's opinions on this matter, but I am here to help, so I say:

Mr. Garrie, for the “[s]everal large global companies [that] have expressed concern,” please send them a link to this post and tell them not to worry.

I don't actually expect Mr. Garrie will do that, but perhaps some of his clients will stumble upon this post, in which case here is my advice to them:

If you act cooperatively and transparently, you will be fine. If you find yourself in a similar position to Mr. Genger's, share your concerns with opposing counsel and the court before you do anything. Don't take matters into your own hands and violate a court order by wiping a hard drive in the middle of the night—it's bad form and will only get you in trouble.

Stayed tuned for the decision of the Delaware Supreme Court—I may have a lot of words to eat...

<!--Thanks to flickr user cliff1066™ for the Austin Powers pic.-->

In Defense of Genger, Part I

I rise now to defend the Court of Chancery's decision in TR Investors LLC v. Genger, C.A. 3994-VCS (December 9, 2009) against the allegations made by Leonard Deutchman, General Counsel at LDiscovery LLC, in a two-part post hosted by Law.com.  I promised at the end of April that a defense would be forth coming but wanted to give everyone time to read the two posts to which I respond.

Mr. Deutchman asserts that the Court got the decision wrong because it (1) doesn't understand the technology involved (Part 1) and (2) doesn't understand the law of eDiscovery (Part 2).  I have decided to respond in two parts to keep each of my posts digestible.

In Part 1, Mr. Deutchman aims to discredit the Court's technical competence, and his first criticism makes unsupported assertions about the Court's findings.

The court ruled that by wiping the unallocated space of the two drives, the defendant violated the standstill agreement and was thus in contempt of court. To reach its holding, the court had to make factual leaps and draw legal conclusions that are in my view questionable.

The court's first factual leap was that because temporary files could have resided intact in unallocated space, they were, in fact, intact prior to the wiping. More specifically, the longer leap is that because temporary files could have resided intact in unallocated space, temporary files important to plaintiffs were destroyed by the wiping.

In my reading, the Court did not assume or conclude that any particular files resided in unallocated space.  Read as a whole, the opinion finds that files existed in unallocated space, some of which may have been relevant, but no one will ever know because Genger destroyed them. The Court fines Genger for willful destruction of data in direct and clear violation of a Court order.

Mr. Deutchman's second criticism was that "that the files [the Court] believed continued to reside in unallocated space if the defendant had not wiped them would have been important to the matter." Here Mr. Deutchman's merely reiterates Genger's "No harm, no foul" defense—or, as Ralph Losey refers to it, the "pig-in-a-poke" defense—to which the Court replied:

For a party to intentionally violate an order not to destroy or tamper with information and then to claim that he did little harm because no one can prove how much information he eradicated takes immense chutzpah. For a court to accept such a defense would render the court unable to govern situations like this in the future, as parties would know that they could argue extenuation using the very uncertainty their own misconduct had created.

Finally, Mr. Deutchman's concludes his first post by suggesting the Court is technically incompetent by claiming the Court thinks of unallocated space as a back up system.

It is important to note that nowhere in typical computer usage or professional information technology practice is the unallocated space on a hard drive regarded as "back up" in the way that the court does here.

No IT professional or typical user would consider unallocated space to be a "backup" space, akin to an external drive or backup tape used to affirmatively back up files, simply because forensic searching could possibly locate therein lost files in their deleted or temporary states.

While the Court of Chancery is likely not full of techno geeks, they seem to more than adequately understand the technology involved. In any case, the Court does not liken unallocated space to a backup system. On this point, the Court said "the information on the unallocated space of the TRI system therefore acted somewhat as a back-stop reservoir of documents that had been deleted from the active files of TRI users," and that the unallocated space was "a data source that would have acted as a back-stop in case relevant evidence had been deleted in the months when the motivation to delete would have been at a zenith." (Emphasis added.) Frankly, Mr. Deutchman's attempt to impugn the Court with this allegation is bizarre considering the plain and clear language quoted above.

I will address Mr. Deutchman's second assault on the Genger decision shortly.

UPDATE: Thanks to LexBlog CEO Kevin O'Keefe for recognizing this as a Best in Law Blogs post, the second time this blog has received that honor.

The State of eDiscovery in Delaware: The Final Chapter

As I suppose we could have expected, 2009 has delivered the most important eDiscovery cases to date, and we’re only half way through the year (or we were when I started writing this series). The District Court started us off before the last of the New Year’s confetti had been swept up by issuing its decision in Micron Technology, Inc. v. Rambus, Inc., C.A. No. 00-792-SLR on January 9, 2009, declaring certain patents unenforceable as a sanction for spoliation. In a suit for patent infringement, Micron claimed Rambus employed a document retention policy that destroyed documents while they had a duty to preserve. The Court said that Rambus was an “aggressive competitor” so should have foreseen litigation as far back as December 1998. All relevant documents destroyed by Rambus after that time was spoliation. As a sanction, the Court decided the patents at issue were not enforceable against Micron.

Not to be out done, and what has really made 2009 interesting, the Court of Chancery has recently issued three opinions with significant eDiscovery implications. On May 18, the Court issued its decision in Triton Constr. Co. v. Eastern Shore Elec. Servs., Inc., 2009 WL 1387115, granting an adverse inference as a sanction for spoliation. In a suit for breach of fiduciary duty, Triton alleged that defendant Kirk had intentionally destroyed evidence on his office computer with a wiping program. Triton’s forensic expert found evidence that Kirk had used the program to annihilate files and emails. Kirk had also been required to produce his personal laptop and thumb drive, which he failed to produce claiming he no longer owned them. The Court didn’t buy it, and issued an adverse inference.

Just days later, on May 29, the Court issued two—yes, two—significant decisions: Omnicare, Inc. v. Mariner Health Care Mgmt. Co., 2009 WL 1515609; and Beard Research, Inc. v. Kates, 2009 WL 1515625. (Oh, what a glorious time it was for eDiscovery nerds everywhere!) In Omnicare, the Court ruled that just because data is on a backup tape doesn’t automatically make it ‘not reasonably accessible.’ Omnicare sued Mariner for breach of contract and moved to compel Mariner to restore backup tapes to retrieve old emails deleted pursuant to their data retention policy. Mariner asked the Court to force Omnicare to pay for the restoration or to allow it hold off on restoration and produce emails from its active files so the parties could assess whether the restoration could reasonably be anticipated to lead to relevant information. The Court looked to Zubulake to analyze the cost-shifting argument, and decided that cost-shifting was not warranted in this case, noting that just because “ESI is now contained on Backup Tapes instead of in active stores does not necessarily render it not reasonably accessible.” Nonetheless, the Court opted not to order the restoration, opting instead for the active file sampling Mariner proposed.

In Beard Research, the Court brought the hammer down on Kates for blatant, repeated, audacious spoliation. Beard sued Kates for tortuous interference and asked the Court to impose sanctions on Kates for spoliation. Kates repeatedly reformatted his laptop’s hard drive, then replaced the drive (but kept it), then wiped the new drive on the eve of the hearing in which he was explicitly told he would be required to turn the laptop over. The Court awarded attorneys’ fees and imposed an adverse inference, and Kates should thank his lucky stars the Court decided to go easy on him.

Ralph Losey posted an outstanding analysis of the issues involved in Beard Research.  Francis Pileggi also had Beard Research well covered along with Omnicare and Triton.

There we have it—the State of eDiscovery in Delaware. I’m off to the beach for a week.