An e-discovery injunction case in Houston has an interesting fact scenario involving an employee’s illegal use of a “thumb drive” to misappropriate an employer’s trade secrets. Anadarko Petroleum Corp. v. Davis, 2006 WL 3837518 (S.D. Tex., Dec. 28, 2006). It also involves what is, to my knowledge, the first successful use of a “deduplication” defense.
A thumb drive as you probably know is a USB device for the flash memory storage of data. They can hold vast amounts of data in a small, hard to detect device. These flash memory drives are usually the size of a thumb, and thus the name. The one pictured above is a novelty version actually fashioned in the shape of a thumb as a joke.
Deduplication is the process of identifying electronically stored information (“ESI”) files that are exactly the same and eliminating them from production. This filtration process is an important tool of efficiency in e-discovery collection and review because it is not uncommon for a computer to contain multiple copies of the same file. Deduplication is made possible though a unique mathematical algorithm as explained in the “Hash” Blog Page above.
The employee defendant in this case, Billy Davis, used his thumb drive to take confidential information from his employer’s computers on his last day of work. Davis then transferred the proprietary ESI onto his personal lap top, and from there onto his new employer’s desk top computer, and then onto its servers. When the former employer found out what had happened, it filed suit against both Davis and his new employer for, among other things, theft of trade secrets, and sent out a preservation letter. The three page letter demanded the preservation of all data on the employee’s and new employer’s computers, including even deleted files. The employee received the letter and consulted an attorney on what to do. The attorney advised Davis to transfer all of the files back onto the thumb drive, so that he could return them – so far so good. But the attorney also supposedly advised Davis to delete all of the files on his new employers servers, desktop and his laptop. This is the exact opposite of the preservation demanded by the plaintiff’s letter (and the law).
At an emergency preliminary injunction hearing a few days after the suit was filed, Davis turned over the thumb drive to the plaintiff with the representation that this constituted all of the ESI taken, Davis also testified that he had deleted all other copies of the ESI. The defendants, both Davis and his new employer, also consented to an injunction requiring the return and full accounting of all ESI taken, and a forensic examination of all of their computers to verify that all of the ESI had in fact been removed as represented.
At a later temporary injunction hearing, the plaintiff asked to have the injunction strengthened to, among other things, prohibit Davis’ employment and competition on the basis of his alleged bad faith theft of trade secrets. The Judge rejected that because: 1) he believed Davis’ testimony that he had never actually used the data, at least not the confidential parts; and 2) he believed Davis’ testimony that he had returned all of the ESI taken. There was considerable reason to doubt that later assertion because Plaintiff’s forensic examination of its computers showed that 7.21 gigabytes had been downloaded by Davis, whereas the thumb drive returned contained only 1.14 gigabytes of data. Davis, who must have been a very credible witness, explained the missing five gigabytes of data with the explanation that he eliminated all redundant, duplicate files when he loaded the files back onto his thumb drive. In other words, he successfully employed a “deduplication” defense, the first I have ever heard of in a case like this. The Judge found the testimony credible, and denied the injunction requested for now, but left the issue open upon completion of the forensic examination. Obviously if the exam seriously impeaches Davis’s testimony, and shows the deduplication excuse was a sham, the court will reconsider its ruling.
The plaintiff also sought sanctions for the spoliation that occured in disregard of the preservation letter. The Judge agreed that the ESI should not have been deleted, that it should have been preserved, but denied sanctions because he found no credible evidence of bad faith destuction of evidence, at least not yet. In the words of the court:
This is an unusual set of facts for a spoliation claim. In most cases in which a party asserts that the alteration or deletion of electronically stored information amounts to spoliation, the party wanted that information to remain available in the form that it was maintained by the other party. In this case, by contrast, Anadarko specifically asked Davis and GeoSouthern to return all the electronically stored confidential and proprietary information Davis had taken from Anadarko and to prevent anyone at GeoSouthern from accessing or using that information. That request makes it necessary for GeoSouthern to make the Anadarko information Davis had placed on the GeoSouthern computer system inaccessible, which requires that such information be deleted. The second aspect that distinguishes this case from the typical spoliation case is that at the same time Davis deleted the information from the GeoSouthern computers and his own laptop, he testified that he placed the information on a thumb drive and delivered it to Anadarko. In most spoliation cases, when information is deleted, no other record of its existence is created, much less promptly produced to the other side. The third aspect that distinguishes this case is that Davis and GeoSouthern have agreed to allow Anadarko to conduct a forensic audit of their computer systems to ensure that no proprietary or confidential Anadarko information remains accessible and to ensure that Davis returned all that he took. . . . .
Anadarko asserts that it is harmed because it cannot verify that all the information Davis took has in fact been returned. Their contention is supported, at least superficially, by the discrepancy in the volume of electronically stored information Davis took compared to what he returned. . . . .
The alleged spoliation currently does not support the issuance of a broader injunction than is presently in place to protect Anadarko’s trade secrets from unauthorized use or disclosure. Because the parties’ computer experts are still conducting their forensic examination of GeoSouthern’s and Davis’s computers, the record necessary to rule on the spoliation motion and determine whether and what sanction should issue is incomplete. This court orders Anadarko to supplement its motion for sanctions within 30 days of the completion of the forensic analysis.
