e-Discovery Team

A federal court in Hawaii recently imposed severe sanctions against a company for facilitating spoliation by trusting its top officers not to intentionally destroy evidence. In re Hawaiian Airlines, Inc., Debtor; Hawaiian Airlines, Inc. v. Mesa Air Group, Inc., 2007 WL 3172642 (Bkrtcy. D. Hawai’i, Oct. 30, 2007).  Defendant’s Chief Financial Officer panicked after he received a litigation hold notice and wiped files from his laptops. The plaintiff later claimed these files would have proved its case. The CFO said no, he was just trying to hide porn, but the judge didn’t believe him, and threw the book at ’em instead.

The defendant, a regional airline company, Mesa Air Group, Inc., was sued by a bankrupt competitor for an alleged breach of a confidentiality agreement. Mesa responded by sending out a written legal hold notice. The notice instructed key players to preserve all ESI on their computers that might be relevant. Mesa timely sent out the first hold notice to its top three officers the day after the suit was filed. It trusted that they would comply with the notice and the law. It trusted that they would not act in bad faith and intentionally destroy relevant evidence.

Big mistake, according to United States Bankruptcy Judge Robert F. Faris. The defendant should not have trusted its employees, even its top officers. It should have assumed they might disobey the hold notice and the law. Mesa should have assumed its people would respond to a hold notice by destroying evidence, not preserving it. It should not only have sent out a hold notice, it should have made backup copies of the hard drives of all of its employees who might have discoverable ESI on their computers. That way, if they responded to the hold notice by deleting incriminating evidence, the company would still have a backup copy of everything to produce to the other side. (For this strategy to work the company would have to make these copies in a stealthy manner before the hold notice was sent.)

To do any less than that was, according to Judge Faris, to “facilitate” the spoliation of evidence, subjecting the company to severe sanctions; in this case, multiple adverse inferences and a fee award. The sanctions were imposed in this case even though the CFO acted alone, and there was no evidence that Mesa or its attorneys “knew of or condoned” the destruction of evidence.

According to Judge Faris, Mesa should have distrusted its Chief Financial Officer and assumed that he would destroy all relevant evidence on his three company computers (two lap tops and a virtual drive on a server) as soon as he found out about this lawsuit. On the oft chance their CFO had something incriminating to hide, and was willing to break the law to hide it, Mesa should have made copies of his various computer hard drives, and not simply relied upon a written notice. In Judge Faris’ words: 

13. Mesa could have taken reasonable steps that would have prevented, or mitigated the consequences of, Mr. Murnane’s destruction of evidence. For example, Mesa could have made a backup of Mr. Murnane’s H drive and the hard drives of Laptop 1 and Laptop 2 promptly after HA filed suit. Doing so would not have been costly, burdensome, or unduly disruptive of Mesa’s business. Instead, Mesa simply told Mr. Murnane to preserve all evidence and trusted him to comply. Even though Mr. Murnane was a valued, trusted, high level employee of the company, Mesa could and should have taken reasonable steps to prevent all of its employees from doing wrongful and foolish things, like destroying evidence, under the pressure of litigation. Because Mesa failed to take such steps, Mesa facilitated Mr. Murnane’s misconduct.

It is true that the imaging of two laptops and a virtual drive would not, in and of itself, have been terribly burdensome or expensive. But does that justify the mandatory stealth imaging of all impacted employees? Mesa is an airline of over 5,000 employees, generating revenues of over $1.4 billion per year. The opinion states that only three employees were sent the original preservation hold notice, the three top officers of Mesa: the CFO, CEO and the President. If in fact only three custodians were involved throughout, which to me seems unusual, then the court’s low cost and burden argument has some merit, even if it is still questionable on policy and practical grounds. But if other hold notices were later sent out to dozens of additional ESI custodians, which to me seems more likely, then the court’s economic analysis is flawed.

The policy of mistrust is also, in my view, not well considered. Although hindsight is 20/20, how was Mesa to have known when suit was filed that its Chief Financial Officer might destroy evidence? There is nothing in the opinion to suggest he was anything other than a trusted and reliable senior management employee. If Mesa could not trust its Chief Financial Officer, then it could not trust anybody. By this logic, in every lawsuit Mesa would have to image the computers of all key witnesses and ESI custodians who might have discoverable ESI in them. Any of them might do “wrongful and foolish things” under the pressure of litigation. Where would this lead? I am reminded of the quote by Ralph Waldo Emerson: “Our distrust is very expensive.” The copying of dozens, if not hundreds, of computers can become very expensive. Is it really reasonable to expect large organizations to always act out of mistrust and fear that it might have a renegade employee, one who is willing to break the law and destroy evidence? Is it really fair to hold that an employer facilitated its employees’ bad faith destruction of evidence, simply because it did not copy all potentially impacted computers as soon as a suit was filed?

Also, as a practical matter, how was Mesa supposed to have copied its top officers’ computers before they had notice of the law suit, and thus an opportunity to delete files from these computers? They are the first ones to learn of a suit like this, and are necessarily involved in discussions with the lawyers on what to do, who should be provided with a hold notice, and the like. Is it realistic to require legal counsel to copy everything on the computers of the top officers of a company any time a suit is filed where they might be involved as a witness? Should in-house counsel be required to do so surreptitiously, even before the officers are told about the lawsuit? I doubt they would last very long if they did! Such extreme measures should, in my opinion, only be employed in very rare circumstances where there is strong evidence that the action is required, that otherwise there is a substantial likelihood evidence will be destroyed. Even then, it should be used with caution. The extreme process of imaging all computers should never be used in a case such as this, where there is no advance warning of possible spoliation, much less a strong showing of likely destruction of evidence.

Beyond the questionable holding, the facts underlying this case are interesting on a number of levels, including the technical “geek” perspective. Mesa’s CFO was said to be “an experienced and knowledgeable computer user.” He installed a program called System Mechanic Professional 6 on both of his company owned laptops, and used it to super-delete files from them. He attempted to disguise the timing of these deletions by changing the dates on the computers before he ran the software. He did not know that forensic analysis can easily detect such system clock changes. The CFO also stored files on a company server, called his “H drive,” but he did not use special software to super-delete any files there. Some files on his “H drive” were deleted, and apparently could not be later restored due to normal usage, but were recovered from backup tapes of the server. These and other technical details are explained by the Court:

System Mechanic has a subprogram called DriveScrubber2 that permanently deletes files from a computer.

7. When an active file (a file that a user can view) is deleted on a computer using the Windows operating system, the data comprising the file is not erased; instead, the file is removed from the “index” of all active files on the disk, and the disk space that contains the deleted file is gradually written over as new files are written to the disk. A person with the appropriate skill and software can analyze the bits of data left on the “unallocated space” of the drive (the portions of the disk that, according to the “index,” do not contain active files) and reassemble some or all of the deleted files. “Disk wiping” programs like DriveScrubber2 render deleted files unrecoverable by writing meaningless data (usually repeated strings of hexadecimal characters) to the unallocated space of the disk, permanently eliminating the residue of previously deleted files.

Later forensic exams of the CFO’s laptop computers could not recover the  super-deleted files, but they did prove that Drive Scrubber was used after the hold notice was received. The exams also revealed a clumsy attempt to conceal the disk wipes by changing the system clock to a time before the hold notice. As to the files ordinarily deleted from the network server “H drive,” Mesa was able to recover “many, if not all” of them by restoring the backup tapes of that drive. Some of the restored files were relevant, but none were “smoking guns.” 

The CFO did come up with a creative defense to his actions. He claimed he was trying to hide the fact that he had been viewing “adult materials.” Judge Faris did not believe this testimony. For one thing, Mesa’s CEO, who the judge said was a good friend of the CFO (and thus obviously trusted him), testified that his friend had “told him he had wiped the hard drives in order to conceal adult content on his computers.” Still, according to Judge Faris:

It was absolutely clear from Mr. Ornstein’s words and demeanor on the witness stand that he did not believe Mr. Murnane’s “adult content” explanation.

I do not know what the CEO’s demeanor was like when he testified about his friend’s excuse – no doubt he was embarrassed – but obviously the CEO believed him or he would not have offered the story. Also, the opinion admits that evidence was offered that the CFO’s laptop was previously found to have adult content in two prior incidents in 2003 and 2004. But Judge Faris was more impressed by the facts that no adult materials were found on the laptops now, nor on the “H drive”, and the IT tech who “regularly worked” on the laptops testified that he had never seen adult content on the computers. 

Also, Judge Faris commented that the CFO never took the stand to testify, and he found that:

It is not credible to suggest that a high-level officer and busy person such as Mr. Murnane would have done a mundane task like this himself rather than leaving it to Mesa’s IT department.

That does not have the ring of truth to me. If a person, no matter what his rank, has the time and indiscretion to view porn on his company laptop, then it does not surprise me that he also has time to wipe it clean, and would not want talkative IT employees to do it for him. No one, especially a “high-level officer,” would want to entrust such a sensitive, and potentially embarrassing task to the company’s IT department. The super-deletion process is not really too hard or time consuming, as the judge here seems to recognize by calling a “mundane task.” So it is not at all surprising that someone would want to do it themself, much less “not credible.”

The timing of the CFO’s deletions of alleged “adult materials” was too suspicious. There were also several indications that the CFO had taken and used confidential information of the bankrupt Hawaiian Airlines, and thus Mesa had breached the confidentiality agreement as alleged. These other facts seemed to color the court’s analysis of the spoliation motion and conclusions that:

b. The confidentiality agreement provides that “Mesa shall be responsible for any breach of this agreement by Mesa’s employees, officers and Representatives….” Mesa should also be responsible for the intentional destruction by one of its highest ranking officers of evidence that could have shown whether Mesa complied with that agreement.

c. Mesa could have prevented Mr. Murnane from destroying evidence, or at least limited his ability to destroy evidence, by taking reasonable, inexpensive, and non-burdensome steps. Mesa failed to do so and is responsible for the consequences of that failure.

For these and other reasons, Judge Faris granted plaintiff’s motion for sanctions, imposed multiple adverse inferences and taxed fees, but stopped short of entry of a default judgment as plaintiff had requested.

This entry was posted on Sunday, November 25th, 2007 at 8:26 am and is filed under Forensic Exam, Lawyers Duties, Spoliation/Sanctions. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.