e-Discovery Team

In Reno, Nevada, Wells Fargo used e-discovery as a weapon to help defend against a disgruntled mortgagee. Johnson v. Wells Fargo Home Mortgage, Inc., 2008 WL 2142219 (D. Nev. May 16, 2008). Wells Fargo moved for dismissal as a sanction for intentional spoliation of computer evidence. Magistrate Judge Robert A. McQuaid, Jr. did not dismiss the case, but did order an adverse inference jury instruction that will probably be outcome determinative. The instruction requires the jury to assume that all of the information plaintiff deleted from his hard drives would have supported Wells Fargo’s defense.

I have never seen a defendant lose a case after being granted a key jury instruction like that, but still, the expense of going forward with trial can be considerable, and you never know what might happen. No doubt Wells Fargo was disappointed with the result, and, as I will explain in this blog, they have every right to be.

Facts of the Case

The plaintiff sued Wells Fargo alleging violation of the Fair Credit Reporting Act. Wells Fargo supposedly reported to credit agencies that two of plaintiff’s loans from Wells Fargo were in default, when they were not. Plaintiff also claims that Wells Fargo foreclosed on one of the loans, even though he was current in payment. Plaintiff claims that he “spent nine months making multiple phone calls and sending correspondence, including cancelled checks and loan documents, verifying the loans were current.” Id. at *1. Plaintiff attached some of the correspondence and other documents as exhibits to his complaint. Wells Fargo not only denied the complaint, it alleged that the plaintiff manufactured the evidence, that the whole thing was staged. According to Wells Fargo, the alleged communications never happened, and the documents were backdated frauds.

To prove its electronic document forgery defense, Wells Fargo, on July 28, 2007, asked plaintiff to produce for inspection the two laptop computers he used to write these documents. Wells Fargo hoped that a forensic exam would prove that plaintiff’s case was fabricated. It expected the forensic examination to show that the key documents supporting plaintiff’s case were prepared just before suit was filed and backdated to support his story of prior communications. Plaintiff objected to the request on September 14, 2007, stating that he would only produce specified files. Wells Fargo made several attempts to resolve the dispute, but ultimately was forced to file a motion to compel production of the hard drives on October 10, 2007. Id. at *3.

The motion was granted, and the plaintiff was ordered to produce the hard drives of his two laptop computers. When the drives were produced and examined by the computer forensic expert retained by Wells Fargo, he discovered that both drives had been “reformatted and/or reinstalled.” Id. at *1. The forensic exam showed that “Plaintiff deleted files and reformatted both hard drives on September 25, 2007 and October 5, 2007.” Id. at *3. That is two months after the request to produce. In other words, plaintiff secretly had his hard drives reformatted and reloaded while the parties were in negotiation over the production.

The expert said that the reformatting prevented him from retrieving useful information about the files that were on the disc before it was reloaded with new files. (This does not, however, mean that more information could not be gleaned by further study.) Still, among the new reloaded files the expert was able to find two of the letters that were key to plaintiff’s claim. The expert also found evidence to prove that these documents were created more than one year after plaintiff claims to have written them. In fact, consistent with Well Fargo’s suspicions, he found that they were created just a few weeks before suit was filed.  It was not explained exactly what evidence the expert had to prove the back dating, but I suspect it was in the word documents’ internal metadata.

Wells Fargo also stated that it would be able to recover still more information from the hard drives, even though they had been formatted, if additional, more expensive forensic recovery work were performed. This would be possible because when a disc is reformatted, all of the original data remains on the disk and is not fully destroyed. Instead, the areas on the disk containing the data are merely marked as available. The old data stays there until overwritten with new files. Wells Fargo confidently predicted that additional forensic study would uncover more forged documents. However, they did not want to incur that additional expense. They wanted the case dismissed.

Naturally, Wells Fargo was upset by the inability to get at all but two of the documents which it claimed the plaintiff had forged and backdated. It had hoped the forensic evidence would be conclusive, and the case would promptly end with a summary judgment. Wells Fargo responded to this discovery of spoliation with a motion for sanctions, seeking the ultimate remedy of dismissal of plaintiff’s case. Here is Judge McQuaid’s summary of Well Fargo’s motion:

Defendant asserts that “Plaintiff has altered numbers on correspondence and checks, fabricated evidence to bolster his position, and most recently, erased his hard drives knowing the information on them was relevant to this action.” (Id.). Defendant goes on to assert that Plaintiff’s “despicable behavior was intended to hamper the fact gathering process by preventing Wells Fargo from obtaining highly relevant information that may have defeated his only remaining claim under the Fair Credit Reporting Act and his damage claims.” (Id.). Defendant contends an adverse jury instruction and monetary sanctions are not enough because the relevant documents no longer exist and that, instead, Plaintiff’s calculated and willful misconduct warrants dismissal of this action (Id.).

Plaintiff tried to justify his secret reformatting of the hard drives with a convenient story about his computers becoming infected with a virus. In these circumstances, that is about as convincing as the “dog ate my homework.” Here is the court’s summary of his excuse:

Plaintiff argues that his laptops were infected with computer viruses and spy-ware and that a computer technician diagnosed the problem and recommended wiping clean and reformatting each hard drive and then reinstall the operating systems (Doc. # 133 at 4). Plaintiff claims that before this procedure is performed, data on the hard drive is backed up and saved and then downloaded back onto the hard drive after the operating system is reinstalled (Doc. # 133 at 4). Thus, Plaintiff argues Defendant’s motion should be denied because no data has been destroyed (Id.).

One problem with plaintiff’s story, aside from the obvious that he did it in secret months after the request to produce, was that plaintiff refused or was unable to produce any of the back-up files of these computers. Further, there are the aggravating circumstance of the testimony of the plaintiff’s wife, and the affidavit that Well Fargo obtained from the technician the plaintiff hired to reformat the laptop. (Apparently the plaintiff himself has not yet been deposed.)

The deposition of plaintiff’s wife occurred just two weeks after the hard drives were formatted, yet in response to questions she denied that any work had been done to their computers. To make matters worse, the plaintiff’s technician who formatted his laptop stated that he only formatted one laptop. He said the other laptop was formatted by plaintiff’s wife two weeks later, with his help and instructions over the phone. Further, the plaintiff’s tech said that he never backed up the files on the laptop before the formatting, and did not instruct the wife on how to do so. Id. at *8. This certainly impeaches the deposition testimony of plaintiff’s wife, and shows that plaintiff was trying to hide his reformatting actions, apparently in the naive hope it would never be discovered. It also contradicts plaintiff’s claim that he backed up both computers before having them reformatted. 

The fact that plaintiff had to hire an expert to format his laptops, and the expert had to talk the wife through the process, tells me that they are both computer novices. Formatting a disc is very easy to do, and is not something you normally need to take to a technician. You might retain a tech to try and get rid of viruses, but there is little evidence the plaintiff’s technician was ever even asked to try and fix the virus problem. Normally a tech could find several less drastic methods than reformatting to rid a disc of viruses and spyware.

Also, when you think about plaintiff’s virus story, you realize it makes little sense.  Plaintiff said he copied all of the files onto backup discs, had the hard drive formatted, and then reloaded the files back onto the computer. How would that get rid of the viruses? The backup discs would include the infected files. When you restore the files onto the freshly formatted hard drive, the virus files would be restored too. You need to delete or quarantine viruses to get rid of them, not copy them back and forth. Alternatively, if you reformat, you do not reload the same files that were on the original infected disc, at least not until inspecting and cleaning all of these files to remove all of the malware.

The plaintiff here also showed his lack of expertise with computers when he tried to hide ESI by simply formatting the disk. More experienced users typically try to hide evidence by wiping a disc, not formatting it. This is easy to do with several off-the-shelf software programs. I have written about this several times before in prior blogs, including IT Tech’s Fast-Talk Had Zero Persuasive Value with Judge, and GhostSurfer Wipe Out Leads to Jail Order Sanction in Bankruptcy Court. These other attempts to hide ESI by unscrupulous litigants, although more sophisticated, also ultimately failed. Even when better software does succeed to clear a disc of all incriminating ESI, there are still records left on the computer that these “Evidence Eliminator” type programs were run. Either way, you cannot win for trying, and there is almost always a way to catch a fraudster.

As to the two documents that Well Fargo’s expert found and claimed were backdated, plaintiff argued that this was pure speculation and “completely meaningless unless it is known whether the date and time set on the computer were correct when the documents were created.” Id. at *7. Again, that is a lame argument of a computer novice, to claim that the dating evidence is meaningless simply because a computer’s clock could have been changed. Why would it have been changed? Moreover, there are ways to detect computer clock resetting, as the CFO in Hawaiian Airline found out in In re Hawaiian Airlines, Inc., Debtor; Hawaiian Airlines, Inc. v. Mesa Air Group, Inc., 2007 WL 3172642 (Bkrtcy. D. Hawai’i, Oct. 30, 2007). I wrote about this and forensic recovery in my blog “Book ‘em Danno”: Hawaiian Judge Sanctions Company for Trusting its Top Officers after One Wipes His Laptops, Allegedly to Hide Porn. An employee who changed the date on his resume by changing the computer clock learned the same lesson in Plasse v. Tyco Elec. Corp., 2006 WL 2623441, (D.Ma. Sept. 7, 2006). In Plasse, the plaintiff’s case was dismissed for this attempted fraud on the court.

Motion For Sanctions

Wells Fargo’s motion for sanctions was based on both Rule 37 and the court’s inherent power. Judge McQuaid made short work of Rule 37 and held that it did not apply simply because plaintiff’s “conduct was not in violation of any discovery order governed by Rule 37.” That is a very narrow construction of the rule, and he did not try to explain or justify it, instead focusing on Well Fargo’s other grounds of the court’s inherent authority to impose sanctions. Judge McQuaid’s legal analysis was based on Ninth Circuit law in this area, primarily Anheuser-Busch, Inc. v. Natural Beverage Distributors, 69 F.3d 337, 348 (9th Cir. 1995). Anheuser-Busch requires courts to consider several factors “before imposing the harsh sanction of dismissal,” including whether the misconduct was intentional or in bad faith, whether there was a “relationship between the sanctioned party’s misconduct and the matters in controversy, such that the transgression threaten[s] to interfere with the rightful decision of the case,” and the effectiveness of “less severe alternatives than outright dismissal.” Id.

Plaintiff here conceded that the reformatting was intentional, but he denied this caused any evidence to be lost. Further, he claimed his actions were all done in good faith and so his case should not be dismissed.

Court’s Holding Denied Dismissal, But Imposed an Adverse Inference Instruction  

The court disagreed with plaintiff’s stories and pleas of good faith, and instead held:

The timing of Plaintiff’s reformatting of his hard drives is also very suspect. Plaintiff reformatted both hard drives within a few days of each other, not only during the period of time he knew Defendant sought production of the hard drives, but also after Defendant informed Plaintiff, on September 20, 2007, that it intended to file a motion to compel production of the hard drives (Id.,Exh. 6). Within five (5) days of being notified that Defendant intended to file a motion to compel, Plaintiff reformatted his first hard drive (Id.,Exh. 1). Then within ten (10) days of reformatting his first hard drive, Plaintiff reformatted his second hard drive (Id.). During this entire period of time, Defendant sent numerous e-mails to Plaintiff attempting to settle the dispute over production of the hard drives (Id.).

Plaintiff’s explanation that he reformatted his hard drives because they were infected with viruses and spy-ware and then he downloaded all the files back onto the hard drives is of little help to the court in finding an absence of willfulness or bad faith. At no time did Plaintiff inform Defendant that his hard drives were infected with viruses or spy-ware, despite having knowledge Defendant requested production of said hard drives. And, as previously stated, Plaintiff has produced no evidence of any back-up files, nor has he indicated that he will produce any back-up files to show that he did, in fact, download all the files back onto the hard drives. 

*5 Under these facts, the evidence weighs heavily against Plaintiff and tends to show Plaintiff did, in fact, willfully reformat his hard drives knowing Defendant was vehemently requesting production of those hard drives. Thus, this factor also weighs against Plaintiff.

So far, so good, for Well Fargo’s request to have the case dismissed because of spoliation. All of the factors the court considered as required by Anheuser-Busch  weighed in defendant’s favor, except for the last one: whether alternatives less severe than dismissal might be appropriate. Here the court was inclined to give the plaintiff a break, and just order an adverse inference instruction instead of outright dismissal. As I stated before, although this means Well Fargo is almost certain to win, it will still be put to the great expense and burden of trial, and it is always possible a jury will rule for the plaintiff. Judge McQuaid must have had some unexpressed doubts about this case to let it go to trial like that. It is also possible he just wanted to play it safe and not risk reversal by the district court. It is hard to say without knowing more about this case and the personalities involved. In any event, here is Judge McQuaid’s explanation for his ruling:

Under these facts, it appears the evidence that Defendant’s forensic computer expert retrieved, together with the timing of Plaintiff’s conduct, actually lend support to Defendant’s theory of the case–that Plaintiff manufactured this action and the evidence he planned to use to support the action–rather than prevents Defendant from fully developing it’s theory as Defendant suggests. Accordingly, for the foregoing reasons, the court finds a jury instruction creating a presumption in favor of Defendant that the spoliated evidence was unfavorable to Plaintiff is a more appropriate, less drastic sanction.

Basically Judge McQuaid is saying that since the plaintiff’s fraudulent destruction of evidence confirms the defense position that the whole case is a fraud, that makes it more appropriate to allow the case to continue to trial, than be dismissed. I am not sure I understand that kind of “two wrongs make a right” logic. A plaintiff who manufactures a case out of whole cloth should not for that reason have carte blanche to commit more fraud. The court should have granted Wells Fargo’s motion and dismissed this case.

This entry was posted on Sunday, June 22nd, 2008 at 5:00 pm and is filed under New Rules. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.