e-Discovery Team ®

GUEST BLOG: James Cook, Of Counsel Attorney, Jackson Lewis LLP. Jim is a member of the Jackson Lewis’ e-Discovery Team and serves as the e-discovery expert liaison for the firm’s Albuquerque, New Mexico office. Before law school Jim had a successful career in software engineering and technology product development, including overhaul of a submarine reactor control system. Jim has also taught strategic IT management at the University of Washington’s Executive MBA program.

_____________

Extensive reporting on sanctions cases have many companies running scared when it comes to preservation. Cases with high visibility failures to preserve such as Victor Stanley, Pension Committee, and Rimkus have focused attention on the dangers inherent in a litigant’s failure to preserve electronically stored information (ESI). That is generally a good thing. But some companies with especially complex systems, and heavy litigation, fear the threat of sanctions so much that they over-preserve in an attempt to shield themselves from sanctions’ motions. I am reminded of the words of the great scientist and two-time Nobel laureate, Madame Marie Curie, who said:

Nothing in life is to be feared, it is only to be understood. Now is the time to understand more so that we may fear less.

This installment of the e-Discovery Team blog is a tale of three sanctions motions. The orders on these motions provide us with a better understanding of the e-Discovery game. Two of the motions resulted in significant sanctions, and one resulted in no sanctions. The difference was in the litigant’s conduct during discovery. The courts rewarded good faith reasonable efforts and this should provide us all with solace.

The first two opinions are in the same case, E.I. du Pont de Nemours and Company v. Kolon Industries, Inc. This is a case about misappropriation of trade secrets associated with DuPont’s Kevlar^® business. The second case, Gentex v. Sutter, et al., is also a trade secrets misappropriation case concerning Gentex’s Advanced Combat Helmet design.

The DuPont Case

On February 3, 2009, DuPont filed suit against Kolon alleging trade secret misappropriation, theft of confidential business information, conspiracy, and other business torts. The litigation initiated largely from the conduct of a former DuPont employee who admitted transferring information, purportedly at Kolon’s invitation, that DuPont alleged were trade secrets.

Leading up to trial, Kolon filed a motion for sanctions against DuPont for spoliation. DuPont also filed a motion for sanctions against Kolon for spoliation.

Kolon’s Motion for Sanctions Against DuPont

Kolon’s motion for sanctions focused on the alleged deletion of email accounts and documents by DuPont of four former DuPont employees. E.I. du Pont de Nemours and Company v. Kolon Industries, Inc., 2011 U.S. Dist. LEXIS 45888 (E.D. Va. April 27, 2011). The deletion allegedly deprived Kolon of information (primarily how DuPont gathered competitive intelligence about Kolon) that Kolon needed to support its defenses. The defendant’s motion for sanctions was denied because DuPont was wearing a Kevlar coat of its own making – reasonable, good faith efforts.

Kolon made three claims in support of its motion for sanctions.

1. DuPont failed to issue a litigation hold for over 13 months after DuPont reasonably anticipated litigation in May 2006.
2. DuPont only issued the first hold order to 18 people even though DuPont allegedly knew that many more employees were likely to have relevant knowledge. Missing from the first hold order were the 4 employees whose email accounts were deleted and the email account of one employee was deleted under “rather suspicious circumstances.”
3. DuPont’s Corporate Counsel allowed the email accounts of the four employees to be destroyed under unexplained circumstances and contrary to DuPont’s internal policies regarding document retention and deletion.

Kolon argued that DuPont reasonably anticipated litigation with Kolon in May 2006. However, the Court had previously held that DuPont reasonably anticipated litigation with Kolon on May 21, 2007. [This was the date DuPont hired outside counsel to assist with the investigation and advise on possible litigation options.] After reviewing the facts surrounding the departure of the four employees and the deletion of their email accounts, the Court concluded that on May 21, 2007, DuPont had no reason to believe that the information in the deleted email accounts would be relevant or potentially relevant to the litigation.

Kolon also argued that the four employees were key players so the first litigation hold order should have been issued to these four employees. The Court concluded from the record before it that DuPont could not have reasonably seen the four employees as key players at the time DuPont issued its first litigation hold order.

In addition to a detailed analysis of the relevant dates and events, the Court made several observations that supported its decision to deny Kolon’s motion.

Although noting a litigant’s obligation to preserve relevant evidence, the Court observed that upon “recognizing the threat or anticipation of litigation, litigants are not required to ‘preserve every shred of paper, every e-mail or electronic document, and every back up tape,’ for ‘[s]uch a rule would cripple large corporations.’” DuPont at *32 (citing to Zubulake v. UBS Warburg LLC, 220 F.R.D. 212, 217 (S.D.N.Y. 2003).

The Court also observed that a “discussion of reasonableness as an underlying consideration when analyzing a litigant’s compliance with its duty to preserve is particularly appropriate in these circumstances. Dupont, at *48. The Court noted the following the following factors supporting its conclusion that DuPont acted reasonably and in good faith.

1. DuPont issued the first hold order shortly after its duty to preserve was triggered.
2. The hold order directed the recipients to hold “any competitive intelligence related to Kolon.”
3. The employee who received all competitive intelligence from the 2,500 people in the business unit did receive the hold order and did comply with it so all competitive intelligence DuPont gathered about Kolon was preserved through that employee.
4. DuPont’s first hold order directed the recipients to include “any competitive intelligence related to Kolon” even though DuPont had no reason to believe at the time that the scope of the hold order should include how DuPont collected competitive intelligence.

The Court stated that it “refuses to second-guess DuPont’s efforts in this regard based on the record, and finds that DuPont, in good faith, took positive steps reasonably calculated to ensure that information it reasonably believed was relevant at that time was preserved for litigation.” Id. at *49 (emphasis added).

So, even though some potentially relevant information was lost, DuPont’s good-faith positive action to ensure preservation of relevant evidence based on what DuPont reasonably knew at the time was all that was required and Kolon’s motion for sanctions was denied. The Court did not demand perfection – just reasonable good-faith efforts. Those kind of efforts will make you nearly sanctions bullet-proof in most courts today.

DuPont’s Motion for Sanctions Against Kolon

Three months later, the same Court came to a far different conclusion about the imposition of sanctions based on its finding that key employees of Kolon engaged in intentional and bad faith deletion of relevant files and email items. E.I. du Pont de Nemours and Company v. Kolon Industries, Inc., 2011 U.S. Dist. LEXIS 79406 (E.D. Va. July 21, 2011).

DuPont’s motion for sanctions was precipitated by Kolon’s production to DuPont in February 2010 of 1.2 million pages of documents. During its review, DuPont discovered printouts of a series of screenshots (an image of the data displayed on a computer display) taken by three Kolon employees shortly after DuPont filed its lawsuit. The screenshots displayed numerous files in their personal accounts with markings such as “Delete,” “Need to Delete,” “Remove All,” and “Get Rid Of.” [Not a good idea to provide evidence to opposing party about your plans to delete relevant evidence.] In addition to the “smoking” screenshots, DuPont noticed that there were suspiciously low document production totals for these and other key Kolon employees.

DuPont explained its concerns in a letter to Kolon’s counsel, which was ignored. [Maybe they will go away.] On July 30, 201, DuPont deposed Kolon’s Rule 30(b)(6) witness about document preservation. The Court noted that Kolon’s witness “provided evasive and incomplete testimony on the subjects of document preservation and the meaning of the screenshots.” DuPont at *8. So, DuPont filed its motion for sanctions on August 19, 2010. The Court noted that this was “the beginning of a long, and oftentimes tortuous, journey on the part of DuPont to get to the bottom of the alleged deletion of files and email items by key Kolon employees in the days after DuPont filed its Complaint.” Id. at *9. The Court also noted that DuPont’s task was “complicated by the numerous objections (many of which lacked substantive merit) lodged by Kolon and by its overall obfuscatory conduct throughout the proceedings.” Id. [Note: Also not advisable to irritate the Court.]

Kolon’s response to DuPont’s motion admitted that a former Vice-President of the business unit competing with DuPont did delete DuPont documents from his computer. However, Kolon characterized his actions as “isolated” and “not representative of Kolon and its efforts to preserve and gather documents.” [Hard to spin it when deletion is admitted, but they had to try.]

After review of the initial briefs, the Court ordered targeted discovery including “a special interrogatory, depositions, and forensic analysis by an independent third-party.” The Court noted that “Eventually, after needlessly dragging its heels, asserting trivial, or meritless objections, and wrangling over details of the depositions and the meaning of ‘independent’ forensic analyst, Kolon responded to DuPont’s interrogatory and produced seven Kolon employees … for depositions.” Id. at *10. [Note: Really, it is not a good idea to irritate the Judge.]

The list of “horribles” detailed in the 30 page Memorandum Opinion is far too long to cover in this article but some of the best (worst?) were:

• Kolon resisted production of the drive images for 8 of 21 custodians until January 13, 2011, 20 days before the evidentiary hearing on February 2, 2011. [If we wait long enough, they won’t have time to look at everything.].
• DuPont’s expert reported that it could not perform a complete analysis of possible email destruction without information from Kolon’s Exchange Server “dumpster.” [The dumpster is a feature in the Microsoft Exchange Server 2007 that allows the server to keep track of deleted items. This is known as the Recoverable Items folder in Exchange 2010. This feature is used to provide protection from accidental or malicious deletion of files and to facilitate discovery efforts in litigation.] This report also let the Court know that Kolon had not complied with the Court’s instructions to Kolon’s counsel in November to expedite the production and analysis of dumpster data. Kolon released data for six custodians in late December 2010, then for the last 7 custodians on January 12, 2011. [Still following the wait long enough strategy.]
• Kolon admitted that its employees held a meeting to discuss identifying documents on their computers for later deletion, marking email items for possible deletion, and deleting folders that contained DuPont proprietary information in the days after DuPont filed its Complaint. [There’s so much harmful data, we better meet to figure out how to get rid of it.]
• Kolon’s rebuttal forensic expert opined that screenshots discussed in the meeting about file deletion actually “depicted collection activity” for locating relevant emails and files. Id. at *25-26. [This does not pass the ‘giggle test.’] The Court noted that it was familiar with preservation efforts undertaken by litigants and thought it “rather unrealistic that employees would preserve relevant email items by circling them on screenshots with directives to ‘Delete,’ ‘Removal All,’ or ‘Need to Delete.’” Id. at *26.
• Kolon’s second hold order to all employees was distributed only a few days after its first hold order. However, it was written in English but distributed to employees who were not English speaking. [It was a written hold order. Do employees have to be able to read it? Next they will probably want us to help employees to understand it.]
• DuPont’s expert concluded that after February 1, 2009, Kolon employees deleted 17,811 files and email items. There were 12,836 unique email items of which 9,010 were responsive to keywords. Kolon employees deleted 4,975 electronic files and 2,141 of the files were overwritten or inaccessible. 134 of the overwritten files were .dbx files, which could contain hundreds (or even thousands of emails). [A .dbx file is the Outlook Express equivalent of an Outlook .pst file. Because this is a “container” type of file that was overwritten, there is no way to know how many email messages and attachments were in the overwritten .dbx files.]
• DuPont’s forensics expert determined that one employee started deleting files on February 10, 2009 (Kolon’s litigation hold to all employees was issued February 10, 2009) and made additional deletions on February 13, 26, and 27, 2009. This employee deleted a total of 1,417 files and email items. Forty-six of the deleted files that were overwritten were .dbx files of more than 720 megabytes (about 72,000 pages of email according to the Court).
• The former DuPont employee whose conduct initiated this lawsuit made a presentation to Kolon executives in Korea in March 2007. He brought a CD containing DuPont proprietary documents that he used in the presentation. When the meeting broke for lunch, a Kolon employee was directed to make a copy of the CD while the former DuPont employee was at lunch. These files were later deleted after the litigation commenced. [Memo to Self: Don’t leave any computer or media containing proprietary information unattended.]

The list of deletions and questionable conduct goes on and on. Even though many files were unrecoverable because they were overwritten, DuPont’s forensic expert was able to obtain the names and the creation, modification and access dates of some of the deleted files. The file names were able to provide strong indications that many of the deleted files were relevant or highly relevant to the litigation.

The Court noted that Kolon did not provide sufficient instruction to employees about the importance of preserving relevant files and email items. The Court also noted that Kolon’s counsel and executives should have affirmatively monitored compliance with the second litigation hold especially because most employees would not know English and would be unfamiliar with litigation in the United States. [Guess we really do have to help employees understand hold notices and preservation obligations.]

The Court determined that sanctions were appropriate because it found that key employees of Kolon intentionally, and in bad faith, deleted files and email after they learned of the lawsuit. The Court decided that entry of default judgment was not warranted because it was “neither proportionate to Kolon’s conduct nor necessary to cure any prejudice to DuPont.” Id. at *104. The Court noted that Kolon “did attempt to put in place two litigation hold orders and it implemented a widespread effort to preserve files.” Id. at *106. Kolon was also “aided by good fortune in that many deleted items were recoverable because of the preservation of Kolon’s backup tapes.” Id.

The Court decided that it would:

[I]nform the jury that certain Kolon executives and employees, after learning that DuPont had sued Kolon, deleted much electronically stored information that would have been available to DuPont for use in presenting its case. The jury then should be allowed to infer that the unrecoverable deleted information would be helpful to DuPont and harmful to Kolon. The jury also should be told that the fact of deletion, without regard to whether the deleted material was recovered, may be taken into account in assessing the element of Kolon’s intent and knowledge.

Id. at *109. The Court also imposed a sanction of attorneys’ fees, expenses and costs related to DuPont’s motion.

DuPont obtained a $919M verdict against Kolon on September 14, 2011, which Kolon has stated it will appeal. It is likely that the adverse inference instruction sanction against Kolon was a key factor in this verdict. The defendant was obviously not wearing a good faith reasonable-efforts Kevlar jacket and so was fatally wounded by Dupont’s sanctions bullets.

The Gentex Case

Gentex Corporation v. Sutter, et al. is a case alleging violations of the Computer Fraud and Abuse Act (CFAA) (18 U.S.C. § 1030) and the Pennsylvania Uniform Trade Secrets Act, as well as breach of contract and tortious interference. Two employees of Gentex quit and went to work for different companies competing with Gentex. The Court referred to the defendant corporations collectively as Armor. The employees allegedly copied proprietary files containing Gentex’s trade secrets about its design for an Advanced Combat Helmet (ACH).

When Gentex learned that its former employees were working on an ACH design for Armor, Gentex’s attorney sent a letter to the former employees asking them to sign an affidavit swearing that they had not used or disclosed Gentex’s trade secrets in violation of their non-disclosure agreements. Based on the advice of Armor and counsel, they did not sign the affidavit.

In a business report, dated November 22, 2006, Armor documented Gentex’s concerns and noted that “Our attorney believes they [Gentex] are headed toward filing a lawsuit.” [Probably not a good idea to put a likely privileged communication in a business document that is not privileged.] Gentex filed suit against one former employee, Sutter, on December 8, 2006. Armor initiated a litigation hold on January 26, 2007, suspending its document destruction policy and instructing employees to preserve documents and electronically stored information concerning Armor’s relationship with Sutter and his work at Armor from March 2006 to the present.

On February 9, 2007, Armor retained a vendor to assist with evidence preservation and analysis. During the remainder of 2007, Armor’s vendor made forensic images of more than 20 computers used by Armor employees, executives and former Gentex employees, an image of Sutter’s home computer, special server backup tapes and various removable media.

On July 13, 2007 Gentex filed suit against another former employee, Walko, and the Armor companies and the two actions were consolidated.

Memorandum Granting in Part and Denying in Part Gentex’s Motion for Default
Case No. 3:07-CV-1269 (M.D. Pa. October 24, 2011)

Discovery in the case uncovered extensive evidence suggesting intentional destruction of ESI by both the corporate and individual defendants. Plaintiffs moved for default judgments against all defendants based on the spoliation. The Court granted a default judgment against the individual defendants and provided an extensive list of “horribles” to support the ultimate sanction. However, the Court found that there were issues of material fact as to whether Armor engaged in spoliation, so it denied the motion for default judgment against Armor. A partial list of “horribles” noted by the Court included:

• Testimony by Armor’s Network Administrator (disputed by Armor) that the litigation hold was taken off a few months after it was put in place. [IT staff should never be confused about whether a litigation hold is in place. If the Network Administrator thought the hold was off, any number of automatic deletion processes could have been restarted.]
• Possible destruction of server backup tapes. Gentex’s expert determined that there should have been 24 sets of backup tapes. Armor was not able to locate the tapes and stated that they must have been destroyed inadvertently. Gentex disputed this because Armor’s IT employees testified that Armor uses software that makes it impossible to inadvertently delete relevant tapes. Gentex also stated that Armor’s regular policy was to keep yearly tapes for 7 years. [Software can’t stop a person from picking up a tape and discarding it. Keeping 7 years of tapes may needlessly expose a lot of data to preservation obligations and possibly production if there is no good reason to retain the data that far back. Even if the data is not harmful, it will be very expensive to handle when other litigation ensues.]
• Armor advised Sutter to preserve both his home and work computers. However, on January 31, 2007, Sutter ran software on his home computer to scrub the hard drive because Gentex’s lawsuit “scared” him. [The Court noted that Sutter cited no authority suggesting that ‘fear’ is a legitimate exception to the rules of spoliation.]
• Sutter and another former Gentex employee, Walko, admitted that they destroyed CDs that did contain or may have contained Gentex information. Walko testified that Armor’s Vice-President of Engineering told him to “do what you think you have to do to clean up” after Walko informed the VP that he had Gentex information on his computer. [All senior managers should know about preservation obligations triggered by litigation. What senior managers do not know can seriously harm a company.]
• Walko testified that another employee purposely deleted information and then copied large amounts of pictures and videos. Gentex’s forensic expert confirmed that the same picture had been copied multiple times between December 17, 2006 and January 31, 2007 and that a large amount of pornographic images had been downloaded on February 22, 2007 and March 8, 2007. [Maybe they will think I’m just trying to hide the pornography and not destroying evidence.]
• An Armor Senior Vice President directed Armor’s IT staff to delete a directory containing his 2006 files.
• Gentex’s expert testified that the Windows Disk Defragmentation tool was run on all of the Armor computers before the forensic images were made. [Defragging a disk is a process in which the information contained in files is moved from one disk sector to another to relocate the information to contiguous sectors. This speeds up retrieval of files from the disk. However, it can result in overwriting of unallocated sectors that may contain information from deleted files and thus may prevent a forensic expert from recovering a deleted file.]
• Walko testified that Sutter deleted many of his own e-mail messages when Sutter was printing them for production to Gentex. [Not a good idea to let the fox guard the henhouse. Individuals at risk in litigation have a strong incentive to destroy evidence that would be harmful to them.]

The Court determined that the most severe sanction against Sutter and Walker, a default judgment, was appropriate because they admitted they had Gentex information and intentionally destroyed relevant and irretrievable information, which prejudiced Gentex. The Court further noted that it was “especially conscious of the deterrence value of harsh sanctions in cases like this where the crucial evidence exists in electronic form, and a party may destroy its opponent’s case with the mere click of a button.”

Although the Court did not grant a default judgment against Armor, the issues of fact about the conduct of Armor’s employees was left for the parties to present at trial and will likely cause Armor difficulty in convincing a jury that it did nothing wrongful.

Some Thoughts for Consideration

The two DuPont opinions clearly demonstrate that a party’s conduct is a major consideration for a court in determining the severity of sanctions that should be imposed for the loss of relevant or potentially relevant evidence. In the first opinion, DuPont’s conduct demonstrated that it was wearing a “white hat.” [A metaphor about how to identify the good guy from old westerns that is frequently used by Ralph Losey.] And even though some data was lost, the Court rightly determined that sanctions were inappropriate.

The second DuPont opinion clearly demonstrated that Kolon and its employees were wearing a “black hat.” However, even though the conduct engaged in by Kolon’s employees was egregious, the Court stopped just short of imposing a default judgment sanction against Kolon.

In Gentex, the two former Gentex employees engaged in deliberate, bad-faith destruction of evidence that they stole from Gentex and the Court imposed the most severe sanction. However, because there were issues in dispute about the conduct of Armor and its other employees, the Court decided not to impose a final sanction and leave the determination to trial.

So, although sanctions are a potential threat for any litigant who fails to preserve electronically stored information, there are a number of things that a litigant can do to mitigate this risk.

• Above all else, act in good faith. Intentional bad conduct is probably the surest way to end up with a harsh sanction if electronically stored information is lost (it probably will be at some time).
• Acquire sufficient knowledge about the nearly infinite number of technology related issues and problems that can arise in identifying and preserving electronically stored information so you can determine when you need help. You also may need this knowledge to educate opposing parties or the court.
• When involved in litigation in which any significant amount of electronically stored information is relevant (most litigation), put together a team of people with the requisite knowledge, skills, and experience to deal with the e-Discovery issues that will inevitably arise. No one person can do it all.
• Don’t attempt to preserve “everything.” It’s not possible. It’s extremely costly.
• Do use the principles of proportionality, reasonableness, and cooperation to resolve potential disputes before they escalate. As Kolon demonstrated, stonewalling will hurt, not help.
• Seek assistance from the court if an opposing party will not cooperate or an issue cannot be resolved.
• Document your decisions and all key events.
• Consider any motivations that individuals may have to destroy evidence and take steps to prevent it before they have a chance to cause spoliation.

Conclusion

So ends our tale of three motions. The moral imperative regarding preservation obligations is clear – act in good faith. Good faith, however, does not require attempts to preserve everything regardless of relevance and cost. You should direct your efforts to identifying key people and the relevant information as quickly as possible so that immediate and effective preservation efforts can be initiated. Doing this well is a key element for avoiding sanctions in any litigation.

The technology challenges associated with identification and preservation are many and difficult. But they are not impossible, especially when we realize that perfection is never required by the law, only reasonable, good faith efforts. As Madame Curie said:

Life is not easy for any of us. But what of that? We must have perseverance and above all confidence in ourselves. We must believe that we are gifted for something and that this thing must be attained.

Success in this phase of e-Discovery (and all other phases as well) requires treating it like a high-value project. Every project needs a good project manager and a team of professionals with the requisite knowledge, skills, and resources. It depends on trained individuals who work together for the greater good of the team and the project. As Marie Curie said:

We cannot hope to build a better world without improving the individual. Toward this end, each of us must work for his own highest development, accepting at the same time his share of responsibility in the general life of humanity—our particular duty being to aid those to whom we think we can be most useful.

It is difficult to build great project teams, but a great team can outperform an average project team 100 to 1. It is my strong belief that investing in preventative efforts is far less costly than fixing up the disasters that occur because you were not prepared. So in the words of an old commercial – “you can pay me now, or you can pay me later.” Where do you want to spend your money?

This entry was posted on Sunday, November 6th, 2011 at 9:14 pm and is filed under Evidence, Forensic Exam, Lawyers Duties, Metadata, New Rules, Related Legal Webs, Review, Search, Spoliation/Sanctions, Technology. You can follow any responses to this entry through the RSS 2.0 feed. Both comments and pings are currently closed.