Summary
allowing access by plaintiff's expert but entrusting the expert to maintain the records securely until defendant has had a chance to screen for privilege
Summary of this case from Fed. Deposit Ins. Corp. v. BowdenOpinion
David E. Schreiber, Bethesda, MD, for Plaintiff.
Johnine P. Barnes, Baker & Hostetler LLP, Washington, DC, for Defendants.
MEMORANDUM OPINION
JOHN M. FACCIOLA, United States Magistrate Judge.
Now pending before this Court are defendants' Motion for Leave to File a Post-Hearing Brief [# 73], Motion for Leave to File Supplement Defendant's Post-Hearing Brief on Spoliation [# 78] and Motion for Leave to Designate Expert [# 80]. This case was referred to me by Judge John D. Bates for management of the discovery process.
I. Background.
The facts and procedural history of this case are set out in this Court's Memorandum Opinion of Jan. 23, 2008. See D'Onofrio v. SFX Sports Group, Inc., 247 F.R.D. 43, 44-45 (D.D.C.2008)( D'Onofrio I ).
Pursuant to D'Onofrio I, an evidentiary hearing was held on April 4, 2008 for the purpose of determining " (a) the basis for the Kroll representative's conclusion that email and other electronically stored information have not been produced; (b) testimony from plaintiff as to what electronically stored information she believes has not been produced; and (c) the circumstances concerning the scrapping of plaintiff's computer and the consequences thereof in light of any demand made by plaintiff to preserve its contents." D'Onofrio I, 247 F.R.D. at 49. The Court also reserved ruling on the plaintiff's claim for sanctions pending the outcome of the hearing. Id. at 55.
The Kroll representative is Mr. Douglas Bond, who has been designated by the plaintiff as an expert in forensic computer analysis.
At the hearing plaintiff presented Mr. Douglas Bond, a forensic computer analyst, who plaintiff has retained and designated as an expert in this matter. Transcript of Evidentiary Hearing-Morning Session 4:17-25 (Apr. 4, 2008) (" AM Tr." ). Mr. Bond testified that he may be able to locate electronically stored information on the defendants' servers using forensic techniques. AM Tr. 28:1-13. Bond further explained that his investigation is best done in person. AM Tr. 34:7-15. The defendants agreed to allow an in-person search of the defendants' servers, but the parties are unable to come to an agreement as to the appropriate protocol to guide that search.
Also at the April 4, 2008 hearing, plaintiff testified that there are several types of electronically stored information and documents that she requested and defendants have not produced, including physical files and items from plaintiff's office. AM Tr. 81:11-15. Despite the fact that this case had been pending for over two years when the April 4 hearing was held, defendants' witness testified that he was only asked to create a copy of plaintiff's personal folder for production a few weeks before the hearing. Transcript of Evidentiary Hearing-Afternoon Session 90:9-21 (Apr. 4, 2008) (" PM Tr." ).
Evidence was also presented concerning plaintiff's spoliation allegations. Defendants called Mr. John Cavender, who is a security officer with Clear Channel Communications. Mr. Cavender testified to what searches for electronic electronically stored information he performed in response to plaintiff's requests and explained the Legato system. Defendants also called Mr. Eugene Mason, who is Vice President of Finance at SFX Basketball. Mr. Mason testified that he is the " de facto I.T. person" in the office where plaintiff was employed. PM Tr. 72:22-24. Mr. Mason also testified that he " scrapped" plaintiff's computer after he decided that it could not be used and also searched for items requested by the plaintiff. PM Tr. 77:1-12.
In 2004, in an unrelated matter, the Justice Department ordered that Clear Channel Communications, Inc. retain e-mail communications by backing them up on an external server. According to defendants, plaintiff was not involved in the suit, but her mailbox was backed up on the server for convenience.
II. Defendants' Motions for Leave.
After the April 4, 2008 hearing, defendants filed two motions for leave to file a supplemental brief. In support of their position, defendants claim that the briefing will aid the Court in ruling on spoliation and sanctions. Plaintiff argues that the record as to spoliation and sanctions was closed as of the end of the April 4, 2008 hearing and that defendants are looking for a second bite at the apple. The Court agrees with plaintiff that defendants' proposed supplemental brief reargues the same evidence and issues addressed in defendants' opposition to plaintiff's motion to compel, and at the hearing. Because the proposed briefing will not aid the Court in its decision by bringing new information to light, the defendants' motion for leave is denied.
The Court is also cognizant of the fact that a forensic expert has yet to conduct a search of the SFX or Legato servers, which is necessary to determine the extent to which electronically stored information has been lost. The results of that search will very likely warrant supplemental briefing.
III. Protocol.
Prior to the lunch recess at the April 4, 2008 hearing, the Court asked the parties, with Mr. Bond's and Mr. Cavender's assistance, to confer regarding what protocol would be appropriate to guide a search of the Legato and local servers. After the hearing, defendants sent to plaintiff a proposed protocol consisting of 11 numbered paragraphs. Defendant's Proposed Protocol for Forensic Experts, Exhibit 2 to Motion for Leave to Designate Expert [# 80] (" Defs.' Prot." ). On June 2, 2008, the plaintiff responded by letter and raised several objections to the proposed protocol. Plaintiff's June 2, 2008 Letter to Defendants, Exhibit 3 to Memorandum in Opposition to Motion for Leave to Designate Expert [# 81] (" Pl.'s Object." ). Plaintiff did not, however, advance an alternative. Thus, the parties were unable to come to an agreement at that time, and have informed the Court that they have still not come to an agreement.
Defendants have proposed a protocol which, unfortunately, is highly technical. I made it clear at the hearing that I expected the lawyers to rely upon their obviously competent IT professionals and Mr. Bond to arrive at a protocol that would satisfy those professionals who fully understand what they were doing and produce a document that was easy to understand and use. What I got was a proposed defendants' protocol that is highly restrictive and full of undefined " buzz words."
Additionally, in one respect the defendants' protocol is incomprehensible. On the crucial question of what will occur if the search yields previously unproduced e-mails, the defendants' protocol indicates that they will be handled " according to the protocol stated in paragraph 2 herein." Defs.' Prot. ¶ 8. But, paragraph 2 says that a Clear Channel employee must be present when the Legato system is accessed and there is no protocol whatsoever in paragraph 2 that makes the reference in paragraph 8 comprehensible.
Since I have gotten so little help from counsel, I will create a protocol of my own using as best I can my understanding of the limited agreement that the parties reached when plaintiff's counsel reacted to defendants' proposal.
Before I specify the terms of the protocol, I must first determine whether the defendants' approach to the new search is correct. As I understand the proposed protocol, the 2007 search for e-mails that the defendants conducted will be replicated; any additional searches are at the discretion of defendants who may decline to conduct them if they will " jeopardize the functioning of the system, or otherwise impact normal business operations." Defs.' Prot. ¶ ¶ 6-7. If defendants deign to permit the additional search, they retain the discretion not to restore the e-mails. Id. ¶ 10.
This approach is fundamentally misguided. I have heard the testimony in this case and I am firmly convinced that the limited search that the defendants conducted was not likely to produce all of the electronically stored information that plaintiff legitimately demanded.
For example, defendants' witness Mr. Cavender testified that he conducted searches of the Legato system using key strings that correspond to the plaintiff's e-mail address. PM Tr. 32:4-24. The practical effect of this was to limit the results of the defendants' searches to e-mails that were either sent by or to Ms. D'Onofrio. Defendants can not colorably argue, however, that e-mails discussing Ms. D'Onofrio are not relevant to this case, particularly e-mails exchanged between her supervisors about her or pertaining to her performance. Defendants, however, have not even suggested that they have looked for this type of electronically stored information.
Similarly, plaintiff has testified that she kept several back-ups of electronic files both on discs and in hard copy in her office. E.g., AM Tr. 78:11-14. Also, Mr. Mason testified that the computer that he threw away had only been used by plaintiff for a short time as it was a replacement for an older model that crashed. PM Tr. 74:6-11. If any efforts have been taken to locate and produce those items, the Court is certainly not aware of them. Perhaps most surprisingly, Mr. Mason testified that the first time that he was asked to make a copy of the plaintiff's file on the server was in March of 2008, a full two years after this case was filed, and one and a half years after plaintiff filed her first motion to compel discovery. PM Tr. 90:3-21. All this is in addition to the fact that defendants, at a minimum, failed to appropriately implement a litigation hold after plaintiff notified Clear Channel in October 2005 that she intended to file suit. Defendants have agreed that plaintiffs' expert may search their computer system or individual computers for electronically stored information. Defendants, however, are unfairly and irrationally limiting the scope and potential results of the search to be conducted. They are obliged to permit the plaintiffs' expert to conduct a diligent search of all potential repositories of electronically stored information that are likely to yield information that is responsive to plaintiff's discovery demands. The restrictions they would impose are inconsistent with that responsibility and I reject them.
a. Items to be searched and scope of search
The parties do not even agree on which systems or hard drives are to be searched. They both reference the Legato system, but plaintiffs also seek access to defendants' local servers in the District of Columbia and to any computers that may be recovered. The testimony I have heard convinces me that plaintiff's expert must be permitted to search any depository of electronically stored information that may contain the following electronically stored information: (1) e-mails to or from plaintiff to include e-mails in which her name appears in the " cc" or " bcc" lines; (2) e-mail in which her name is mentioned; (3) electronically stored information created by her; (4) electronically stored information sent to her, again whether sent to her directly or as one of other recipients; (5) electronically stored information in which her name appears, whether her full name or her first or last name or initials.
Now that I have specified the criteria by which the decision to search a depository will be made, I expect the defendant to permit Mr. Bond to search any depository that he believes may contain electronically stored information that meets these criteria. Having heard his testimony, I am convinced that he will take seriously the quasi-judicial responsibility I am imposing upon him to conduct in good faith a search of depositories that in his judgment may contain such information. I would have to note that if Mr. Bond is mistaken, the worst that can happen is that he will have wasted whatever time it took to search that particular depository. Surely, that will take less time and money than more litigation about the scope of search.
b. Time limitations.
Defendants suggest that " [t]his on-site visit or search will be performed on agreed to dates and the designated expert will be allowed onsite [sic] for no longer than twelve hours each day." Defs.' Prot. ¶ 1. Plaintiff objects to defendants' proposed time limits. Pl.'s Object. at 3. The Court agrees with defendants that a 12 hour-per-day limitation is reasonable. The Court also agrees that the parties must agree to the dates when the search will be conducted in advance and I will not tolerate anyone being unreasonable in setting those dates. The plaintiff's expert shall be given up to three days at each location to complete the search. If he needs more time, counsel will confer with me by conference call and I will decide whether he shall have more time.
c. Persons Present.
Defendants request that a Clear Channel employee, representative or counsel be present while the Legato system is accessed. Plaintiff does not object, and so the Court agrees. A Clear Channel or SFX representative can also be present during any search of any depository of electronically stored information.
d. Credentials.
Defendants refuse to give credentials to plaintiff's expert to access the Clear Channel systems. Plaintiff argues that this limitation is unnecessary. The defendants are not required to give credentials to the plaintiffs, but are required to ensure that the defendants' representative who is present during the searches has full credentials to access the relevant system and will assist plaintiff's access to the system without qualification or obstruction.
e. Commands.
Plaintiff and defendants agree that a Clear Channel Information Technology representative (" IT Representative" ) will perform the system commands with plaintiff's expert observing. Any dispute as to whether a particular command should be used will be resolved by me; counsel shall make me aware of the dispute by conference call.
f. Production.
Defendant requires that all search results be delivered to defense counsel for review prior to being made available to the plaintiff. The plaintiff asks that all results be turned over to plaintiff's expert on-site.
The purpose of this search is to determine whether electronically stored information that plaintiff claims she has not received exists, and then to ensure that defendants fully comply with their obligations to produce it if it falls within plaintiff's discovery requests. The search may yield electronically stored information that falls within the attorney-client or work product privileges.
Plaintiff's expert testified that it is his normal practice to hand electronically stored information over to opposing counsel for review before making them available to his client. AM Tr. 91:22-92:9. I do not share defendants' concern that Mr. Bond will, despite his representations to me, give privileged electronically stored information to the plaintiff. I trust that Mr. Bond's copies of the search results will remain in his exclusive possession until I order otherwise.
I will therefore require plaintiff's expert, functioning for this purpose as a quasi-judicial officer, to make a complete copy of the results of his search available to me in camera by duplicating those results on a DVD that will be filed under seal in the docket in this case. I will keep the DVD in my chambers pending conclusion of this matter.
Plaintiff's expert will also make a second DVD containing the search results available to defendants' counsel. She will have three weeks to examine those results and file in accordance with Rule 26 of the Federal Rules of Civil Procedure a privilege log in which she specifically claims whatever privilege is appropriate as to any electronically stored information that is on the DVD. I note that I expect the most specific claim of privilege possible. See Victor Stanley, Inc. v. Creative Pipe, Inc., 250 F.R.D. 251, 263-67 (D.Md.2008). If the claim is not specifically made, I may deem it waived. See id.
g. System Overview.
Defendants suggest that their IT Representative should perform an overview of the Legato system prior to beginning any searches stating that " after this initial review of system functionality, the process followed for the previous data production in this matter will be discussed." Defs.' Prot. ¶ 5. While plaintiff does not object, I am afraid that I do not know what an " initial review of system functionality" means in this context and what is to be discussed. I expect defendants' representatives to provide plaintiff's expert with a comprehensive explanation of how the system works, what searches it is capable of running and how the results of those searches will be produced. I expect defendants' representatives to answer all questions plaintiff's expert has.
h. Prior Searches.
The parties agree that they will re-run the searches that defendants ran previously and compare the current and former results as one of the searches I am authorizing.
i. New Searches.
Defendants ask that the IT Representative be permitted to object to searches based on their effect on the system. The Court agrees that the plaintiff should not be permitted to compromise the defendants' systems, and the IT Representative is permitted to refuse any searches that will jeopardize the system or have a significant negative impact on business functioning with the understanding that I may insist on another hearing to assess the validity of such a claim.
In any event, to reduce the negative impact on the system, the Court urges the parties to schedule the visit(s) with a view to the fact that these servers serve an important daily business function. If the parties are concerned about the toll these searches may take on the servers' resources, they should consider performing these searches during off-hours, when I assume that the burden on the servers is at its lightest.
j. Imaging.
Defendants refuse to allow plaintiff to " image" the Legato server. Defs.' Prot. ¶ 9. Defendants do not mention any images of other servers. Plaintiff does not object to defendants' proposed limitation regarding the Legato server, but refuses to accept limitations on images of other servers and hard drives. Pl.'s Opp. at 3. Accordingly the Court assumes that the parties are in agreement that an image of the Legato server is not necessary. If Mr. Bond determines that it is necessary to take an image of the Legato server, I will entertain the parties' arguments and objections by conference call.
Defendants have not taken a position on whether Mr. Bond should make an image of the other servers or hard drives. At the hearing, Mr. Bond explained that imaging, as that term is used here, means to copy the server or hard drive. AM Tr. 36:21-24. According to Mr. Bond, he commonly begins a forensic investigation by imaging the server, and then analyzes the image. AM Tr. 64:23-25.
Mr. Bond's statements mirror my own experience; in the warrants I sign for searches of computers, federal and local law enforcement officers ask for the authority to create a mirror image of the computer as soon as they arrive. This preserves the computer's memory at the moment of the search and the mirror image can be searched instead of using the computer directly. This relieves the investigators (and the subjects of investigation) of the burden of removing the computer from the premises and prevents any later claim that the search of the computer itself destroyed some portion of its contents.
Because this procedure will prevent similar claims in this case I will permit Mr. Bond to follow his usual practice and image the driver and servers he is searching, other than the Legato server. I expect him to do all that he must to limit the burden on defendants' servers and computers and nevertheless capture the current state of the defendants' computer system, I will direct Mr. Bond to retain all such images pending my further order.
k. E-mail restores.
Defendants agree to generate lists of items that are responsive to plaintiff's search terms, but do not agree to restore the actual items. I am not sure defendants' counsel intends what this means. She cannot be suggesting that it would make any sense to produce e-mails that no one can read or use. Thus, if electronically stored information is newly discovered by plaintiff's expert's search, defendants are obliged to restore the items during the search, if such restoration is necessary to render the electronically stored information " reasonably usable," capable of being read on a computer using either commonly available word processing software, such as Word or Word Perfect, e-mail software such as Outlook or Lotus Notes, or Abode Acrobat Reader and without the necessity of having to buy other software because only that software renders the restored e-mail. In this context, I assume that the search will yield the metadata for the restored e-mails and that the metadata will be preserved by Mr. Bond for later use.
l . Cost.
The defendants offered to pay for the costs of the search up to $10,000, but plaintiff argues that the defendants should pay for the entire cost.
The presumption under the Federal Rules of Civil Procedure is that the producing party bears the costs of complying with a discovery request. Peskoff v. Faber, 251 F.R.D. 59, 61 (D.D.C.2008) (citing Oppenheimer Fund, Inc. v. Sanders, 437 U.S. 340, 358, 98 S.Ct. 2380, 57 L.Ed.2d 253 (1978)). However, the Court may shift a portion of the costs to the requesting party in the event that the discovery request would unduly burden the producing party. Id.
The plaintiff has not advanced an estimate, and has refused to be limited by cost and I am reluctant to give plaintiff a blank check. I will direct Mr. Bond to provide me and the parties with a good faith, best estimate of the cost by letter if he anticipates it will be greater than $10,000 within two weeks of the date this Opinion is issued. If the anticipated cost is greater than $10,000 I will determine how to allocate the cost. IV. Additional Expert.
Defendants have also moved the Court for leave to designate a forensic expert. Motion for Leave to Designate Expert [# 80] (" Exp. Mot." ). Defendants request first that their expert be present when Mr. Bond searches defendants' servers. Defendants have shown no reason to believe that Mr. Bond is anything other than an unbiased professional. Further, the defendants' servers are in their possession so they may conduct searches of them at any time without leave. The Court sees no reason why the defense should require an expert to be present during these searches, and therefore that request is denied.
Defendants also seek leave to designate an expert to rebut Mr. Bond's forthcoming conclusions about spoliation. However, as the defendants point out, Mr. Bond has not yet given an expert opinion on whether or not spoliation has occurred. Until the search has been conducted and Mr. Bond has submitted his report, the Court is unable to determine whether an additional forensic expert is even necessary. Therefore, the defendants' motion for leave is denied without prejudice to being refiled after Mr. Bond has prepared his report.
V. Conclusion
For the reasons stated above, the defendants' Motion for Leave to File a Post-Hearing Brief [# 73] and Motion for Leave to File Supplement Defendant's Post-Hearing Brief on Spoliation [# 78] are denied, and the defendants' Motion for Leave to Designate Expert [# 80] is denied without prejudice.
Further, Mr. Bond is directed to prepare and submit an estimate of the cost of conducting the searches outlined in this Opinion to the extent that the estimated cost of those searches exceeds $10,000.
An Order accompanies this Memorandum Opinion.