Transcript Document

Using Electronic Evidence
in IP Litigation
Tips, Tactics, Technology
Presented by
Christopher Wall, Esq.
July 17, 2015
Discussion Outline
Tips, Tactics & Technology
•
•
•
•
21st Century Discovery
Preservation / Spoliation
Trial & Evidentiary Issues
E-Discovery Technology & Costs
21st Century Discovery
Electronic Evidence
Computer Forensics
• Investigative & detailed analysis
• Typically a single hard drive or PC
• Searching for deleted information
• Determine who, what, when
• Recreation of time-critical events
• Reporting & expert testimony
• Breaking of passwords/encryption
Electronic Discovery
• Gathering, searching, culling & producing
large volumes of relevant information for
legal review
• Data is accessed but not analyzed
• Includes active & archival data
• Typically does NOT include discarded,
hidden or deleted data
• Email systems, network shares,
desktops and backups
21st Century Discovery
Electronic Evidence
Computer Forensics
• Investigative & detailed analysis
• Typically a single hard drive or PC
• Searching for deleted information
• Determine who, what, when
• Recreation of time-critical events
• Reporting & expert testimony
• Breaking of passwords/encryption
21st Century Discovery
Computer Forensics Case Profiles
• Securities Litigation
• Trade Secret Misappropriation
• Corporate Fraud
• Wrongful Termination
• Sexual Harassment
• Divorce Settlement
21st Century Discovery
Electronic Evidence
Electronic Discovery
• Gathering, searching, culling & producing
large volumes of relevant information for
legal review
• Data is accessed but not analyzed
• Includes active & archival data
Interrogatories
• Typically does NOT include discarded,
hidden or deleted data
• Email systems, network shares,
desktops and backups
21st Century Discovery
E-Discovery Case Profiles
• Product Liability Litigation
• Intellectual Property Disputes
• Complex Employment Suits
• Securities Litigation
• HSR Antitrust Investigation by FTC or DOJ
• Becoming increasingly common in almost every large scale
litigation
21st Century Discovery
•
About 31 billion emails are sent daily, on the Internet and elsewhere, a
figure which is expected to double by 2006. The average email is about
59 kilobytes in size, thus the annual flow of emails worldwide is 667,585
terabytes.
– IDC Email Usage Forecast and Analysis (analysis available at
http://www.sims.berkeley.edu/research/projects/how-much-info-2003)
•
The average volume of discovery data collected from a custodian has
increased more than 500% in the past five years.
– Daryl Teshima, “7 Deadly Sins of Electronic Discovery” Law Office
Computing, June/July 2003.
21st Century Discovery
96% Digital
4% Paper
21st Century Discovery
• 70% of electronic documents
are never printed
• Considering only paper
documents is the equivalent
of managing only 3 of 10 file
drawers of potentially relevant
information.
Source: U.S. News & World Report
21st Century Discovery
• Theft of intellectual property was the second most expensive
computer crime last year.
– 2004 CSI/FBI Computer Crime and Security Survey.
http://i.cmpnet.com/gocsi/db_area/pdfs/fbi/FBI2004.pdf
• Firms with annual sales under $10M spent an average of
approximately $500 per employee on computer security, while
the largest firms, spent an average of about $110 per
employee.
– 2004 CSI/FBI Computer Crime and Security Survey.
http://i.cmpnet.com/gocsi/db_area/pdfs/fbi/FBI2004.pdf
21st Century Discovery

Internal
Hard Drives

Floppy Disks

PCMCIA Cards

Notebook
Computers

Personal
Digital
Assistants

Microdisks

Flash USB Devices
Where can you
find the data?

Tape
Back-Ups

External Hard
Drives

Offsite Storage

Internet

Digital Voicemail

Proprietary
Systems
21st Century Discovery
• Discoverability
FRCP 34 – “data compilations”
– “Today it is black letter law that computerized data
is discoverable if relevant.” Anti-Monopoly, Inc. v. Hasbro,
Inc., 1995 WL 649934 (S.D.N.Y. Nov. 3, 1995).
– “A discovery request aimed at the production of
records retained in some electronic form is no
different in principle from a request for documents
contained in any office file cabinet.” Linnen v. A.H.
Robins Co., 1999 WL 462015 (Mass. Super. June 16, 1999).
21st Century Discovery
• Electronic production may be required; i.e. traditional paper
printouts alone may be insufficient
– Anti-Monopoly, Inc. v. Hasbro, Inc., 1995 WL 649934 (S.D.N.Y. Nov.
3, 1995).
– Zakre v. Norddeutsche Landesbank Girozentrale, 2004 WL 764895
(S.D.N.Y. Apr. 9, 2004).
• Backup tapes must be produced if relevant
– In re CI Host, Inc., 92 S.W.3d 514 (Tex. 2002)
• Mere copies of files aren’t enough – bit-by-bit forensic image
is the standard
– Taylor v. State, 93 S.W.3d 487 (Tex. App. 2002)
21st Century Discovery
What can be requested:
– Requesting party may be able to receive a copy not only of
business data but of opposing party’s personal hard drive.
Superior Consultant Co. v. Bailey, 2000 WL 1279161 (E.D. Mich.
Aug. 22, 2000).
– Opposing party must produce all data relevant to material facts
and preserve data compilations and computer data. Kleiner v.
Burns, 2000 WL 1909470 (D. Kan. Dec. 15, 2000).
– Requesting party should have access to active and deleted
data alike. Simon Property Group v.mySimon, Inc., 194 F.R.D.
639 (S.D. Ind. 2000).
21st Century Discovery
• Active Data: Data which exists on a hard drive on a
particular date and time.
– Captured by use of copying or mirror imaging technology
• Archival / Legacy Data: Data which is located on “back up”
tapes and systems
– Restored from archival media for processing, in many
instances is obsolete
21st Century Discovery
•
•
•
Delete does NOT mean delete
File Allocation Tables (FATs)
Delete simply makes space
available for overwriting
21st Century Discovery
User ’s
view: SmokingGunEmail.pst
The filename is kept in
your directory along with
a reference to the File
Allocation Table (FAT).
LINK
FAT
SmokingGunEmail.pst
1
2
3
The File Allocation Table
(FAT) is a map of where
data is stored on the
drive.
4
Disk Surface
1
4
2
3
21st Century Discovery
User ’s
view:
σmokingGunEmail.pst
When you delete a file,
you simple break the link
between the FAT and the
data on the hard drive.
LINK
FAT
SmokingGunEmail.pst
1
2
3
Once the links are
broken, the space on the
hard drive used by the
deleted data can be
overwritten.
4
BROKEN
LINKS
Disk Surface
1
4
2
3
21st Century Discovery
[A] computer’s DELETE key acts
somewhat like a thief who steals a
card from the old library’s card file.
When the card was in place, the
librarian could decode the library’s
filing system and find the book. If
the card was gone, or unreadable,
the book was still in the library, but
it could no longer be found amidst
the library’s stacked shelves. In a
computer, the “lost” book can be
found with very little effort.
Judge James M. Rosenbaum, D. Minn.
21st Century Discovery
Deleted electronic evidence is fully discoverable.
•
•
Prior to termination of their employment, Defendants copied and took
with them volumes of computerized data maintained in Plaintiff’s files
and storage media.
Court required electronic evidence preservation and ordered Defendants
to allow a court-appointed expert to recover lost or deleted files and
perform automated searches of the evidence under guidelines agreed to
by the parties or established by the court.
Dodge, Warren, & Peters Ins. Servs. v. Riley, 130 Cal.Rptr.2d 385 (Cal. Ct. App.
2003).
21st Century Discovery
• 14% of companies have been ordered by a court or
regulatory body to produce employee email (a 5% increase
since 2001).
– American Management Association (2003)
• 13% of employers have battled workplace lawsuits triggered
by employee e-mail.
– AMA/ePolicyInstitute Research. 2004 Workplace E-Mail
and Instant Messaging Survey. www.epolicyinstitute.com
21st Century Discovery
If anything will bring about the downfall of a
company... it is blind copies of e-mails that
should never have been sent in the first
place. . . .
- Michael Eisner (Forbes, May 2000)
The Search for E-mail
Discussion Outline
Tips, Tactics & Technology
•
•
•
•
21st Century Discovery
Preservation / Spoliation
Trial & Evidentiary Issues
E-Discovery Technology & Costs
Preservation / Spoliation
• 65% of all companies responding lack document retention
policies.
― AMA/ePolicyInstitute Research. 2004 Workplace E-Mail and
Instant Messaging Survey. www.epolicyinstitute.com
• 37% of employers do not know or are unsure about the
difference between an electronic business record that must
be retained, versus an insignificant message that may be
deleted.
― AMA/ePolicyInstitute Research. 2004 Workplace E-Mail and
Instant Messaging Survey. www.epolicyinstitute.com
Preservation / Spoliation
Hypothetical:
– Your client is a multinational conglomerate
– Patent infringement suit is filed against
your client
– Multiple product lines implicated in the
lawsuit
– Specific allegations of wrongdoing by
named individuals
Preservation / Spoliation
1.
2.
3.
4.
5.
Response Plan
Suspend document destruction policy
Distribute document preservation letter to
employees, opponent and 3rd parties
Assemble electronic discovery response
team (including outside expert)
Create an inventory of hardware and
software
Make a list of individuals likely to possess
responsive documents
Preservation / Spoliation
Response Plan (cont’d)
6. Define relevant time period
7. Make forensically sound image of hard drives from
key individuals
8. Consult with opposition to define the scope of
discovery (key words, file types, etc.)
9. Prepare an electronic discovery plan (potential
appointment of 3rd party neutral expert)
10. Determine method of document review and
production (for relevance and/or priv)
Discovery Plan
Planning:
– Develop (and/or negotiate, if feasible) keyword searches to
run across universe of data
– List types of files you will need to consider (text, email, CAD,
JPG, MPG, etc.)
– Determine whether to consider deleted files (may or may not
be relevant)
– Decide how you will conduct your priv/confidential review
– Decide how you will produce your ultimate data set
Preservation / Spoliation
Duty to Preserve Electronic Data: When does the duty arise?
•
Proctor & Gamble v. Haugen, 179 F.R.D. 622 (D.Utah 1998). Duty to
preserve exists independent of a court order.
•
NOW v. Cuomo, 1998 WL 395320 (S.D.N.Y., July 14, 1998). Duty to
preserve arises at the latest with service of the complaint and counsel has
a DUTY to advise client of pending litigation and the need to preserve
potentially relevant data.
•
United States v. Smithfield Foods, Inc., 972 F.Supp. 338 (E.D. Va. 1997).
The producing party has a duty to preserve once it was on notice of a
government investigation.
Preservation / Spoliation
Duty to Preserve Electronic Data: When does the duty arise?
Document Retention Policy Does Not Protect Plaintiff
from Consequences of Document Purge in Patent Case
•
•
•
•
•
In a patent infringement suit, the defendant alleged that the plaintiff instituted a
document-purging program despite being on notice of impending litigation for the
patents at issue.
The plaintiff held a “Shred Day,” an event in which the plaintiff’s employees shredded
about two million documents as part of its document retention and destruction policy.
At trial, the plaintiff did not dispute that it “destroyed some documents because of their
‘discoverability’.”
The court concluded that even if the plaintiff “did not institute its document retention
policy in bad faith, if it reasonably anticipated litigation when it did so, it is guilty
of spoliation.”
The court granted the defendant’s motion and ordered the plaintiff to immediately
produce documents containing information about or relating to the creation,
preparation, or scope of the plaintiff’s document retention policy.
- Rambus, Inc. v. Infineon Techs. AG, 2004 WL 383590 (E.D.Va. Feb. 26, 2004), amended by, 220 F.R.D. 264
(E.D.Va. 2004).
Preservation / Spoliation
Golden Rule of E-Evidence:
Sector-by-Sector Image
(Gates Rubber)
Corollary to the
Golden Rule of E-Evidence:
Work only from the copy
Portable
Server
Target
Computer
Preservation / Spoliation
Common Spoliation Mistakes
1. Failing to cease document destruction with notice of pending or
impending suit [intentional or negligent]
2. No sector-by-sector or bit-by-bit image made….aka – mirror image of
media [Gates Rubber Co. v. Bando Chem. Ind.]
3. Booting a computer
4. Clicking on a file
5. Modifying Web site links and content
Preservation / Spoliation
Potential Sanctions for Spoliation
•
Keir v. UnumProvident, 2003 WL 21997747 (S.D.N.Y. Aug. 22, 2003). Court
found the Defendant’s failure to preserve was unintentional, but criticized
the Defendant’s poor compliance with the preservation order, and
recommended further action to determine feasibility of retrieving lost
data and the extent of prejudice to the Plaintiffs in order for the court to
fashion a remedy for the Plaintiffs.
•
Danis v. USN Communications, 2000 WL 1694325 (N.D. Ill. Oct. 23, 2000).
CEO was fined $10,000 and negative inference instruction given.
Preservation / Spoliation
Potential Sanctions for Spoliation
• Linnen v. A.H. Robins, 1999 WL 462015 (Mass. Super. June
16 1999). Failure to preserve e-mails resulted in “inexcusable
conduct” jury instruction.
• William T. Thompson Co. v. General Nutrition Corp., 593
F.Supp. 1443 (C.D. Cal. 1984). Court ordered default judgment
and $450,000 in sanctions for destruction of e-documents.
Preservation / Spoliation
How Serious was the Spoliation?
• In a patent infringement suit, the plaintiff produced email and
other electronic documents after the close of the discovery
period.
• To the extent that it had not already done so, the plaintiff was
ordered to produce all emails generated or received by the
inventor relating to the patent at issue.
• The court found that while the plaintiff did not engage in a good
faith effort to produce all requested discovery in a timely
manner, the cost to the defendant was minimal and therefore
refused to issue sanctions.
Lakewood Eng’g v. Lasko Prod., 2003 WL 1220254 (N.D.Ill. Mar. 14,
2003).
Preservation / Spoliation
Court Sanctions Defendant by Transferring Defendant’s Domain Names to Plaintiff
•
•
•
•
In a trademark infringement case, the plaintiff accused the defendant of illegally using
the Internet to sell the plaintiff’s brand of cigarettes, which was intended only for sale
abroad, to customers in the United States.
The plaintiff’s computer forensics expert examined the defendant’s sales data and
found inconsistencies in computer programming formulas, individual sales records, and
customer email confirmations.
After being confronted with the expert’s analysis, the defendant admitted its sales data
was unreliable, and likely fraudulent.
Finding the defendant’s “supporting testimony and data … so riddled with
fabrication and deception as to warrant the inference that the truth is the exact
opposite of what [the defendant] contends,” the court ordered the transfer of the
defendant’s domain names to the plaintiff.
- Philip Morris USA, Inc. v. Otamedia Ltd., 2004 WL 1878751 (S.D.N.Y. Aug. 20, 2004).
Preservation / Spoliation
Computer Expert Exposes Attempts to Destroy Electronic Data in Copyright Case
•
•
•
In a copyright infringement suit, the plaintiffs’ computer expert inspected the
defendant’s servers and discovered the defendant ran a program, designed to
erase electronically stored information, more than 50 times from a remote location
in an attempt to delete all electronic data from the servers.
The defendant attempted to attack the plaintiffs’ methodologies for extrapolating the
number of users and downloads.
The court indicated that the defendant was “in a poor position to attack plaintiffs’
evidence,” noting that “[d]estruction of evidence raises the presumption that
disclosure of the materials would be damaging.” The court decided not to issue
sanctions but instead encouraged the plaintiffs to move for appropriate sanctions as
the case progressed.
- Arista Records, Inc. v. Sakfield Holding Co. S.L., 314 F.Supp.2d 27 (D.D.C. 2004).
Preservation / Spoliation
Zubulake V: Sanctions
Defendant Sanctioned for Destruction of Email Evidence
•
An employee moved for sanctions against the employer for failing to produce
backup tapes containing relevant emails in a timely manner.
•
Determining that the employer had willfully deleted relevant emails despite
contrary court orders, the court granted the motion for sanctions and also
ordered the employer to pay costs.
•
The court further noted that defense counsel was partly to blame for the
document destruction because it had failed in its duty to locate relevant
information, to preserve that information, and to timely produce that
information.
--Zubulake v. UBS Warburg, 2004 WL 1620866 (S.D.N.Y. July 20, 2004).
Preservation / Spoliation
Zubulake V: Role of Counsel
Counsel Has Duty to Locate, Preserve, & Produce E-Data
Addressing the role of counsel, Judge Scheindlin declared that "it is not
sufficient to notify all employees of a litigation hold and expect that the party
will retain and produce all relevant information. Counsel must take affirmative
steps to monitor compliance so that all sources of discoverable information are
identified and searched."
Discussion Outline
Tips, Tactics & Technology
•
•
•
•
21st Century Discovery
Preservation / Spoliation
Trial & Evidentiary Issues
E-Discovery Technology & Costs
Trial & Evidentiary Issues
What to Ask for in Discovery
1. Must seek specific relevant information
– Objections re: excessive scope & burden
2. Begin narrowly & expand
3. “Goose & Gander” phenomenon
4. The Sorcerer’s Apprentice Problem (a.k.a. Be
careful what you wish for!)
Trial & Evidentiary Issues
Chain of Custody
Hearsay, Foundation and Other Admissibility Issues
Trial & Evidentiary Issues
Chain of Custody
• Guard yours / Question theirs
• Temperatures, smoke, dust,
magnetic fields
Trial & Evidentiary Issues
•
•
•
•
•
•
•
Chain of Custody
Was the file altered during imaging process?
Was the file altered during the analysis?
How sound was the capture process?
Was the image forensically sound? Did it need to be?
How secure is the data during analysis? While it is
stored?
From what media is the analysis being done? From the
original? From an image?
Who handled and processed the data? Can you prove
the data is still sound?
Trial & Evidentiary Issues
• Hearsay, Foundation and Other Admissibility Issues
– State of Wash. v. Ben-Neth, 663 P.2d 156 (Wash. Ct. App. 1983).
Computer-generated evidence is hearsay but may be admitted as a
business record provided a proper foundation is laid.
• Business Records Exception
– Harveston v. State, 798 So.2d 638 (Miss. Ct. App. 2001). Court refused to
allow in computer database print-outs under business records exception
because no evidence offered as to the means by which the
information…was compiled.
Discussion Outline
Tips, Tactics & Technology
•
•
•
•
21st Century Discovery
Preservation / Spoliation
Trial & Evidentiary Issues
E-Discovery Technology & Costs
Technology & Costs
Technology: Overview of Process
Printed
Paper
Stage
1
Stage
2
Stage
3
Stage
4
Legal and
Technical
Consulting
Data
Gathering
Data
Filtering
Data
Processing
Stage
5
Output
Options
Litigation
Support
Database
Secure Webbased
Repository
Technology & Costs
Filtering Technology
• File identification
• Effective keyword searching
• Elimination of blank pages
& duplicative documents
• Segregation of potentially
privileged documents
• Identification of very
large files
Technology & Costs
Technology & Costs
Technology: Output Option 2
(Print)
• Litigation Support
Database
– Introspect
Concordance
Summation
DBTextworks
JFS Litigators Notebook™
UR Law™
Documatrix
Virtual Partner™
• Load Files
Technology & Costs
Technology: Output Option 3
(Litigation Database)
Technology & Costs
Costs
• Discovery represents 50 percent of litigation costs in the
average case and up to 90 percent of litigation costs in
cases in which it is actively used.
-http://www.uscourts.gov/ttb/oct99ttb/october1999.html
• On average, attorneys spend more time on discovery (16.7%
of their time on the case) than they spend conferring with
clients, working on pleadings, negotiating settlements, or
conducting legal research.
-http://polisci.wisc.edu/~kritzer/research/CLRP/clrp.htm
Technology & Costs
Costs
• “Paper discovery costs an average of $.70 a page.
Electronic discovery costs an average of $.23 per
page”
– Daryl Teshima, “7 Deadly Sins of Electronic Discovery” Law
Office Computing, June/July 2003.
Technology & Costs
Costs: Containment Tips
– Identify and address electronic document issues early
– Negotiate scope – seek a protective order early if necessary
– Propose culling techniques
• Data sampling
• De-duplication
• Keyword searching
– Use technology to increase speed and accuracy of document
review
Technology & Costs
Costs
• General Rule – Producing Party Pays
• Inherent Power of Court to Shift Costs
• The Texas Solution – Tex.R.Civ.P. 196.4
– “Reasonable Availability” vs. “Extraordinary Steps”
Technology & Costs
Costs: Cost-shifting
•
Producing Party Pays for Production (traditional rule):
– Delozier v. First Nat’l Bank of Gatlinburg, 109 F.R.D. 161
(E.D. Tenn. 1986). Requesting Party Pays
•
Requesting Party Pays for Production:
– Oppenheimer Fund, Inc. v. Sanders, 437 U.S. 340 (1982).
•
Combination or Cost Splitting:
– Rhone-Poulenc Rorer, Inc. v. Home Indemnity Co., 1991 WL
111040 (E.D. Pa. 17, 2001).
Technology & Costs
Costs: Burden & Proportionality
• A party producing electronic evidence must be protected
against undue burden and expense associated with the
production.
Southern Diagnostic Assoc. v. Bencosme, 833 So.2d 801 (Fla.
Dist. Ct. App., Oct. 2002)
Technology & Costs
Costs: Cost-shifting
•
•
•
•
•
In a trade secret violation suit, the defendant moved for the production of
approximately 996 network backup tapes and argued that the plaintiff should
bear production costs.
Medtronic objected to the defendant’s requests as “unduly burdensome” and
“astronomically costly.” The parties did not dispute the relevance of the
electronic data at issue.
Court applied an 8 factor cost-shifting test to determine burden and cost.
Finding that the majority of the factors favored shifting a portion of discovery
costs to the defendant, the court outlined a detailed discovery protocol.
The court also ordered the plaintiff’s vendor to “search the extracted data using
[identified] keywords” and to “produce to [the defendant] a complete list of the
files identified by the backup tape restoration keyword search.”
Medtronic Sofamor Danek, Inc. v. Michelson, 2003 WL 21468573 (W.D.Tenn. May 13,
2003).
Technology & Costs
Costs: Cost-shifting (cont’d)
Zubulake’s Revised Cost Allocation Test
1.
2.
3.
4.
5.
6.
7.
Extent to which the request is specifically tailored
Availability of information from other sources
Total cost of production compared to amount in controversy
Total cost of production compared to resources available to each party
Relative ability of each party to control costs and incentive of each
party to do so
Importance of the issue at stake in the litigation
Relative benefits to the parties in obtaining the information
Zubulake v. UBS Warburg, 217 F.R.D. 309 (S.D.N.Y. 2003)
Parting Thoughts
1. Electronic Evidence is Unique
2. Electronic Evidence Requires Education &
Expertise
3. Electronic Evidence Provides Opportunity
Questions?
Christopher Wall
Kroll Ontrack
[email protected]
(703) 668-1357
(800) 846-7430