An Ounce of Prevention is Worth a Pound of Cure (and Court Sanctions)
Consider the following scenario…
When John Elder thought he was passed up for a promotion because of his age, he decided to leave Company X. During the exit interview before his departure, John mentioned to the HR personnel that he had a valid reason to think he was being discriminated against because of his advanced age.
After John’s departure, the HR personnel, with the help of the IT department, searched John’s computer for any signs of “the valid reason” he had mentioned but to no avail. His computer was then redeployed to a new hire.
A few weeks after John’s departure, Company X was served with an age discrimination suit, which led in-house counsel to issue a litigation hold. Despite counsel’s prompt action, several executives purged their computer of old files to rid their computers of any damaging evidence.
During litigation, the plaintiff requested discovery, and the judge ordered the defendant to produce the computers used by key individuals in Company X . The plaintiff hired a computer forensic expert to uncover files that might support John’s allegations. The expert noticed that on John’s computer, HR’s attempts to search for the evidence John had mentioned during the interview had altered the “modify” dates. Furthermore, the computers of the executives contained mass deletion activities that occurred on the date the litigation hold was issued. This report was sufficient for the court to impose sanctions on Company X for spoliation of evidence, and the case was settled in favor of the plaintiff.
Understanding How Spoliation Occurs:
Apart from willful destruction, electronic evidence spoliation occurs very easily, and often times, without any exertion from an individual. In the preceding scenario, when HR and IT were looking through John’s computer, they had inadvertently changed the metadata of the files, which, in this case, was the modify date. Essentially, metadata is data about data. It provides information about a file, such as the date the file was created, modified or deleted, the person who created the file, etc. When a computer is left turned on, the likelihood of changing the metadata on active files in the normal course of business is extremely high. Data can be overwritten when someone opens and closes a file, during routine automatic electronic document destruction or during the weekly backup of the network data when new data overwrites old data on the backup tape. Sometimes computers are configured to have their hard drives defragmented every month, which can cause meta dates of the files to change, thereby complicating the forensic investigation.
The mutability of electronic evidence is a compelling reason for counsel to exercise extreme caution when dealing with a case that involves electronic discovery. It is important for in-house counsel to understand their client’s technology to ensure that they meet their legal obligations during the preservation and discovery process. For example, if counsel is unaware of the recycling of backup tapes, this may pose as a potential problem if the IT department continues to rewrite these backup tapes with new data, consequently destroying old data that may be relevant during litigation.
Counsel should take the following necessary measures to ensure their client adheres to proper preservation procedures during litigation, or in anticipation of one, to prevent spoliation of evidence. These measures, when carefully followed, should help save the client a lot of trouble and money during discovery proceedings. As with willful destruction (evident in the previous scenario when the executives in Company X were industriously deleting electronic files), there really is not much counsel can do to reverse the detriment caused by such actions.
Spoliation Prevention
A best practice for a company, even when there is no pending litigation, is to anticipate one just to make sure that they are always ready with a response, should litigation arise.
For example, when an employee leaves the company, have a policy in place whereby the computer(s) used by the employee will be turned off and set aside. Personnel from HR or IT should not be allowed to navigate the computer until proper measures have been taken to capture the data on the computer (known as forensic hard drive imaging) to make sure that the information is kept “frozen in time.” Optimally, this procedure should be performed by a computer forensic expert.
It is also a good practice to remove the hard drive used by the employee and replace it with a new one before deploying the same computer to a new employee. The old hard drive should be sealed and kept in a secure location for a period of time addressed in the company’s document retention policies. When litigation arises, hire a computer forensics expert to perform a forensic analysis on the hard drive that was stored in a secure location. This measure will ensure the information contained within the drive is not tainted by further use, which could prove to be vitally important at a later date.
In a recent landmark case, Zubulake v. UBS Warburg, Inc., a string of decisions were made that influenced many of the processes of electronic discovery today. In one of the decisions, Zubulake V, 2004 WL 1620866 (S.D.N.Y. Jul 20, 2004) , the court established three steps attorneys should follow to help their clients preserve documents: 1) issue a litigation hold; 2) talk to key individuals about preservation of documents; 3) obtain the electronic documents. In following that decision, in the event of litigation, counsel should not wait but immediately issue a litigation hold to stop all routine destruction of company files. Therefore, it is important for counsel to understand the infrastructure of the client to be able to target all documents that are discoverable.
The litigation hold should notify every employee to halt all document destruction and deletion. Once issued, counsel has to exercise constant vigilance to ensure that every employee adheres to their preservation duties. Issuing a hold just once at the onset of litigation will not suffice as variables like the addition of new employees may undermine the first decree. Therefore, effective communication between counsel and client is vital to the efficacy of the litigation hold.
Counsel should also take affirmative steps to determine that all sources of information can be ascertained and searched. One such step is to hire a computer forensic expert to image the hard drives of key individuals identified in Rule 26(a) Initial Disclosures. These individuals should be instructed to gather and segregate electronic copies of files relevant to the case. In the same vein, counsel should identify and set aside backup tapes that concern relevant time frames and key individuals, and keep them at the same secure location as the copy of the imaged hard drives.
In the electronic age, it is reasonable to assume the prominence of electronic data in the discovery process, but as with any new development, it comes with its own set of caveats. However, let this not be a deterrent to counsel’s attempts to surmount it. The recommendations set forth herein will facilitate counsel in circumventing the pitfalls of electronic evidence spoliation.