Summary
granting mirror imaging of defendant's computer to preserve evidence
Summary of this case from Satmodo, LLC v. Whenever Commc'ns, LLCOpinion
2:12-cv-00059-KJD -VCF
04-05-2012
UNITED FACTORY FURNITURE CORP, Plaintiff, v. AIMEE LYNN ALTERWITZ, et at., Defendants.
ORDER
Before the court are plaintiff United Factory Furniture Corp.'s (hereinafter "UFFC") Motions For Order to Preserve Evidence (#10), Preliminary Injunction (#11), and A Mirror-Imaging Order (#12). Defendants Aimee Lynn Alterwitz and Chip Green filed an Opposition to the motions (#19), and plaintiff filed Replies in support of its motions (#20, #21, and #22). Background
Plaintiff prepared the motion as one document, but as the motion seeks three forms of relief, the motion was entered into the docket as three separate motions.
Plaintiff UFFC filed its complaint against the defendants on January 12, 2012, asserting claims for (1) violations of the Computer Fraud Abuse Act 18 U.S.C. § 1030, (2) violations of NRS §§ 205.477 and 205.511 - Unlawful Access to Computer, Civil Action, and (3) breach of Walker Furniture Employee Handbook. (#1). Defendant Alterwitz's family has operated and managed plaintiff's furniture store Walker Furniture since 1973. Id. Both defendants were employees of Walker Furniture. Id. Defendant Alterwitz's husband, defendant Green, was the MIS Director of Walker Furniture, and his responsibilities included managing and maintaining plaintiff's computer server and network services. Id.
In the complaint, plaintiff alleges that defendants used defendant Green's IT expertise to "access emails of the employees and Board Members of [p]laintiff company, and used [plaintiff Alterwitz's] position with Walker Furniture to acquire the confidential records and addresses of employees." Id. Plaintiff also alleges that defendants accessed employee records to harass and threaten employees, and that they "manipulated the computer records of [plaintiff Alterwitz's] accounts payable and expense accounts to attempt to manipulate company financial records." Id. Plaintiff asserts, "[u]pon information and belief," that defendant "Green created a secret access or a "back door" to the company server which was beyond his authorization," and that he used the "back door" to access "confidential information such as sensitive financial information, business plans, confidential customer [information,] and trade secret information." Id. Plaintiff alleges that defendants copied, removed, and/or deleted computer data, e-mails sent and received by plaintiff's Board Members, Officers, and Shareholders, and files concerning plaintiff Alterwitz's accounts payables and expense accounts. Id.
Due to these alleged "illegal and inappropriate" acts, defendant Alterwitz was suspended as an employee in July 2008, and terminated in 2009, and defendant Green's employment was terminated on June 8, 2008. Id. After defendant Alterwitz was terminated, she filed a complaint against plaintiff and other related parties. Id. Plaintiff asserts that it recently learned that since defendant Green's termination, he has accessed the plaintiff's server using the "back door" he created, and that he has "manipulated, copied, transferred, deleted and/or used" data, files, and other information for the defendants' financial gain. Id. Pending Motions
Plaintiff asserts that a mirror-imaging of defendants' home computers is necessary and must be ordered immediately, as highly relevant evidence that exists on defendants' computers "can be overwritten and lost even through the normal use of a computer." (#10). Due to defendants' "history of tampering with and deleting electronic data, plaintiff asks this court to (1) require defendants to preserve the electronic data on their home computers and any other computers over which they exercise control, (2) enjoin defendants from spoliation or deletion of evidence, and (3) enter a mirror-imaging order to allow a computer forensics expert to mirror-image defendants' computer equipment and other materials. Id. Plaintiff asserts that "it is highly likely that the [d]efendants will destroy...evidence" on their personal computers if the court does not issue such an order. Id.
A. Relevant Facts
Before commencing the instant action, plaintiff conducted an investigation and discovered that certain files relating to defendant Alterwitz that were once on plaintiff's computer server were deleted after defendants' termination. Id. Plaintiff asserts that it was concerned that the defendants were accessing plaintiff's computers, because defendant Alterwitz had stated that "she knows what is being written in company emails." Id. In the State Court action commenced by defendant Alterwitz after she was terminated, plaintiff produced emails which were neither sent to, nor from, defendant Alterwitz or her husband. Id. Plaintiff became more concerned, and directed its Information Technology manager to investigate. Id. The IT manager discovered "tampering with and/or deletion of files concerning Alterwitz's accounts payables and expense accounts as well as other questionable activity." Id. Upon discovering this, plaintiff filed the instant lawsuit. Id. Plaintiff believes that this illegal activity has continued following the commencement of this action. Id.
B. Expedited Discovery
Federal Rule of Civil Procedure 26(d) states that "[a] party may not seek discovery from any source before the parties have conferred as required by Rule 26(f), except in a proceeding exempted from initial disclosure under Rule 26(a)(1)(B), or when authorized by these rules, by stipulation, or by court order." Upon a showing of good cause, the court may permit expedited discovery before the Rule 26(f) conference. American LegalNet, Inc. v. Davis, 673 F.Supp.2d 1063, 1066 (C.D. Cal. 2009). "Good cause exists 'where the need for expedited discovery, in consideration for the administration of justice, outweighs the prejudice to the responding party." Id.
Discovery has not commenced in this action. (#10). Based on plaintiff's allegations that defendants have access to plaintiff's computer server, defendants have been deleting files and relevant evidence, and that evidence of their conduct, which is central to the litigation, will be erased through normal use of defendants' computer, the court finds that "good cause" exists to permit expedited discovery. Id; See also Fed. R. Civ. P. 26(b)(1);Oppenheimer Fund v. Sanders, 437 U.S. 340, 351 (1978)(holding that relevance within the meaning of Rule 26(b)(1) is considerably broader than relevance for trial purposes, and that for discovery purposes, relevance means only that the materials sought are reasonably calculated to lead to the discovery of admissible evidence.).
1. Motion For Preliminary Injunction/Preservation Order
Plaintiff asks this court for a preliminary injunction from spoliation of evidence and an order to preserve evidence. (#10 and #11). Defendants assert that they do not object to an order to preserve evidence, but that "it is unreasonable to expect them to cease using their personal and home computing devices." (#19). The court finds that it is unnecessary to enter a preservation order or a preliminary injunction at this time, as defendants are under a duty to preserve and not destroy relevant evidence. The court also finds that defendants do not need to cease using their computers, as the court is issuing a mirror-imaging order that will maintain the status quo.
Litigants owe an "uncompromising duty to preserve" what they know or reasonably should know will be relevant evidence in a pending lawsuit even though no formal discovery requests have been made and no order to preserve evidence has been entered. Kronisch v. United States, 150 F.3d 112, 130 (2nd Cir. 1998); Sensonics, Inc. v. Aerosonic Corp., 271 F.3d 1566, 1575 (Fed. Cir. 1996); Silvestri v. General Motors Corp., 271 F.3d 583, 590 (4th Cir. 2001). This includes preserving electronically stored information or the status of electronic devices that would otherwise be automatically deleted. Southeastern Mechanical Services, Inc. v. Brody, 657 F.Supp.2d 1293, 1300 (M.D. Fl. 2009)(holding that the "wiping" of laptops and Blackberries led to spoliation of evidence). A defendant's duty to preserve exists when a defendant is "on notice that documents and information in its possession are relevant to litigation, or potential litigation." Bayoil, S.A. v. Polembros Shipping Ltd., 196 FRD 497, 482 (S.D. TX 2000); Continental Cas. Co. v. St. Paul Surplus Lines Ins. Co., 265 FRD 510, 532-33 (E.D. CA 2010).
Once a party reasonably anticipates litigation, "it must...put in place a 'litigation hold' to ensure the preservation of relevant documents." Zubulake v. UBS Warburg, LLC., 220 FRD 212, 218 (S.D. NY 2003). In addition to the parties' obligation to preserve evidence, counsel "must take affirmative steps to monitor compliance," and counsel's failure to do so constitutes gross negligence for sanctions purposes, "because it is likely to result in destruction of relevant information." Treppel v. Biovail Corp, 249 FRD 111, 118 (S.D. NY 2008); Pension Committee of Univ. Of Montreal Pension Plan v. Banc of America Securities, LLC., 685 F.Supp.2d 456, 466 (S.D. NY 2010). Under the court's inherent power to manage its own affairs, the court may impose severe sanctions against a party that engages in the spoliation of evidence. Residential Funding Corp. v. DeGeorge Fin'l Corp., 306 F.3d 99, 107 (2nd Cir. 2002); Leon v. IDX Syatem Corp., 464 F.3d 951, 958 (9th Cir. 2006).
Plaintiff filed its complaint on January 12, 2012 (#1), and defendants were served with the complaint on January 12, 2012, at 6:58 p.m. (#4 and #5). Defendants' duty to preserve attached on that date, if not before. Bayoil, 196 FRD at 482; Continental Cas. Co., 265 FRD at 532-33. The complaint alleges that defendants illegally accessed plaintiff's computer server, and copied, deleted, and/or altered files, data, or other information for their own financial benefit. (#1). The status of and information contained on defendants' personal/home computers and devices that store electronic information are directly relevant to the instant action and must be preserved. Fed. R. Civ. P. 26(b)(1);Oppenheimer Fund, 437 U.S. at 351; Kronisch, 150 F.3d at 130; Southeastern Mechanical Services, Inc., 657 F.Supp.2d at 1300. Defendants and their counsel are under a duty to preserve such evidence, and their failure to do so will result in sanctions under Fed. R. Civ. P. 37. Id; See also Treppel, 249 FRD at 118; Residential Funding Corp., 306 F.3d at 107; Leon, 464 F.3d at 958 (holding that sanctions for spoliation may be imposed under Rule 37 for failure to obey court orders.). The willful destruction of relevant evidence after defendants were on notice of the pending litigation, such as that being alleged by plaintiff, will not be tolerated by the court. Leon, 463 F.3d at 959 (sanctioning a party for willful spoliation when he "knew he was under a duty to preserve all data on the laptop, but intentionally deleted many files and then wrote a program to write over deleted documents.").
2. Mirror-Imaging
Plaintiff also asks this court to enter a mirror-imaging order pursuant to Fed. R. Civ. P. 26(b)(2). (#12). Plaintiff asserts that since the normal use of computer equipment may cause information to be overwritten and lost, the only way to ensure that further destruction of evidence does not occur is through mirror-imaging. Id. Defendants argue that mirror-imaging would not only be "personally intrusive," but would violate the federal rules governing discovery because discovery has not commenced in this action. (#19). As previously stated, the defendants are under a duty to preserve relevant evidence, including electronically stored information. Considering the circumstances of this case, the court finds mirror-imaging is appropriate to maintain the status quo. Playboy Enterprises, Inc. v. Welles, et. al., 60 F.Supp.2d 1050 (S.D. Cal. 1999)(permitting mirror-imaging of defendant's hard drive where defendant destroyed e-mails relevant to the litigation). The need for expedited discovery of this nature is warranted and does not violate the federal rules. American LegalNet, Inc., 673 F.Supp.2d at 1066. With regard to the intrusive nature of mirror-imaging, as discussed below, the court's protocol for creating the mirror-image will adequately limit any physical intrusion and will protect the defendants' privacy interests.
Information stored on a computer is discoverable, and the "only restriction in this discovery is that the producing party be protected against undue burden and expense and/or invasion of privileged [or private] matter." Playboy Enterprises, Inc., 60 F.Supp.2d at 1053-54. In weighing the benefit and the burden of the discovery, the court must consider (1) the needs of the case, (2) the amount in controversy, (3) the importance of the issues at stake, (4) the potential for finding relevant material, and (5) the importance of the proposed discovery in resolving the issues. Id. at 1054; See also Fed. R. Civ. P. 26(b)(2).
The plaintiff's allegations in the complaint center around defendants' unlawful access to and destruction, copying, and altering of information stored on plaintiff's computer server. (#1). Plaintiff contends that defendants created a "back door" on their own computer through which they gain access to plaintiff's computer server. Id. Information stored on the defendants' computers or electronic devices is directly relevant to this action. Fed. R. Civ. P. 26(b)(1). For the action to be fairly litigated, defendants' computers must remain unaltered. The first factor to be considered, the needs of the case, weigh in favor of mirror-imaging. Playboy Enterprises, Inc., 60 F.Supp.2d at 1054. With regard to the amount in controversy, plaintiff is seeking compensatory, consequential, punitive and/or statutory damages, as well as reasonable attorney's fees and costs. (#1). Plaintiff alleges that defendants' unlawful conduct "potentially caused substantial financial losses to the [p]laintiff company," that plaintiff suffered damages in excess of $75,000, and that judgments in CFAA cases can amount to the millions of dollars. Id; (#12). As the amount in controversy is great, this factor weighs in favor of mirror-imaging. Playboy Enterprises, Inc., 60 F.Supp.2d at 1054.
Plaintiff asserts that the issues at stake in this litigation involve plaintiff's "trade secrets and sensitive business information, including its customers' data and credit information." (#12). As the court has an interest in protecting individuals from the unauthorized dissemination of their personal credit information and in protecting business's trade secrets and proprietary information, this factor weighs in favor of mirror-imaging. Playboy Enterprises, Inc., 60 F.Supp.2d at 1054. Since the information stored on and the activity of the defendants' computers and electronic devices is at the center of this litigation, the mirror-imaging will preserve relevant evidence. This evidence could not be obtained through simple document production, as information describing the history, tracking, or management of an electronic file is usually not apparent via a hard copy or a screen image. See Fed. R. Civ. P. 26(f) Advisory Committee Notes. The last two factors weigh in favor of mirror-imaging. Playboy Enterprises, Inc., 60 F.Supp.2d at 1054.
Considering these factors, the court finds that the plaintiff's need to create a mirror-image of defendants' computers outweighs the burden on the defendants. Playboy Enterprises, Inc., 60 F.Supp.2d at 1054. Mirror-imaging will not result in any undue expenses, as plaintiff has offered and will be responsible for paying all costs associated with the process of mirror-imaging. (#12 and #20). Defendants' privacy interests and privileged information will be protected by the protocol outlined below, as the court will appoint an outside expert to produce a mirror-image of defendants' computer and electronic devices, who will sign the protective order in place, and who will not personally view or retain custody of the mirror-image. See Playboy Enterprises, Inc., 60 F.Supp.2d at 1054 (appointing an outside expert to produce a mirror image in order to protect defendant's privacy and attorney-client communications).
Accordingly, and for good cause shown,
IT IS ORDERED that plaintiff United Factory Furniture Corp.'s Motions For Order to Preserve Evidence (#10) and Preliminary Injunction (#11) are DENIED as unnecessary.
IT IS FURTHER ORDERED that plaintiff United Factory Furniture Corp.'s Motion For A Mirror-Imaging Order (#12) is GRANTED. The parties shall follow the protocol outlined below:
(1) The court will appoint a computer expert (hereinafter "computer specialist") who specializes in the field of electronic discovery to create a mirror-image of defendants' computer and any devices that store electronic information that defendants have control over or possession of. The parties shall meet and confer within ten (10) days from the entry of this order to agree upon the designation of such a computer specialist. If the parties are unable to agree, each party shall submit to the court the name of and contact information for a suggested computer specialist by April 20, 2011. Thereafter, the court will enter an order appointing one of the computer specialists.
(2) Defense counsel shall meet with defendants in good faith to ascertain what personal/household computers and electronic devices defendants have in their possession or have previously had in their possession or under their control since July 1, 2008. Defense counsel must make those devices, which remain functional, available for mirror-imaging at the time agreed upon pursuant to section (4) below. Defense counsel shall provide a log of any applicable devices which are not functional or not under defendants' control. The log must indicate the type of device, the time-frame the device was functional and/or under defendants' control, and the current location/status of the device.
(3) The court appointed computer specialist will serve as an officer of the court, and any direct or indirect access the specialist has to information protected by the attorney-client privilege will not result in a waiver of the attorney-client privilege. The computer specialist shall sign the protective order (#16) currently in effect in this action. Any communications between the computer specialist and the plaintiff regarding payment of the computer specialist shall be produced to defendants' counsel.
(4) The parties shall work together to agree on a day and time to access defendants' computers and electronic devices as identified in section (2) above. Plaintiff shall consider defendants' schedule in selecting a date, and the mirror-imaging must be conducted within fourteen (14) days from the appointment of the computer specialist. All parties shall be informed of the date and time of the mirror-imaging, and only defense counsel shall be permitted to be present during the mirror-imaging process.
(5) After the appointed computer specialist makes a mirror-image of the defendants' computers and electronic devices, the storage device containing the mirror image shall be delivered to the United States District Court for the District of Nevada, 333 Las Vegas Blvd. Las Vegas, NV 89101, Clerk's Office c/o Roni Hayes within five (5) days from the date the mirror-image is created. The mirror-image shall be delivered in a sealed envelope marked with the above captioned case number and a description of the contents of the envelope. A copy of this order shall be delivered with the mirror-image. The mirror-image will be placed in the Clerk's Office vault and shall remain in the custody of the court through the course of this litigation. If the plaintiff, at any time, has reason to believe that spoliation of evidence has occurred, it may move the court for access to the mirror-image. If no such motion is filed, at the resolution of this action, the mirror-image contained on the storage device shall be disposed of in accordance with paragraph (9) of the parties protective order (#16).
____________
CAM FERENBACH
UNITED STATES MAGISTRATE JUDGE