Opinion
22 Civ. 2299 (LGS)
12-02-2022
NETWORK DATA ROOMS, LLC, Plaintiff, v. SAULREALISM LLC, et al., Defendants.
OPINION AND ORDER
LORNA G. SCHOFIELD, District Judge:
Plaintiff Network Data Rooms, LLC (“NDR”) brings this action against Defendants Saulrealism LLC and Ryan Saul (collectively “Saul”) for misappropriation of trade secrets under the Defense of Trade Secrets Act, 18 U.S.C. § 1836, et seq. and New York common law, as well as for conversion and breach of contract. On August 5, 2022, Saul advised the Court that Plaintiff apparently had submitted falsified emails in support of its motion for a preliminary injunction. Based on that letter, and on Plaintiff's letter response, the Court ordered Plaintiff to show cause why the Court should not impose sanctions up to and including dismissal of the action and a referral to the United States Attorney's Office for perjury and making false statements to the Court. For the reasons below, the case is dismissed.
I. BACKGROUND
Plaintiff asserts that Saul, Plaintiff's former software developer, stole the latest iteration of Plaintiff's source code and code base for the development of a new product. Plaintiff seeks an injunction and damages. Saul denies that he has any of the code or a copy of the code and maintains that he cannot return what he does not have.
Plaintiff NDR was created to establish a virtual data room platform called “DealTable” (the “Platform”). It was intended to serve clients of NDR's affiliate Network Financial Printing Inc., a well-established financial printing company. The plan was to transition the printing company's financial clients, who were moving away from traditional printing, toward paperless and digital document retention. Plaintiff is a New York limited liability company whose members are Christopher, Thomas and Jack Concannon.
Plaintiff acquired the DealTable software in 2019 to create a virtual data room and developed a plan for what features the software would need to provide. In November 2020, Plaintiff hired David Delorge to be the DealTable Azure Chief Cloud Architect and Cloud Security Engineer for the DealTable VDR Platform development project. Delorge had over 30 years of IT experience, a Masters in Technology, multiple cloud certifications and other credentials. He was responsible for overseeing the infrastructure on which the Platform was being built, ensuring that all code and services were backed up and implementing and monitoring security protocols. Delorge established Plaintiff's DevOps Source Code Repository (“Repository”) where developers working on the Platform software were required to save all source code.
Microsoft Azure is a cloud computing platform that provides a wide range of cloud services helpful to business users.
In December 2020, Plaintiff hired Saul as Lead Project Developer to edit the existing codebase and write new source code needed to complete the development of the Platform. Both Delorge and Saul were independent contractors and paid a consulting fee. Like all of Plaintiff's software developers, Saul was required to write original source code on a development site, accessed through a secure internet connection via the Azure Virtual Desktop, and save the code on the Repository. Beginning in September 2021, Saul was the only software developer working on the project.
On January 18, 2022, Saul was fired after a dispute with one of the owners about requested changes to the source code. According to Delorge, Saul reacted angrily by deleting aspects of the DealTable, which Delorge could only partially restore, and which Saul offered to “fix” if NDR rehired him. Saul denied that he did any of this.
On around February 17, 2022, Delorge reported to the owners of NDR that Saul had not saved source code to the Repository since September 26, 2021, and that none of the code written by Saul between that date and his firing had been saved to the Repository. The owners promptly reported to law enforcement that the source code had been stolen.
This Action
Plaintiff commenced this action on March 21, 2022. Although the Complaint seeks damages and a permanent injunction, Plaintiff has made clear that “its only incentive in bringing this action is to recover the decompiled source code.” Accordingly, the focus of the litigation has been whether Saul has the source code.
As Delorge explained in his first declaration, a developer writes the source code in decompiled format, which can be edited and augmented. When the source code is compiled and deployed, it cannot be edited or updated. Plaintiff needs the decompiled code (also known as the original source code) in order to make any updates or additions.
On March 25, 2022, Plaintiff filed an ex parte motion for a temporary restraining order (“TRO”) and preliminary injunction to compel Saul to return the source code and prohibit him from destroying or disseminating it. The ex parte motion was granted in part enjoining Saul from destroying or disseminating the source code. In subsequent briefing on the preliminary injunction motion, Saul responded that he did not have the source code and therefore had no objection to continuing the prohibitory injunction, but opposed any order requiring him to return the code. An evidentiary hearing was held on April 20 and 21, 2022, at which Delorge and one of Plaintiff's owners, Thomas Concannon, testified on behalf of Plaintiff. Saul testified on behalf of himself.
Following the hearing and to assist the Court, the parties selected and retained an expert, whom Plaintiff agreed to pay. The parties also agreed on the scope of the expert's review. The expert submitted an initial report and two supplemental reports, which are discussed below.
On September 23, 2022, the mandatory injunction ordering Saul to turn over the code was denied, based on Plaintiff's lack of credible evidence and Plaintiff's inability to show a clear and substantial likelihood of success on the merits. The prohibitory relief was granted as unopposed. Plaintiff's motion to reconsider was also denied.
Falsification of Evidence
On August 5, 2022, defense counsel submitted a letter to the Court reporting that an email chain Plaintiff had submitted in support of its motion for a preliminary injunction had been falsified. Defense counsel's letter attached both the altered email that Plaintiff had offered as evidence and the version of the email that Plaintiff had produced in discovery. Plaintiff responded, essentially admitting that “non-party” Delorge had altered the email but denying that Plaintiff or its counsel had any knowledge or involvement.
On August 16, 2022, the Court issued an order that Plaintiff show cause at an evidentiary hearing why sanctions should not be imposed, up to or including dismissal of the action and referral to federal prosecutors for perjury and false statements to the Court. Plaintiff was ordered to produce Delorge and the expert at the hearing “unless Delorge states in an affidavit filed with the Court that he intends to assert his Fifth Amendment right against self-incrimination.” The parties filed memoranda of law on whether sanctions should be imposed.
On September 6 and 17, 2022, Delorge mailed the Court an affidavit stating that he no longer worked for Plaintiff and asserting his Fifth Amendment right against self-incrimination. The first version of the affidavit was unsigned and attached what Delorge described as “the Original Email thread.” The second version was identical and signed. It referenced, but did not include, the attachments. In the affidavit, Delorge appeared to deny that he had ever been in possession of the altered email or that he knew where it came from. Plaintiff's counsel disputed that statement and reaffirmed that Delorge had provided them the doctored email on March 1, 2022. They referenced their previously filed declaration, sworn to August 25, 2022, which attached Delorge's March 1, 2022, cover email to Plaintiff's counsel with the altered email. Plaintiff's counsel also confirmed that they had not received the unaltered email until they collected documents for discovery. On October 24, 2022, the evidentiary hearing was cancelled.
Delorge's affidavit states in part:
As for the ‘Email' in question, the ‘Original Email thread is attached', for your review in entirety. I did not give this email to any lawyers, and the information I provided Network Data Rooms, is also attached. I humbly, as given the option, assert my Fifth amendment right against self-incrimination, as I was not in possession on this ‘Evidence', nor do I know the chain of custody it went through, as there were hundreds of emails and passed around.
II. STANDARD
“A court may sanction a party under its inherent power to deter abuse of the judicial process and prevent a party from perpetrating a fraud on the court.” Yukos Cap. S.A.R.L. v. Feldman, 977 F.3d 216, 235 (2d Cir. 2020). “Sanctions for fraud are warranted if it is established by clear and convincing evidence that [a party] has sentiently set in motion some unconscionable scheme calculated to interfere with the judicial system's ability impartially to adjudicate the action.” Id. (alteration in original).
A district court exercising its inherent power has several options available to sanction a plaintiff. The court may dismiss a plaintiff's case with prejudice. See, e.g., Shepherd v. Annucci, 921 F.3d 89, 98 (2d Cir. 2019). The court may impose monetary sanctions against a party or its counsel. See, e.g., Int'l Techs. Mktg., Inc. v. Verint Sys., Ltd., 991 F.3d 361, 367 (2d Cir. 2021). A court may give an adverse jury instruction. See, e.g., Klipsch Grp., Inc. v. ePRO E-Com. Ltd., 880 F.3d 620, 629 n.5 (2d Cir. 2018). Before imposing the sanction of dismissal, the court should “consider[ ] . . . alternative, less drastic sanctions.” John B. Hull, Inc. v. Waterbury Petroleum Prods., Inc., 845 F.2d 1172, 1176 (2d Cir. 1988); accord ComLab, Corp. v. Tire, 815 Fed.Appx. 597, 602 (2d Cir. 2020) (summary order). “Because of its potency, however, a court's inherent power ‘must be exercised with restraint and discretion.'” Int'l Techs., 991 F.3d at 368 (quoting Chambers v. NASCO, Inc., 501 U.S. 32, 44 (1991)).
Before a court may invoke its inherent power to sanction, the party facing sanctions must be provided with “adequate notice and an opportunity to be heard.” Shepherd, 921 F.3d at 97. When the sanction is dismissal with prejudice, it must be supported by “clear evidence of misconduct and a high degree of specificity in the factual findings.” Mitchell v. Lyons Pro. Servs., Inc., 708 F.3d 463, 467 (2d Cir. 2013) (internal quotation marks omitted). The court must find “willfulness, bad faith, or reasonably serious fault,” id. (internal quotation marks omitted), and must also consider whether a lesser sanction would be appropriate, see Shepherd, 921 F.3d at 98.
III. DISCUSSION
Based on the parties' respective submissions, Delorge's testimony at the preliminary injunction hearing and documents from Delorge, the Court finds by clear and convincing evidence that Delorge, acting on behalf of Plaintiff, knowingly, willfully and in bad faith submitted altered evidence, thereby committing fraud on the Court.
The falsified evidence at issue consists of an email string in which Delorge asks, and Saul responds, where he (Saul) is saving the code that he is writing for Plaintiff. There are three versions of the email exchange. The first version was filed as the sole exhibit to the Delorge declaration in support of Plaintiff's motion for a preliminary injunction (the “PI Version”). The parties do not dispute that this version has been altered. The second, presumably unaltered version, was submitted by defense counsel as having been produced by Plaintiff in discovery (the “Unaltered Version”). The third version was submitted by Delorge with his invocation of the privilege against self-incrimination, after he was no longer employed by Plaintiff (the “Fifth Amendment Version”). The Fifth Amendment Version is not imputed to Plaintiff.
The PI Version consists of two emails, the first dated “Saturday, October 19, 2021 5:44 PM” and the response dated “Saturday, October 20, 2021 8:44 PM.” In the first email, Delorge asks Saul, “Hi ya, May I ask where your committing code to? I was looking through the Projects in Azure Devops- and wondered which project your using? I am not seeing new check-ins. Can you advise? Thanks.” Saul responds: “New branch under project Ryan Development. I Just Checked in and it is up to date.” The authenticity of the emails is obviously questionable as the two successive days could not both have been a Saturday. Defense counsel pointed out at the preliminary injunction hearing that October 19, 2021, was a Tuesday. Plaintiff does not dispute that this email was altered.
The Unaltered Version consists of two similar emails. The first is dated “January 16, 2021, 9:42 PM.” The response is dated “January 16, 2021 9:44 PM.” Delorge's inquiry is the same but also contains what appears to be a hyperlink: “Projects - Home (azure.com).” Saul's response is entirely different from the PI Version: “New branch under project backendv2. Branch name is GraphAPILogin.” The parties appear to agree that this is the authentic version of the email.
The Fifth Amendment Version consists of four emails. The first two emails are identical to the Unaltered Version and were sent on January 16, 2021, at 9:42 and 9:44 PM. The third email, dated the same day, purports to be Saul's correction to his 9:44 PM email and says “Correction: project NDR_frontend_v2, branch GraphAPILogin.” The fourth email, dated January 17, 2021, purports to be Delorge's response, “Awesome, Thank you- Was just getting latest, making sure I had the right branch. [smiley face]. Have a great weekend.”
The third email bears an earlier time of 8:45 PM, perhaps because Saul used different computers logged into different time zones for his two emails, or perhaps some other reason.
The emails critically bear on a central issue in this case -- whether Saul stole the code. The answer to that question lies in where Saul saved the code that he had written. Delorge says Saul saved it on a private repository that Saul owned, rather than on Plaintiff's repository, and that is how Saul was able to steal the code. Saul says unequivocally that he saved the code on the Repository. Delorge's evidence was in part the doctored email, the PI Version, in which Saul supposedly said that he was uploading to “New branch under project Ryan Development.” Delorge swore in his preliminary injunction declaration that Ryan Development contained only old code that Saul had placed there to create the appearance that he was saving new code to Plaintiff's repository. It is now clear from the doctored email that Delorge fabricated the Ryan Development story.
There is no project called Ryan Development in the list of all projects and repositories on Plaintiff's Azure DevOps Account, filed on September 7, 2022. The NDR2021 Project contains branches called “Ryan” and “Ryan-Development,” according to Exhibit F of Delorge's reply declaration.
It appears from the PI Version that Delorge not only wanted to create an explanation for logs showing that Saul regularly saved code to the Repository, Delorge also seemed to want to hide where Saul actually said he saved code -- to “New branch under project backend_v2. Branch name is GraphAPILogin,” which Saul apparently corrected to “project NDR_frontend_v2, branch GraphAPILogin.” There is no project (or is no longer a project) called “backendv2” according to Plaintiff's list of projects filed with the Court.
Plaintiff's list includes projects called “ndrbackend” and “ndrfrontend,” both for code developed before Plaintiff purchased the software. And the list includes a project called “ndrfrontendv2” for later code developed after Plaintiff purchased the software, but no “backendv2,” which Saul referenced.
Plaintiff's case was filed in reliance on Delorge's supposed discovery of what Saul had done and Delorge's blatant lie about what Saul had told him. Delorge's preliminary injunction declaration states:
Following my review of the DealTable Systems, I have determined that Saul, without authorization, downloaded NDR's codebase for the DealTable VDR Platform to a self-owned GitHub Repository and, beginning on September 26, 2021 performed [his] coding work including changes to the source code and the creation of new code to build out the . . . Platform on a personal computer and saved the source code on a hidden, self-owned Git-Hub Repository, which violated the security procedures implemented by NDR.
Delorge continued:
Saul went to great lengths to conceal [his] unlawful conduct in downloading the codebase . . . by logging in to the Virtual Desktop each day but actually coding on a different machine....Saul created a new “branch” on NDR's secure [Repository] called “Ryan Development,” where [he] told me that the source code was being saved and, instead, uploaded old code to the repository so that I and NDR's members would believe that [he] was uploading the new source code that was being deployed to the [Platform] website and application. See email from Ryan Saul dated October 20, 2021 annexed hereto as Exhibit “A.”
The same allegations appear in the Complaint, in Plaintiff's motion for a TRO and preliminary injunction, and Plaintiff continues to press the same theory today (presumably without the “Ryan Development” feature).
Because Delorge's fraudulent conduct was plainly intentional and the foundation of Plaintiff's case, dismissal with prejudice is the only appropriate sanction. The evidence is undisputed that Delorge, speaking on behalf of Plaintiff as its Chief Cloud Architect, sought to defraud the Court in a manner “calculated to interfere with the judicial system's ability impartially to adjudicate the action.” Yukos Cap. S.A.R.L., 977 F.3d at 235. Also considering Plaintiff's continued pursuit of its claim, a lesser sanction -- such as a monetary sanction, the exclusion of evidence or an adverse inference instruction to the jury at trial -- would be insufficient to remedy the impact of this misconduct or to deter future misconduct. A monetary sanction also seems misaimed when the perpetrator of the fraud is a closely held company in which the individual wrongdoer has no financial stake. Sanctions at trial are also inappropriate because a trial would be largely pointless. Presumably the jury would learn of Delorge's fabrication, hear the limitations of the remaining evidence discussed below and very likely return a verdict for Saul. “A trial in this case would therefore be a pointless waste of judicial resources and impose an expensive and undue burden on the defendants.” Rossbach v. Montefiore Med. Ctr., No. 19 Civ. 5758, 2021 WL 3421569, at *7 (S.D.N.Y. Aug. 5, 2021) (dismissing plaintiff's case with prejudice after finding that she sought to perpetrate a fraud on the court).
As to Plaintiff's counsel, the evidence does not show, nor do Defendants allege, that Plaintiff's counsel knew that the email was altered when it was submitted to the Court. See Lawrence v. City of New York, No. 15 Civ. 8947, 2018 WL 3611963, at *2 (S.D.N.Y. July 27, 2018). Delorge sent the document to Plaintiff's attorneys on March 1, 2022. They reviewed its substance and then attached it to Delorge's declaration in the exact form it was received. The substance of the document, on its face, was consistent with the information provided by Delorge -- that Saul was saving code to a new branch called “Ryan Development.” Although Plaintiff's counsel should have noticed the date discrepancy on the only email and only one of three exhibits filed in support of the preliminary injunction motion, there is no evidence that Plaintiff's counsel was privy, or willfully blind, to the misconduct. Accordingly, no sanctions are imposed on Plaintiff's counsel.
Plaintiff argues against sanctions, but does not dispute that the evidence was altered. Rather, Plaintiff argues that Delorge's “rogue acts” should not be imputed to Plaintiff when the evidence shows that any act committed with respect to the altered email was committed by Mr. Delorge, on behalf of himself, without the knowledge or inducement of Plaintiff or its counsel. The Court rejects the argument that a corporation can file a lawsuit in its own name, put forward as its own the assertions of an individual acting as its representative -- whether an employee, consultant, shareholder, officer or director -- and then disassociate itself from the person for purposes of the lawsuit when the assertions turn out to be fraudulent. See Restatement (Third) of Agency § 7.08 (2006) (“A principal is subject to vicarious liability for a tort committed by an agent in dealing or communicating with a third party on or purportedly on behalf of the principal when actions taken by the agent with apparent authority constitute the tort or enable the agent to conceal its commission.”).
Plaintiff offered Delorge's written and oral testimony, describing him as Plaintiff's Chief Cloud Architect and Cloud Security Engineer responsible for “overseeing the infrastructure platform on which DealTable VDR Platform is being built, making sure that all services and code were being backed up and had high availability and governance, and in implementing and monitoring security protocols.” He held a significant role with the company for a year and a half, both in title and responsibilities. See Garanti Finansal Kiralama A.S. v. Aqua Marine & Trading Inc., 697 F.3d 59, 73 (2d Cir. 2012) (“Apparent authority arises from the written or spoken words or any other conduct of the principal which, reasonably interpreted, causes a third person to believe that the principal consents to have an act done on his behalf by the person purporting to act for him.” (internal quotation marks omitted)). Delorge was the only person affiliated with NDR who had the technical competence to accuse anyone of stealing the code. That others at the company did not know of or ratify Delorge's misconduct is immaterial. See Chevron Corp. v. Donziger, 974 F.Supp.2d 362, 557, 566 n.1304 (S.D.N.Y. 2014) (stating that under New York law, and citing the Restatement (Third) of Agency §§ 7.03, 7.04 and 7.08, a principal is liable for the acts of its agents, committed within the scope of their employment or actual or apparent authority, and that ratification is immaterial except in the absence of actual or apparent authority). Plaintiff's case is dismissed based on Delorge's misconduct. See, e.g., ComLab, Corp., 815 Fed.Appx. at 600 (upholding sanction of dismissal with prejudice and award of attorneys' fees against plaintiff corporation where plaintiff's CEO willfully fabricated invoices and emails and spoliated other evidence); New York Credit & Fin. Mgmt. Grp. v. Parson Ctr. Pharmacy, Inc., 432 Fed.Appx. 25, 25 (2d Cir. 2011) (summary order) (upholding joint and several monetary sanctions against individual defendant and corporate defendant where the individual falsified emails, which defendants then relied upon and submitted in connection with a motion for summary judgment).
Plaintiff also opposes sanctions on the basis that their discredited witness, Delorge, and the altered email are not central to the case because Plaintiff can prove its claims through other evidence. Plaintiff relies on several of the expert's conclusions to establish that Saul did not save the source code to the Repository. Even assuming the premise of Plaintiff's argument, it does not mitigate the severity and willfulness of the misconduct, its centrality to the issues in the case and the need for drastic sanctions.
Moreover, Plaintiff's assertion that it can prove that Saul stole the code is questionable because the expert's opinions are inconclusive. For example, the expert concluded that the code that was developed and actually deployed to the website (i.e. used) did not come from any active branch in the Repository, but could have come from a deleted branch in the Repository (implicating Delorge) or from a source outside the repository (implicating Saul), and he further explained the limitations on his determining either. Most important, there is no evidence from any source that Saul is in current possession, custody or control of the code. Plaintiff does not, as it suggests, have meritorious claims against Saul that are “wholly supported by credible admissible evidence entirely unrelated” to the fabricated emails.
The expert reviewed all active projects and all active branches, but he did not review deleted projects and branches. In his supplemental report, he explained that entire branches can be deleted and are always recoverable, but will appear in a search for deleted branches only if the exact branch name is used in the search. Similarly, the history of having saved the code -- i.e., the “commit history” -- is stored in the deleted branch and is not available unless the deleted branch is restored. Audit logs showing a deletion are available for only 90 days. “[T]here could potentially be deleted branches that I was not able to find without using an exact name match and that any deleted branch commit history will not [be] available unless the deleted branch is restored.” The expert was not asked whether the same principles that apply to the deletion of branches also apply to the deletion of projects. The expert's search revealed no deleted branch with the name “Net Roadshow” or “Net Road Show,” which is where Saul testified he saved the code during his preliminary injunction testimony. But the expert was not asked to search for a deleted project or branch with the names Delorge concealed in the altered email -- “project backendv2. Branch name is GraphAPILogin.”
IV. CONCLUSION
For the foregoing reasons, this action is hereby DISMISSED with prejudice. Plaintiff's request for a pre-motion conference on the spoliation issue is DENIED as moot.
The Clerk of Court is respectfully directed to close this case.