|
“HARD DRIVE”
DISCOVERY IN LITIGATION
Introduction:
It is an oddity of
how people react to their own computers that they feel the hard drive
within the computer containing the user’s stored confidential and
private information is somehow a “private” arena that is not accessible
to third parties.
Of course that is
simply not true. Most passwords are easily broken and if a computer has
any access to the internet, unknown clever hackers can access the
majority of computers.
But there is an even
blunter instrument that is available in litigation which is becoming a
central part of the discovery process. The reader should read our
article on
American Litigation and on
Computer Discovery
before proceeding further with this article.
This article shall
concentrate on the ability of parties in litigation to gain access to
the hard drive on all the computers and personal devices of
opposing parties and witnesses. Put simply, in most litigation, at least
limited access to the hard drive will be gained and made available to
computer experts on the other side for full examination for relevant
evidence though what can be revealed to the other parties will be a
matter of relevance and law and motion.
The key fact to
realize, however, is that your hard drives will be in the hands of
strangers to pour over and determine what will be made a matter of
public record. And this includes all of your computers, from desk top to
lap top, from Blackberries to iPhones.
How to handle that
fact is the theme of this article.
Basic Discovery Tools
and Computers:
As discussed in our
article on
American Litigation, the discovery aspect of American
litigation is a unique and powerful instrument available to the parties.
By formally demanding written answers, oral examination and/or
production of documents, and access to relevant evidence, a party can
investigate aggressively and proactively the other party’s evidence and
documents. Indeed, the first year of any litigation is normally spent in
achieving some mix of the above discovery by and for all parties.
Most cases are won
or lost in the discovery arena in which each side seeks to gain
advantage by obtaining admissions, documents and information from third
parties and opposing parties to either make their own case or destroy
another party’s case.
Given the pervasive
use of every type of computer by both businesses and individuals in most
of the world, including hand held, and the constant use of e mail, it
was only a matter of time before gaining full access to such information
was made a standard part of litigation. More and more cases are being
decided by use of access to e mail in which parties make admissions or
discuss aspects of the case that they never would have expected to be
available to the other side. A party that would never write a letter
making destructive admissions can often be found to have written
numerous e mails that achieve the same effect.
While communications
to legal counsel may be privileged (see our article on
Attorney Client Privilege) most other communications are
not and are thus susceptible to standard discovery, whether stored on a
computer, handheld device, or in the server of the company or third
party.
One of this writer’s
favorite admissions in a case began with a writer stating in an e mail,
“I never would put this in writing, but….” He failed to realize that
writing an e mail…is writing!
But there is an
aspect of computer discovery that goes far beyond the more traditional
discovery of documents.
Information stored
on a computer is stored in a device commonly known as the “hard drive”
and all information of the user is normally stored on that device. It is
as if all your business records were kept in a single file and in a
discovery dispute, in order to allow the party to search the critical
file for evidence…they had to be given your files of all your matters
regardless of relevance. And even documents once stored and deleted are
still available for inspection by the experts…as is information as to
every website you may have visited and viewed on your computer.
Nor is the solution
of having your own expert provide the relevant documents likely to solve
the problem since the opponents will not want to rely on your expert but
have their own expert review the hard drive to determine what relevant
documents exist.
This can lead to a
whole series of discovery disputes in which your counsel seeks a
protective order and the court or court appointed commissioner becomes
involved to determine a procedure for allowing access to the entire hard
drive to determine what relevant documents may exist.
The usual result is
some expert is given the task of copying your entire hard drive and
either reviewing it himself or having some third party review it to
determine what relevant documents may exist to be produced for the other
side.
And what is on your
hard drive? First, not only e mails but every document that was ever on
your computer. Every website you have ever visited. Every document you
have ever downloaded. Everything you have ever bought. It is as if your
private life was suddenly a subject of public examination by experts
hired by your adversaries.
And even if you
deleted documents or e mails, the odds are good that an experienced
expert will be able to recover most if not all of them or, at the least,
the fact that you deleted them. Deleting documents can, itself, be
evidence that is of key import to a Trier of fact. Just ask Richard
Nixon about the thirteen minutes of missing tapes in the White House
conversations…which were “accidently” deleted. And spelled his doom.
That is what will be
in the hands of your adversaries or the experts selected by your
adversaries.
Steps to Expect
1.
Opening Shots:
At the very commencement of the litigation an aggressive adversary will
immediately stop the other party from taking any steps that could alter
the data on the computer. The usual step is to send a variation of the
letter sent below, which has been redacted.
June x, 200x
See Attached Service
List
Via Email and U.S.
Mail
Re: XXXXXX Trust
San Francisco Superior Court Case No. XXXXXX
Preservation of Evidence
Dear Lady and
Gentlemen:
We respectfully
demand that you immediately preserve and retain all evidence relating to
this matter, including, but not limited to, all documents, tangible
things, and electronic data in the possession, custody, or control of
you or your agents.
For purposes of this
letter, such “electronic data” includes, but is not limited to, text
files (including word processing documents), spread sheets, e-mail files
and information concerning e-mail (including logs of e-mail history and
usage, header information and “deleted” files), internet history files
and preferences, graphical image files (including “.JPG, .GIF, .BMP and
TIFF files), data bases, calendar and scheduling information, computer
system activity logs, instant message text and all related information
and/or data related, and all file fragments and backup files containing
the above electronic data. Additionally, the continued operation of any
computer systems (including standalone personal computers, network
workstations, notebook and/or laptop computers, or desktop computers) in
the possession, custody or control of you or your agents will likely
result in the destruction of relevant evidence due to the fact that
electronic evidence can be easily altered, deleted, overwritten or
otherwise modified. We hereby demand that you and your agents refrain
from operating (or removing or altering fixed or external drives and
media attached thereto) such computer systems (or segregate all storage
systems and devices, or create and retain true and compete images of all
related storage systems and devices) and suspend all overwriting
practices and protocols until further written notice from me.
Please note that the
failure to preserve and retain evidence, including electronic data,
constitutes spoliation or destruction of evidence and may subject you to
sanctions under California law. See Code of Civil Procedure § 2023;
Penal Code § 135; Cedars-Sinai Medical Center v. Superior Court, 18 Cal.
4th 1, 12 (1998).
Please contact me if
you have any questions or concerns.
Sincerely,
ZZZZZZZZZZ, Esq.
cc Client
Once you receive
that letter any actions you take that could alter or endanger data on
your hard drive can lead to severe sanctions from the Court. Of course,
if you have already altered or deleted files before receiving that
letter, that fact will eventually come out in discovery and if an expert
can recreate what was deleted…not an impossible task much of the
time…your deletion can be disastrous to your case if the document was
relevant.
After the above
letter is received, you will receive formal notice of demand to obtain
access to your hard drive and computer…and that is most likely when the
law and motion before the discovery commissioner will ensue…but in most
instances at least limited access to the hard drive is likely to be
granted.
2.
The Inspection:
An entire industry of computer experts now exist who assist attorneys in
analyzing information on hard drives. They are normally subject to court
orders as to restrictions on what they can advise parties (assuming your
counsel obtained the correct protective order) but the issue of what
data is relevant can be a matter of hot dispute before the court.
You will be required
to give access to the expert to copy your hard drive and that will
include each and every device you used to either send or receive e mails
or store information. That will include computers you may have only used
occasionally or even other person’s computers that you used once or
twice. They will discover which computers you may have used by written
discovery that you will have to answer under oath.
Keep in mind that
this may include your home computer, your spouse’s computer, your
children’s computers. It will include friend’s computers and family
members that you may have visited if you used their computers.
The courts do impose
certain restrictions and will normally only grant access to such
computers if the likelihood of discovering evidence can be demonstrated.
But the tradition of the courts is to broadly grant discovery.
A simple rule is
that the less you used a computer and the more ancillary the person is
to the case, the more likely the court will prohibit access.
3.
The Copying of the
Hard Drive:
The expert does not normally remain on your premises going through your
computer. Normally, they make a copy of each and every hard drive and
remove the copy from the premises, to be kept by the expert for the
examination either allowed by your counsel or ordered by the court.
Usually, upon conclusion of the case, the hard drive is returned. Most
parties do worry that additional copies of the hard drive may be created
which is why experts rather than opposing parties are normally the ones
who retain possession, it being reasoned they are less likely to abuse
access to the hard drive.
4.
Employment Issues:
But the situation is radically different for a computer you use at work
which is owned by the company. In those cases, the employer will
normally own and have unfettered access to the hard drive since they own
it. It is up to the employee to try to restrict access to the employer
in court and that may be an uphill fight. While the law is in flux and
some courts are beginning to stress the employee’s right to privacy,
normally the employer will seize the hard drive immediately, make a
copy, and by the time the court is involved, may have viewed its
contents in detail.
Courts
recognize that employers have a right to protect their own information
and that such information is normally found on computers accessed by
employees. Most courts will freely allow the company to regain access to
the computer and the issue of what information may be used from their
examination of their own hard drive is a matter of some dispute in most
cases.
5.
Trial:
The standard rules of evidence will apply to data obtained from the
computers. If the information is relevant to the issues at bar, e mails,
websites, etc. will not only be admitted into evidence, but will often
be reproduced on computers within the court room and shown on the
various visual equipment that is routinely used in trial.
Unique Problems with
Computers
Perhaps an
illustration from a case will exemplify the unique issues facing the
holder of such evidence. In one case the home computer of a party was
given access to our opposing party since our client often worked at
home. It was a business dispute having to do with breach of contract but
the question of when notice was given was before the court and e mails
that may have given notice were thus relevant.
Our client had once
used his teen aged son’s computer. Over the son’s strident protests, his
hard drive was viewed by the expert. As one can expect, the websites
visited by the boy were not ones he wished his parents to know about,
but a real crisis arose since one site could be considered child
pornography which is subject to remarkable restrictions. To even possess
such pornography
is a crime. See our
article on
child pornography. Suddenly our client and his family
were faced with a catastrophe that had nothing to do with the case.
The law required the
expert to report the existence of such evidence to the authorities. He
had no choice. Our opponents expressed regret but were secretly
delighted that their adversaries were suddenly on the defensive.
The authorities were
reasonable and the problem was quickly resolved, but the lesson is
clear. Once litigation begins, the access to the hard drive can become a
very troubling event.
Trends
Given the increasing
use of such tools and, indeed, the rapid growth of social networking
that has data stored on servers possessed by third parties, one can
expect these issues to become even more central. As one client
commented, every cased can become an invasion of privacy.
Recognizing this,
the courts are seeking to develop rules to restrict access to data and
the commissioners routinely issue protective orders to attempt to limit
the inherent harm that can arrive. Certainly counsel in California are
held to high standards of ethical conduct as are most experts.
But those same legal
counsel are required by duty to seek to obtain access to all such
information…and to defend access. As one judge commented, whether a
letter in a paper file or an e mail in a hard drive file, if it is
evidence, it is evidence, and counsel are obligated to seek it out.
To some extent
mutual deterrence can apply. Few want their own hard drives subject to
review by opponents and once that battle begins the courts will normally
grant equal access to both sides. Knowing this, counsel normally try to
negotiate a methodology as to reasonable access and only if those
negotiations break down is the court brought in.
But there are
parties and counsel who are “scorched earth” in their approach to
litigation and will gladly fight for months in the courts to attempt to
gain access to hard drives, enjoying the anger, embarrassment and
frustration that may ensue if such access is granted in the wrong way.
Courts now expect
reasonable restrictions to be agreed upon by the parties and that has
become the norm. A party seeking to gain further access for “fishing
expeditions” will have to convince the court that the evidence that may
exist is worth the invasion of privacy of a party.
Pro Active Steps
Once
the case begins, destroying evidence, even before a restrictive order is
received, can be both criminal and foolish. To destroy a hard drive
requires far more than erasing or buying a program that promises to
delete. It usually means physically destroying the unit and recall that
all servers….including third party servers…will often have full copies
of all that was on the computer.
Once
such destruction is discovered, opposing parties will emphasize that
“guilty” act before any Trier of fact.
A much
more intelligent approach is to restrict what one puts on one’s business
computer and use personal computers for strictly personal matters. This
would solve the problem-but in reality it is unrealistic. Most people
work long hours and must use business computers interchangeably with
personal use. With more and more handhelds and telephones becoming mini
computers, it is perhaps unrealistic to expect such division of use to
last. But if you can…you should.
It is
vital to recall that whatever you type will be subject to scrutiny if
litigation arises, at least by some expert, and not to make the typical
mistake of thinking computer writing is not writing. It is all
discoverable evidence. If you have something important to state that is
in any way legal in nature, copy your attorney since the attorney client
privilege applies to communications to counsel.
A
planned program of
destruction of
business records is good practice for any business since
otherwise they can be submerged in ancient records. This program
cannot be used merely to destroy evidence, however. It must be regular,
organized, and instituted before the case began.
Above
all, it is important to realize that your hard drive is a piece of
evidence and will be subject o investigation if such evidence is
relevant to the issues at bar.
Of
course, the same is true for your opponent’s computers.
Conclusion
It is
vital to educate employees and family members as to the facts of life of
access to hard drive. It is vital to realize that tens of millions of
dollars in damages has been obtained by legal counsel obtaining access
to e mails foolishly sent by employees. It is vital to understand that
the screen sitting on your desk is not a window to your private world.
It is merely a device to store information and make it available and it
sits there as a remarkable convenience…and a dangerous trap.
One of
our clients put a note on his computer that he says is a useful
reminder. “If Mom Can’t Stand to See It…Neither Can the Judge.”’
A bit
extreme…but not much. |
