December's Notable Cases and Events in E-Discovery

1. In WeRide Corp. v. Kun Huang, 2020 WL 1967209 (N.D. Cal. Apr. 24, 2020), U.S. District Judge Edward J. Davila of the Northern District of California issued terminating sanctions against defendants for significant and recurring evidence spoliation, including the failure to suspend the auto-delete function on the email server and the use of ephemeral messaging systems to circumvent retention obligations.

In this trade secret misappropriation and breach of contract litigation, plaintiffs, developers of autonomous car technology, alleged that its former CEO and former head of hardware technology stole source code and confidential materials upon departing from plaintiffs and violated their duties of loyalty in soliciting plaintiffs’ employees to join a newly established rival firm. Id. at *1-*2. In January, 2018, plaintiffs had removed their CEO, one of the defendants, who proceeded to start a rival company to compete with plaintiffs and recruited plaintiffs’ head of technology to join the rival company — both also defendants. In the lead-up to the hardware technology head’s joining the rival company, he ran internet searches related to the consequences for soliciting employees and testified that he was worried at that time that plaintiffs would sue him. Id. at *2. Plaintiffs alleged that among other things, the hardware technology head stole source code upon his departure and provided it to defendants.

Prior to this litigation, plaintiffs issued cease-and-desist letters to its former CEO and head of technology related to disparagement of plaintiffs. The former head of hardware technology’s counsel forwarded a document-hold notice to the co-founder of the defendant rival company. The hold notice was not, however, distributed more widely until eight months later.

Plaintiffs filed suit and moved for the court to enter a preliminary injunction prohibiting defendants from using or disclosing plaintiff’s trade secrets or confidential information. The court granted the motion and “specifically prohibited the enjoined parties from ‘[d]estroying, concealing, disposing, deleting, removing or altering any and all documentation of any kind, whether paper or electronic, ... data, drafts or other things or materials’ that are related to [plaintiff’s] confidential material or information, or [defendant rival company’s] source code.”

Despite the court’s order, defendants did not preserve information. Specifically, the rival company defendant failed to turn off an auto-delete setting on the company’s email server. Although defendants discovered in June that the auto-delete function had not been turned off, defendants did not notify the court of the loss for two months. Id. at *3. Additionally, the court found that defendants had spoliated information by destroying email accounts assigned to the individual defendants as well as high-level individuals within defendant rival company. Finally, the court found that defendants spoliated their source code, because the logs showing changes to the company’s source code were deleted well after defendants reasonably anticipated litigation.

Faced with the revelation of defendant’s failure to preserve in violation of the preliminary injunction, the magistrate judge ordered the appointment of a neutral forensic inspector to investigate the destruction of information. Based on the evidence discovered by the forensic inspector, plaintiffs moved for terminating sanctions based on defendant’s spoliation under Fed. R. Civ. P. 37(b) and (e) and the court’s inherent authority to sanction.

As a preliminary matter, the court acknowledged that the parties disagreed about whether the Federal Rules displaced the court’s inherent authority to issue sanctions. Id. at *8. The court, however, determined that sanctions were appropriate under Rules 37(b) and 37(e) and therefore declined to decide whether it had the authority to issue sanctions under its inherent authority.

“Rule 37(b) provides that a court may sanction a party for failure to comply with a court order.... District courts should consider ‘(1) the public’s interest in expeditious resolution of litigation; (2) the court’s need to manage its dockets; (3) the risk of prejudice to the party seeking sanctions; (4) the public policy favoring disposition of cases on their merits; and (5) the availability of less drastic sanctions.’ ” Id. (quoting Leon v. IDX Sys. Corp., 464 F.3d 951, 958 (9th Cir. 2006).

“Rule 37(e) allows for sanctions where a party fails to preserve ESI. To determine whether spoliation of ESI has occurred, courts should consider ‘(1) the ESI ‘should have been preserved in the anticipation or conduct of litigation’; (2) the ESI ‘is lost because a party failed to take reasonable steps to preserve it’; and (3) ‘[the ESI] cannot be restored or replaced through additional discovery.’ ” Id. at *9 (quoting Porter v. City & Cty. of San Francisco, 2018 WL 4215602, at *3 (N.D. Cal. Sept. 5, 2018).

Judge Davila stated that courts have split on whether the moving party must “meet the preponderance of evidence standard or the clear and convincing evidence standard for terminating sanctions” but noted that the Ninth Circuit had yet to resolve this issue. Finding the question a “close call,” the court opted to apply the preponderance of evidence standard. The court reasoned that the exceptions to the preponderance of the evidence standard in civil litigation are uncommon and that the circumstances in which a court must apply a higher standard of evidence are different in kind and importance as compared to the interests implicated by dismissal of a civil suit.

In analyzing sanctions under Rule 37(b) the court cited several factors that it found weighed in favor of terminating sanctions. Id. at *10. The court determined that defendants acted willfully and in bad faith by leaving in place the auto-delete setting on its email server. Also important to the court’s decision was that defendants began using an ephemeral messaging service following issuance of the preliminary injunction and maintained “a policy of deleting the email accounts and wiping the computers of former employees.” The court found that the factors related to the public’s interest in expeditious resolution of dockets and the court’s need to manage its docket were both “easily met” especially in light of the revelation that defendants failed to report for two months the discovery that the auto-delete feature had not been turned off. Finally, the court found that lesser sanctions would be futile, explaining that the spoliation was so widespread that any exclusionary instruction could not cover the scope of the spoliation. Id. at *12. Further, even creating a presumption in favor of plaintiffs would be insufficient as plaintiffs could not offer evidence rebutting defendant’s arguments against the presumption.

The court also found terminating sanctions appropriate under Rule 37(e). The court held that defendants should have been preserving information, as litigation was reasonably anticipated well before defendants ceased destroying and deleting data. Defendants failed to turn off the auto-delete email feature even after litigation began. The court noted that defendants engaged in a pattern of destroying discoverable evidence, leading the court to conclude that the spoliation was intentional under the totality of circumstances.

The court also determined that terminating sanctions were appropriate as to the individual former CEO and head of hardware technology. Id. at *13. The court explained that the former CEO knew of the spoliation and had previously been found to have control of the defendant rival company, making terminating sanctions appropriate. For the former head of hardware technology, the court found that defendant had violated the preliminary injunction by failing to preserve source code as required. Id. at *15. The court also found a terminating sanction appropriate due to the former head of hardware technology’s destruction of information on the laptops he had from plaintiffs when he should have reasonably known about the anticipated litigation. The court noted that the former head of hardware technology demonstrated that he reasonably anticipated litigation by conducting searches related to the consequences for soliciting employees. The timing of the destruction of information in connection with receipt of the cease-and-desist letter provided further evidence that the destruction was done to cover up evidence supporting a finding of intent.

The court ordered defendants to pay fees and costs related to the instant motion, all discovery related to spoliation, and the discovery motion practice before the magistrate. Id. at *16.

2. In In Re Capital One Consumer Data Security Breach Litigation, 2020 WL 2731238 (E.D. Va. May 26, 2020), Magistrate Judge John F. Anderson found that a report prepared by a cybersecurity firm acting under the direction of counsel would have been prepared regardless of any anticipated litigation and accordingly was not protected work product.

In this data breach litigation, plaintiffs sought discovery of a report prepared by a cybersecurity investigation firm related to a data breach. Id at *1. Prior to the data breach, Capital One had entered into a master services agreement with a cybersecurity firm to provide, among other things, incident response services in the event of a data breach. When Capital One experienced the data breach, it retained a law firm to provide legal advice in connection with the breach and directed the cybersecurity firm to perform incident response services at the direction of the law firm. Immediately following the public disclosure of the data breach, several lawsuits, including the instant one, were filed.

The magistrate judge noted that the work product doctrine shields only documents prepared because of the prospect of litigation. Id. at * 3 (italics in original). He explained that “[t]he ‘because of standard’ is designed to protect only work that was conducted because of the litigation and not work that would have been done in any event.” It is not enough to render documents protected work product if they were also created because of the prospect of litigation. In other words, to determine whether documents was created because of anticipated litigation, a “but for” causation test applies. Id. at *4.

As an initial matter, Judge Anderson acknowledged that “there was a very real potential that Capital One would be facing substantial claims following its announcement of the data breach.” There was no question that at the time of the breach, Capital One anticipated litigation. The crucial issue, therefore, was whether the cybersecurity firm’s report “would have been prepared in substantially similar form but for the prospect of that litigation.” The burden of showing that a document would not have been created but for the potential for litigation rests with the party requesting the work product protection.

After examining the circumstances of the cybersecurity firm’s retention, Magistrate Judge Anderson concluded that the report the firm generated would have been produced regardless of anticipated litigation. Id. at * 7. Important to Judge Anderson’s analysis was that Capital One had entered into the master services agreement with the cybersecurity firm in advance of any data breach. Id. at *4. The master services agreement detailed the incident response services the cybersecurity firm was to provide in the event of a data breach. Capital One sent a letter to the cybersecurity firm at the time of the data breach directing it to perform the same services as had been agreed to in the master services agreement. Although the letter directed that the work be done at the direction of a law firm, the services to be performed were identical. Judge Anderson also observed that at the time Capital One and the cybersecurity firm entered into the master services agreement, the retainer paid was consider a “business-critical expense and not a legal expense.”

Also relevant to Judge Anderson’s analysis was that Capital One did not offer any statement or evidence that it would not have had the cybersecurity firm generate a substantially similar report absent the prospect of litigation. The fact that the cybersecurity firm performed its work under the direction of a law firm and initially provided its report to the law firm was not enough to show that the report would have been substantially different even absent the prospect of litigation.

Judge Anderson concluded that the cybersecurity firm would have generated a report similar to the one it produced regardless of whether there was a prospect of litigation. The report, therefore, could not be withheld as work product. Id. at * 7. Although Judge Anderson held that the cybersecurity firm’s report was not work product, he declined to decide whether material related to the report would also have been produced absent the prospect of litigation and so did not rule whether such material could be protected as work product.

3. In Impact Engine, Inc. v. Google LLC, 2020 WL 1939023 (S.D. Cal. Apr. 21, 2020), Magistrate Judge Bernard G. Skomal declined to determine the appropriate number of custodians and search terms to govern production of ESI, finding that the parties had not followed local court rules and failed to follow the processes set forth in Fed. R. Civ. P. 34.

In this discovery dispute, the parties contested both the preservation of ESI and the ESI search protocol in their Fed. R. Civ. P. 26(f) filing with the court. With respect to ESI preservation, the plaintiff requested that the magistrate judge order the defendant to preserve all ESI from instant messaging or chat applications used by employees during the scope of their work related to the products at issue in the litigation, claiming that these messages were likely to contain information relevant to the case. The defendant countered that such preservation should not be required as it would be overly burdensome compared to the needs of the case and given the unlikelihood of the messages’ containing relevant information not also included in employee emails. Finding that neither party had adequately addressed the merits of the issue or followed chamber procedures for addressing discovery disputes, the competing motions were denied. Id. at *1.

With respect to the ESI search protocol, the magistrate judge again found that the parties had not followed the local rules for raising discovery disputes and characterized the disagreement as “centered around the number of custodians for email and non-email ESI searches, and the number of search terms per custodians.” Id. at *2. Fed. R. Civ. P. 34 governs requests for production of documents and does not distinguish between physical paper and electronic information. Rule 34 requires the requesting party to make a request and the producing party to comply or object. To the extent Rule 34 does address ESI production, it does not require a requesting party to identify custodians or search terms. “The parties are best situated to evaluate the procedures, methodologies, and technologies appropriate for preserving and producing their own electronically stored information.” Id. at *2. Magistrate Judge Skomal stated that the parties should work to come to an agreement as to how relevant ESI should be identified and produced, which may or may not include the use of search terms, in accordance with the terms of Rule 34.

Magistrate Judge Skomal declined to decide the number of custodians and search terms appropriate for the matter and directed the parties to follow the process dictated by Rule 34: “That is discovery: a party requests information and the burden is on the producing party to locate and produce it or object legitimately to production.” Id. at *3.

4. In Mannion v. Ameri-Can Freight Systems Inc., 2020 WL 417492 (D. Ariz. Jan. 27, 2020), U.S. District Judge Dominic W. Lanza rejected plaintiff’s proposed spoliation adverse inference jury instruction as being improper in terms of form and timing, the legal standards cited in the instruction, the lack of evidence to support granting the sanction, and a determination that no reasonable juror could resolve the instruction in favor of the plaintiff.

This matter arose from a vehicle collision. At the outset of the matter, the court set a deadline for completion of discovery and a procedure for resolving disputes. The court made clear that discovery disputes must be raised and resolved prior to the discovery deadline. Neither party raised discovery issues during this time or the subsequent motions practice. Nearly eight months following the close of discovery, the parties submitted proposed jury instructions. One instruction proposed by the plaintiffs would have (1) asked the jury to decide whether the defendants had engaged in spoliation of seven items of evidence and (2) permitted the jury to apply an adverse inference against the defendants if the jury made a spoliation finding. The defendants opposed this instruction. Id. at *1–*2.

The court first addressed whether the defendants forfeited their ability to oppose the plaintiff’s proposed spoliation instruction given their pretrial conduct. When the parties jointly submitted their instructions, it appeared the defendants were stipulating to the use of the spoliation instruction at trial. In the simultaneous joint pretrial order, however, spoliation was identified as a disputed issue. The court concluded that despite the confusion created by the defendants’ seeming acceptance of the instruction, the simultaneous pretrial order did indicate their opposition to the instruction. Therefore, they had not forfeited their ability to object. Id. at *2–*3.

Turning to the merits, the court found that the form and timing of the plaintiffs’ request were improper. The plaintiffs had not filed any discovery-related motions during the pretrial phase but instead treated the matter as a jury issue. The court observed that “[s]poliation is a discovery offense, so issues surrounding alleged spoliation should be resolved during discovery — not on the eve of trial.” Id. at *3 (citation omitted). The court determined that it could reject the plaintiff’s instruction on this basis alone. In addition, Judge Lanza noted that federal law governs spoliation in federal court, with two sources of a district court’s ability to sanction a party for spoliation of evidence being the court’s inherent power to sanction and sanctions available under Fed. R. Civ. P. 37. These sources emphasize that judges, not juries, should make decisions related to spoliation sanctions. The court admitted that some courts have shared this power with the jury by allowing it to reassess the judge’s factual findings. Assuming that was an appropriate method, in this case, the plaintiff had never raised the issue to the judge. Therefore, there was nothing for the jury to reassess in this matter. Id. at *4–*5.

The court next determined that the plaintiffs’ proposed instruction misstated the applicable law. The instruction proposed by the plaintiffs was based on state, rather than federal, law. Under the governing Rule 37(e)(2), the party seeking an adverse inference instruction must show that (1) the ESI cannot be restored or replaced through additional discovery, and (2) the adverse party acted with the intent to deprive the other party of the use of the missing information. Neither of these requirements was included in the proposed instruction. With respect to non-ESI, the parties’ proposed instruction included an erroneous standard altogether. Id. at *5–*6.

Next, the court determined that the plaintiff had not presented sufficient evidence to support the imposition of an adverse inference instruction under federal standards. The plaintiff had sought the instruction related to seven pieces of evidence. For the first — a business card identifying a witness to the collision — the court found that the plaintiff had other sources, including a police report, disclosing this information. An adverse inference instruction was not warranted for such evidence. Id. at *6.

The second was a driver’s log of the trip leading up to the collision. While other sources had this information, the plaintiffs had never sought to subpoena them. Additionally, this log book was located by the defendants during the trial. While the court had barred the defendants from introducing the log books at trial, given the late disclosure, it “would have been bizarre to pretend the logs had been destroyed and then instruct the jury that it could infer the logs were unfavorable to Defendants.”

The third category was bills of lading for the shipment of the defendants’ vehicle at the time of the collision. The court determined that an adverse inference instruction was unwarranted for numerous reasons. For one, the bills of lading were not lost; there was simply a disagreement as to whether those produced were the actual bills of lading. This was an issue for pretrial motions, and, at this point, the court did not have the basis to determine whether these were the actual bills of lading. Second, the plaintiffs’ failure to complain about the lack of production throughout discovery indicated that the plaintiffs did not find these documents particularly important. Third, the relevance of the documents was insignificant.

The fourth and sixth categories of evidence involved the defendants’ vehicle’s brake system. The court found that an adverse inference was not warranted with respect to these categories because (1) the plaintiff had requested the evidence too late, (2) mechanical inspectors had evaluated the vehicle following the collision and identified no mechanical issues, and (3) the plaintiffs’ theory was based on failure of the driver rather than failure of the vehicle. Id. at *7.

The fifth piece of evidence was an accident investigation kit filled out by one of the defendants following the collision. The court found that because the defendants had produced this defendants’ handwritten statement and the plaintiffs had failed to establish what additional information might be included in the kit, an adverse inference was not warranted.

The final piece of evidence was one of the defendants’ personal and company wireless communication devices. While the plaintiff had requested production of these communications, they had never followed up after the defendant failed to respond to the request. Because the plaintiff failed to file a motion to compel or raise the issue with the court, they seemingly did not find the records important. Furthermore, they could have obtained the information by subpoenaing the cell phone provider directly.

Finally, the court found that no reasonable juror could have resolved the elements in the proposed instruction in the plaintiffs’ favor, based on the evidence (or lack thereof) presented at trial. The trial had not touched on the topics listed in the proposed jury instruction.

For these reasons, the court rejected the proposed jury instruction.