Tag Archives: electronic discovery

Facebook Carnac and Other Horrors

Posted on by

I believe I can see the future
Cause I repeat the same routine
I think I used to have a purpose
But then again
That might have been a dream
From Every Day Is Exactly The Same by Nine Inch Nails

In case you were feeling safer, more secure and comfortable these days with social networking allow me [with apologies to Stephen Colbert] to Keep the Fear Alive. Just about the time you start feeling more complacent because crack programmers are slowly but surely plugging the holes in the privacy sieve that is Facebook, stories like these rear their ugly heads.

Exhibit A comes to us from Mike Elgan on the IT Management blog. In this entry entitled ‘Pre-crime’ Comes to the HR Dept. he writes about a new service for Human Resources [Memo to HR: While I'm mostly human if you refer to me as a resource, I will slap you so hard that your unborn resources will be well behaved] that pushes the privacy violation envelope.

A Santa Barbara, Calif., startup called Social Intelligence data-mines the social networks to help companies decide if they really want to hire you.

While background checks, which mainly look for a criminal record, and even credit checks have become more common, Social Intelligence is the first company that I’m aware of that systematically trolls social networks for evidence of bad character.

Using automation software that slogs through Facebook, Twitter, Flickr, YouTube, LinkedIn, blogs, and “thousands of other sources,” the company develops a report on the “real you” — not the carefully crafted you in your resume. The service is called Social Intelligence Hiring. The company promises a 48-hour turn-around.

Because it’s illegal to consider race, religion, age, sexual orientation and other factors, the company doesn’t include that information in its reports. Humans review the reports to eliminate false positives. And the company uses only publically shared data — it doesn’t “friend” targets to get private posts, for example.

The reports feature a visual snapshot of what kind of person you are, evaluating you in categories like “Poor Judgment,” “Gangs,” “Drugs and Drug Lingo” and “Demonstrating Potentially Violent Behavior.” The company mines for rich nuggets of raw sewage in the form of racy photos, unguarded commentary about drugs and alcohol and much more.

That’s right sports fans, just like Carnac the Magnificent Social Intelligence claims predictive abilities. Although unlike Johnny Carson’s well known character who could psychically divine unseen answers to unknown questions, these clever entrepreneurs glean their predictions by a systematic dredging of the social networking cesspool. About now you might be going all Church Lady on me and thinking “Well, isn’t that special? Isn’t it a good thing that companies avoid hiring drunken, crackheaded, violent gang bangers exhibiting bad judgement? And besides, I’m comfortably employed so why should I care?” Well, quite simply, there’s an app for that too.

The company also offers a separate Social Intelligence Monitoring service to watch the personal activity of existing employees on an ongoing basis. The service is advertised as a way to enforce company social media policies, but given that criteria are company-defined, it’s not clear whether it’s possible to monitor personal activity.

The service provides real-time notification alerts, so presumably the moment your old college buddy tags an old photo of you naked, drunk and armed on Facebook, the boss gets a text message with a link.

Two aspects of this are worth noting. First, company spokespeople emphasize liability. What happens if one of your employees freaks out, comes to work and starts threatening coworkers with a samurai sword? You’ll be held responsible because all of the signs of such behavior were clear for all to see on public Facebook pages. That’s why you should scan every prospective hire and run continued scans on every existing employee.

In other words, they make the case that now that people use social networks, companies will be expected (by shareholders, etc.) to monitor those services and protect the company from lawsuits, damage to reputation, and other harm. And they’re probably right.

That’s right, even if you are gainfully employed and your sinful, poor judgement days are long past you are not immune. Not if you ever had unsavory friends. Or have friends now on Facebook. To paraphrase Queen guitarist Brian May, when asked about bandmate Freddie Mercury‘s infamously decadent parties, you’ve been there,  so you’re definitely going to hell.

But how is this legal? I mean this is the United States of America after all, state of martial law imposed after 9-11 notwithstanding. Surely the judicial branch of our government will put an end to this. Actually, no. As Exhibit B, this entry in the Electronic Discovery Law blog illustrates.

Defendant sought to discover plaintiff’s “current and historical Facebook and MySpace pages and accounts”, including deleted information, on the belief that information posted there was inconsistent with her injury claims.  The court granted the motion, despite plaintiff’s privacy concerns, upon finding the information was material and relevant and that plaintiff had no reasonable expectation of privacy, and because the defendant’s need for access outweighed plaintiff’s privacy concerns.

Regarding plaintiff’s privacy concerns, the court found that production of plaintiff’s MySpace and Facebook entries would not violate her right to privacy, and “that any such concerns were outweighed by Defendant’s need for the information.”  Specifically, the court found that “as neither Facebook nor MySpace guarantee complete privacy, Plaintiff has no legitimate reasonable expectation of privacy.”  The court supported this finding by noting that both MySpace and Facebook warned users against an expectation of privacy.  My Space, for example, warned users “not to forget that their profiles and MySpace forums are public spaces.”  The court concluded:

Thus, when Plaintiff created her Facebook and MySpace accounts, she consented to the fact that her personal information would be shared with others, notwithstanding her privacy settings.  Indeed, that is the very nature and purpose of these social networking sites else they would cease to exist.  Since Plaintiff knew that her information may become publicly available, she cannot now claim that she had a reasonable expectation of privacy.  As recently set forth by commentators regarding privacy and social networking sites, given the millions of users, “[i]n this environment, privacy is no longer grounded in reasonable expectations, but rather in some theoretical protocol better known as wishful thinking.”

So see, not only does the court not recognize a reasonable expectation of privacy with respect to social networks, it actually gives that idea a name: theoretical protocol better known as wishful thinking. So next time you post anything on Facebook you need to get a bit stricter than don’t post anything you wouldn’t want your mother to see. Your mom knows about your failings and loves you anyway. Your boss and the courts, not so much.

Adverse Inference

Posted on by

I’ve mentioned before that I’m an avid follower, albeit not a practitioner, of electronic discovery and forensics. One of my favorite concepts – in the sense that it is usually invoked in response to some truly ham-fisted effort to scam the court – is adverse inference. Essentially it says that if you fail to produce or intentionally destroy discoverable material then the court will assume that the evidence must have been damning. This case taken from the Electronic Discovery Blog is a great example.

Requestor had asked producer to produce emails regarding a dinner meeting in which certain statements germane to the dispute were allegedly made. Testimony indicated that one of the parties was certain that emails regarding the dinner meeting had been exchanged. Producer did not produce any responsive documents.

Requestor therefore asked for a forensic examination of producer’s systems. Requestor engaged a forensic examiner to make mirror images of producer’s computer system as well as two computers used by a key player. After completing the examination, [the forensic examiner] was to provide responsive ESI [Electronically Stored Information] to producer’s counsel for review, as well as an acquisition report “detailing the server and computer data that was captured and a list of all file names extracted from the search.”

[The forensic examiner]  did not find any ESI meeting the search criteria. However, they determined that about 70,000 files had been deleted on the first computer during the discovery period, using a tool called “Eraser.” On the second computer, folders relating to [the key player's] mailbox had been moved to the recycle bin, at 2:08 AM on the day after the order directing the forensic examination was entered, and again several days before the examination.

After relating a detailed timeline of events, the court concluded that “it is difficult to find that [producer] did not intentionally destroy electronic information on both of the computers after such information was requested.” Although producer knew that requestor was seeking the emails at issue, it permitted emails within that time period to be deleted. Although producer argued that “all pertinent files were copied and relocated” from the old computer to his new one, the court found that “there is no way to determine if all of the data on the old computer was in fact transferred.” Nor was it possible to determine the relevance of deleted files. “According to  [the forensic examiner], the use of the [Eraser] program has resulted in the deleted files being overwritten with a series of zeros and there is no way to determine whether they were in fact copied to the new computer.” In addition, the movement of files to the recycle bin could have changed the dates of emails inside of the folder which would then caused them not to be found by a date restrictive search. Furthermore, the timing of the destruction appears more than coincidental. The 70,000 files on the old computer were erased at about the same time [the requestor] wished to conduct a forensic examination. The email folders on the new computer were moved to the recycle bin at 2:00 am on the day before the examination.

Thus, the court found that producer had violated its duty to preserve evidence. The court awarded the costs of conducting the forensic examination as a sanction against producer, and postponed consideration of an adverse inference sanction to the trial “once the substantive harm caused by their actions is known.”

You really have to wonder what these guys were thinking. Or rather it’s easy to imagine what they were thinking: “no evidence, no harm, no foul”. It’s hard to believe that they actually thought they could bamboozle the forensic examiner. Like nobody ever tries to destroy the evidence and those forensic guys have never heard of data eraser programs. What’s really hard to imagine is that the actual evidence, had it survived, could possibly be as adverse to the case as the court will infer.

Strange things are afoot in e-discovery

Posted on by


For some odd reason – odd because I’m not a lawyer and not really in the biz – I’m fascinated by the goings-on in the e-discovery world and avidly follow a number of e-discovery blogs.  The thing that really fascinates me is that while courts often rule in counter intuitive ways, the caricature of judges as technophobic Luddites is often dispelled with extreme prejudice when one actually reads the rulings – often to the chagrin of litigants who were banking on that caricature being accurate.

Consider this case reported in the Electronic Discovery Blog where the defendant decided that if the evidence were destroyed that there would be no case. Sorry, no cigar.

The magistrate judge had previously ordered defendant producer to produce computers for forensic examination. When the expert arrived  [the defendant] refused to produce a laptop for nearly two hours. When the laptop was finally produced, requestors found “that ‘it was hot to the touch and a screw was missing from its hard drive enclosure.’” The court subsequently appointed a forensic expert to analyze the laptop.

Producers responded by admitting many of the allegations raised by the court’s expert. A computer technician admitted reinstalling the operating system shortly before the imaging took place. He changed the clock “to determine whether old files had expired.” Over 12,000 files were copied onto the laptop by the technician, and had searched for programs to help retrieve the data, including “Kill Disk” and “Get Data Back.”

The court concluded that “plaintiffs have demonstrated that [the defendant] spoliated the laptop.” The duty to preserve the laptop arose on when plaintiff requestors had filed their action.  “At a minimum, [the defendant] behaved negligently when he provided [the computer technician] the laptop and asked him to remove potentially embarrassing files without informing him that the laptop’s contents constituted evidence in ongoing litigation.”

The spoliated computer files might have related to any one or more of the claims. Because defendant spoliated the files, “it is impossible to identify which files [were relevant to plaintiff's claims] and how they might have been used.”… Accordingly, “it is impossible to know what [plaintiffs] would have found if [defendants] and [their] counsel had complied with their discovery obligations.”

Accordingly, the court found that the only appropriate sanction would be a default judgment in plaintiff requestor’s favor. The court noted that previous sanctions against defendants had failed to deter discovery misconduct. In addition, “the most serious forms of spoliation merit the harshest sanctions, and in this case, the destruction of evidence was of the worst sort: intentional, thoroughgoing, and (unsuccessfully) concealed.”

So if you destroy the evidence, the court can only assume the whatever might have been there was really, really bad. Guilty! Thank you, that is all.

Or how about this case reported in Electronic Discovery Law. We’ve always thought – well I’ve always thought – that your spouse could not be compelled to testify against you. Not so fast, buckaroo!

In April 2002, former Broadcom CEO, Henry Nicholas, used his company laptop and email account to send an email to his then-wife discussing his children, his marriage, his drug use, and various issues related to Broadcom. Quotations from the email included:

•   “The worst part is the company falling apart because I am not fully functioning.”
•   “However, I don’t care about Broadcom anymore…I just feel like a liar to the people I am recruiting to new positions…because I am potentially f—ing some things up this week that will be irreparably damaging.”
•   “However, I am willing to lie and bulls— to get key people in place so I can extract myself from Broadcom as soon as possible”

Nicholas also referenced “suffering ecstasy come-down” and “panic attacks” and “electric shock like flashes” upon quitting “cold turkey,” among other things.

In 2002, the email was discovered by an IT staff member engaged in authorized maintenance and was subsequently provided to another member of the IT staff acting on instructions of the Board to gather information regarding concerns over Nicholas’s behavior.  Between 2002 and 2007, when the email was disclosed to the government in the course of their investigation of Broadcom’s stock option practices, many people at Broadcom became aware of the email, including General Counsel, the Co-Chairman of the Board of Directors, and the Director of Human Resources.

Extensive motions practice ensued regarding potential protection of the email by the marital privilege.

As the Ninth Circuit recognized, the Email may be admissible at trial notwithstanding the privilege.  The Court will have to make the ultimate determination of the Email’s admissibility at trial after considering all of the facts and circumstances at that time.  Because the Email may be admissible at trial, in fairness, the Email must now be disclosed to [the co-defendant].  Finally, in light of the disclosure of the contents of the Email by the Orange County Register, the Court finds no compelling interest in keeping this order under seal.

In reaching this determination, the district court first examined the scope of the Ninth Circuit’s ruling regarding the applicability of the marital privilege and relevant precedent regarding the same. Accordingly, the district court stated:
[P]recluding the use of the Email for any purpose would exceed the “appropriate scope of the protection” to which the Email is entitled.  Evidentiary privileges are not absolute, and the jury’s obligation to consider relevant, probative, evidence may outweigh any interest in keeping privileged information from it.

Yeah. Be real careful what you email – even to your spouse. Also you probably shouldn’t send email when you’re baked. Or try to run a major corporation.

And then there’s this case from Electronic Discovery Blog wherein a clever guy hatched a plan for milking the DRAM industry with surprise licensing fees but was careful to cover his tracks before launching the dastardly plan.

Rambus is a developer and manufacturer of computer memory chips. As a result of meetings among other chip technology owners, manufacturers and purchasers in 1991 to develop industry-wide standards for memory chips, Rambus became concerned that chip manufacturers were using its technology to develop competing chips. In 1996 and 1997, Rambus “planned to create a patent ‘minefield’ that it could use to its advantage in dealing with other companies in the industry.” In October, 1997, Rambus hired Joel Karp as VP of Intellectual Property, who would be responsible for “assessing [the Rambus] patent portfolio, determining when chips infringe [the Rambus] patent portfolio, setting licensing strategies for infringing chips, and for negotiations with companies that build and sell infringing chips.”

Karp met with several attorneys to discuss licensing and litigation strategy and discussed preparing trial graphics and claims; retaining experts; gathering critical documents and implementing a document retention policy; and building a case against potential litigation targets. A memorandum for the Board was prepared which “discusses Rambus’ competitors, features of the licensing program and a hierarchy of potential licensees and, in the event that licensing efforts failed, a tiered litigation strategy contemplating litigation in fora that “proceed at an accelerated schedule,” making early preparation advantageous for Rambus.” In his presentation to the Board, Karp told them “that the document retention policy was necessary to prepare for the ‘upcoming battle.’”

“One of the reasons for implementing the policy was to allow Rambus to purge documents, including emails, from its files that might be discoverable in litigation.” In May, 1998, Karp sent an email to Rambus employees “announcing that, effective immediately, full system back-up tapes would be saved for only three months and that data to be saved beyond three months must be archived separately…. Karp also announced the imminent implementation of a company-wide document retention policy.”

In September, 1998, Rambus employees participated in “Shred Day”, during which about 400 banker’s boxes of documents were destroyed, “relating to contract and licensing negotiations, patent prosecution, JEDEC and Board meetings, and finances.”

The court concluded that “[i]t is apparent from the record that Rambus, from its inception, was prepared to be an aggressive competitor in a very competitive industry. Its patent portfolio was considered a weapon to be used, as necessary, in its chosen theater of operations, the DRAM market. Under these circumstances, one could safely predict that litigation was inevitable.”

The duty to preserve arose “no later than December, 1998, when Karp had articulated a time frame and a motive for implementation of the Rambus litigation strategy.” Because the document retention policy was discussed in the context of this litigation strategy,
the court found that Rambus knew, or should have known, that a general implementation of the policy was inappropriate because the documents destroyed would become material at some point in the future. Therefore, a duty to preserve potentially relevant evidence arose in December 1998 and any documents purged from that time forward are deemed to have been intentionally destroyed, i.e., destroyed in bad faith.

The spoliation conduct was extensive, including within its scope the destruction of innumerable documents relating to all aspects of Rambus’ business; when considered in light of Rambus’ litigation conduct, the very integrity of the litigation process has been impugned. Therefore, the court concluded that the appropriate sanction for the conduct of record is to declare the patents in suit unenforceable.

Curses foiled again by that “duty to preserve” thing. Great way to bury a promising technology under a mountain of greed.

And finally a P.T. Barnum-esque observation by my favorite e-discovery blogger, Sharon D. Nelson, Esq. in her {ride the lightening} blog regarding social networks.

Theglobeandmail.com has just reported that (according to Nielsen) one in every eleven minutes spent online is spent on a social networking or blogging site. Consider the veritable avalanche of electronic evidence that will result, much of it written in haste and ill-considered.

Apparently there’s more than just one born every minute.

Prophecy for 2009

Posted on by

prophet

Last week Dr. Anton Chuvakin posted this succinct blog entry inquiring “Which Blogger Will Post 2009 Predictions First?” Since almost immediately Michael Janke posted “Janke’s Official 2009 Technology Predictions”, I guess I’m a little late (curses foiled by Janke again!). But not to be outdone and dying to try on my old testament prophet hat I decided to post my prophecy for 2009. Now for those less theologically inclined, prophecy is less about making predictions and more about connecting the dots, as in you have been behaving like this so expect that usually with a divine attribution. While I’m certainly no Ezra or Jeremiah I think I’m pretty safe with the following prophecy.

Beware ye greedy purveyors of unwise sub-prime mortgages and pernicious credit default swaps for your time of litigation is at hand.

It’s not hard to imagine that with all of the billions, yea even trillions, lost in the recent market collapse that there will be hell – or rather shareholders, FTC, FDIC, and litigants of all stripes – to pay. I think we can expect a a whole lot of work in the e-Discovery sector. But before the aforementioned greedy purveyors breathe any sighs of relief due to their carefully eliminated electronic tracks, just remember – this is not 1999 and courts are disinclined to cave in to the old “we lost the archive” or “the amount of data you are asking for is unmanageable” excuses. Take for example this case mentioned in the Electronic Discovery Blog wherein the defendant tried to convince the judge that the burden of producing the electronic evidence was too onerous, and then still failed to pony up when the court gave them direction.

In an ongoing dispute regarding discovery of e-mail on backup tapes, plaintiff requestor had asked for recovery of e-mail boxes on two backup tapes and had provided search terms. Defendant producers had searched only the mailboxes of seven individuals whom requestor had sought to depose. The court had granted requestor’s motion to compel producers to search all mailboxes on the tapes (as well as an additional tape selected by requestor) as the results were producing “meaningful discoverable information.” The court suggested however, “that Plaintiff be more artful with its search terms and that Plaintiff utilize a list of the people, provided by Defendants, to review whether all mailboxes needed to be searched. The court also granted Defendants the opportunity to narrow the search terms.”

Producers failed to provide the list suggested by the court and did not narrow the search terms. The results of the search produced thousands of documents, and producers sought relief from being required to review and produce all of the results.

In weighing the circumstances, the court acknowledged the massive amounts of electronic information which had been involved in the case, along with the burdens of working with it. However, “the court gave Defendants numerous tools by which to reduce the burden of e-mail discovery, including an opportunity to limit Plaintiff’s search terms and an opportunity to provide a list by which the number of peoples and the number of boxes being searched could be reduced. Defendants did not take advantage of these opportunities. Defendants must now lie in the bed that they have made.”

That’s harsh, but hey, like I said this ain’t 1999, and today’s courts have been to this rodeo a few times, cowpokes. Or how about this case from the Electronic Discovery Blog wherein the defendant tried to argue that the only person who understood their email system was a consultant from Switzerland who refused to testify. Sorry, no takers on this excuse either.

Producer had argued that the requested information was irrelevant to requestor’s claims, and that the only source of information on producer’s systems was an independent consultant in Switzerland who had refused to testify. The court observed that the designated deponent has a duty of being knowledgeable on the subject matter identified in the area of inquiry. A corporation must prepare its selected deponent to adequately testify not only on matters known by the deponent, but also on subjects that the entity should reasonably know.” The court further stated:

In modern litigation, discovery almost always involves the production of documents stored on computers, servers and other electronic facilities. It is commonplace in litigation to inquire of a corporate defendant the steps it took to find and produce documents relating to the litigation, as well as the corporation’s electronic document storage and retrieval systems, in order to ensure that discovery was diligently completed. Where a defendant has failed to produce any meaningful documents in response to Plaintiff’s discovery requests, the need for and relevance of this inquiry is unquestionable.

Looks like the days when you could dazzle ‘em with your brilliance or baffle ‘em with your steer manure have waned considerably. Playing ignorant doesn’t seem to fly either.

So back to the prophecy. Expect litigation. Lots of litigation. And don’t expect  sympathetic courts. We bailed them out so we could crucify them. How very biblical. Thus spake the prophet Joseph.