Discovering and Preserving Electronic Evidence: How to Avoid Spoliation Pitfalls in the Computer Age

Discovering and Preserving Electronic Evidence: How to Avoid Spoliation Pitfalls in the Computer Age

A version of this article was published in
The New Jersey Law Journal
April 17, 2000

"The dog ate my homework" may have been a popular excuse among school children before they began using computers to complete their homework. In the past, such an excuse would probably be met with a raised eyebrow and a direction to take your seat. The homework obviously was not going to be produced and the teacher had few resources to verify the child's unlikely story.

However, today's schoolchildren, as we are often reminded, are living in the information age. While the excuse may be the same, the teacher can simply request that the child print out another answer sheet on the computer. If met with an objection that it can't be found, the resourceful teacher can hire a computer forensics expert to search the child's computer for the missing homework assignment.

Of course this is not a likely scenario in today's schools. However, for attorneys and litigants, the missing homework assignment may be the proverbial "smoking gun" in particular litigation. It's not particularly noteworthy that a vast amount of information is available at our fingertips by simply surfing the web and that we are able to communicate with practically anyone in the world in seconds. However, for those involved in high stakes litigation, it is crucial to realize that footprints are left on the information superhighway and on local computer hard drives, floppy disks and peripheral devices. These electronic footprints may allow experts to identify where, when and what web sites a computer user surfed, financial information, hidden e-mail communications and other valuable information.

The good news is that attorneys need not become computer forensics experts in order to locate, decipher and reap the benefits from this data. A cottage industry has developed that is dedicated to recovering computer files and deleted files; accessing protected or encrypted files; analyzing relevant data and providing expert consultation and testimony. Computer forensics experts provide additional benefits including: protection of evidence destruction during an investigation, prevention of the introduction of a computer virus, proper management of relevant evidence and a continuing chain of custody. Despite the availability of computer forensics experts, counsel should be aware of the potential electronic evidence available during discovery and how to avoid spoliation pitfalls.

Electronic Mail

Whether e-mail transmissions will someday make traditional correspondence and facsimiles dinosaurs is yet to be known. However, what is certain is that with an estimated 40 million e-mail users today sending an estimated 60 billion messages, e-mail is an increasingly popular way for businesses and individuals to send messages. Susan J. Silvernail, Electronic Evidence: Discovery in the Computer Age, 58 Ala. Law 176, 181 (1997). There are countless advantages to using e-mail in lieu of traditional means of communication. By just typing and clicking, a message can be sent practically anywhere in the world. Unlike faxes, the e-mail is rarely garbled in transmission. In addition, e-mail can be delivered without interference from a receptionist or assistant and may be less costly.

Nevertheless, the same versatility and simplicity that accounts for the meteoric rise in e-mail use may also present future legal problems for the unwary. In many instances people use e-mails in the same fashion as a telephone, for casual, seemingly private conversations. Although a written communication, the e-mail may be a quick response to another e-mail that is not particularly well thought out. While the verbal comment in a telephone conversation may be just as damaging as the statement in an e-mail, there is no verbatim transcript of that verbal communication.

Unfortunately (or fortunately depending on which side of aisle you are seated at trial) many e-mail users don't appreciate that there is almost always a permanent record of the e-mail communication-even if the sender has deleted the transmission. In the Iran-Contra affair, Oliver North discovered first hand that just because an e-mail was deleted did not mean it was gone forever. E-mail messages that North believed to be deleted were found and used against him in litigation. James H.A. Pooley and David M. Shaw, Finding Out What's There: Technical and Legal Aspects of Discovery, 4 Tex. Intell. Prop. J. 57, 63 (Fall 1996).

Even if a user successfully erases an e-mail from his or her computer, it is likely that the message still exists in a recipient's electronic mailbox, on his or her hard drive or somewhere on the web. Multiple copies of the "erased message" may exist and, if located, may be discoverable.

Discovery Rules and Costs

Electronic data and e-mails are subject to the same discovery rules as traditional documentation. The information is discoverable assuming it is not subject to a privilege and reasonably calculated to lead to the discovery of admissible evidence. The 1970 amendment to the Federal Rule of Civil Procedure 34 made clear that computer related documents were included within the parameters of Rule 26. Practitioners in the federal arena are currently studying electronic information discovery issues to determine whether additional amendments to the rules are necessary.

Attorneys and parties who ignore computer discovery requests do so at their peril. In Crown Life Ins. Co. v. Craig, 995 F.2d 1376, 1382-83 (7th Cir. 1993) the petitioner sought information about the amount of money that he was allegedly owed in renewal commissions. Although respondent produced written summaries of the year-end computer printouts of total renewals, respondent failed to produce the raw data on which the summaries were based, despite repeated requests. At trial, the existence of a database containing the raw data was confirmed. The court held that Crown Life's failure to make the raw data available in response to a court order requiring production of "underlying documents" supporting computer entries amounted to a violation of discovery orders. As part of the sanctions ordered, respondent was not permitted to rely upon its own calculations at trial.

Costs are a significant factor in electronic information discovery. One industry insider estimates costs of at least $25,000 to review and collect e-mail from disparate tapes and databases. Roberta Fusaro, Cases Highlight Need for E-Mail Policies, Computerworld, Oct. 5, 1998, at 20. The costs of retrieving electronic information will vary depending on how "hidden" the information is. For example, recovery of data is not difficult if the hardware or software that stores the information is readily known and available. However, expenses can quickly rise if the hardware or software system is no longer used or available or the system used to store the information is unknown.

Courts have generally required parties to produce relevant evidence despite the financial and time costs. McLeod, Alexander, Powell & Apffel, P.C. v. Quarles, 894 F.2d 1482, 1485 (5th Cir. 1990). For example, in Baxter Travenol Lab. Inc. v. LeMay, 93 F.R.D. 379 (S.D. Ohio 1981) the court rejected plaintiff's plea of undue burden to produce relevant documents despite plaintiff's assertion that production of the relevant documents would require a search of 2.8 million documents, cost more than $80,000 and require hundreds of hours of search time.

Courts appear to be handling e-mail and electronic discovery requests in the same manner. There are several factors a court may consider in determining which party should bear the cost of discovery of electronic information, including:

The cost of producing the information and whether this is inordinately high;
The relative abilities of the parties to bear the cost;
The requesting party's cost to get the information through other means;
The relative cost to the responding party to produce the information;
Whether the responding party benefits by producing the data.

Monique C.M. Leahy, J.D., Recovery and Reconstruction of Electronic Mail as Evidence, 41 Am. Jur. Proof of Facts 3d 1 (1997).

For example, in Re Brand Name Prescription Drugs Antitrust Litigation, 1995 WL 360526 (N.D.Ill. June 15, 1995) a district court in Illinois required the responding party to bear the costs of e-mail production even though costly and burdensome. In this complex price-fixing case, a defendant drug manufacturer protested that it would cost the company $50,000 to $70,000 to compile, format and search for relevant e-mail responsive to the discovery request in the company's database which contained 30 million pages of e-mail. The drug manufacturer argued that the plaintiff class, which consisted of retail drug stores, should bear the production costs. The court held that the costs would not be shifted to the plaintiffs. In so reasoning, the court stated that the costs of a retrieval program and/or method was an ordinary and foreseeable risk of defendant's electronic storage method. See also Bills v. Kennecott Corp, 108 F.R.D. 459, 463-64 (D. Utah 1995) (disclosing party should best be able to bear costs of retrieving information from own system).

When the information sought by a discovery production request is not e-mail, but other electronic information, the requesting party may suffer financial and time costs if the information is not produced in a readable format. Discovery requests that produce voluminous amounts of both paper and electronic information in non-readable forms may be expensive to convert.

Identifying, Locating and Recovering the Hidden Electronic Information

Although attorneys need not become computer forensics experts in order to obtain and use electronic information, they should become familiar with basic technical aspects of data recovery and reconstruction. This information will be helpful not only to the attorney, but also the company counsel may choose to aid in the production and retrieval of electronic data in litigation.

There are several factors to consider before attempting to obtain electronic information. In order to give a computer forensics technician the best possible opportunity to recover "lost" or "hidden" data, counsel should identify the following information:

The computer system configuration type, i.e. whether the computer containing the hard disk is part of a local area network (LAN), part of a wide network (WAN) or is a stand alone computer;
The type of hardware that houses the hard disk;
The types of operating system and software being used on the computer, including the version of the software;
Any security features, such as required user ID's, passwords, encryption codes, macro commands or "traps" used to destroy information if unauthorized access is attempted.

Leahy, Recovery and Reconstruction of Electronic Mail as Evidence.

Counsel should also consider the format of the information retrieved. Depending on the information sought, requesting hardcopies of documents is not always the best idea. For example, a general e-mail document request may only uncover the actual e-mail messages. However, e-mails usually contain much more information than what is actually written in the text. Information such as time, date, origin, recipient's name, remarks made in headers and footers, filenames and date the message was last accessed may be more valuable to the litigation. Counsel may also benefit from old or deleted versions of e-mails.

For those who do not want to leave any stone unturned, (and of course have the means to pay for it), counsel may seek discovery of peripheral computer devices such as printer ribbons and servers. There may be bits of data remaining on these devices not found elsewhere. Information found on back-up tapes or disks may also be helpful in litigation.

Retention Policies

Much of the financial and time costs incurred in responding to electronic information discovery requests may be avoided if the responding party has implemented a document retention policy. Companies that effectively manage their electronic information may also experience a tactical advantage in litigation. A well managed computer file and e-mail retention policy reduces legal exposure and can save substantial time and money when responding to a production request. As part of its investigation of Intuit Inc., the Justice Department served the company with a 76-page production request. Intuit was required to review the equivalent of 15 million pages of text to respond to the request, most of which should not have been retained, according to Intuit's defense counsel. Linda Himselstein, The Snitch in the System, Business Week 104 (April 17, 1995).

A properly managed retention program should make sure that (1) documents are preserved to comply with laws and regulations for as long as necessary, (2) documents necessary for the conduct of business are filed in a systematic way to ease access, (3) documents are retained that will be relevant in a judicial, investigative or congressional investigation, (4) microfilm storage is used for permanent documents and (5) all other documents are destroyed. Matthew J. Bester, A Wreck on the INFO-BAHN: Electronic Mail and the Destruction of Evidence, 6 CommLaw Conspectus 75 (1998). For e-mail retention policies specifically, a useful motto is "[K]eep it only while you need it, destroy it when you don't and don't destroy it if you've been ordered by the court to retain those records." Fusaro, supra.

In some instances, the document retention policy itself becomes an integral part of a lawsuit. In Armstrong v. Executive Office of the President, 1 F.3d 1274 (D.C.Cir. 1993), rev'd on other grounds, 90 F.3d 553 (D.C.Cir.1996), cert. denied, 520 U.S. 1239 (1997) journalists filed suit against the Executive Office of the President to prevent destruction of electronic records, specifically e-mails, contained in White House computers. The district court held that the agencies' practice of retaining hardcopies of the e-mails was insufficient because it did not preserve the e-mails' on screen data. The court ordered the agencies to retain electronic copies of the e-mails and periodically review the electronic record keeping policy.

In 1997 the District Court for the District of New Jersey ordered Prudential to preserve all relevant documents to a class action that was filed by policyholders. In re Prudential Insurance Company of America Sales Practice Litigation, 169 F.R.D. 598 (D.N.J. 1997). Despite Prudential's notification of its employees to preserve documents in accordance with the court's order, its employees continued to destroy relevant documents. Although finding that Prudential did not engage in willful misconduct, the district court levied a $1 million fine, directed a mailing to all employees describing the litigation and ordered Prudential to promulgate a document retention policy.

Once litigation has begun it is too late to start implementing a document retention policy. In Lewy v. Remington Arms Co., 836 F.2d 1104 (8th Cir. 1988) the Eighth Circuit provided several factors to consider in determining whether a document retention policy is reasonable: (1) whether the record retention is reasonable considering the facts and circumstances of the documents in question; (2) the frequency and magnitude of other complaints or lawsuits filed against the party; and (3) whether the retention policy was instituted in bad faith.

In addition to preventing obsolete and potentially harmful documents from surfacing in litigation, a well-organized electronic information and e-mail retention policy should also provide companies with a defense to spoliation claims.

Spoliation of evidence is the intentional or negligent "destruction or significant alteration of evidence, or the failure to preserve property for another's use as evidence, in pending or future litigation." Hernandez v. Garcetti, 80 Cal.Rptr.2d 443(Cal. App. 1998); Callahan v. Stanley Works, 306 N.J. Super. 488, 496-497 (Law Div. 1997). Depending on the severity and significance of the destruction and the destroying party's intent, spoliation of evidence may result in the entry of judgment, an adverse inference or an award of attorneys' fees. Ian C. Ballon, Spoliation of E-mail Evidence: Proposed Intranet Policies and a Framework for Analysis, 4 No. 1 Cyberspace Law 2 (1999). Before any sanctions are levied, the court must find that the opposing party was prejudiced by the destruction of the evidence. Struthers Patent Corp. v. Nestle Co., 558 F.Supp. 747, 766 (D.N.J.1981).

In Computer Assoc. Int'l, Inc. v. American Fundware, Inc., 133 F.R.D. 166, 169 (D. Colo. 1990) a Colorado district court concluded that American Fundware acted in bad faith by destroying software that was critical to the litigation. After the commencement of a copyright infringement action and service of discovery requests, American Fundware continued to destroy old versions of software as it developed new versions in compliance with its internal policy. The court granted the moving party's motion for default judgment.

In Applied Telematics v. Sprint Communications Co., 1996 U.S. Dist. LEXIS 14053 at *13-14 (E.D.Pa. Sept. 17, 1996) a Pennsylvania district court ordered Sprint to pay sanctions, including attorneys' fees and costs of litigation for destroying electronically stored routing plans. The court stated that Sprint was aware or should have been aware that the destroyed plans were subject to discovery based upon its document production request.

Spoliation of evidence is a serious act with potentially devastating repercussions. In the realm of electronic information, the risks of running afoul and destroying discoverable information increases exponentially if the responding party does not have a well managed retention policy.

Conclusion

Litigants, unlike school children, may not find solace in the excuse that a document is missing or lost. Resources are available to search and uncover that "lost" electronic document or data hidden in the most remote parts of the user's computer or elsewhere. Clients would be well advised to establish retention policies in order to avoid potential tremendous discovery costs in future litigation.