august 30, 2015 using electronic evidence in ip litigation tips, tactics, technology presented by...

April 19, 2023

Using Electronic Evidence in IP Litigation

Tips, Tactics, Technology

Presented by

Christopher Wall, Esq.

Discussion Outline

• 21st Century Discovery• Preservation / Spoliation• Trial & Evidentiary Issues• E-Discovery Technology & Costs

Tips, Tactics & Technology

• Investigative & detailed analysis

• Typically a single hard drive or PC

• Searching for deleted information

• Determine who, what, when

• Recreation of time-critical events

• Reporting & expert testimony

• Breaking of passwords/encryption

• Gathering, searching, culling & producing large volumes of relevant information for legal review

• Data is accessed but not analyzed

• Includes active & archival data

• Typically does NOT include discarded, hidden or deleted data

• Email systems, network shares,desktops and backups

Electronic Evidence

Computer Forensics Electronic Discovery

21st Century Discovery

• Investigative & detailed analysis

• Typically a single hard drive or PC

• Searching for deleted information

• Determine who, what, when

• Recreation of time-critical events

• Reporting & expert testimony

• Breaking of passwords/encryption

Electronic Evidence

Computer Forensics


Computer Forensics Case Profiles

• Securities Litigation

• Trade Secret Misappropriation

• Corporate Fraud

• Wrongful Termination

• Sexual Harassment

• Divorce Settlement


Electronic Evidence


• Gathering, searching, culling & producing large volumes of relevant information for legal review

• Data is accessed but not analyzed

• Includes active & archival data

• Typically does NOT include discarded, hidden or deleted data

• Email systems, network shares,desktops and backups

Electronic Discovery

CIDHSR Second Request

Subpoena Duces Tecum

Request for Production

Interrogatories

E-Discovery Case Profiles

• Product Liability Litigation

• Intellectual Property Disputes

• Complex Employment Suits

• Securities Litigation

• HSR Antitrust Investigation by FTC or DOJ

• Becoming increasingly common in almost every large scale

litigation


• About 31 billion emails are sent daily, on the Internet and elsewhere, a figure which is expected to double by 2006. The average email is about 59 kilobytes in size, thus the annual flow of emails worldwide is 667,585 terabytes. – IDC Email Usage Forecast and Analysis (analysis available at

http://www.sims.berkeley.edu/research/projects/how-much-info-2003)

• The average volume of discovery data collected from a custodian has increased more than 500% in the past five years. – Daryl Teshima, “7 Deadly Sins of Electronic Discovery” Law Office

Computing, June/July 2003.


96% Digital

4% Paper


Source: U.S. News & World Report

• 70% of electronic documents are never printed

• Considering only paper documents is the equivalent of managing only 3 of 10 file drawers of potentially relevant information.



• Theft of intellectual property was the second most expensive computer crime last year. – 2004 CSI/FBI Computer Crime and Security Survey.

http://i.cmpnet.com/gocsi/db_area/pdfs/fbi/FBI2004.pdf

• Firms with annual sales under $10M spent an average of approximately $500 per employee on computer security, while the largest firms, spent an average of about $110 per employee. – 2004 CSI/FBI Computer Crime and Security Survey.

http://i.cmpnet.com/gocsi/db_area/pdfs/fbi/FBI2004.pdf

InternalHard Drives

Floppy Disks

PCMCIA Cards

Notebook Computers

PersonalDigitalAssistants

Microdisks

Flash USB Devices

TapeBack-Ups

External Hard Drives

Offsite Storage

Internet

Digital Voicemail

Proprietary Systems

Where can you find the data?



• Discoverability

FRCP 34 – “data compilations”

– “Today it is black letter law that computerized data is discoverable if relevant.” Anti-Monopoly, Inc. v. Hasbro, Inc., 1995 WL 649934 (S.D.N.Y. Nov. 3, 1995).

– “A discovery request aimed at the production of records retained in some electronic form is no different in principle from a request for documents contained in any office file cabinet.” Linnen v. A.H.

Robins Co., 1999 WL 462015 (Mass. Super. June 16, 1999).


• Electronic production may be required; i.e. traditional paper printouts alone may be insufficient– Anti-Monopoly, Inc. v. Hasbro, Inc., 1995 WL 649934 (S.D.N.Y.

Nov. 3, 1995).

– Zakre v. Norddeutsche Landesbank Girozentrale, 2004 WL 764895 (S.D.N.Y. Apr. 9, 2004).

• Backup tapes must be produced if relevant– In re CI Host, Inc., 92 S.W.3d 514 (Tex. 2002)

• Mere copies of files aren’t enough – bit-by-bit forensic image is the standard

– Taylor v. State, 93 S.W.3d 487 (Tex. App. 2002)


What can be requested:

– Requesting party may be able to receive a copy not only of business data but of opposing party’s personal hard drive. Superior Consultant Co. v. Bailey, 2000 WL 1279161 (E.D. Mich. Aug. 22, 2000).

– Opposing party must produce all data relevant to material facts and preserve data compilations and computer data. Kleiner v. Burns, 2000 WL 1909470 (D. Kan. Dec. 15, 2000).

– Requesting party should have access to active and deleted data alike. Simon Property Group v.mySimon, Inc., 194 F.R.D. 639 (S.D. Ind. 2000).

• Active Data: Data which exists on a hard drive on a particular date and time.– Captured by use of copying or mirror imaging technology

• Archival / Legacy Data: Data which is located on “back up” tapes and systems– Restored from archival media for processing, in many

instances is obsolete


• Delete does NOT mean delete• File Allocation Tables (FATs)• Delete simply makes space

available for overwriting


The filename is kept in your directory along with a reference to the File Allocation Table (FAT).

The File Allocation Table (FAT) is a map of where data is stored on the drive.

SmokingGunEmail.pst

LINK

1 2 3 4

User ’s view:

FAT


1 2 3 4

1

2

3

4

Disk Surface

SmokingGunEmail.pst

σ

1 2 3 4SmokingGunEmail.pst

BROKEN LINKS

FAT

1

2

3

4

Disk Surface

LINK


When you delete a file, you simple break the link between the FAT and the data on the hard drive.

Once the links are broken, the space on the hard drive used by the deleted data can be overwritten.

mokingGunEmail.pst User ’s view:


[A] computer’s DELETE key acts somewhat like a thief who steals a card from the old library’s card file. When the card was in place, the librarian could decode the library’s filing system and find the book. If the card was gone, or unreadable, the book was still in the library, but it could no longer be found amidst the library’s stacked shelves. In a computer, the “lost” book can be found with very little effort.

Judge James M. Rosenbaum, D. Minn.

Deleted electronic evidence is fully discoverable.

• Prior to termination of their employment, Defendants copied and took with them volumes of computerized data maintained in Plaintiff’s files and storage media.

• Court required electronic evidence preservation and ordered Defendants to allow a court-appointed expert to recover lost or deleted files and perform automated searches of the evidence under guidelines agreed to by the parties or established by the court.

Dodge, Warren, & Peters Ins. Servs. v. Riley, 130 Cal.Rptr.2d 385 (Cal. Ct. App. 2003).



• 14% of companies have been ordered by a court or regulatory body to produce employee email (a 5% increase since 2001).

– American Management Association (2003)

• 13% of employers have battled workplace lawsuits triggered by employee e-mail.

– AMA/ePolicyInstitute Research. 2004 Workplace E-Mail and Instant Messaging Survey. www.epolicyinstitute.com


If anything will bring about the downfall of a company... it is blind copies of e-mails that should never have been sent in the first place. . . .

- Michael Eisner (Forbes, May 2000)

The Search for E-mail

Discussion Outline



• 37% of employers do not know or are unsure about the difference between an electronic business record that must be retained, versus an insignificant message that may be deleted. ― AMA/ePolicyInstitute Research. 2004 Workplace E-Mail and

Instant Messaging Survey. www.epolicyinstitute.com

Preservation / Spoliation

• 65% of all companies responding lack document retention policies.― AMA/ePolicyInstitute Research. 2004 Workplace E-Mail and

Instant Messaging Survey. www.epolicyinstitute.com

Hypothetical:– Your client is a multinational conglomerate– Patent infringement suit is filed against

your client– Multiple product lines implicated in the

lawsuit– Specific allegations of wrongdoing by

named individuals


Response Plan1. Suspend document destruction policy 2. Distribute document preservation letter to

employees, opponent and 3rd parties3. Assemble electronic discovery response

team (including outside expert)4. Create an inventory of hardware and

software5. Make a list of individuals likely to possess

responsive documents


Response Plan (cont’d)

6. Define relevant time period

7. Make forensically sound image of hard drives from key individuals

8. Consult with opposition to define the scope of discovery (key words, file types, etc.)

9. Prepare an electronic discovery plan (potential appointment of 3rd party neutral expert)

10.Determine method of document review and production (for relevance and/or priv)


Planning:– Develop (and/or negotiate, if feasible) keyword searches to

run across universe of data– List types of files you will need to consider (text, email, CAD,

JPG, MPG, etc.)– Determine whether to consider deleted files (may or may not

be relevant)– Decide how you will conduct your priv/confidential review– Decide how you will produce your ultimate data set

Discovery Plan


Duty to Preserve Electronic Data: When does the duty arise?

• Proctor & Gamble v. Haugen, 179 F.R.D. 622 (D.Utah 1998). Duty to preserve exists independent of a court order.

• NOW v. Cuomo, 1998 WL 395320 (S.D.N.Y., July 14, 1998). Duty to preserve arises at the latest with service of the complaint and counsel has a DUTY to advise client of pending litigation and the need to preserve potentially relevant data.

• United States v. Smithfield Foods, Inc., 972 F.Supp. 338 (E.D. Va. 1997). The producing party has a duty to preserve once it was on notice of a government investigation.


Document Retention Policy Does Not Protect Plaintiff from Consequences of Document Purge in Patent Case

• In a patent infringement suit, the defendant alleged that the plaintiff instituted a document-purging program despite being on notice of impending litigation for the patents at issue.

• The plaintiff held a “Shred Day,” an event in which the plaintiff’s employees shredded about two million documents as part of its document retention and destruction policy.

• At trial, the plaintiff did not dispute that it “destroyed some documents because of their ‘discoverability’.”

• The court concluded that even if the plaintiff “did not institute its document retention policy in bad faith, if it reasonably anticipated litigation when it did so, it is guilty of spoliation.”

• The court granted the defendant’s motion and ordered the plaintiff to immediately produce documents containing information about or relating to the creation, preparation, or scope of the plaintiff’s document retention policy. - Rambus, Inc. v. Infineon Techs. AG, 2004 WL 383590 (E.D.Va. Feb. 26, 2004), amended by, 220 F.R.D. 264 (E.D.Va. 2004).

Duty to Preserve Electronic Data: When does the duty arise?


Golden RuleGolden Rule of E-Evidence:

Sector-by-Sector Image (Gates Rubber)

CorollaryCorollary to the to the

Golden RuleGolden Rule of E-Evidence:

Work only from the copy

PortableServer

TargetComputer

Common Spoliation Mistakes

1. Failing to cease document destruction with notice of pending or impending suit [intentional or negligent]

2. No sector-by-sector or bit-by-bit image made….aka – mirror image of media [Gates Rubber Co. v. Bando Chem. Ind.]

3. Booting a computer

4. Clicking on a file

5. Modifying Web site links and content



Potential Sanctions for Spoliation

• Keir v. UnumProvident, 2003 WL 21997747 (S.D.N.Y. Aug. 22, 2003). Court found the Defendant’s failure to preserve was unintentional, but criticized the Defendant’s poor compliance with the preservation order, and recommended further action to determine feasibility of retrieving lost data and the extent of prejudice to the Plaintiffs in order for the court to fashion a remedy for the Plaintiffs.

• Danis v. USN Communications, 2000 WL 1694325 (N.D. Ill. Oct. 23, 2000). CEO was fined $10,000 and negative inference instruction given.


Potential Sanctions for Spoliation

• Linnen v. A.H. Robins, 1999 WL 462015 (Mass. Super. June 16 1999). Failure to preserve e-mails resulted in “inexcusable conduct” jury instruction.

• William T. Thompson Co. v. General Nutrition Corp., 593 F.Supp. 1443 (C.D. Cal. 1984). Court ordered default judgment and $450,000 in sanctions for destruction of e-documents.

How Serious was the Spoliation?• In a patent infringement suit, the plaintiff produced email and

other electronic documents after the close of the discovery period.

• To the extent that it had not already done so, the plaintiff was ordered to produce all emails generated or received by the inventor relating to the patent at issue.

• The court found that while the plaintiff did not engage in a good faith effort to produce all requested discovery in a timely manner, the cost to the defendant was minimal and therefore refused to issue sanctions.

Lakewood Eng’g v. Lasko Prod., 2003 WL 1220254 (N.D.Ill. Mar. 14, 2003).


Court Sanctions Defendant by Transferring Defendant’s Domain Names to Plaintiff

• In a trademark infringement case, the plaintiff accused the defendant of illegally using the Internet to sell the plaintiff’s brand of cigarettes, which was intended only for sale abroad, to customers in the United States.

• The plaintiff’s computer forensics expert examined the defendant’s sales data and found inconsistencies in computer programming formulas, individual sales records, and customer email confirmations.

• After being confronted with the expert’s analysis, the defendant admitted its sales data was unreliable, and likely fraudulent.

• Finding the defendant’s “supporting testimony and data … so riddled with fabrication and deception as to warrant the inference that the truth is the exact opposite of what [the defendant] contends,” the court ordered the transfer of the defendant’s domain names to the plaintiff. - Philip Morris USA, Inc. v. Otamedia Ltd., 2004 WL 1878751 (S.D.N.Y. Aug. 20, 2004).



Computer Expert Exposes Attempts to Destroy Electronic Data in Copyright Case

• In a copyright infringement suit, the plaintiffs’ computer expert inspected the defendant’s servers and discovered the defendant ran a program, designed to erase electronically stored information, more than 50 times from a remote location in an attempt to delete all electronic data from the servers.

• The defendant attempted to attack the plaintiffs’ methodologies for extrapolating the number of users and downloads.

• The court indicated that the defendant was “in a poor position to attack plaintiffs’ evidence,” noting that “[d]estruction of evidence raises the presumption that disclosure of the materials would be damaging.” The court decided not to issue sanctions but instead encouraged the plaintiffs to move for appropriate sanctions as the case progressed.- Arista Records, Inc. v. Sakfield Holding Co. S.L., 314 F.Supp.2d 27 (D.D.C. 2004).

Zubulake V: SanctionsDefendant Sanctioned for Destruction of Email Evidence

• An employee moved for sanctions against the employer for failing to produce backup tapes containing relevant emails in a timely manner.

• Determining that the employer had willfully deleted relevant emails despite contrary court orders, the court granted the motion for sanctions and also ordered the employer to pay costs.

• The court further noted that defense counsel was partly to blame for the document destruction because it had failed in its duty to locate relevant information, to preserve that information, and to timely produce that information. --Zubulake v. UBS Warburg, 2004 WL 1620866 (S.D.N.Y. July 20, 2004).


Zubulake V: Role of CounselCounsel Has Duty to Locate, Preserve, & Produce E-Data

Addressing the role of counsel, Judge Scheindlin declared that "it is not sufficient to notify all employees of a litigation hold and expect that the party will retain and produce all relevant information. Counsel must take affirmative steps to monitor compliance so that all sources of discoverable information are identified and searched."


Discussion Outline



What to Ask for in Discovery1. Must seek specific relevant information

– Objections re: excessive scope & burden2. Begin narrowly & expand

3. “Goose & Gander” phenomenon

4. The Sorcerer’s Apprentice Problem (a.k.a. Be careful what you wish for!)

Trial & Evidentiary Issues


Chain of Custody

Hearsay, Foundation and Other Admissibility Issues


• Guard yours / Question theirs• Temperatures, smoke, dust, magnetic fields

Chain of Custody

•• Was the file altered during imaging process?Was the file altered during imaging process?

•• Was the file altered during the analysis?Was the file altered during the analysis?

•• How sound was the capture process?How sound was the capture process?

•• Was the image forensically sound? Did it need to be?Was the image forensically sound? Did it need to be?

•• How secure is the data during analysis? While it is How secure is the data during analysis? While it is stored?stored?

•• From what media is the analysis being done? From the From what media is the analysis being done? From the original? From an image?original? From an image?

•• Who handled and processed the data? Can you prove Who handled and processed the data? Can you prove the data is still sound?the data is still sound?

Chain of Custody



• Hearsay, Foundation and Other Admissibility Issues– State of Wash. v. Ben-Neth, 663 P.2d 156 (Wash. Ct. App. 1983).

Computer-generated evidence is hearsay but may be admitted as a business record provided a proper foundation is laid.

• Business Records Exception– Harveston v. State, 798 So.2d 638 (Miss. Ct. App. 2001). Court refused to

allow in computer database print-outs under business records exception because no evidence offered as to the means by which the information…was compiled.

Discussion Outline



Technology & Costs

Technology: Overview of Process

Stage1

Legal and Technical

Consulting

Stage2

DataGathering

DataFiltering

DataProcessing

OutputOptions

Secure Web-based Repository

Printed Paper

LitigationSupportDatabase

Stage4

Stage3

Stage5

Technology & Costs

Filtering Technology• File identification• Effective keyword searching• Elimination of blank pages & duplicative documents• Segregation of potentially privileged documents• Identification of very large files

Technology & Costs

Technology & Costs

Technology: Output Option 2 (Print)

Technology: Output Option 3(Litigation Database)• Litigation Support

Database– Introspect

ConcordanceSummation DBTextworks JFS Litigators Notebook™ UR Law™ Documatrix Virtual Partner™

• Load Files

Technology & Costs

• Discovery represents 50 percent of litigation costs in the average case and up to 90 percent of litigation costs in cases in which it is actively used.-http://www.uscourts.gov/ttb/oct99ttb/october1999.html

• On average, attorneys spend more time on discovery (16.7% of their time on the case) than they spend conferring with clients, working on pleadings, negotiating settlements, or conducting legal research.-http://polisci.wisc.edu/~kritzer/research/CLRP/clrp.htm

Technology & Costs

Costs

Technology & Costs

• “Paper discovery costs an average of $.70 a page. Electronic discovery costs an average of $.23 per page”

– Daryl Teshima, “7 Deadly Sins of Electronic Discovery” Law Office Computing, June/July 2003.

Costs

Costs: Containment Tips– Identify and address electronic document issues early– Negotiate scope – seek a protective order early if necessary– Propose culling techniques

• Data sampling• De-duplication• Keyword searching

– Use technology to increase speed and accuracy of document review

Technology & Costs

Technology & Costs

• General Rule – Producing Party Pays

• Inherent Power of Court to Shift Costs

• The Texas Solution – Tex.R.Civ.P. 196.4– “Reasonable Availability” vs. “Extraordinary Steps”

Costs

Technology & Costs

Costs: Cost-shifting• Producing Party Pays for Production (traditional rule):

– Delozier v. First Nat’l Bank of Gatlinburg, 109 F.R.D. 161 (E.D. Tenn. 1986). Requesting Party Pays

• Requesting Party Pays for Production:

– Oppenheimer Fund, Inc. v. Sanders, 437 U.S. 340 (1982).

• Combination or Cost Splitting:

– Rhone-Poulenc Rorer, Inc. v. Home Indemnity Co., 1991 WL 111040 (E.D. Pa. 17, 2001).

Technology & Costs

Costs: Burden & Proportionality• A party producing electronic evidence must be protected

against undue burden and expense associated with the production.

Southern Diagnostic Assoc. v. Bencosme, 833 So.2d 801 (Fla. Dist. Ct. App., Oct. 2002)

Technology & Costs

• In a trade secret violation suit, the defendant moved for the production of approximately 996 network backup tapes and argued that the plaintiff should bear production costs.

• Medtronic objected to the defendant’s requests as “unduly burdensome” and “astronomically costly.” The parties did not dispute the relevance of the electronic data at issue.

• Court applied an 8 factor cost-shifting test to determine burden and cost. • Finding that the majority of the factors favored shifting a portion of discovery

costs to the defendant, the court outlined a detailed discovery protocol. • The court also ordered the plaintiff’s vendor to “search the extracted data using

[identified] keywords” and to “produce to [the defendant] a complete list of the files identified by the backup tape restoration keyword search.”

Medtronic Sofamor Danek, Inc. v. Michelson, 2003 WL 21468573 (W.D.Tenn. May 13, 2003).

Costs: Cost-shifting

Technology & Costs

Zubulake’s Revised Cost Allocation Test1. Extent to which the request is specifically tailored

2. Availability of information from other sources

3. Total cost of production compared to amount in controversy

4. Total cost of production compared to resources available to each party

5. Relative ability of each party to control costs and incentive of each party to do so

6. Importance of the issue at stake in the litigation

7. Relative benefits to the parties in obtaining the information

Zubulake v. UBS Warburg, 217 F.R.D. 309 (S.D.N.Y. 2003)

Costs: Cost-shifting (cont’d)

Parting Thoughts

1. Electronic Evidence is Unique

2. Electronic Evidence Requires Education & Expertise

3. Electronic Evidence Provides Opportunity

Questions?

Christopher Wall

Kroll [email protected]

(703) 668-1357

(800) 846-7430

august 30, 2015 using electronic evidence in ip litigation tips, tactics, technology presented by...

Documents

century discovery slide

tactics technology slide

electronic documents

deleted information

deleted data email systems

legal review data

active archival data

analysis analysis available