Wednesday, November 21, 2012

"Egregious spoliation conduct" of plaintiff, who used various pieces of software to scrub his computer, results in claim forfeiture

Update: I've placed a link to the case in the write-up

In Taylor v. Mitre Corp., 2012 U.S. Dist. LEXIS 162854 (E.D. Va. September 10, 2012), the plaintiff in an employment related suit (FMLA and ADA claims), through "egregious spoliation conduct" - use of CCleaner, Evidence Eliminator, and a sledge hammer - had his suit tossed out and forfeited his claims.

The action was brought before the court on a Motion for Sanctions, filed by the defendant, after Mitre Corp. discovered (through a court ordered forensic examination of the plaintiff's computer) that the defendant had knowingly deleted large swaths of files on his new computer. The plaintiff was also requested to produce an old HP laptop that he had used during his employment with Mitre and which had significant litigation related information on it. The plaintiff, however, indicated that he had tried to back up the computer, only getting 30-40% of the files off, before taking a sledgehammer to the computer and taking it to the dump.

Aware of the plaintiff's new Dell computer, the court ordered a computer inspection of the Dell to discover any related evidence. The court described what happened next:

 E-mails between Plaintiff and his counsel illustrate Plaintiff's frustration with the Court's consideration of a mandatory computer inspection. For example, on May 30, 2012, in an e-mail to counsel, Plaintiff said, "As a computer expert very familiar with forensic examinations, I find this overly invasive and unwarranted" and that he and his wife would "not submit to a voluntary submission of [their] electronic devices without a court order."  Plaintiff goes on to say that if his counsel returned with a court order requiring inspection of his laptop he "will either not provide the devices or [he] will move all non-sensitive files to a CD and wipe the drive." . . . At the conclusion of the e-mail he jokes that "an electrical surge just fried my computer and a 50 pound anvil fell over and landed on it" and asks "what penalties [he would] suffer from a contempt of court citation."
The attorney client emails above were discoverable due to the fraud exception to the privilege.  After the court order was clarified to fall under FRCP 34, a forensics firm conducted a keyword search on the computer, but the defendant refused to allow it to be imaged.

The forensic company then ran various forensics programs on the computer and discovered a plethora of evidence showing the plaintiff's spoliation activity. The day the plaintiff heard about the court order for inspection, he bought Evidence Eliminator, which overwrites files on the computer to make them unable to be recovered upon forensic examination. However, the plaintiff did not make any attempt to remove the program after using it, so it was easy to confirm he had in fact done so. Additionally, he had run CCleaner (which cleans temporary internet files), to destroy additional evidence, to the tune of approximately 16K files being deleted. Finally, in another effort to avoid discovery, he used Private Browsing to ensure browsing history would be erased when the browser was exited.

The court was not pleased, and dismissed the case and ordered forfeiture of the plaintiff's claims - the harshest sanction possible. This was a ruling based on all of the activities the plaintiff took, willfully to destroy evidence - taking a sledgehammer to the old PC, using CCleaner, private browsing, and most especially, using Evidence Eliminator. With regard to the latter, the court stated:
This Court cannot, and will not, tolerate the use of such a program by a plaintiff in litigation—in the middle of the discovery—who had knowledge that his computer was about to be searched pursuant to a Court order. The undersigned Magistrate Judge concludes that downloading and running of Evidence Eliminator just days after finding out about the Court-ordered computer inspection constituted willful spoliation of evidence.
The court went on to say that the conduct noted above highly prejudiced the defendant, and to let the suit proceed after such willful conduct, would be to the detriment of the defendants.

My question is - how could a self-described computer expert not know he would get caught?




7 comments:

  1. I'm having issues finding the opinion, but one thing that stuck out to me are what appears to be emails between the plaintiff and his legal counsel? Did the person doing the forensic examination have permission to look and/or seize those very protected communications?

    ReplyDelete
  2. I added the link so you could take a look

    ReplyDelete
  3. Aha yes I see the relevant information in the footnote:

    The Court determined that the crime/fraud exception to the attorney-client privilege applied to this May 30, 2012 e·mail chain between Plaintiff and his counsel. (Okt. No. 84.)

    I find it ironic that he underestimated what the forensic software would find with regards to his website browsing behavior, even as a "forensic expert" himself. I'm still not clear how the attorney / client emails were retrieved (did the third party company that performed the forensic examination find them?) to even be brought to the judges attention. I can't imagine emails much more incriminating than what he sent.

    Thanks for sharing, this was like an episode of "Expert witnesses gone bad".

    ReplyDelete
  4. I'm curious about how that all worked, as well. And this was a great "what not to do" case.

    ReplyDelete
  5. I thought people only destroyed evidence like that when they had something to hide.

    The files disappeared? The hard drive was messed up so he took a sledge hammer to it and then carried it to the dump? Not much chance of recovering anything there.

    If someone goes all out like that, it means that they are being very cautious. They could be genuinely cautious because they are trying to ensure that work related documents are being kept confidential. Or it could be because they know they've done wrong.

    ReplyDelete
  6. disqus_0h36cLritwMay 6, 2013 at 10:19 AM

    It should be noted that the court ordered the plaintiff to pay the other party’s attorney fees and the costs for spoliation. In the order from this past February, the court awarded the defendants $163,882.18 for fees and costs, including $32,000 for the costs of the forensic analysis of the personal laptop and 487 hours of attorney work for the spoliation issues. The court also allowed an additional motion for further explanation of image processing fees.

    ReplyDelete
  7. Great article. Thanks for the info, this is really a helpful post. BTW, if anyone needs to fill out a court forfeiture,
    I found a blank form in this site PDFfiller. This site also has several related
    forms that you might find useful.www.courts.ca.gov

    ReplyDelete