Plaintiffs to Save 3ABN:

"We Want Your Hard Drives!"

< Prev.

Next >

The Hard Drive Issue Raises Its Head

• In the Rule 26(f) Conference of July 2, 2007, Danny Shelton and 3ABN's attorneys let it be known that they wanted a copy of defendants Joy and Pickle's hard drives.
• In their report of that conference filed with the Court on July 19, the plaintiffs complained about our intention to refuse that request.
• In the Scheduling Conference of July 23, Danny Shelton and 3ABN's attorneys raised this issue with Judge Saylor, who then referred it to Magistrate Judge Hillman who specializes in such issues.
• After a phone conference with Judge Hillman, a hearing was scheduled for August 9 in Worcester, to be preceded by a phone conference between the parties that would hopefully reach an agreement.
• The phone conference between the parties took place on August 3, with Attorneys Duffy, Penwell, Hayes, and Richards; and Joy, Pickle, and Attorney Heal attending. No agreement was reached.

So what do the plaintiffs hope to gain by getting copies of the defendants' hard drives? What do they claim to be looking for?

• Deleted files and the like.
• BCC headers in emails.
• The creation, modification, and last-accessed dates associated with various files.

The August 9 Hearing

The August 9, 2007, hearing before Magistrate Judge Hillman that dealt with the hard drive issue was held in Federal District Court in Worcester, Massachusetts, at about 2 pm. Gailon Joy and Attorney Heal were present, with Bob Pickle joining via video conference from Fargo, North Dakota. Attorneys Gerald Duffy and Jerrie Hayes of Minnesota, and Attorney Lizette Richards of Massachusetts represented the plaintiffs. Duffy, Hayes, and Richards were also accompanied by Mark Lanterman of Minnetonka, Minnesota. Mr Lanterman is the CEO and Chief Technology Officer of Computer Forensic Services.

The Costs to 3ABN

Just how much does Mr. Lanterman's computer forensic services run? $250 to $300 per hour, based on a quote we received. Now just how many hours might Mr. Lanterman's company take to go through multiple hard drives that contain used space of tens or hundreds of gigabytes? How high a bill might 3ABN expect to receive for just this little part of the case?

Since we're asking about costs, how much did or will 3ABN get billed for the airfares of Duffy, Hayes, and Lanterman that allowed them to appear in Worcester for the August 9 hearing? How much did their services and testimony cost for just this hearing?

Mark Lanterman's Qualifications

From the website of Computer Forensic Services:

Mark Lanterman, CEO and Chief Technology Officer Mark Lanterman has over 11 years of law enforcement experience as a police investigator, culminating as a member of the U.S. Secret Service Electronic Crimes Task Force. Lanterman has successfully led hundreds of forensic investigations with large legal organizations, Fortune 500 corporations and governmental organizations. Lanterman is recognized as an expert witness and is frequently asked to speak at national and international conferences. He has also been retained as a court appointed computer forensics expert. In 2003, the Director of the U.S. Secret Service recognized Lanterman for his contributions to law enforcement.

Laird Heal: "What Search Program Would You Be Using?"

Attorney Heal has a bit of a computer background, and so he asked Mr. Lanterman a few technical questions during the August 9 hearing. What computer program would Mr. Lanterman use to search the hard drive? "GREP," was the reply. "And what does that acronym stand for?" Attorney Heal inquired. Of course, not every computer expert is going to have that answer on the tip of his tongue, and Mr. Lanterman was no exception.

Next Attorney Heal wanted to know what expression Mr. Lanterman would use as a parameter for the GREP command in order to find the word "insurance" under a certain condition. Mr. Lanterman indicated that he could not off the top of his head state what that expression would be, and would need to look it up.

Gailon Joy: "When the File Is Defragmented, Is the Data Left Behind in the Old Sectors?"

Mr. Joy doesn't have a computer background, and thus his questions were slightly less technical than Attorney Heal's. Yet he did ask Mr. Lanterman whether, after a disk is defragmented, data from files is left behind in the old sectors where those files used to be located.

The purpose of this question was to demonstrate to the Court that confidential data can be all over a hard drive if it is defragmented regularly. Thus it becomes very impractical to try to remove all confidential data before turning over a complete copy of a hard drive to an adversary.

Mr. Lanterman, CEO and Chief Technology Officer of Computer Forensic Services, was certain: When a hard drive is defragmented, the data is moved to new, contiguous sectors, but is not left behind in the old sectors. Thus, no data is left behind in hard disk free space in the way that deleting a file leaves data behind, Mr. Lanterman testified to the Court.

ComputerWorld Disagrees with Mark Lanterman

However, ComputerWorld apparently disagrees, for they published the following in an article dated June 6, 2007:

The defragmentation process realigns all pieces of each file so that the constituent parts are contiguous on disk. It does this by moving the data from the old locations to new, contiguous sectors. That increases the chance of recovery for two reasons. First, it's more likely that deleted files will still be in contiguous sectors. Second, defragmentation offers another possible route to file recovery, because it doesn't overwrite the data in the old sectors. Instead, the file system simply releases those locations as free space. If a file or any part of it has been damaged, it may be possible to search for and find a copy that was left behind when the disk was defragmented.—Robert L. Mitchell, "Surviving a home data disaster: How Shirley got her files back."

Gailon Joy: "What About What We've Already Given Is Insufficient?"

Other questions Mr. Joy directed toward Mr. Lanterman concerned the relevance of the whole thing. Why did they need byte for byte images of the defendants' hard drives? What about the data that had already been turned over was inadequate for the purposes of the plaintiffs?

Mr. Lanterman acknowledged having the defendants' CDs and DVD with him which contained hundreds of megabytes of files, but since he had not yet looked at the content of those disks, he could not speak to the question of what was still missing, and thus why having access to the defendants' hard drives would be relevant to this case.

Attorney Hayes: "We Need BCC Headers and File Dates"

Attorney Hayes informed the Court that the plaintiffs would be looking for such things as BCC headers in emails, and file creation, modification, and last-accessed dates. Such dates might be helpful, Attorney Hayes asserted, in determining when exactly a document was written and sent out, and thus have a bearing on the defamation aspects of the case.

However, it is possible that if Mr. Lanterman had taken the time to look at the files that the defendants had already turned over to the plaintiffs, he would have discovered that much of the material consisted of email files that could conceivably contain BCC headers and all relevant date information. Also, system file dates, at least in regards to email files, are irrelevant, since a single email file created a decade ago may contain thousands of emails of all sorts of dates.

The Sedona Principles

In answer to Mr. Joy's question of whether the Court recognizes the Sedona Principles, Judge Hillman answered in the affirmative. What are the Sedona Principles, which arose out of what is called the Sedona Conference? They consist of 14 principles that are to serve as guidance to parties, attorneys, and judges in regards to legal discovery of electronically stored information. Aspects of these principles were incorporated into the amendments to the Federal Rules of Civil Procedure which took effect on December 1, 2006.

Meanwhile, the Working Group has continued to meet, and publish, on topics relevant to how to handle electronic information in the context of litigation or investigations. The small group of twenty-four that first met in October 2002 has now grown to more than 400, with participation from the bench, academia, government, and all segments of the civil bar.—The Sedona Principles: Second Edition, p. vi.

Sedona Principle 6: Responding Parties Should Know Best

6. Responding parties are best situated to evaluate the procedures, methodologies, and technologies appropriate for preserving and producing their own electronically stored information.—pp. ii, 38-42.

Clearly, if 3ABN and Danny Shelton are the party requesting the information, Joy and Pickle as the responding party should be better situated than Attorney Hayes and Mr. Lanterman in deciding the best form to produce the information in. Thus, if Joy and Pickle feel that it is better to give the plaintiffs the data in a different form than an image of their hard drives, absent good cause otherwise, the Court and the plaintiffs should be content.

Sedona Principle 7: Requesting Party Has the Burden

7. The requesting party has the burden on a motion to compel to show that the responding party's steps to preserve and produce relevant electronically stored information were inadequate.—pp. ii, 43-44.

Thus, if Danny Shelton and 3ABN as the requesting party do not feel that what we have given them is adequate for their purposes, the burden is upon them to demonstrate such to the Court, rather than the burden being upon us to demonstrate to the Court that what we have given them actually is quite adequate.

Sedona Principle 9: We Don't Necessarily Have to Produce Deleted Files

9. Absent a showing of special need and relevance, a responding party should not be required to preserve, review, or produce deleted, shadowed, fragmented, or residual electronically stored information.—pp. ii, 49-50.

Bear in mind that Sedona Principles: Second Edition repeatedly raises the issue of "good faith":

An obligation to discuss the issues in good faith applies to both parties, and requesting parties must be prepared to be as precise as possible in regard to potential discovery.—p. 21.

In other words, it seems that Danny Shelton and 3ABN need to provide some sort of evidence that Joy and Pickle are purposely deleting or altering files before pushing for access to their hard drives in order to fish for deleted files. Now if the plaintiffs can provide some sort of evidence similar to the Nick Miller story, a story that claims that Danny Shelton had Attorney Miller's billing records altered without his knowledge, they might have a basis for requesting such access.

Similarly, as Danny Shelton and 3ABN's attorneys reported to the Court in the July 23 Scheduling Conference, Joy and Pickle have a source that claims that 3ABN is destroying documents. As Mr. Joy addressed this issue raised by the plaintiffs, an issue unpublished up to that point in time, he pointed out to the Court that he understood that 3ABN's CFO was involved in some way in just such document destruction. Now if Danny Shelton and 3ABN can come up with similar information about the defendants, then they might have a basis for asking the court to allow them to have access to their hard drives.

Otherwise, or unless there is some other reason why deleted files would be relevant to a case that concerns defamation, to ask for deleted files would assume that one party or the other is not acting in good faith.

Note: Defamation concerns the publishing of alleged lies that have allegedly harmed the plaintiffs. If a file was deleted rather than published, how would such an unpublished file be relevant to Danny Shelton and 3ABN's case?

Comment 9.a vs. Attorney Hayes, "We Aren't Talking About Scope of Discovery"

Attorney Hayes informed the Court that she wasn't talking about the scope of discovery at all (and didn't want to do so at this time), but rather the form in which documents would be turned over in. Thus, the idea of turning over an entire image of a hard drive instead of only the files being sought after, had nothing to do with scope of discovery, in her opinion.

In light of Comment 9.a on Principle 9, we beg to differ:

Comment 9.a. The scope of discovery of electronically stored information At the outset of litigation parties should consider the potential need for preservation and production of electronically stored information that is not readily apparent to ordinary employees and records custodians and be prepared to discuss the matter at the initial meet and confer session. Such information includes system data as well as deleted, shadowed, fragmented, or residual information.—p. 49.

Comment 3.a vs. Mr. Lanterman, "I Don't Know the Search Terms"

Another issue plaintiffs were unprepared to properly discuss consisted of what search terms Mr. Lanterman would be using when searching the defendants hard drives for deleted files. To Mr. Joy's questions in the August 9 hearing regarding search terms, Mr. Lanterman repeatedly acknowledged that he didn't know. And this was 6 days after a colleague of his in the August 3 phone conference also acknowledged that he didn't know what search terms would be used.

Comment 3.a on Sedona Principle 3 makes it clear that search terms should be part of the early discussions between the parties, and it even cites Treppel v. Biovail Corp., a case which criticized "failure to discuss potential search terms" (pp. 21, 22).

Sedona Principle 10: We Must Protect Confidential Information

10. A responding party should follow reasonable procedures to protect privileges and objections in connection with the production of electronically stored information.—pp. ii, 51-56.

So why should we be concerned if Danny Shelton and 3ABN have access to our hard drives, other than the possibility raised by the Nick Miller story that they might find things on our hard drives that were never there to begin with? Simply put, these hard drives contain the confidential information of many people, and we are required to protect that information.

Sedona Principle 11: We Can Do Our Own Searches

11. A responding party may satisfy its good faith obligation to preserve and produce relevant electronically stored information by using electronic tools and processes, such as data sampling, searching, or the use of selection criteria, to identify data reasonably likely to contain relevant information.—pp. ii, 57-59.

Danny Shelton and 3ABN's attorneys would like to have the firm they have hired, Computer Forensic Services, do the searching of our hard drives, but Principle 11 is quite clear that we should be able to do that ourselves.

Think of all the thousands of dollars that will save 3ABN.

Sedona Principle 12: The Two Default Forms Don't Include Hard Drive Images

12. Absent party agreement or court order specifying the form or forms of production, production should be made in the form or forms in which the information is ordinarily maintained or in a reasonably usable form, taking into account the need to produce reasonably accessible metadata that will enable the receiving party to have the same ability to access, search, and display the information as the producing party where appropriate or necessary in light of the nature of the information and the needs of the case.—pp. ii, 60-66.

Absent party agreement or court order providing otherwise, the responding party must produce electronically stored information in one of two "default forms," the form "in which it is ordinarily maintained," or a form that is "reasonably usable." See Comment 12b, supra. In addition, absent an agreement or order, a party need not produce the same electronically stored information in more than one form.—p. 65.

In the case of all or nearly all of the documents that Danny Shelton or 3ABN might seek, the original form that the documents occur in would also be the form that would be most easily searched, accessed, and displayed by the plaintiffs. No special, expensive software would be required.

Thus, there would be nothing gained by having the documents provided in the form of an image of our hard drives.

Conclusion?

Both sides are to submit a memorandum to the Court, after which Judge Hillman will render a decision.

< Prev.

Next >