#CaseoftheWeek Episode 67: Exiting Employee Laptop Review and Spoliation

For episode 67 of #CaseoftheWeek, Kelly Twigger analyzes CaramelCrisp v. Putnam decision. The decision from United States Magistrate Judge Sunil R.Harjani looks at whether the review of an employee’s laptop by company IT, following that employee’s termination, can lead to sanctions for spoliation. 

Good morning, and welcome to episode 67 of our #CaseoftheWeek series, published in partnership with ACEDS. My name is Kelly Twigger. I am the CEO and founder of eDiscovery Assistant, as well as the principal at ESI Attorneys. I’m so happy to be here with you today. Thank you so much for joining me.

As you can see, I had to do some resetting of my settings on my computer, and we have a very close up view today. You’ll have to forgive us for being a little bit in Zoom today in our video.

As you know, each week we choose a recent decision in electronic discovery that highlights key issues for litigators. Then we talk about the practical aspects of that case, what it means for you, how to prepare and plan for you, your practice, and for your clients.

This week’s decision comes to us from a case titled CaramelCrisp LLC v. Putnam. This is from the Northern District of Illinois, where we know we get a lot of our really good ediscovery decisions from that court. This one is a pretty recent case from April 26 of 2022. This is a decision authored by United States Magistrate Judge Harjani.

As always, we tag each case in our eDiscovery Assistant database with issues so that they’re easy for you to track down within the database. Issues for this decision include legal hold, exclusion of witness, dismissal, sanctions, adverse inference, bad faith, spoliation, failure to preserve and forensic examination.

Let’s dig into the case a little bit. Our underlying case here involves a misappropriation of trade secrets as well as a breach of confidentiality and a non-compete agreement.

We are before the court today on a motion for sanctions for failure to preserve ESI brought by the defendant. The defendant is a former employee of the plaintiff who was terminated effective March 7, 2019, and in this motion, alleges that the plaintiff improperly deleted data from the defendant’s company laptop after the defendant left, but prior to bringing this lawsuit. That’s where we are in terms of the case.

As always, when we talk about on the Case of the Week, timing is key. So we have to keep in mind that we’ve got that March 7, 2019, effective date of termination.

On our motion for sanctions, the defendant seeks an adverse inference instruction, as well as a dismissal of the breach of contract claim.

The parties here CaramelCrisp does business as Garrett’s Popcorn. If you’re from Chicago or have traveled to Chicago, Garrett’s Popcorn is a Chicago landmark and some of the best popcorn you’ll ever have. The defendant here was the Director of Research and Development for CaramelCrisp from February 2015 through March 9th of 2019, for a total of about four years.

As part of her job, the defendant had access to all the plaintiff’s trade secrets, as well as highly confidential and proprietary information, including secret popcorn recipes.

The defendant was terminated effective March 7, 2019. For reasons that are completely unrelated to this litigation. The defendant learned of her termination several days before it became effective, and when she learned of that termination, she delivered her laptop to the Vice President of Human Resources.

Standard company practice for CaramelCrisp was for It to consolidate the user data on the departing employees laptop, and that work was to be done by Wally Newman of the IT Department at CaramelCrisp. As part of his analysis on March 5th, Mr. Newman learned that the defendant had done a number of things that caused him concern.

First, she had sent herself emails with attachments containing a vast amount of CaramelCrisp confidential information and trade secrets, including recipes, batch pricing, product weights, production processes, development and distribution agreements, supplier information, customer service reports, and market research. She had also deleted substantially all of the data on her computer, as well as emptying the trash folder and the recovery folders in violation of the terms of her 2015 agreement. That was on March 5th. Two days before she left.

On March 22, 2019, the VP of HR contacted the defendant and told her that she needed to be concerned about violations of her contract with CaramelCrisp and accused her of emailing confidential documents to herself prior to her termination. On that same day, Newman, who was again the IT professional at CaramelCrisp reviewing the laptop, sent the VP of HR an email asking her about placing a legal hold on the defendant’s account and stating that he was revoking access from the defendant’s supervisor so that “nothing is disturbed in the account and IT will no longer access it directly, only via logs and searches on the back end when requested.” Really trying to put a litigation hold in place to protect the account.

In response to that call from the VP of HR, the defendant immediately forwarded five emails that she had sent to herself and assured the VP of HR that it was her intention to comply with the terms of her agreement.

Now, following that exchange, with the defendant returning the emails, CaramelCrisp then learned that the defendant had copied and misappropriated more than 5400 files—which made up about three (3) gigs of data—onto a personal USB drive and had taken the drive with her following her termination.

Fast forward a few days to March 28, 2019, and CaramelCrisp Counsel sent an email to the defendant demanding that she make available to a third party forensic examiner all of her electronic devices that had any of the company’s confidential or trade secret information on them during her employment, as well as those used since the date of her termination. In effect, CaramelCrisp is now saying, “we want you to provide all of your electronic devices to a third party forensic examiner for them to take a look at.”

The email to the defendant stated that the forensic expert would permanently delete any protected information, and also demanded an affidavit from the defendant that she had not disclosed any of this confidential information and trade secrets to anyone and that she would not do so in the future. At that point, the defendant hired her own counsel and provided an affidavit that stated that she had deleted all of the information covered by the agreement and refused to allow the plaintiff to conduct a forensic examination of her devices, emails, and cloud accounts.

Following that exchange, CaramelCrisp then brought this lawsuit alleging that starting on March 5, 2019, the defendant began deleting all of the data on her computer in clear violation of her 2015 agreement, as well as the trash and recovery folders. On May 2, 2019, just under two months after this whole thing started, the plaintiff turned over the defendant’s laptop to Berkeley Research Group, otherwise known as BRG, and asked for an independent forensic expert to create a copy of the defendant’s laptop.

William Foyer from BRG created a forensic image of the laptop at that time. The defendant at that point then retained her own forensic expert named Alan Buxton. Mr. Buxton examined the forensic image that was made by BRG and found that the defendant did not substantially delete all of the data from her computer, as CaramelCrisp had alleged. Mr. Buckson also stated that the plaintiff had deleted hundreds of files from the defendant’s laptop after March 8, 2019, and that CarameCrisp failed to use best practices in working with the computer such that the original state of the laptop upon returning it was irreparably altered.

Essentially, what Mr. Buxton is saying is that initial preservation of the laptop should have included imaging the laptop before any changes were made to it by IT, and instead, his examination revealed that IT had changed or accessed 39,000 files after March 8, 2019, prior to the imaging that was done by BRG. Mr. Buxton’s position is that because of the actions taken by IT, the laptop is irretrievably altered and can no longer be reliable evidence.

The defendant is now before the court alleging sanctions that it claims are appropriate based on the plaintiff’s destruction of evidence, really based on all the actions taken by IT prior to the image made by BRG. In her motion for sanctions, the plaintiff seeks a couple of different things.

First, she wants an adverse inference instruction stating that a forensic image of the laptop created at the time should have been created at the time of her termination and would have demonstrated that she did not delete any of the information from the laptop. Second, she also asks the court to bar CaramelCrisp from introducing testimony from any BRG employee regarding conclusions about the state of the laptop at the time of her employment, because the forensic image was created on May 3, but was substantially altered by CaramelCrisp’s IT Department prior to that. She also asked for an award of attorney fees and costs incurred in moving for sanctions.

Now, in response to the defendant’s motion, the plaintiff argues that sanctions are not warranted based on its handling of Putnam’s work laptop. After her termination for four separate reasons. CaramelCrisp states that there was no duty to preserve that was breached at the time the work was done; that the defendant was not prejudiced because she failed to show that CaramelCrisp had destroyed any relevant electronically stored information. Third, that the defendant failed to show that CaramelCrisp deletion of ESI was done in bad faith, and fourth, that the observations of BRG are unaffected by any of the issues raised by defendant sanctions motion.

Those are the facts before us. Let’s talk a little bit about what the Court’s analysis is.

The Court starts out really at the end of the facts here by just blanket stating that sanctions aren’t warranted because the defendant has not established that there was a breach of the duty to preserve at the time alterations were made to the data on the laptop. The Court noted that once the duty to preserve was triggered, that the defendant has not established that any ESI that was lost is in any way relevant to the party’s claims or defenses in this action.

That’s really where the Court comes down to. Let’s find out how the Court gets there.

The Court starts, as is pretty common with Rule 37(e), which is the motion for sanctions for failure to preserve. The defendant moved under Rule 37, as well as the Court’s inherent authority for sanctions. The Court starts with the requirements of Rule 37. These are well known to our audience here on the Case of the Week, but include five separate elements.

First, that the information issued must be electronically stored information, or ESI. Second, that there must be anticipated or actual litigation. Third, that it must be the case that because of the actual anticipated litigation, the information should have been preserved (i.e. that a duty to preserve would have arisen). Fourth, that the ESI must have been lost because a party failed to take reasonable steps to preserve it. And fifth, that the lost ESI must be unable to be restored or replaced through additional discovery.

If those five requirements are met under Rule 37, then the Court determines whether the party who has lost the data will be prejudiced. If so, the Court can order measures sufficient to cure that prejudice or upon a finding of intent to deprive, can order an adverse inference, dismissal, or default judgment.

We’ve got the five elements of Rule 37. Then we’ve got to show prejudice. Then we’ve got to show intent to deprive to be able to get to the sanctions that the defendant is asking for here.

The Court starts with the first step of whether or not there was a duty to preserve that was triggered and when that duty to preserve was triggered. The Court’s decision notes that the parties agreed that the duty to preserve arose not later than March 22 of 2019. That’s the date that IT contacted the VP of HR about the litigation hold, as well as the date that the VP of HR contacted the defendant and suggested to her that she was in violation of her 2015 agreement with the company.

Remember that date we’ve got March 22, because March 5 is when the plaintiff learned or the defendant learned that she was going to be terminated. That’s when she turned her computer back over. That’s the first time that IT saw information that caused it to raise a red flag. Subsequently, March 7 is when the defendant left the company. March 22 is the first time that CaramelCrisp acknowledged that there were potential claims related to the breach of her agreement.

The Court then uses the March 22, 2019, date as the date that the duty to preserve arose, and as such, it evaluates the spoliation claim in correspondence with that date for the duty to preserve. The Court then found that the actions taken on the laptop by CaramelCrisp IT were prior to the March 22 date. There was no spoliation because there was no duty to preserve at the time that those actions were taken.

Essentially a separate argument, the defendant’s expert Buxton also asserted that there were seven files that were deleted after March 22 when the duty arose. The Court looked at those files and found that there was nothing relevant about them to the claims or defenses that were made in the case here.

Unlike certain situations where you really have no evidence as to what the information was that is deleted (and a party can be prejudiced because they simply don’t know what they don’t know), here, that wasn’t the case. In this particular decision, the Court notes that the parties had access to the file names and contents of the information that were deleted so they could tell that they were not relevant to the claims or defense of the action.

You’ve really got two pieces here. One, the actions that were taken that may have irreparably altered the laptop were done prior to the date the duty to preserve attached. There’s no spoliation under Rule 37. And the subsequent files that were deleted by CaramelCrisp were not relevant to the claim to the action so you don’t meet the initial five requirements of Rule 37(e) in order to move on to prejudice or intent to deprive.

The defendants here also argued that any testimony from BRG, which again, was the independent forensic examination or independent forensic copy actually that was made by BRG, should be precluded stating that BRG roughly altered the laptop, and that’s because it had been altered before BRG received it, that any observations that they would make should carry no weight. The Court rejected that argument, saying first that CaramelCrisp hasn’t offered any expert opinions from BRG, that the expert disclosure deadline has already passed, and that there are no opinions being offered that would need to be stricken.

The Court then says that even if there was an opinion offered, there’s no evidence that the alterations happened after the date the duty to preserve arose. Essentially, here, the defendant is pretty much out of luck on sanctions because all of the conduct that was potentially spoliation occurred prior to the date the duty to preserve arose.

The Court did recognize that the defendant had a challenge to the reliability of the forensic image that was created by BRG, and it allowed the defendant to preserve that challenge and to raise it later in advance of trial, whether that’s on motion of limine to preclude the plantiff from relying on that image or in some other way. The Court notes that it will be upon the plaintiff to bear the burden of proof with regards to the reliability of that evidence made by BRG.

There’s a final quote from the Court here that I think is really important to note, and the crux really of this case is practices on exit termination of employees. This one’s really key because the question comes to corporations or organizations where departing employees are leaving as to when is reasonable anticipation of litigation such that the duty to preserve arises.

Here’s that quote from the Court:

In sum, even assuming CaramelCrisp failed to follow best practices when it analyzed Putnam’s work issued laptop, any alteration to Putnam’s laptop and deletion of files other than the seven deleted files occurred prior to CaramelCrisp duty to preserve and the precise identities of the seven deleted files are available. So in the end, Putnam complaints mostly about ESI that Caramel Crisp had no duty to preserve, and she has not identified any relevant ESI loss after the duty to preserve arose.

The Court also denied the plaintiff’s request for attorneys fees, striking the notion that the defendant brought her motion in bad faith. The motion for sanctions was denied, as well as the motion for any costs and fees.

What are our takeaways from this decision?

We’ve got to kind of look at this from the corporate perspective of what is the process and what are the company’s requirements when an employee is leaving. Are they constantly required to make forensic images of laptops upon a review of them?

Here, there was no reason to suspect that the defendant was stealing information until IT received her laptop and started seeing questionable behavior that was exhibited by examination of the laptop. There was no ability to foresee it prior to examining the laptop, which means that there was no duty to preserve and no requirement to make a forensic copy of that laptop at the outset of doing that examination by IT.

Now, there are tools that IT can own to allow them to make their own forensic copy of those laptops. If you have clients who have considerable litigation, whether it’s in the employment context or in this theft of trade secrets context, and you want to be able to protect them by allowing them to be able to make forensic images in-house, there are machines that will allow you to do that, and they’re pretty cost effective from a perspective of maintaining them within it. You can then make that forensic image, be able to keep it, and do the examination. If there’s no need to keep the forensic image, you can then just wipe it.

That’s not required by the Court here. The Court here is specifically saying that the analysis under the Federal Rules of Civil Procedure, are that you have to have a duty to preserve in order to require that level of preservation of an image. Here CaramelCrisp appeared to have a great process in place—good communication between it and HR regarding preserving, putting legal holds in place and getting a forensic image made. It all happened pretty quickly for the context of litigation, but still you’ve got a sanctions motion that’s pending and at great cost to both parties.

CaramelCrisp really did the right thing here by sending out that legal hold and getting the forensic image made. I think at some point in your planning process, planning for exit interviews, there may be a threshold of information that IT learns, at which point they say, “we need to stop doing this examination right now. Can we make a forensic image of the computer and then continue our evaluation on it?” Even if it’s prior to the date of duty to preserve arose, they won’t have the continuing reliability of evidence issues that will persist in this case regarding the forensic image that was made by BRG.

It’s good to be aware of this type of issue and have a resource in place to be able to have that forensic image made quickly in order to be able to preserve the state of the laptop. As I mentioned, there are devices that are available that IT shops can have on hand. It’s a quick training process to be able to make those forensic images so even not having an outside source to do it, that work can be done internally to keep costs down as well as manage time. That’s something to think about if your client regularly has issues where forensic images may need to be made.

OThat’s our Case of the Week for this week. Thanks for dealing with us, with our technical challenges and for joining me. We’ll be back again with another decision from our ediscovery Assistant database next week.

If you are an ACEDS member and interested in using our eDiscovery Assistant database, there’s a discount available to current ACEDS members and a (90-day) trial for folks who are taking the ACEDS exam. Information on both of those is accessible in your ACEDS portal.

If you are interested in doing a free trial of our case law and resource database at eDiscovery Assistant,  you can sign up for a free trial. If you’re interested in having it for your organization, you can drop us an email@supportediscoveryassistant.com or contact us, and we’ll be back in touch to set something up with you.

Thanks so much. Stay safe and healthy out there, and I’ll see you next week.

Watch Next Episode Live

#CaseoftheWeek streams live on the ACEDS YouTube, Facebook, Twitter, and LinkedIn company pages. Subscribe to the ACEDS social channels to be notified when we go live.

Catch the Replay

You’ll be able to read episode summaries and watch the recorded show right here on the eDiscovery Assistant blog or access the recorded versions on our Vimeo channel.