#CaseoftheWeek Episode 35: Step by Step Instructions on How to Seek a Forensic Examination

Key evidence exists on devices, but whether and when a party can seek a forensic examination has been an uphill battle. Kelly Twigger explores this further in episode 35. The decision is from January 12, 2021 in Delta T, LLC v. Williams, 337 F.R.D. 395 (S.D. Ohio 2021), and she discusses what a party needs to do to compel a forensic examination as well as the the discovery of webpages.

Good morning and welcome to our #CaseoftheWeek for August 10, 2021. My name is Kelly Twigger. I am the CEO of eDiscovery Assistant and the Principal at ESI Attorneys. Thanks so much for joining us this week.

When you join us each week, we choose a case from the eDiscovery Assistant case law database and in cooperation and partnership with ACEDS, highlight some key principles about that decision, what it means, and what the practical implications are for you, your clients and your practice.

In the comments section to whatever platform you’re viewing us on, whether that’s YouTube, Twitter, Facebook or LinkedIn, you’ll find a link to the case that we’re talking about today.

As always, the cases in eDiscovery Assistant are available as public links, and we encourage you to share those links with your colleagues. The goal being to make sure that we are all aware of what’s happening in developments in technology in the case law as it’s associated with eDiscovery, because it has dramatic implications for how we engage as businesses, not only as attorneys, whether we’re representing individuals, but also on businesses when it comes to information governance and how we’re going to handle particular instances. Today’s case is no exception.

You’ll also find a link to the 2020 Case Law Report, which shows some significant trends of what happened in case law in 2020. We’ll be putting together a new report with Doug Austin for 2021. We’d also encourage you to jump over to our new web site at ediscoveryassistant.com and sign up for our blog. If you’re watching this live, thanks for joining us. If you are watching it recorded from our blog, those recordings come out each Thursday as part of our case law newsletter. You can sign up to receive those at our blog.

Let’s get into this week’s case. This week’s case is a decision from the case titled Delta T vs. Williams. Delta T is actually a company that does business as a company called Big Ass Fans, which is frankly just a fun name to say. Big Ass Fans is a company that was founded in my hometown of Lexington, Kentucky, which, if you watched last week’s broadcast, is where we broadcasted from. This is a situation where the plaintiff, Delta T, has moved to compel production of web pages, as well as the forensic examination of multiple devices from the defendant.

Really what we’re looking at here is what is the evidence about the company that was created? Did it directly compete and was it a violation of the non-compete?

According to the Court, the parties engaged in a limited amount of expedited discovery, which included the deposition of Williams, as well as two rounds of written discovery. Then there were substantial objections to some of that discovery from the defendants.

Following that discovery, the plaintiff moved to compel, as I mentioned, 1) the production of defendant’s current and previous Internet pages, as well as other marketing materials that promoted the fans and 2) to submit defendants electronic devices to a limited forensic inspection, along with relevant information from their mobile phone and Internet providers.

That third piece is important. That relevant information for the mobile phone and Internet providers, because that’s kind of like a separate issue that the Court addresses.

How did the Court proceed here?

The first analysis of the Court really engages in is the request for web pages from defendant’s website showing the products being sold. The request really covers web pages, advertisements, and any related promotional material that Williams used to sell non-BAF fans. The Court found that the request closely tied to claims that the defendant’s violation of its obligations to BAF by using the new company to compete.

There’s not really an issue at all, and the Court doesn’t get into very much. It’s clear that these materials are relevant. But one of the keys here and again, as we find with a lot of these decisions, is a court really buries a lot of the truly crucial facts, like here that several of the websites that would be promoting the fans for Williams’ new company had been taken down. Plaintiff cannot collect them on their own. According to the Court, though, plaintiffs have been able to find and collect enough information to suggest the existence of additional information. We’re going to talk about how that plays into the factors of being able to to get new information.

The defendant’s objections to the web pages, according to the Court, were less objections in terms of vague, over broad, not proportional, not relevant, and more just a statement of the merits of the case. The Court pretty much outright rejected that position and said, “The Court may not deny a party relevant discovery because the other party predictably has a different view of the legal claims merit.” Defendants also stated that the plaintiff had found everything there is to find. The Court found that those web pages and promotional content were relevant to the claims. That seems obvious here.  Ultimately granted those on the motion to compel.

The next question that the Court looked at in the analysis of these web pages, however, was whether the defendants were intentionally withholding those materials. The Court looked at the facts of what the defendants had admitted and found that there was a basis to produce and unless there was some sort of undue burden, which the defendants had not identified, they were required to be produced. The Court said, “Are they relevant? Are they proportional? Is there any kind of undue burden that causes us to engage in a proportionality analysis?”

They were relevant; no claims of disproportionality, and so those were ordered to be produced.

The second issue that the Court took up was the request for a limited third-party forensic inspection of defendant’s electronic devices. The plaintiffs asked for a specific protocol with regard to the examination of those devices. Before we get into that protocol, something that’s really important, and I read this case a couple of times to try and understand what we were talking about — is there’s no real discussion of what exactly the electronic devices are that we’re talking about doing a forensic examination of. There’s a suggestion that we’re really talking about computers as opposed to mobile devices. A lot of times when we talk about ESI, when we talk about devices, we’re talking about mobile devices. We’re not talking about physical computers. I think that we’ve really got to understand vocabulary here. Again, the Court is not particularly detailed in discussing which devices we’re talking about. Those kinds of details are great to have in these decisions because they allow us to point to factual similarities and make analogous arguments. We don’t have that here. As far as courts go, the more detail that can be added to these opinions, the more guidance that we’ll get on these electronic discovery issues.

With regard to the protocol that the parties asked for—maybe it was the plaintiffs that asked for it—there would be a three-step process. One, an independent forensic examiner would perform the examination. Two, the search will be limited to specific search terms that are designed to generate communications between the defendants and the former BAF employees, as well as defendants and commercial parties that are involved in the fan business. One additional fact that I forgot to mention is that when Williams left the company, he also recruited two additional companies from Big Ass Fans to come over to the new company and all three of those people engaged in communications to solicit business from existing customers of Big Ass Fans in violation or an alleged violation of the non-compete agreement that Williams had signed with Big Ass Fans.

Defendants, of course, argued that there was no need for, “such invasive tactics” and cited case law that forensic imaging should only be employed in a limited set of circumstances. The Court does a good job here of looking at the Brown case, which we’ve talked about before in this situation, and really distinguishing the facts of this case from the facts in Brown, in which the Court declined to order a forensic examination. The Court identified three factors to look at and whether to compel forensic imaging.

First, the Court noted that courts should tread lightly before compelling mirror imaging in computers when the request is, ” extremely broad in nature” and the connection between the devices and legal claims is unduly vague or unsubstantiated. Second, mere skepticism that an opposing party has not produced all the relevant material does not justify, “drastic electronic discovery measures.” Third, even if forensic imaging is acceptable in a given case, a district court can still consider the significant interest at stake before ordering such a procedure. You’ve got to consider privacy, other potential implications that may have an impact on the forensic imaging process. Then the court said, OK, those are the three factors. Let’s break them down according to the facts of this case.

Let’s take limited scope first. The proposed scope that that I think the plaintiffs here proposed, which was to use a set of search terms that were designed to gather only relevant information, was really tailored and constrained. The plaintiff also agreed to pay for the forensic imaging. Plaintiff has provided a narrowly tailored approach that is designed only to get relevant information and they’re going to pay for it. The Court looked at the scope of the restrictions and found that they would generate relevant discovery and prevent the production of privileged material.  The Court also found that there was a reasonable connection between the electronic devices and the claims because the web pages and emails, for instance, would clearly have been created on a computer.

Now, that one is a little confusing and a little…I’m not sure what the word is… maybe obvious? Generally, we would think that the Court would tie a little bit more relationship between the device and the actual information, because, of course, most ESI is going to be created on a computer. I think that here what the Court doesn’t say is that we’re talking about information that would have been created by the very people who created this company and who are at issue here and whose devices we’re talking about imaging. I think there is that relationship with the language that the Court uses doesn’t quite draw the connection that we might like it to have.

The Court also finds that the limited search is designed to locate relevant material and that the burden on privileged information is lessened because of the process that the parties have agreed to and that the plaintiff is paying the associated costs. One key point that the Court covers here, and I mentioned it at the outset, is that the plaintiff also asked the Court to have the defendants direct their mobile phone carriers to provide access to the forensic examiner, to allow the examiner to search content on mobile devices, including WhatsApp. The defendant’s push back, saying that, one, they don’t have access to some of that information. The Court really pushes back and says, “the plaintiff, you really didn’t provide enough support to compel that kind of access.” We’re going to find that on one area here for forensic examination the plaintiffs provided a good amount of data to get over the mere skepticism requirement. With regard to have the forensic examiner have access to the mobile device providers information, the Court said, “you didn’t give us enough, there’s no basis here for us to award that. We’re going to say no there.”

Second factor the court looked at in whether or not to allow the forensic examination of devices was whether or not there was evidence of non-production of relevant material. This is where we really want to focus, because this is a situation where the plaintiff provided solid evidence of a failure to produce information, including deleted web pages, an email sent to an alleged BAF customer in which they actively solicited the customer to become a business partner of the new company, as well as emails involving design patents that were similar to BAF products. Those specific examples the Court pointed to show that it was not mere suspicion that the sought-after materials existed. That’s going to be really crucial. We’ll talk about that in the takeaways.

The Court also said that there were significant interests at stake in ordering the examination and that the defendants themselves make references to relevant material that they did not produce and that they have not identified any undue burden, which would suggest why they had not produced it. You’ve got legit evidence from the plaintiffs, and you’ve got admissions from the defendants in one form or another, which really gives the Court a basis to say “there is this information that exists, and we do need to produce it. And there is information that evidence exists on these devices. And we’ve got a process and protocol in place to allow everybody’s interest to be protected. And we’re going to let you do that.”

Third factor is weighing the interests. The Court really found that the utility and necessity of forensic imaging here outweighed the privacy and confidentiality concerns inherent in a forensic image for the defendants. The Court found that the plaintiff had an interest in the relevant information, that the defendants failed to produce it or to explain why there was any undue burden in producing it. Then this quote from the Court kind of lays out what you want to focus on with regard to requesting a forensic image. This quote goes:

“Whether the defendants are unwilling or unable to cooperate, forensic imaging will help the parties to engage in an appropriate and productive discovery stage. The constrained forensic imaging protocol here will result in the exchange of relevant proportional discovery while screening privileged material or reveal a dearth of material. Either way, the process will be important in resolving the case.”

I think that quote right there really sets out what your framework is for making an argument for a forensic examination here. The Court also addressed the privacy concerns of the defendant, calling them vague allusions and found that the constraints on the search that both parties have a say in choosing the examiner and that the process that the parties had set out address those concerns. In general, the steps of the protocol, which essentially allowed for the parties to pick the examiner, that data would be pulled by the examiner and sent to counsel for BAF. BAF would then be allowed to review that information. They would then provide a privilege log and provide the responsive information. That still left it in BAF’s hands. That really meant that whatever concerns you had about a third party having the data were alleviated because the third party had no relationship to the plaintiffs as well.

The Court also really just says taken together, the factors weigh in favor of a limited forensic imaging of the defendant’s devices and granted the motion to compel, except, as I mentioned, the Court did not agree to order the defendants to provide access to any of its third-party Internet providers or mobile device providers for the forensic examiner.

Now, the next thing that the Court does, which is something you’re really going to want to pay attention to, is they set out a process and a timeline for the identification of the examiner, the provision of devices, payment, review of the data, creation of a privilege log. The reason that that process is great, the way the Court sets it out as it gives us a framework to work within. If you’re going to a court to ask for a forensic examination, you’ve now got the specific steps you need to prove, and you’ve got a really nice framework and protocol for how to be able to lay this out for the Court so that it is fair for the parties and meets the requirements under the Federal Rules of Civil Procedure.

What are our takeaways? As I just mentioned, you’ve really got those steps that are required to get a forensic examination here and you want to be able to use those steps if you’re moving to compel in a similar fashion. Now, keep in mind, as I mentioned, that the second factor of having evidence is key. We see a lot of case law where there is just the suspicion that additional evidence exists and no hard evidence. You’ve got to note early on, if you have a suspicion that evidence is not being produced, not being provided. You’ve got to create a record that will allow you to have the evidence to show that you’re missing evidence. Right? I mean, that seems a little oxymoronic, but at the same time, mere suspicion won’t get you there. We have seen numerous cases, especially in eDiscovery Assistant and that we’ve talked about on the #CaseoftheWeek where parties simply say, “we really believe that this information exists.” The Courts’ say, “look, you’ve got to give us some evidence that this information exists. A mere suspicion or a just telling us that it does isn’t going to get it done.” You’ve got to have that evidence. One of the ways to get that evidence is to understand and create a strategy for how you can devise that that evidence exists.

Taking the deposition of Williams or another party that’s really going to be one way to go about it. You want to be able to create that strategy. You can ask the right questions about communications, about sources of ESI and be able to compare that with evidence that’s been produced or that you already have. In this particular instance, as I mentioned, the plaintiffs had hard evidence in the defendant’s statements that were inconsistent with their position that gave the Court the ability to find the evidence that was needed to order the examination.

Question that I have here is why didn’t the defendant’s attorney just agree to do the limited searches themselves and produce that information? Why would you want to get a third party involved? Really, the last thing you want to do is take the ability to know what data exists and put it in a third-party hands instead of having it within your own control. I do have a question as to what that why that would have happened. There’s no no real way for us to know. We can always make up suppositions about whether counsel really knew or understood that they could do that kind of forensic examination.

It really is incumbent upon you is counsel to take that action to understand what kind of information exists and how you can manage and control it for your client. It could be that that information having that done through a forensic examination of their own doing by defendants instead of by the process ordered by the court, would have allowed them to evaluate and and use that information, whether it’s in form of settlement, if it’s bad, or whether it’s just to know that, hey, there’s nothing really here.

You’ve got to know and be able to manage that information effectively for your client. It’s so critical, and it’s a key part of the discovery process.

Now, I mentioned already that the Court lays out an excellent process and timeline. That’s a good model to follow if you’re going to do a motion to compel a forensic examination. I even like that it included the provision of a privilege log with regard to the provided information.

Last takeaway is with regard to the collection of web pages and other promotional online content. This is an area where the deletion of electronic information can happen like that (snaps fingers). Social media profiles get taken down. Profile pictures get changed. Whole content on the profile can get changed. Web pages can be completely taken down. The notion that you can get any web page through the Wayback Machine is — if you ever tried that — it’s there’s partials and sometimes you get lucky. For the most part, it’s not all there. You need to recognize that that content is going to be discoverable. If you’re the defendant, you need to take early steps to preserve that content. If you are the plaintiff here, you need to get on immediately and start trying to collect as much information as you can find that is publicly available. You need to make sure that you’re sending a preservation letter to the other side that encompasses all of that information and advises them not to take it down and that it has to be collected before it’s taken down.

We got one quick question from the audience, and I’m going to see if we could address here. When does it make more sense to seek information directly from the carrier provider (i.e., Apple’s iCloud data) versus a forensic examination of a mobile device, assuming it depends on the data being sought?  You’re going to have a very, very difficult time going directly to the provider to get any information, whether that’s a social media platform or Apple or Google or anybody else. As a general rule, those third-party providers are going to stand behind the Stored Communications Act and not provide that information unless it is sought in a criminal context with a warrant. You’re going to have very little success and you’re going to beat your head against a wall and you’re going to waste a lot of time trying to get access to a third-party provider.

Here, if there was information that was available on the mobile devices that was relevant, then that’s a separate argument that the plaintiffs should have made. The Court specifically notes that the plaintiffs just made a cursory statement about why they should be entitled to that information from the third-party mobile providers. It wasn’t enough for the Court to even really do any analysis on.

If you have evidence that WhatsApp chats exist or instant messages exist or people used texts to exchange information, as likely happens all the time in business. Not likely. It absolutely does. Then that information needs to be caught from the devices.

The the other thing to note is that WhatsApp is still encrypted end-to-end, so you can’t get that information from Facebook, which now owns WhatsApp. Apple does not have access to the individual text messages. If you want the information that’s contained on a device, you need to get that information from the device that it was sent from or received to. That’s going to be your best source of information for that kind of evidence. It’s really those individual devices. You’re going to need to make the case that those devices should be imaged.

In this situation, I’m not sure exactly what the requests for production were because they’re not specifically all stated in the decision that we’re looking at. If the request for production specifically sought information that would have been on the mobile devices, then that information should have been provided from the mobile devices.

Hopefully that answers the question that was raised. If not, please feel free to reach out to me further.

All right. That is our #CaseoftheWeek for this week. Thanks so much for joining me. I’ll bepriv back next week with another edition of our #CaseoftheWeek from eDiscovery Assistant in partnership with ACEDS. If you are an ACEDS member and interested in using eDiscovery Assistant, there is a discount available to ACEDS members and a trial for folks taking the ACEDS exam. If you’re interested in either of those, just drop us a line at aceds@eDiscoveryassistant.com and one of our team will get you started.

If you are interested in doing a free trial of our case law and resource database but are not an ACEDS member, please just go to ediscoveryassistant.com. You can sign up in the upper right-hand corner for a free 14 day trial or you can reach out to one of our team at support@ediscoveryassistant.com and we’ll be glad to get you started.

Thanks so much. Stay safe and healthy and I’ll see you next week.

Watch Next Episode Live

#CaseoftheWeek streams live on the ACEDS YouTube, Facebook, Twitter, and LinkedIn company pages. Subscribe to the ACEDS social channels to be notified when we go live.

Catch the Replay

You’ll be able to read episode summaries and watch the recorded show right here on the eDiscovery Assistant blog or access the recorded versions from the ACEDS social media channels.