Nacco Materials Handling Group, Inc. v. Lilly Co. , 278 F.R.D. 395 ( 2011 )

ORDER ON YALE’S MOTION TO PREVENT FURTHER SPOLIATION OF EVIDENCE

DIANE K. VESCOVO, United States Magistrate Judge.

Before the court is the August 22, 2011 motion of the plaintiff, Nacco Materials Handling Group, Inc., d/b/a Yale Materials Handling Corporation (‘Yale”), pursuant to Rule 37 of the Federal Rules of Civil Procedure to “prevent further spoliation” by the defendant, The Lilly Company (“Lilly”), of evidence stored on Lilly’s computers and elsewhere. In addition, Yale requests the court to award Yale its legal fees and costs incurred in conducting a Rule 30(b)(6) deposition of Lilly in order to investigate and determine what electronic evidence exists. Yale also seeks an order requiring Lilly to pay the cost of the forensic examination of Lilly’s computers conducted to date and the cost of imaging and examining the remaining computers.¹ Lilly opposes the motion. The motion was referred to the United States Magistrate Judge for determination. A hearing was held on October 27, 2011. For the reasons that follow, the motion is granted in part and denied in part.

I. PROCEDURAL AND FACTUAL BACKGROUND

This lawsuit arises from Lilly’s unauthorized and improper access to Yale’s secure dealer website. Yale asserts claims for violation of the Computer Fraud and Abuse Act, 18 U.S.C. § 1030, (Count I), computer trespass (Count II), misappropriation of trade secrets (Count III), tortious interference with contract and business relations (Count IV), tortious interference with prospective economic advantage (Count V), violation of North Carolina’s Unfair and Deceptive Trade Practices Act (Count VI), and copyright infringement (Count VII). Yale claims that it has suffered competitive and economic injury and seeks restitution, disgorgement of profits, monetary damages, and injunctive relief. (Compl. ¶¶ 34-35.)

Yale manufactures and sells lift trucks under the Yale trademark along with aftermarket parts. (Compl. ¶ 2.) The lift trucks and parts are sold only through authorized Yale dealers. (Compl. ¶ 3.) Yale maintains a secure website for its authorized dealers, the Yale Dealer Resource Site. (Compl. ¶4.) Through the secure website, authorized Yale dealers can access certain proprietary information of Yale, such as information for the service of Yale lift trucks, including the parts and manuals for performing maintenance and diagnosing performance problems, proprietary software, and pricing information and strategy. (Compl. ¶¶ 6-7.) Access to Yale’s secure website requires a user name and password. (Compl. ¶¶ 8, 27.) By virtue of their contractual dealership agreements, authorized Yale dealers are required to maintain the confidentiality of the contents of Yale’s secure website. (Compl. ¶ 8.) In addition, users of the website must accept a “click-wrap agreement,”² which also contains confidentiality obligations. (Compl. ¶ 8.)

Until 2008, Lilly was an authorized Yale dealer in Arkansas, Missouri, Mississippi, and Tennessee. (Compl. ¶ 19; Lilly’s Resp. to Yale’s Req. for Admis. 1, Reid Deck Ex. H, D.E. 67-8, at 5.) In January of 2008, Lilly was terminated as a Yale dealer. (Clarke Aff. ¶ 3, D.E. 30; Sattler Deck ¶ 6, D.E. 24.) When Lilly was terminated as an authorized Yale dealer, all user IDs and passwords issued to Lilly were canceled.³ (D.E. 22, at 13.) Lilly currently is an authorized dealer of lift trucks for several of Yale’s competitors, including Clark Material Handling Company, Doosan Infracore America Corporation, Linde Material Handling North America Corporation, and Toyota Material Handling U.S., Inc. (Compl. ¶¶ 19-20.) Lilly has dealership locations in Alabama, Arkansas, Mississippi, and Tennessee. (Compl. ¶ 11; Lilly’s Resp. to Yale’s Req. for Admis. ¶ 3, Reid Deck Ex. H, D.E. 67-8.) Before Lilly was terminated as an authorized dealer, Lilly had operations in Nashville, Tennessee and its surrounding counties dating back to 1996. (Lilly Mem. in Supp. Mot. to Dismiss, at 3, D.E. 14.) In January 2008, Lilly sold the assets, including its computers, used for its operations in the Nashville area to KMH Systems, Inc. (“KMH”), an authorized Yale dealer. (Lilly Mem. in Supp. Mot. to Dismiss, at 3, D.E. 14.)

Eddie Wolfe was formerly an employee of Lilly. Wolfe left the employ of Lilly in January of 2008 and became an employee of KMH. (Sattler Deck ¶ 13(d), D.E. 24.) When he left Lilly’s employment, his original user ID and password for the Yale Dealer Resource Site were canceled, and he was issued a new user ID and password as a KMH employee. (Sattler Deck ¶ 13(d), D.E. 24.)

In its complaint filed February 22, 2011, Yale alleges that from November 1, 2010 through December 20, 2010, on numerous occasions, over 40,000 times, Lilly entered Yale’s secure dealer website by using the user ID and password assigned to Eddie Wolfe, while a KMH employee, and that Lilly, by entering the website, accessed one or more of Yale’s servers where the secure website is maintained. (Compl. ¶ 9; Sattler Deck ¶ 13(d), D.E. 24.) These servers are located in Ohio, Illinois, and Washington. (Compl. ¶ 53.) Upon learning of the access, Yale canceled Wolfe’s user ID and password. (Sattler Deck ¶ 13(d), D.E. 24.) Yale alleges that Lilly accessed the Yale authorized dealer website from four different computer IP addresses in four locations — Salisbury, North Carolina; La Vergne, Tennessee; Memphis, Tennessee; and Fairport, New York. (Compl. ¶ 9.) All four IP addresses allegedly belong to Lilly. (Compl. ¶ 9.)

After its discovery of the unauthorized access, Yale notified KMH by telephone in December 2010 that it had uncovered a password and ID assigned to a KMH employee that had been used by an unauthorized person to access Yale’s secure dealer website. (Guenin Letter, Jan. 14, 2011, D.E. 82-1.) KMH immediately launched an investigation, which confirmed that the ID and password were issued to its current employee Eddie Wolfe, that the ID and password were communicated to Lilly’s Memphis operation, and that the ID and password allowed Lilly to look up and research Yale parts. (Guenin Letter, Jan. 14, 2011, D.E. 82-1.) KMH also confirmed that its parts manager and its parts and service sales representative had knowledge of the practice but failed to inform KMH’s management. KMH suspended its parts manager, terminated the sales representative, and ceased all communication and sales to Lilly. All these matters were set forth in a letter dated January 14, 2011 from Michael Guenin, the President of KMH, to Yale. Guenin also emailed a copy of the letter to Lilly.

In January 2011, Joe Clark (“Clark”), President of Lilly, requested Lilly’s IT Director, Frank Robertson (“Robertson”), to block all access to Yale’s secure dealer website from Lilly computers. (Robertson Deck ¶ 4, D.E. 84.) Robertson installed a firewall block, specifically blocking access to the URL “yale.com” through Lilly’s data and communications network. (Robertson Deck ¶ 4, D.E. 84.)

On February 25, 2011, Lilly was served with the complaint in this lawsuit filed by Yale.

On March 9, 2011, Clark received a “litigation hold letter” dated March 8, 2011 from Lilly’s attorney. The letter advised Clark that “given the prior litigation between Lilly and [Yale], there is a very real prospect that e-diseovery issues may loom large in this lawsuit, especially in light of the allegations made in the Complaint.” (Smith Letter, March 8, 2011, D.E. 84-1.) The letter further advised Clark that “essentially all electronic data is potentially discoverable____in-cludpng] email[s] sent or received by any employee, other ‘active’ information stored on servers, or information stored on backup tapes or other media capable of restoration.” (Smith Letter, March 8, 2011, D.E. 84-1.) It instructed Lilly to (1) issue a written litigation hold; (2) identify all key players and ensure their electronic and paper records are preserved; (3) cease deletion of e-mail; (4) preserve the records of former employees; and (5) preserve back up tapes when they are the sole source of relevant information or when they relate to key players. (Smith Letter, March 8, 2011, D.E. 84-1.) Clark was reminded that “it is imperative that you provide everyone with written notice” and “in addition, you should reissue the litigation-hold instructions periodically.” (Smith Letter, March 8, 2011, D.E. 84-1.)

Clark forwarded the litigation hold letter to Robertson and other management personnel and parts department personnel in Lilly’s Memphis operation. (Robertson Deck ¶ 4 & Ex. A, D.E. 84.) Specifically, the litigation hold letter was sent to seven employees: Lilly’s CFO, Bob Davidson; Lilly’s COO, Eric Wisher; VP Wade Clark; Frank Clark; Bonnie James Pine; Memphis Parts Manager, Jerry Crouch; and Robertson. (Robertson Deck Ex. A, D.E. 84-1.) Clark’s email to Robertson forwarding the litigation hold letter contained the following message: “Frank, is there anything you need to do to our system to insure that information is not lost.” (Robertson Deck Ex. A, D.E. 84-1.) In May 2011, Robertson searched the hard drives of all of Lilly’s servers looking for files with “Yale” as part of the file name but found no such files “saved on the hard drives after the date on which [he] installed the firewall block.” (Robertson Deck ¶ 6, D.E. 84.) At some point, after learning that Justin Grant, a Lilly employee in Tupelo’s parts department, had accessed the Yale site, Lilly sent the litigation hold letter to the Tupelo branch manager, Jeanne Senter, and the Tupelo parts manager, Steve Nanny. At the hearing, Lilly’s counsel advised the court that in June or July of 2011, an email was sent to all employees in the entire company advising them not to delete files.

In response to requests for admissions, Lilly admits that its employees accessed the Yale authorized dealer site after its termination in January of 2008 as an authorized dealer. (Lilly’s Resp. to Yale’s Req. for Ad-mis. ¶ 4, Reid Decl. Ex. H, D.E. 67-8; PL’s Resp. to Def.’s Mot. to Stay 3, D.E. 64.) Lilly’s admissions also confirm that Lilly accessed the Yale authorized dealer site by using the ID and password of an employee of another dealer, KMH. (Lilly’s Resp. to Yale’s Req. for Admis. ¶ 8, Reid Decl. Ex. H, D.E. 67-8.) Lilly denies that it accessed any information that might be a trade secret and denies that it accessed any information it knew to be copyrighted. (Lilly’s Resp. to Yale’s Req. for Admis. ¶¶ 9, 10, Reid Decl. Ex. H, D.E. 67-8.)

Yale originally brought suit in the Eastern District of North Carolina. On March 25, 2011, Lilly filed a motion to dismiss or transfer venue based on the lack of personal jurisdiction. While the motion to transfer was pending, Yale, on April 5, 2011, filed a motion for preliminary injunction and expedited discovery. On May 25, 2011, the North Carolina district court granted Lilly’s motion to transfer venue, declined to rule on the pending motions, and transferred the case to the Western District of Tennessee.

The motion for expedited discovery was referred to the United States Magistrate Judge. By order dated June 27, 2011, the court permitted Yale to have a computer forensics expert examine Lilly’s computers “for the purpose of determining whether or not any of the [the computers] were used to access a Yale computer server ... after March 28, 2008. (Order, June 27, 2011, D.E. 60.) If a computer had accessed a Yale server, the order directed the expert to copy the Lilly computer hard drive and maintain the copy for further examination as ordered by the court. (Order, June 27, 2011, D.E. 60.) The order also directed Lilly to provide to Yale a list of its computers and the name of the user to whom each computer is assigned. Pursuant to the Court’s order, Yale retained LogicForce Consulting, LLC (“Log-icForce”) to conduct the forensic examination of Lilly’s computers. (KempVanEe Decl. ¶ 1, D.E. 78-1.)

LogicForce conducted an examination of Lilly’s computers using a seventy-six word keyword search.⁴ Initially, LogicForce’s preview of twenty-one of Lilly’s computers, including desktops, laptops, and servers, revealed evidence of access to Yale’s secure dealer website on eleven of the computers. (KempVanEe Decl. ¶¶ 12-13, D.E. 78-1.) At the most recent hearing, Yale’s counsel advised the court that Yale had previewed thirty-five of Lilly’s computers and evidence of access was found on seventeen computers.

Subsequently, Lilly filed a motion to stay discovery, which the court denied, finding that Yale would be prejudiced by a stay because evidence could be destroyed each day by the operation of Lilly’s computers.⁵ (Order, D.E. 70, July 21, 2011.) Lilly was ordered to present a Rule 30(b)(6) deponent to answer questions about Lilly’s access to Yale’s website. (Order, D.E. 70, July 21, 2011.)

Lilly produced Clark, its President, as its 30(b)(6) designee to testify as to the following seven topics on July 27, 2011:

(1) The identity of each individual at KMH who allegedly authorized Lilly to use the user name and password assigned to Edward Wolfe to access the Secure Yale Dealer Resource Site (“the Site”);

(2) The identify of each individual at KMH who allegedly authorized Lilly to access the Site;

(3) The identity of each individual at Lilly (former or current) to whom Mr. Wolfe’s user name and password were disseminated;

(4) The identity of each individual at Lilly who disseminated any ID or password issued to KMH by NMHG to any person formerly or currently employed by Lilly and the means/method of such dissemination;

(5) The identity of each individual formerly or currently employed by Lilly who accessed the Site using Mr. Wolfe’s user name and password or otherwise (“Accessing Individual(s)”);

(6) With respect to each Accessing Individual^): (a) The Lilly Computer(s) from which such access was obtained; (b) The portions(s) of the Site to which access was obtained; (e) The portion(s) of the Site downloaded, viewed, copied, or forwarded; (d) The Electronic Media and Lilly Computer(s) on which each such download, viewing, or copy was made or stored and the location thereof; and

(7) With respect to each Lilly Computer, the date on which it was placed in service and the history of file deletions and hard drive reformats.

(Mem. in Supp. of Pl.’s Mot. to Prevent Further Spoliation 2, D.E. 78.) According to Clark’s testimony, of 160 Lilly employees, only seven employees had accessed Yale’s secure website. Clark further testified that Lilly did nothing to preserve electronic evidence of access to Yale’s secure site when the user ID and password Lilly was using to access the site was canceled in December of 2010; Lilly did nothing to preserve electronic evidence of access to Yale’s secure site when it was served with Yale’s complaint in February 2011; and Lilly did nothing to preserve electronic evidence of access to Yale’s secure site after it received a “document hold” letter from Yale in March 2011, other than to forward the litigation hold letter received from its attorney to seven other employees.

In the present motion, Yale contends that the evidence Lilly failed to preserve goes to the very core of its claim, that Yale therefore has been deprived of the opportunity to use the evidence in support of its claim, and thus Yale has been prejudiced by Lilly’s failure to preserve evidence. In response, Lilly insists that Yale has failed to establish that Lilly spoliated any evidence whatsoever either by intentional destruction or by failing to preserve evidence and that Yale’s own server logs are the best evidence of access to Yale’s secure dealer website.

II. ANALYSIS

A. The 30(b)(6) Deposition of Lilly

Yale argues that Lilly violated Rule 30(b)(6) and the court’s order by failing to designate a person or persons knowledgeable about the topics listed in the deposition notice and by failing to adequately prepare the designated deponent. Lilly maintains that it complied with its obligations under Rule 30(b)(6) by producing Clark and that Clark was adequately prepared.

Rule 30(b)(6) governs the procedure for taking a corporation’s deposition. Under Rule 30(b)(6), a party may depose a corporation or organization by issuing a notice or subpoena that “describe[s] with reasonable particularity the matters for examination.” FED. R. CIV. P. 30(b)(6). “Obviously it is not literally possible to take the deposition of a corporation; instead, when a corporation is involved, the information sought must be obtained from natural persons who can speak for the corporation.” 8A Charles Alan Wright, Arthur R. Miller, & Richard L. Marcus, Federal Practice And Procedure, § 2103, at 451 (3d ed.2010). Rule 30(b)(6) requires a corporation to designate a person that can testify about information known or reasonably available to the corporation. Although the designated person does not need personal knowledge of the facts to which he testifies, he must be prepared by the corporation so that he can adequately testify as to the corporation’s position. See FDIC v. Butcher, 116 F.R.D. 196, 199 (E.D.Tenn.1986) (stating that a corporation must make a good-faith effort to designate persons having knowledge of the matter sought and to prepare those persons); Marker v. Union Fidelity Life Ins. Co., 125 F.R.D. 121, 126 (M.D.N.C.1989) (recognizing that Rule 30(b)(6) requires a corporation not only to produce persons to testify with respect to the designated matters, but also to prepare them so that they may give complete, knowledgeable, and binding answers on behalf of the corporation.)

Clark testified that to prepare for the deposition, in addition to meeting with Lilly’s attorney, he met with (1) Eric Wisher, Lilly’s Chief Operating Officer; (2) Wade Clark, Vice President of Lilly, for an hour or two; (3) Frank Robertson, IT director for Lilly, on several occasions; and (4) parts department personnel — Jerry Crouch for about 15 to 25 minutes, Bonnie Pine several times for 10 to 15 minutes each, and Steve Nanny for 8 to 10 minutes. Other than Crouch, Pine, and Nanny, Clark did not meet with any other employees in the parts department or employees in any of the other departments, namely the rental department, the service department, the accounting department, or the sales department, to prepare for the deposition. Other than Crouch, Pine, and Nanny, Clark did not meet with any other employees that he knew had accessed Yale’s secure dealer website. In particular, Clark did not meet with Ken Bullard, Corby Bullard, or Travis Jones, even though he knew they had accessed Yale’s secure dealer website. Nor did he search their computers to see what portion of Yale’s secure dealer website was accessed.

Even though Clark met with Wade Clark to prepare, Wade Clark did not provide any information in preparation of the 30(b)(6) deposition. Robertson and Clark, however, discussed the computers at the company, replacements and reformatting of hard drives, who accessed Yale’s secure dealer website and when, items that may have been copied from Yale’s secure dealer website, and file deletions. Clark determined which individuals accessed the site by speaking with the three employees in the parts department and one employee of approximately twenty-three in the sales department. He did not review any documents or records to determine who accessed the site, although he admitted that Lilly probably had such records available.

The court finds that Lilly failed to meet its obligation to provide a proper and prepared 30(b)(6) witness. Clark was not prepared to testify as to several topics. For example, Clark was unable to state with certainty the identity of persons to whom the KMH ID and password were disseminated or the portion of the website accessed, downloaded, viewed, copied, or forwarded by each employee who accessed the website. Clark had not spoken with each employee, who admittedly had accessed the website, to determine whether they had provided the KMH access information to any other Lilly employees or to determine what portion of the website each employee accessed, downloaded, copied, or disseminated. Nor had Lilly examined the computers of each employee who admittedly accessed the site to determine if any information from Yale’s secure website had been downloaded, copied, or forwarded.

Rule 37(b)(2) of the Federal Rules of Civil Procedure, authorizes a court to impose sanctions in cases where “a party or a party’s officer, director, or managing agent — or a witness designated under Rule 30(b)(6)” has failed “to obey an order to provide or permit discovery.” FED. R. CIV. P. 37(b)(2). Among the permissible sanctions, the court may refuse to allow a disobedient party to support or oppose designated claims or defenses, prohibit the party from introducing designated matters into evidence, or require the disobedient party to pay all reasonable costs and attorney fees. FED. R. CIV. P. 37(b)(2)(A) & (C).

The court finds that sanctions are appropriate under Rule 37. Here, the court had ordered Lilly to produce a 30(b)(6) representative; Lilly had a duty to produce a knowledgeable person as to each topic and to adequately prepare the deponent. But the deponent was neither knowledgeable as to all topics nor adequately prepared. Accordingly, Yale will be allowed to redepose Lilly’s corporate representative. The deposition shall last no longer than four hours exclusive of meals and breaks. The deponent will be allowed one fifteen-minute break halfway through the deposition that will not count toward the four-hour duration limit. Lilly must designate and produce a knowledgeable 30(b)(6) witness. Lilly is cautioned to adequately prepare its corporate representative.⁶ As a sanction, Lilly must bear the court reporter and transcript costs of the first deposition and Yale’s attorney fees and expenses incurred during the actual taking of the first deposition. Lilly is warned that, henceforth, failure to comply with the 30(b)(6) deposition requirements will lead to additional sanctions.

B. Lilly’s Alleged Failure to Preserve Evidence

In addition to the imposition of sanctions under Rule 37 for violation of a court order, the court may also impose sanctions for spoliation based on the court’s inherent authority to control the judicial process. Link v. Wabash R. Co., 370 U.S. 626, 630-31, 82 S.Ct. 1386, 8 L.Ed.2d 734 (1962) (stating that a court’s inherent power is “governed not by rule or statute but by the control necessarily vested in courts to manage their own affairs so as to achieve the orderly and expeditious disposition of cases.”); Adkins v. Wolever, 554 F.3d 650, 652 (6th Cir.2009); Clark Constr. Group, Inc. v. City of Memphis, 229 F.R.D. 131, 137-38 (W.D.Tenn.2005). Spoliation is “the destruction or significant alteration of evidence, or the failure to preserve property for another’s use as evidence in pending or reasonably foreseeable litigation.” Clark Constr. Group, Inc., 229 F.R.D. at 136 (quoting Zubulake v. UBS Warburg, LLC, 220 F.R.D. 212, 216 (S.D.N.Y.2003)). In 2009, the Sixth Circuit, overruling prior decisions, held that federal, not state, law governs spoliation issues. Adkins, 554 F.3d at 652.

A duty to preserve evidence is a prerequisite to imposing spoliation sanctions. Beaven v. United States Department of Justice, 622 F.3d 540, 553 (6th Cir.2010); Clark Constr. Group, Inc., 229 F.R.D. at 136-37; Zubulake v. UBS Warburg, LLC, 220 F.R.D. 212, 216-20 (S.D.N.Y.2003). A party has a duty to preserve all evidence, including electronically stored information (“ESI”), that it knows or should know is relevant to any present or future litigation. John B. v. Goetz, 531 F.3d 448, 459 (6th Cir.2008); Clark Constr. Group, Inc., 229 F.R.D. at 136; Zubulake, 220 F.R.D. at 216-18. “It is the responsibility of the parties to ensure that relevant ESI is preserved, and when that duty is breached, a district court may exercise its authority to impose appropriate discovery sanctions.” John B., 531 F.3d at 459. “The trigger date is the date a party is put on notice that it has a duty to preserve evidence.” Clark Constr. Group, Inc., 229 F.R.D. at 136; Zubulake, 220 F.R.D. at 217.

In order to determine if sanctions against Lilly are appropriate, the court must first determine (1) when Lilly’s duty to preserve evidence arose; (2) the scope of Lilly’s duty to preserve evidence; (3) whether Lilly’s litigation hold and search and collection efforts were sufficient; and (4) if not, whether sanctions should be imposed on Lilly, including requiring Lilly to pay for the costs of the forensic examinations and mirror imaging of its own computers.

1. When Lilly’s Duty to Preserve Evidence Was Triggered

It is undisputed that when Lilly was served with the verified complaint on February 25, 2011, Lilly’s duty to preserve evidence was triggered. In addition, when Lilly received a litigation hold letter from its own attorney and a preservation letter from Yale in March 2010, it had a duty to preserve evidence. Yale insists, however, that Lilly had a duty to preserve evidence in December 2010 when it first learned that its employees had been accessing Yale’s secure website.

Lilly argues that it was not aware of the possibility of litigation in December 2010. Lilly insists that it was first made aware of its employees’ access to Yale’s secure dealer website when Clark, Lilly’s President, received an email from Michael Guenin, the President of KMH, on January 14, 2011, in which Guenin forwarded to Clark a draft letter to Yale in response to inquiries made by Yale to KMH concerning Lilly’s access to Yale’s website using a KMH ID and password. Lilly asserts that the tone of Guenin’s letter suggested resolution of the matter, not litigation. (Lilly Resp. 3, D.E. 82.) Lilly further argues that Yale did not write a “cease and desist letter” or a preservation letter or any correspondence indicating Yale’s intent to file suit against Lilly before Lilly was served with the complaint on February 25, 2011.

Yale argues that Lilly knew about its employees’ access prior to the January 14, 2011 email because Guenin and Clark exchanged drafts of the letter before it was sent to Yale. Merely because Lilly knew of its employees’ access does not necessarily mean that Lilly had reason to anticipate litigation. Yale did not contact Lilly or send Lilly any type of pre-litigation letter or cease-and-desist letter. Based on these facts, the court cannot conclude that Lilly had reason to anticipate litigation prior to being served with the lawsuit. Therefore, at the earliest, on February 25, 2011, when Lilly was served with the complaint, Lilly knew or should have known that electronic evidence residing in its computers would be relevant to the litigation.

2. The Scope of the Duty to Preserve

A party has a duty to preserve all relevant documents — but not multiple identical copies — in existence at the time the duty to preserve attaches and any relevant documents created thereafter. Zubulake, 220 F.R.D. at 218. It is well established at this time that the duty to preserve evidence includes the duty to preserve electronic evidence. Pension Comm. of the Univ. of Montreal Pension Plan v. Banc of Am. Secs., LLC (Zubulake Revisited: Six Years Later), 685 F.Supp.2d 456, 475 (S.D.N.Y.2010).

Given the allegations concerning computer access, which Lilly did not deny, Lilly’s duty to preserve potentially relevant ESI was very broad. Here, Lilly had a duty to preserve any electronic evidence of access to Yale’s site, such as Lilly’s server logs or Internet history. In addition, Lilly had a duty to preserve any electronic data downloaded from Yale’s secure dealer website onto any Lilly computers, plus hard copies of data downloaded from Yale’s secure website which were in existence at the time Lilly was served with the complaint, as well as data obtained after being served with the complaint.

3. The Sufficiency of Lilly’s Preservation and Collection Efforts

“The first step in any discovery effort is the preservation of relevant information.” Banc of Am. Secs., LLC, 685 F.Supp.2d at 464. Upon being served with the lawsuit on February 25, 2011, Lilly took no immediate action whatsoever to preserve any data, electronic or paper.⁷ In addition, upon receiving the preservation letter, approximately twelve days later, Lilly failed to issue a written company-wide litigation hold. Instead, Clark simply circulated the litigation hold letter to seven Lilly employees out of Lilly’s 160 employees without any additional instruction. The failure to issue a written litigation hold is “likely to result in the destruction of relevant evidence.” Id. at 465. These seven employees, however, were not even all the “key players,” who had admittedly accessed Yale’s secure dealer website. Clark did ask Robertson if there was anything Lilly needed to do to Lilly’s computer system to make sure information was not lost, but there is no evidence that Robertson ever responded to Clark or took any action. Lilly did not take any steps to prevent emails from being deleted, to prevent data from being overwritten, or to identify and preserve backup tapes which might contain the only electronic evidence of access to Yale’s secure dealer website.

According to the professional opinion of Yale’s technical expert, reasonable steps to preserve evidence would have entailed sending the March 8, 2011 preservation letter to all Lilly employees, suspending the routine destruction of such evidence, and “taking steps to preserve active data stored or found on servers, backup tapes, or other media.” (KempVanEe Supp. Aff. ¶¶ 9-11, D.E. 86-3.)

“The next step in the discovery process is collection and review.” Banc of Am. Secs., LLC, 685 F.Supp.2d at 465. Upon being served with the lawsuit and upon receiving the preservation letter, Lilly took no steps to timely collect evidence. It was not until May 2011, nearly three months after Lilly was served with the complaint in this lawsuit, that Robertson searched Lilly’s servers for any electronic documents containing the word “Yale” in the file name. According to Robertson’s affidavit, he found none downloaded since the installation of the firewall, but he doesn’t say what was downloaded before the firewall’s installation. Lilly took no steps, of which the court is aware, to collect evidence from the key players or to search key players’ computers to see if ESI existed or had been deleted. It appears that Lilly left collection efforts to its employees to search their own computers with no supervision or oversight from management. Lilly did not follow up with its employees to determine what efforts were taken to preserve and collect relevant evidence, and Lilly failed to document any of its search and collection efforts. Indeed, it is not even clear who was in charge of the preservation, search, and collection efforts at Lilly. Although Lilly was probably not equipped to conduct computer searches itself, Lilly failed to retain a technical expert.

In summary, after the duty to preserve was triggered, Lilly failed to timely issue an effective written litigation hold, to take appropriate steps to preserve any existing electronic records, to suspend or alter automatic delete features and routine overwriting features, and to timely and effectively collect ESI. Therefore, the court finds that Lilly breached its duty to preserve relevant evidence.

C. Appropriate Sanctions

The next question is what sanctions, if any, are appropriate in light of Lilly’s violation of its discovery obligations. Yale asserts that it may ultimately be entitled to an adverse inference based on Lilly’s failure to preserve evidence; however, Yale does not seek an adverse inference at this time. Rather, Yale asks the court to require Lilly to pay for the cost of the forensic examination of Lilly’s computers, including the completed previews of the 37 computers, the cost of making mirror images of the hard drives of 17 computers,⁸ the cost of analyzing the data on the 17 mirror imaged hard drives,⁹ and the cost of making mirror images of the hard drives of the remaining approximately 100 computers at Lilly.¹⁰ Lilly argues that before any sanctions are appropriate, Yale must prove actual destruction of relevant evidence and that Yale cannot prove any such destruction. In addition, Lilly argues that even if ESI were destroyed, Yale has not been prejudiced because Yale has the best evidence of unauthorized access: Yale’s own server logs. Lilly also insists it should not be required to image the hard drives of its own computers because Yale has failed to show “some interest significant enough to overcome the risk of improper exposure of confidential or private personal information” that could result in mirror imaging. (Resp. 2, D.E. 82.)

In order to decide if sanctions are appropriate, the court must first determine the degree of culpable conduct, that is, whether Lilly’s conduct was negligent, grossly negligent, or willful, wanton, and reckless. The Sixth Circuit recognized that “[b]ecause failures to produce relevant evidence fall ‘along a continuum of fault-ranging from innocence through the degrees of negligence to intentionality,’ the severity of a sanction may, depending on the circumstances of the ease, correspond to the party’s fault.” Adkins v. Wolever, 554 F.3d 650, 652 (6th Cir.2009) (citation omitted). In Judge Scheindlin’s opinion, “Possibly after October, 2003, when Zubulake IV was issued, and definitely after July, 2004, when the final relevant Zubulake opinion was issued, the failure to issue a written litigation hold constitutes gross negligence because that failure is likely to result in the destruction of relevant information.” Banc of Am. Secs., LLC, 685 F.Supp.2d at 464-65; see also Treppel v. Biovail Corp., 249 F.R.D. 111, 121 (S.D.N.Y.2008) (holding that the failure to preserve backup tapes after December 2003 was sufficient to constitute gross negligence or recklessness). But see Adorno v. Port Auth. of N.Y. & N.J., 258 F.R.D. 217, 228-29 (S.D.N.Y.2009) (holding that defendants were only negligent where they instituted some form of a litigation hold). In addition, the failure to collect relevant documents from key players, in Judge Scheindlin’s opinion, also constitutes negligence. Banc of Am. Secs., LLC, 685 F.Supp.2d at 465.

Here, within approximately two weeks after being served with Yale’s complaint, Lilly instituted a very limited written litigation hold by forwarding Yale’s preservation letter to seven employees, then later to two more. Despite sending the letter to ultimately nine employees, Lilly took no other affirmative steps to preserve electronic data. Lilly did not issue any directive to employees to alter delete functions in its email program, to preserve Internet logs, or to preclude overwriting on its computers and servers. In addition, Lilly failed to proceed to collect potentially relevant documents and ESI from key players. Based on these facts alone, the court finds at this time that Lilly’s conduct was, at a minimum, negligent in discharging its discovery obligations.¹¹

Having determined the degree of culpability, the court must also decide who should have the burden of proof as to the relevance of evidence that has been lost or possibly lost and the prejudice to the innocent party. This court agrees again with Judge Scheind-lin:

The burden of proof question differs depending on the severity of the sanction. For less severe sanctions — such as fines and cost-shifting — the inquiry focuses more on the conduct of the spoliating party than on whether documents were lost, and if so, whether those documents were relevant and resulted in prejudice to the innocent party.

Banc of Am. Secs., LLC, 685 F.Supp.2d at 467.

As Lilly correctly points out, Yale has not produced any proof that relevant evidence was, in fact, destroyed. Because of Lilly’s inadequate preservation and collection efforts, however, no one may ever know if relevant evidence was actually destroyed. For all anyone knows, Yale’s copyrighted and trademarked material and proprietary information could have been downloaded and shared among Lilly’s employees for years, and Lilly could have used the information to obtain a competitive advantage over Yale. Likewise, until it is known whether relevant evidence was-lost or destroyed, it is impossible to know the extent of the prejudice suffered by Yale.¹² Given the fact that Lilly admitted that its employees accessed Yale’s secure website, it seems probable — even very likely — that some relevant ESI, such as Internet history or server logs that show Lilly’s employees accessed Yale’s secure dealer website, existed when Lilly’s duty to preserve attached but may have been lost by Lilly’s failure to copy data on its server or preserve back-up tapes. The potentially missing server logs or back-up tapes may have been the only source for that information.

It is within the broad discretion of the court to impose sanctions. However, “[t]he court should always impose the least harsh sanction that can provide an adequate remedy.” Banc of Am. Secs., LLC, 685 F.Supp.2d at 469; see also Freeland v. Amigo, 103 F.3d 1271, 1277 (6th Cir.1997) (requiring consideration of less drastic sanctions before sanction of dismissal is imposed). “[A] proper spoliation sanction should serve both fairness and punitive functions.” Adkins, 554 F.3d at 652.

Yale does not request a severe sanction such as default judgment or adverse inference at this time, and severe sanctions are not warranted now because Yale has not presented sufficient evidence of relevance and prejudice at this time. But, because Lilly was negligent in performing its discovery obligations, the court finds a lesser sanction is appropriate.

Courts should be free to tailor sanctions in order to remedy any harm caused by a failure to implement litigation holds to preserve potentially relevant evidence. See Treppel, 249 F.R.D. at 124 (“ ‘[T]rial judges should have the leeway to tailor sanctions to insure that spoliators do no benefit from their wrongdoing — a remedial purpose that is best adjusted according the facts and evidentiary posture of each case.’ ” (quoting Reilly v. Natwest Mkts. Grp. Inc., 181 F.3d 253, 267 (2nd Cir.1999)). At a minimum, additional discovery in the form of searches for relevant evidence is needed. The only way to determine if relevant evidence currently exists or previously existed and was lost or destroyed is to conduct a forensic examination to see if such evidence exists. Pursuant to court order, Yale has already done an initial preview forensic examination of thirty-five of Lilly’s computers and imaged the hard drives of seventeen computers at a significant cost. Yale seeks reimbursement of its forensic examination costs to date as a sanction. Because Lilly’s deficient preservation and collection efforts necessitated these actions, the court finds that Lilly should bear these costs.

Yale also asks the court to require Lilly to bear the cost of a forensic analysis to be performed by LogicForce of the data contained on the seventeen mirror imaged hard drives. Lilly objects to an analysis of the data by LogicForce citing concerns about personal, confidential, and proprietary information that may be contained on the hard drives. These concerns are addressed in and alleviated by the protective order already in place which provides that a party may designate certain documents as “Confidential” or “Attorneys’ Eyes Only” and certain safeguards will then apply. (Protective Order, June 17, 2011, D.E. 58.) Again, because Lilly’s deficient preservation and collection efforts necessitates a forensic analysis of the data, the court finds that analyses of the data on the hard drives of some of the computers is warranted at this time and that Lilly should bear these costs. Specifically, Log-icForce shall conduct forensic analyses of the mirror imaged hard drives of the computers of the nine employees who admittedly accessed Yale’s secure dealer website using the best practices. LogicForce shall conduct the analyses within fourteen days of the date of this order and prepare a report on its finding.¹³ Any documents or evidence recovered shall be provided to Lilly’s attorneys first for privilege and confidentiality review. If Lilly withholds any documents as privileged, it must so indicate on a privilege log. The remaining documents and privilege log shall be provided to Yale’s counsel within fourteen days of receipt of the report and documents from LogicForce. If the forensic analyses of these hard drives reveal relevant information or destruction of relevant information, then Yale may petition the court to conduct forensic 'analyses of the remaining mirror imaged hard drives.

Further, Yale requests that Lilly be required to bear the cost of mirror imaging the hard drives of all the remaining Lilly computers. Relying primarily on the Sixth Circuit’s opinion in John B. v. Goetz, 531 F.3d 448 (6th Cir.2008), Lilly opposes forensic imaging of the remainder of its computers asserting that the duty to preserve evidence does not require it to image its computers and Yale’s unfounded concern about potential loss of evidence is not sufficient to warrant imaging.¹⁴

In John B. v. Goetz, the Sixth Circuit warned that courts should proceed cautiously “in requiring the mirror imaging of computers where the request is extremely broad in nature and the connection between the computers and the claims in the lawsuit are unduly vague or unsubstantiated in nature.” John B., 531 F.3d at 459-60. Here, Yale has demonstrated, and Lilly readily admits, that employees in the parts department accessed Yale’s secure site. Thus, it is likely that the computers of the employees in the parts department may contain relevant information or evidence of deletion, and mirror imaging of the hard drives of the computers in this department is warranted. In addition, Yale has come forward with proof that diagnostic software, which would only be needed by the service department, was downloaded. This is a sufficient basis to warrant mirror imaging of the computers in Yale’s service department at this time.¹⁵ As to the other departments, Yale has not established a sufficient connection to its claims, and the likelihood that relevant information would be revealed by mirror imaging is small. Yale’s request is denied as to these computers.

It bears repeating. Lilly is required to bear these costs because its preservation and collection efforts were woefully inadequate. Parties must take their duty to preserve ESI seriously. In order to avoid sanctions, such as these, parties must cooperate and voluntarily preserve, search for, and collect ESI.

To assure that Lilly is complying with its duty to preserve evidence going forward, particularly as to those computers that are not the subject of court-ordered forensic examinations, Lilly is ordered to file with the court an affidavit or declaration setting forth in detail each step it has taken to preserve, search for, and collect potentially relevant information, both electronic and paper, from the time Lilly was served with the complaint and to the present, the name of the person taking such steps, and the date on which the steps were taken. The declaration should include (1) when a written litigation hold was issued; (2) the names of the employees to whom it was issued; (3) when the hold was reiterated and by whom; (4) the name of the person in charge of overseeing the preservation, search, and collection efforts; (5) what computers and files were searched and by whom; and (6) the search method utilized. In addition, Lilly is directed to certify to the court, under oath, that automatic delete functions on the remaining computers that have not been imaged have been suspended and that any backup tapes from the time Lilly was served with the complaint that may be the only source of relevant information have been preserved.

The court also finds that monetary sanctions are appropriate. Yale is entitled to an award of reasonable costs, including its attorney fees, associated with bringing this motion. Yale’s counsel is directed to submit an affidavit within fourteen days of the date of this order verifying the amount of expenses, including attorney fees, incurred by Yale in bringing this motion. Lilly shall have seven days from service of the affidavit to file objections to the amount of costs and fees requested by Yale.

III. CONCLUSION

Lilly failed to take reasonable steps to preserve, search for, and collect potentially relevant information, particularly electronic data, after its duty to preserve evidence was triggered by being served with the complaint. Lilly’s failure to take steps to preserve evidence may have resulted in the destruction of relevant evidence. In addition, Lilly failed to present an adequately prepared and knowledgeable 30(b)(6) deponent. Therefore, the sanctions set forth in this order are appropriate.

1 . Yale reserves the right to seek an adverse inference instruction to a later date.

2 . Clickwrap agreements pop up on a user’s screen and will not allow the user to access a website or install, download, or use a program or service without the user manifesting his or her assent to the license agreement by clicking on an icon. Specht v. Netscape Commc'ns Corp., 306 F.3d 17, 22 n. 4 (2d Cir.2002).

3 . The termination of Lilly as an authorized Yale dealer was the subject of previous litigation between Lilly and Yale. (Nacco Materials Handling Grp., Inc. d/b/a Yale Materials Handling Corp. v. Toyota Materials Handling USA, Inc., and The Lilly Company, No. 03-22561B, Western District of Tennessee.)

4 . During the examination, LogicForce discovered the hard drives in two Lilly computers had been replaced: (1) Bonnie Pine’s computer and (2) Justin Grant’s computer. (KempVanEe Decl. ¶¶ 22, 23, D.E. 78-1.) Since that time, Lilly has located the original hard drives, which are now available for inspection by LogicForce. (Lilly Resp. 5, D.E. 82; Robertson Decl. ¶¶ 13-14, D.E. 84.) Based on Lilly's representation that the original hard drives have not been destroyed but are still available, the court will not consider this fact in determining whether there has been spoliation of evidence.

5 . On June 30, 2011, Lilly filed a motion to dismiss for failure to state a claim upon which relief can be granted. (D.E. 61.) The motion is still pending. Lilly sought the stay of discovery pending resolution of the motion to dismiss.

6 . Lilly can produce Clark again, but he must be adequately prepared this time.

7 . In January of 2011, Lilly's IT director installed a firewall blocking any access through Lilly's server to any "yale.com” website. According to Yale’s consulting expert, however, the firewall would not have prevented Lilly employees from accessing "yaleacessonline.com” through Lilly's servers or from accessing Yale's secure dealer website through other servers, for example, by using a laptop at an Internet café, at home with a personal wireless connection, or on the road using a wireless card. (KempVanEe Supp. Aff. ¶¶ 5, 6 D.E. 86-3.) Thus, the firewall did not prevent Lilly employees from obtaining data from Yale's secure website after it was installed in January of 2011.

8 . At the hearing, Yale estimated its cost to date of previewing the thirty-seven computers and copying the hard drives of seventeen computers to be approximately $75,000.

9 . At the hearing, Lilly estimated this cost to be approximately $55,000.

10 . At the hearing, Yale estimated this cost to be approximately $300 per computer.

11 . The court makes no further finding as to the degree of culpable conduct by Lilly at this time but may reconsider its determination if additional evidence of culpable conduct is revealed during discovery.

12 . For instance, because Yale has its own server logs, Yale may not be prejudiced by destruction of Lilly's Internet history logs or server logs. However, Yale’s server logs would not show what parts of Yale’s secured website were accessed and what the Lilly employees did with the information.

13 . The parties can extend the deadlines set forth herein by mutual agreement without seeking leave of court.

14 . Lilly also reiterates its privacy and confidentiality concerns which the court has already addressed.

15 . In addition, the parties have agreed to mirror image certain computers that may or may not be encompassed by this order.