Equity Analytics, LLC v. Lundin

MEMORANDUM OPINION

JOHN M. FACCIOLA, United States Magistrate Judge.

INTRODUCTION

In this suit, Equity Analytics, LLC (“Equity”) claims that its former employee, Timothy Lundin (“Lundin”), gained illegal access to electronically stored information after he was fired.

Equity employee, Melissa Kirk (“Kirk”), is assistant vice president of operations and, in that capacity, assists in the oversight of the security of Equity’s computer system. Plaintiff Equity Analytics, LLC’s Motion for Order Authorizing Examination of Defendant’s Computer [# 25], Exhibit 8 (“Doc. 25-8”) at ¶ 1. She explains that Lundin was fired in December, 2006. Id. at ¶ 6. On October 30, 2007, the senior system administrator told Kirk that one of the members of the Equity staff had reported an unauthorized user accessing Equity’s Salesforce.com, account. Kirk then ascertained that two Equity employees had logged into this account using a Macintosh operating system and a Firefox browser on several days between May 28, 2007, and October 28, 2007, although Equity employees were only issued PC’s with a Windows 2003 Professional operating system and Internet Explorer and were not permitted to change either the operating system or web browsing software. Id. at ¶¶ 11, 12.

For his part, Lundin explains that Eric Aguirre, another employee at Equity, granted Lundin permission to use Aguirre’s user-name and password to access Equity’s Sales-force.com account. Defendant Timothy D. Lundin’s Memorandum in Support of its Response and Opposition, in part, to Plaintiff Equity Analytics, LLC’s Motion for Order Authorizing Examination of Defendant’s Computer [# 26], Exhibit 2 (“Doc. 26-2”) at ¶ 44. Lundin then states: “Over the next 90 days between June 21, 2007 and September 18, 2007, I used the access that Aguirre provided me with his username and password to [access] Salesforce.com some eighteen times.” Id. at ¶45. Lundin indicates that he used his Macintosh computer to access Salesforce.com. Doc. # 26-2, passim.

DISCUSSION

I. The Contents of Lundin’s Computer

On November 8, 2007, Judge Lamberth issued a temporary restraining order against Lundin that, inter alia, prohibited him from “accessing or attempting to access Equity Analytics, LLC’s data on Salesforce.com for any purpose.” Order of November 8, 2007[# 4] (“Doc. 4”) at ¶ 2(b).

Initially, Judge Lamberth struck from the order that Equity had proposed a requirement that Lundin permit Equity to have a computer forensic expert examine Lundin’s computer to ascertain: (1) whether Lundin accessed Equity’s confidential customer data and/or trade secrets; (2) whether the data has been forwarded to Lundin’s new employer an Equity competitor; and (3) whether the data was purged or overwritten. Doc. 4 at ¶ 4.

Although Judge Lamberth struck this provision, the parties are now agreed that a computer forensic specialist should be permitted to examine Lundin’s Macintosh computer. Unfortunately, even though they have been trying diligently with my encouragement to arrive at a protocol for the search, they have reached an impasse that I must now resolve.

II. The Use of Keywords to Search

Lundin now works out of his home and uses the Macintosh computer and portable hard drives to store data and for many other purposes. As a result, the computer and the hard drives contain: (1) attorney-client communications; (2) business records; (3) medical records; (4) tax and banking records; and (5) data (including images) created for his professional photography business. Doc. 26-2 at ¶¶ 74-75. Since there is data on the computer and the hard drives that is personal, private, and privileged, plaintiffs counsel has proposed that the forensic computer examiner (hereafter “the examiner”) use search terms to restrict the search to data that is relevant to this case. Doc. 26 at 2.

Equity argues that search terms are inadequate because Lundin indicates that he loaded a new operating system (“Leopard”) onto the Macintosh on October 31, 2007 (Doc. 26-2 at ¶¶ 67-69), and doing so could have compromised the integrity of the files that were previously on the computer. Doc. 25 at 4.

Lundin also proposes that the search first be limited to certain file types, i.e., MS Word (.doc, .txt, .rtf),¹ MS Excel (.csv, .xml), MS Powerpoint (.ppt), MS Entourage² and Adobe Acrobat (.pdf)- Doc. 25-6 at 1. Once those files are found, the search would then be limited to files that contain certain key words. Id.

Equity protests that files can be converted easily from one format to another to “disguise their identity.” Doc. 25 at 4. Thus, Equity argues that confidential files could have been downloaded and saved in a phony format, i.e., a document stolen from Equity could have been saved as a .jpg file, used to save an image, rather than as a .doe file that is used to save a Word document. Id. at 4-5. Additionally, if there are less than complete files, in the form of fragments of information, a file extension and keyword search will not capture them. Id. at 5.

III. Resolution of the Controversy

I recently commented that lawyers express as facts what are actually highly debatable propositions as to efficacy of various methods used to search electronically stored information. United States v. O’Keefe, No. 06-CR-249, 2008 WL 44972, at *8 (D.D.C. Feb. 18, 2008).

As I explained in that case, determining whether a particular search methodology, such as keywords, will or will not be effective certainly requires knowledge beyond the ken of a lay person (and a lay lawyer) and requires expert testimony that meets the requirements of Rule 702 of the Federal Rules of Evidence. Obviously, determining the significance of the loading of a new operating system upon file structure and retention and why the contemplated forensic search will yield information that will not be yielded by a search limited by file types or keywords are beyond any experience or knowledge I can claim.

Accordingly, I am going to require Equity to submit an affidavit from its examiner explaining why the limitations proposed by plaintiff are unlikely to capture all the information Equity seeks and the impact, if any, of the loading of the new operating system upon Lundin’s computer and the data that was on it before the new operating system was loaded. The expert shall also describe in detail how the search will be conducted. Armed with that information, supplemented if necessary by a hearing at which the expert will be cross examined, I can make the best possible judgment as to how to balance Equity’s need for information against Lundin’s privacy.

IV. E-Mails

In its deposition request, Equity asked for information concerning some eight companies. Doc. 25-6 at 2. In a portion of his proposed Protocol, Lundin describes some of the information that he believes will be in the computer and the hard drives and makes reference to these eight companies. Equity protests that, while it does not dispute that information about these companies are the ones Lundin recollects, it should not be limited to the companies Lundin recalls. Doc. 25 at 5. Similarly, Equity identified certain companies it believes Lundin contacted but insists that its search should not be limited to them either.

Lundin, in reply, does not speak to either of these issues and I believe that Equity is correcting on insisting that the examiner must search for evidence of any contact between Lundin’s and any of Equity’s current and prospective clients.

V. Return of the Hard Drives

The parties contemplate that the examiner will make a mirror image of the hard drives, but they differ over what then happens to the hard drives. Lundin, who needs the computer and the data to make a living, see Doc. 26-2 at ¶73, wants them returned to him as soon as the mirror image is made. Equity wants them preserved in their present condition until this litigation is concluded. It fears that if “some evidentiary issue or the issue of spoliation arises, the parties will be unable to review of [sic] the original hard drives to resolve the issue because they would have [been] altered by Lundin’s use.” Doc. 25 at 11.

But, it is my understanding of the technology, based for the most part on my understanding of the FBI’s procedures in the criminal cases where I issue search warrants, that the mirror image is a perfect duplication of the hard drive and that it is physically impossible for the mirror image to contain anything the hard drive does not and for there to be anything on the mirror image that is not on the hard drive. Once again, I will turn to the examiner for his or her knowledge and require that in the declaration I am ordering the examiner speak to whether there is any possibility whatsoever that the mirror images will not be perfect copies of the hard drives and whether there is any need to preserve the hard drives in their original condition once the mirror images are created.

VI. Agreement Versus Order

The parties have differed over whether the document they were negotiating will be in the form of an agreement or order. It will be in the form of an order that I will issue. Lundin indicates that the hard drives may contain attorney-client communications. See Doc. 26 at 7. As Magistrate Judge Grimm pointed out in what is now the seminal decision on the question, a judicially compelled disclosure of otherwise privileged information is not a waiver of any privilege that could be claimed. See Hopson v. Mayor, 232 F.R.D. 228, 232 (D.Md.2005)³ Thus, an order can accomplish what an agreement between counsel cannot and I will issue an order.

VII. “Whereas" Clauses

Lundin, although he is consenting to the forensic examination of the hard drives, still insists that he has concerns about the court’s jurisdiction as well as any attempt by Equity to shift the cost of the examination to him, and wants to insert certain “whereas” clauses into the agreement. See Doc. 25-6 at 1-2. Equity disputes the necessity of inserting such clauses into the agreement, on the grounds that “any issues of the waiver of any defenses or the shifting of any costs are best addressed under the Federal Rules of Civil Procedure and appropriate case law, not by agreement of the parties.” Doc. 25 at 10.

However unlikely, Equity, who is going to pay for the forensic examination, may try to recover that cost at some latter point in the litigation if the order does not preclude such an effort. I do not share Lundin’s concern, however, about waiving any claim that the court lacks jurisdiction over the subject matter — such a claim may be made at any time. See Fed.R.Civ.P. 12(h)(3) (court must dismiss an action whenever it appears that it lacks jurisdiction over the subject matter).

Nevertheless, in the interest of prompt resolution of this matter, my order will contain a provision that Lundin, by not objecting to the forensic examination, is not thereby consenting to any additional discovery and reserves the right to move at any time to dismiss the case for lack of jurisdiction over its subject matter. My order will also provide that the cost of the examination will be borne by Equity and that it may not seek to recover that cost from Lundin at any time or for any purpose.

VIII. Report

The parties also quarrel over whether the examiner will produce a report. The examiner shall produce such a report because doing so will, in my view, expedite the conclusion of this matter.

An Order accompanies this Memorandum Opinion

ORDER

In accordance with the accompanying Memorandum Opinion, it is, hereby,

ORDERED by March 20, 2008, that Equity submit an affidavit from its examiner explaining the following:

1) Why the limitations proposed by plaintiff are unlikely to capture all the information Equity seeks and the impact, if any, of the loading of the new operating system upon Lundin’s computer and the data that was on it before the new operating system was loaded;

2) How the search will be conducted; and

3) Whether there is any possibility that the mirror images will not be perfect copies of the hard drives, and whether there is any need to preserve the hard drives in their original condition once the mirror images are created.

Plaintiff may file a reply thereto by March 31, 2008.

SO ORDERED.

1 . The three letters preceded by the period indicate the file extension.

2 . Lundin does not provide a file extension for MS Entourage files.

3 . This is the principle that underlies proposed Federal Rule of Evidence 502. See John M. Facciola, Sailing on Confused Seas: Privilege Waiver and the New Federal Rules of Civil Procedure, 2 Fed. Cts L. Rev. 57 (2007).