e-Discovery Team Training

Welcome to Module 3-L.

More on the Key Problem of “Not Reasonable Accessible” Data.

This module goes deeper in the issue of preservation of relatively inaccessible ESI and Rule 26(b)(2)(B), a key rule for e-discovery. It starts with the troublesome issue of backup tapes (this is the one that gives all e-discovery lawyers nightmares), and then moves on to cache and double-deleted files (a phrase Losey thinks he coined).

Should a Litigation Hold Include Backup Tapes?

I think Judge Scheindlin got it right in Zubulake IV when she held that a litigation hold should not, as a general rule, include backup tapes. Zubulake v. UBS Warburg LLC, 220 F.R.D. 212, 218 (S.D.N.Y. 2003):

The scope of a party’s preservation obligation can be described as follows: Once a party reasonably anticipates litigation, it must suspend its routine document retention/destruction policy and put in place a litigation hold to ensure the preservation of relevant documents. As a general rule, that litigation hold does not apply to inaccessible backup tapes, for example, typically maintained solely for the purpose of disaster recovery, which may continue to be recycled on the schedule set forth in the company’s policy. (emphasis added)

Judge Sebelius in Kansas agreed with Judge Scheindlin and held that a company is not required to suspend the normal recycling of its backup tapes as part of a litigation hold. Oxford House, Inc. v. City of Topeka, Kansas, 2007 WL 1246200 at *4 (D.Ka. April 27, 2007). Such suspensions as part of a routine litigation hold can be very disruptive and expensive to any large organization with substantial ESI to backup. In most e-discovery cases, the tapes are never needed, and so the cost of routine preservation in every case is simply not justified. Further, disaster recovery type backup tapes are not reliable and decay over time. Even when the tapes are preserved, they are always difficult to recover, data is often lost, and you are never certain that the relevant evidence can be restored.

Admittedly in some rare cases, backup tapes may be the only place relevant ESI is still located by the time an organization receives notice of a suit. In these circumstances, the imposition of a hold at that time would be the only way to preserve relevant evidence. If an organization has notice of these unusual facts, then the general rule should probably not apply, and the hold notice should cover backup tapes. But such circumstances are highly unusual. Most of the time a defendant at the time of hold does not know whether the tapes will be needed. In a few unusual cases, it is later discovered that the tapes were needed, and should have been preserved. These few exceptional cases do not justify the disruption caused in the vast majority of cases where the tapes are never needed.

The general rule of exclusion of backup tapes from a hold is tested in the rare case; the case where it turns out the tapes should have been preserved. Oxford House is just such a case. Here a Topeka City Commissioner was found during discovery to have deleted certain relevant email in June of 2005. The plaintiff claimed spoliation and sought sanctions. The court rejected this argument because it found that litigation was not reasonably anticipated until August of 2005, two months after the email deletion. The destruction of email before a duty to preserve arises cannot constitute spoliation.

That part is fairly cut and dried. But the plaintiff also argued that the city should have preserved its email backup tapes. It did not. Instead, even after the August hold date, the city continued its normal backup tape recycling. It continued to reuse the same tapes and thus erase the old emails and other information from the previous backups. The city was on notice of pending litigation at the time it continued to recycle the tapes, and so from a time perspective at least, the duty to preserve had arisen. But the city did not then know that the Commissioner had deleted relevant emails and the tapes might be the only place they could still be found.

This situation raises the issue of the scope of the duty to preserve; did it extend to backup tapes? Clearly the preservation duty applied to “live” ESI, to the easily accessible email on the city’s computers, but did it also run to the backup tapes? Some would say yes, especially legal counsel representing a party with little electronic evidence at issue. They disregard or attempt to minimize the cost and disruption caused by the routine imposition of holds on backup tape operations. The plaintiff, Oxford House, was of that ilk, and argued that the city had a duty to preserve backup tapes; but the court did not agree.

The backup tapes used by Topeka were disaster recovery type tapes. They were not reasonably accessible, meaning they could be accessed, but only at great cost and expense. In fact, the city estimated a cost of at least $100,000 to restore and review the tapes. Judge Sebelius in Kansas, like Judge Scheindlin in Manhattan, was right to hold that these kinds of tapes do not have to be preserved. A company should not have to stop its normal, good faith operation of recycling disaster recovery tapes every time litigation is threatened or materializes.

The City of Topeka first opposed plaintiff’s sanctions argument on the backup tapes the same way it opposed sanctions for deletion of the live email. The city argued that the relevant emails had already been deleted from the backup tapes before August 2005, and so a duty to preserve never arose before deletion. They made this claim because the backup tapes are supposed to be recycled every six weeks. Since there was an approximate eight week gap between the estimated time of email deletion, and notice of pending litigation, the city argued that the emails in question were no longer on the backup tape in August, 2005. In effect, they argued that the notice to preserve came two weeks too late, and so there was no need for the court to consider whether the scope of duty included backup tapes.

Judge Sebelius recognized that it was a close question as to whether the emails would still have been on the backup tapes or not. Of course the city argued that its normal recycling procedures had been followed, and for that reason the emails would already have been written over in six weeks. But this is a slippery slope of an argument because it is hard to know if the exact timing of the recycling protocols were in fact followed, and the timing here was close.

If the facts alleged by the city had been proven, which is difficult to do, then once again there would have been no spoliation based on timing. The erasure of the backup tapes, just like the deletion of the emails, would have occurred before a duty to preserve arose. Then the court would not have had to decide whether the duty to preserve extended to backup tapes. But the city’s argument was on shaky grounds, and apparently not well confirmed by affidavits or depositions. In any event, the judge chose to reject it, and face the issue of the scope of preservation head on. Still, in other circumstances with a more fully developed evidentiary record, this argument alone might succeed.

The court denied plaintiff’s motion for sanctions for backup tape spoliation based on the assumption that the deleted emails were still on the backup tapes in August at the time the duty arose. In the words of Magistrate Judge Gary Sebelius:

In the court’s view, even if such back up tapes were conclusively shown to possess the deleted e-mail communications, “as a general rule, a party need not preserve all backup tapes even when it reasonably anticipates litigation.” Zubulake, 220 F.R.D. at 217. When parties put a litigation hold policy on destruction of documents in response to pending litigation, “that litigation hold does not apply to inaccessible back-up tapes (e.g., those typically maintained solely for the purpose of disaster recovery), which may continue to be recycled on the schedule set forth in the company’s policy.” Id. The record in this case indicates that the back-up tapes are used for disaster recovery purposes.

The decision goes on to consider the related issue of whether the city should be forced to search its current backup tapes now, almost two years after the emails in question had been deleted. Plaintiff argued that there was a chance the emails were still on the tapes in spite of their reuse. Plaintiff wanted to put the City of Topeka to the expense of undertaking the restoration and search of backup tapes on the chance that the emails in question had never been written over. Plaintiff argued that the emails could possibly still be on the tapes because they might have been stored at the very end of the tapes, and no subsequent backups went that far. This argument was based more on hope than reason, and was rejected by the Court:

It is certain that the cost of retrieval of data would be high. However, this factor is not dispositive–consideration must also be given to the potential efficacy of a technique seeking discoverable information. The court finds such efficacy is minimal at best in the instant case. The City of Topeka continually rewrites new data over the prior date on its back-up tapes. Therefore, unless the latter back-up tape did not write as close to the end as the previous back up tape, this information has likely already been written over. As the likelihood of retrieving these electronic communications is low and the cost high, this court further finds that the unanswered portion of Plaintiffs’ Interrogatory No. 4 is unduly costly. The court thereby denies plaintiffs’ motion to compel further responses to Plaintiffs’ Interrogatory No. 4.

Aside from the odd procedural basis of this dispute arising from an objection to an interrogatory, the opinion itself is notable for never mentioning new Rule 37(e), which states:

Absent exceptional circumstances, a court may not impose sanctions under these rules on a party for failing to provide electronically stored information lost as a result of the routine, good faith operation of an electronic information system.

You would expect a full analysis of the issues in this case to include the new “safe harbor” rule. The “exceptional circumstances” exclusion to the safe harbor is intended to apply to some situations where a duty to preserve has arisen. In this case, the plaintiff would argue that the duty arose by notice of the pending litigation. There are other circumstances where the duty can arise, and the safe harbor be lost, such as by statute or regulation requiring emails or other ESI to be retained for certain periods.

Perhaps the Court did not go there because it did not have evidence that the Commissioner’s email deletion was a “routine, good faith operation.” In any event, the Court chose instead to rely upon the well established common law elements of spoliation. It did not go into the related, but separate, and as yet largely untested provisions of the new rule. Still, in most circumstances you would want to include the Rule 37(e) arguments in this kind of spoliation dispute.

Should You Save Internet Cache?

Does the duty to preserve potential evidence require you to save your Internet cache? A district court in Pennsylvania addressed this issue, and, indirectly at least, said NO. Healthcare Advocates, Inc. v. Harding, Earley, Follmer & Frailey, 2007 WL 2085358 (E.D. Pa. June 20, 2007). The court held that the defendant’s automatic and unwitting deletion of cache files did not constitute spoliation, and did not warrant any kind of sanctions, even though potential evidence had been destroyed. The court did not squarely hold there was no duty to preserve Internet cache per se; instead, it held that, in this case, the destruction of evidence contained in the temporary cache files was accidental, and was not prejudicial, so no sanctions were appropriate.

In my opinion, the court here got it right, and in most cases there is no need to take the time and effort required to preserve cache files. Still, there may be rare exceptions to this general rule where you should save cache; for instance, if an employee is fired for viewing porn-sites at work and then he or she immediately files suit. In this circumstance, Internet cache files would provide critical evidence, and the custodian of the computer should save the cache. Assuming the employer knows about Internet cache, then they would want to preserve the cache, because it proves what websites have been visited on a computer. Of course, if the employer does not know about cache files, and how they can be automatically deleted, much like the law firm defendant apparently claimed in the Healthcare Advocates case, then they would not know to save their cache. Can you breach a duty to preserve evidence that you did not even know existed, much less was in danger of destruction? That is a difficult question that was not really answered by this case. The answer depends on whether you think the party, or their lawyer, should have known about cache files, such that it was negligence, perhaps even gross negligence, not to preserve these mystery files.

So what is Internet cache? Internet cache is not a misspelled “Pay-Pal” money thing, it’s a temporary storage area where frequently accessed data are placed for subsequent rapid access. It can be RAM memory type cache, or it can be cache that is written to a drive. The Internet cache files we are talking about here are of the latter variety. Microsoft calls this kind of cache “Temporary Internet Files.”

As you know, when you “go to” an Internet website, the website is actually coming to you. Copies of the website files are transferred from the web server computer to your computer. These files are actually downloaded and saved to your computer hard drive. (There are of course some exceptions to this for some website content, such as streaming video and the like, but as a general rule this is how it works.) These html and related web files are then viewed with your browser software, such as Microsoft’s Internet Explorer, from your own computer. The place where the downloaded web files are stored on your computer is called the “Internet cache.” Many people do not know that when they leave a website, and go someplace else on the web, the website itself remains lurking and hidden on their computer.

The Internet cache web files are stored on your computer because you may return to that same website again. If you do, and you point your browser to the same address, the browser will know that it already has the website in its cache, and so will not actually go out and fetch it again from the remote webserver. That could take some time. The browser will instead just display the web files you have already visited and stored in your cache. It is much faster that way, which is the whole point of a cache. Of course, in the meantime, the web may have changed, and you may not know it because you are looking at the web you previously downloaded. No worries, however, because you can defeat that, and force the browser to go out and get the file again from the webserver, by simply using the refresh file function.

Back to the Healthcare Advocates case: it involves some very interesting facts, albeit a farfetched complaint. I do not have all of the facts underlying this law suit (some are filed under seal), but from the court’s opinion, it appears that this is little more than a sour grapes type of spite suit. To understand this case, you have to understand the one that preceded it. There the same plaintiff, Healthcare Advocates Inc. (hereinafter “HAI”), sued a competitor for trademark infringement and trade secret misappropriation. HAI lost this case, in large part because of excellent lawyering by the defendant’s attorneys, the law firm of Harding, Earley, Follmer & Frailey (hereinafter “Harding”). Harding used the very handy service found at archive.org called the “Wayback Machine.” If you are not already familiar with this web and service, I suggest you check it out. The archive’s Wayback Machine allows you to view prior versions of websites that have been saved by archive.org. It is a very good way to determine what trademarks and other materials were actually in use by a company in the past. Harding used it to find out what HAI’s website had looked like in the past. The old versions of HAI’s web proved to be very powerful evidence against HAI, and they lost their case by summary judgment.

So what did HAI do next? They filed yet another law suit, this time against their competitor’s attorneys, the Harding law firm. Unbelievable, but true! What horrible things is the law firm alleged to have done? HAI accuses them of violating their copyrights by “hacking” the Wayback Machine so as to download old versions of their website! Never mind that there was no evidence of hacking, and Harding only used the archive.org repository the way any good law firm would: to find the truth and defend their client.

To add insult to injury, HAI tried to dress up this second case with charges of spoliation based solely on Harding’s failure to preserve the Internet cache files of the old HAI’s web pages. HAI even had the audacity to argue that the law firm should have stopped using their computers altogether so that the temporary cache files would not be lost. In their losing cross-motion for summary judgment, HAI’s lawyers got carried away, again, and argued that Harding’s failure to stop using their computers to preserve the Internet cache was such a bad act of spoliation that it “shocks the conscience.” Here is the understated way the court responded to these arguments:

The Harding firm had no reason to anticipate that using a public website to view images of another public website would subject them to a civil lawsuit containing allegations of hacking.

Thus, the failure to immediately remove computers that the firm used every day, when they had no reason to believe that their actions would subject them to a lawsuit for “hacking,” is not an action that shocks the conscience.

I am pleased to report that this second suit has been dismissed too, again by summary judgment. Obviously it was a “fair use” by the law firm of the discontinued copyrighted web pages, and not even close to a copyright infringement. Moreover, the spoliation charges were just as bad. It is not clear from the opinion, but I think that Harding knew full well about Internet cache files. It is after all a group of Phildelphia lawyers specializing in intellectual property law. Harding simply choose not to preserve these files because there was no reason to save them. They had already printed out all of the webs, and used them in evidence. Why should they also preserve the cache? The whole suit by HAI is just plain bizarre. The court agreed, and found no prejudice at all to the plaintiff from the deletion of the cache files.

There are two more things that surprise me about this case. First, Internet Archive, the non-profit group behind http://www.archive.org, was joined as a defendant to the case. That is not surprising given HAI’s obvious litigiousness, but it is hard to understand why the archive group settled with HAI, instead of moving for summary judgment. Apparently, they were concerned because their exclusion policy, which supposedly allows any website to opt-out of the archive and its Wayback Machine by the use of a robots.txt file, did not work in this case. HAI had, for obvious reasons, tried to have its web excluded from the archive before it filed the first law suit against its competitor, but the exclusion failed and Harding was able to get at the truth. The terms of the settlement are confidential, so we can only speculate why Internet Archive preferred to settle. The second surprising thing is that the Harding firm provided HAI with a forensic image of their computer’s hard drives. It impressed the court that Harding had nothing to hide, but one wonders why they bothered.

Although not reported in the decision, my review of the docket sheet for this case shows that there is now a motion pending by Harding for an award of $161,461.50 in attorney fees. They argue that this is a frivolous case, and an award of fees in this amount, plus costs of $9,348, is justified.

When Should You Search for Deleted Files?

The District Court in Tampa issued a discovery Order involving deleted email. Wells v. Xpedx, 2007 WL 1200955 (M.D.Fla. April 23, 2007). The case raises the interesting issue of when you should search for deleted files, and when you should not because they are “not reasonably accessible” under Rule 20(b)(6). In my view, this often hinges on whether or not the files were “double-deleted.” The order in question granted plaintiff’s motion to compel a 30(b)(6) deposition of defendant’s IT representative, but deferred ruling on the companion motion to compel production of deleted emails because there was an inadequate factual record to decide the issues, and for that reason the deposition was allowed.

The dispute began after defendant Xpedx produced its written records retention policy manual. The manual showed that Xpedx had introduced a new email retention policy in 2003 wherein emails were automatically deleted after 90 days, unless they were specifically designated for retention. The manual explained that if an email was not designated for retention, then after 90 days the automatically deleted email could not be restored, without consent of the company’s legal or tax department.

Not surprisingly, plaintiff sought a deposition to learn what this policy meant, and specifically to explain the procedures for retrieval. Further, plaintiff hoped to discover in that deposition if any emails were destroyed relating to his claims. Plaintiff also sought to compel production of all Xpedx emails related to his claims. During the hearing on the motion to compel, the plaintiff narrowed the scope of production request to any emails containing his name, Joseph Wells, in certain time periods in 2002 and 2003 by seven Xpedx employees.

The defendant opposed the deposition, arguing that it was unnecessary because it had already produced its records retention manual. This argument was not persuasive in view of the vagaries of the wording of the policy, especially as to the approval of restoration of deleted emails by the law or tax department. Further, a plaintiff in this position is normally permitted to inquire whether the actual practices of the company comply with the policy directives.

Defendant opposed the motion to compel because it argued that all relevant emails had already been produced. This is a very dangerous argument, as many defendants in the past have discovered, including UBS Warburg and Morgan Stanley. After you make that kind of representation to a court, it tends to look bad if relevant emails are later discovered, no matter how innocent and understandable the mistake. Finally, defendant argued that if there had been any other emails that were not specifically preserved, then they would have already been deleted under its 90 day policy.

Magistrate Judge Elizabeth Jenkins, who is well known in Central Florida for her good analysis and pragmatic results, begins her discussion of the email discovery dispute by noting that:

Deleted emails are, in most cases, not irretrievably lost. Discoverability of Electronic Data Under the Proposed Amendments to the Federal Rules of Civil Procedure: How Effective Are Proposed Protections for “Not Reasonably Accessible” Data? 83 N.C.L.Rev. 984, 988 (2005). Deleted emails may remain on a computer hard drive, servers or retained on back-up tapes. Id. at 988-90.

So far, so good; but then Magistrate Jenkins goes on to hold that: “The producing party has the obligation to search available electronic systems for deleted emails and files. Peskoff v. Faber, No. 04-526 (HHK/JMF), 2007 U.S. Dist. LEXIS 11623, at *13 (D.D.C. Feb. 21, 2007).” There I think the opinion goes too far, or should have been better qualified and clarified to apply only to “once-deleted” emails and files, and to exclude “double-deleted” files.

First let me explain what I mean by these terms. As everyone knows, if an email in Outlook is deleted, it is not erased; it is just moved into another Outlook folder for deleted files. It is still readily accessible. Any user can change their mind and restore the email. But if an email in the Deleted Folder is deleted again, in other words “double-deleted,” then it is no longer indexed in Outlook, and no longer readily accessible (unless, in some circumstances, as one observant reader pointed out, it is still within a double-deleted email retention period set by the Outlook Administrator; usually only seven days). Of course, double-deleted files are not truly deleted yet on the hard drive, but the file markers pointing to it and identifying it have been omitted (or, in some cases, will soon be omitted). These double-deleted files still exist, they have not been erased, but, in most cases at least, they are no longer easy to find and retrieve. It requires some level of forensic examination to locate and try to retrieve them. In fact, in some circumstances, double-deleted emails may be impossible to retrieve from the hard drive (be it server or PC) because they have been written over by other files. The same process applies to “once-deleted” files in the Windows operating system environment. They are not removed from an index of files when first deleted; they are simply moved to a new location, the Trash directory. But if the Trash is emptied, the pointers for that file are removed, and the space is considered to be available for writing new data.

So, back to the opinion, which states a party has an “obligation to search available electronic systems for deleted emails and files.” If the phrase “deleted emails and files” is construed to mean “once-deleted,” than I agree completely. These files are readily accessible. But, in most circumstances, it would be wrong to try to stretch the meaning of this holding to also include files that have been “double-deleted,” and thus require forensics to locate and restore, or resort to a search of back-up tapes.

In my opinion, and that of most commentators and courts that have squarely faced the issue, the obligation to search for “double deleted” files should not arise in all circumstances. This duty should only arise in certain special circumstances, where, for instance, there is evidence that highly relevant emails have been double-deleted, and therefore that there is good cause to go to the extra time and expense inherent in a forensic examination for such files. Most courts do not require an extraordinary search for deleted files, unless and until special circumstances are shown to warrant such extraordinary efforts. See for example, Hedenburg v. Aramark American Food Services, 2007 U.S. Dist. LEXIS 3443 (W.D. Wash. Jan. 17, 2007) discussed in my blog entry of February 25, 2007.

The facts alleged by Xpedx to oppose the deposition of its 30(b)(6) IT representative suggest that the emails sought were all “double deleted.” But it is not clear, and in fact, that was the plaintiff’s whole point. His motion to compel the deposition sought discovery of the facts surrounding these emails and deletion. The deposition should reveal whether or not the emails in question were once deleted, and thus reasonably accessible under Rule 26(b)(2)(B). If they are twice-deleted, and further, if under Xpedx’s computer system that means that they are not readily accessible, as I suspect, then an entirely different legal analysis applies to determine whether the plaintiff is entitled to compel production of these emails. If they are not reasonably accessible under Rule 26(b)(2)(B), then the plaintiff would be required to make a showing of good cause sufficient to justify the extra expense of location and recovery of the double-deleted emails.

For these reasons, Judge Jenkins’ order compelling the deposition makes good sense, especially when you consider she limited the deposition to four hours and permitted it to occur by phone. It also makes sense to defer ruling on the motion to compel. This motion cannot be properly determined without evidence as to whether the deleted emails are reasonably accessible, and if not, whether the facts and circumstances show good cause for them to be produced anyway, perhaps with cost sharing as suggested by Rule 26(b)(2)(B).

SUPPLEMENTAL READING: Review the cases and webs linked to or cited in this module.

EXERCISE: Find and review the Internet Cache files located on your computer(s). How many do you have stored right now? If you have a Mac this may be difficult. Don’t fret if you cannot find the answer, but at least make an effort. (Hint, try Google for help if you get stuck.)

Additional Exercise: Search and find at least one article or case opinion on any of the issues addressed in this module that takes a contrary view, or at least different view, to that provided here by ralph Losey. Write a one para summary to yourself of the contra point.

Students are invited to leave a public comment below. Insights that might help other students are especially welcome. Let’s collaborate!

Copyright Ralph Losey 2015