Most e-discovery requests involve computer data such as emails, documents, and photographs. But courts are increasingly confronted with requests from parties seeking “ephemeral” data — data that is automatically created by a computer system without the conscious knowledge of the user, and is usually temporary. Such data (also known as electronically stored information, or ESI) would include things like Internet browser histories, or metadata that’s updated automatically, like “last opened” dates and “file created” dates.
This type of evidence, which can sometimes make or break a case, is fragile and can be difficult to preserve and collect. Two recent suits highlight the perils — and costs — for parties involved in ephemeral data cases: Nacco Materials Handling Group, Inc. v. Lilly Company and Tener v. Cremer.
In the first case, Nacco, a manufacturer and seller of forklift trucks and small appliances, accused Lilly, a former Nacco dealer, of illegally accessing its password-secured website on more than 40,000 occasions. Nacco filed suit in U.S. district court in Tennessee, and requested an expedited discovery so that its forensic expert could search Lilly’s computers and determine which of its computers were used to access Nacco’s site. The expert found evidence of inappropriate access on 17 of the 35 computers he examined.
As discovery unfolded, it was revealed that Lilly failed to take any steps to preserve its existing electronic records and did not suspend the automatic delete and routine overwriting features. In response, Nacco filed a motion to prevent the further spoliation of evidence and sought sanctions.
U.S. Magistrate Judge Diane Vescovo ruled that Lilly’s attempts to preserve the electronically stored information were “woefully inadequate.” She criticized the company for not protecting emails from being deleted, and for failing to preserve backup tapes, Internet histories, and server logs that could contain important evidence. She also chastised the company for apparently leaving “collection efforts to its employees to search their own computers with no supervision or oversight from management,” and for failing to document any of its search and collection efforts.
The court found that Lilly was at a minimum “negligent in discharging its discovery obligations,” and imposed sanctions against Lilly that included the expense of additional discovery. In addition, the judge ordered Lilly to pay monetary sanctions equal to plaintiff’s reasonable costs, including attorney fees, that were related to the motion.
A second case, Tener v. Cremer, provides an example of the expense and burden that can be imposed on nonparties when “ephemeral” data in their possession is sought in litigation. The plaintiff filed suit in New York state court, claiming that she was defamed in a post that originated from a computer at a medical center at New York University. Her lawyers subpoenaed the NYU medical center, seeking the names of all individuals who accessed the Internet on the date that the statement was posted, via the originating IP address. NYU objected to the subpoena, stating that the information requested was kept as a text file that was overwritten every 30 days, and further maintained that the center didn’t have the technological capability to recover files that may have been created a year earlier and had been overwritten at least 12 times.
When NYU did not produce the data, the plaintiff moved for contempt. The trial court denied the motion, but was reversed on appeal. The plaintiff submitted an affidavit from a computer expert on software that is designed to retrieve deleted information. The appellate court noted that NYU offered no evidence that it made any effort to access the data, and that NYU erroneously believed that as a third party, it was not required to use forensic techniques to recover this data.
Additionally, although the data sought by the plaintiff was stored as a “cache” file (as either unallocated data or backup data, which is difficult information to access), the court noted that this information was possibly the plaintiff’s only chance to confirm the identity of the person who defamed her. The appellate court remanded the case to the trial court to determine whether the data sought was accessible. A budget for the cost of the data retrieval, if possible, was to be provided. In the case that NYU had the ability to produce the data, the appellate court also instructed the trial court to allocate the cost of the production to the plaintiff.
These two cases demonstrate both the utility and difficulty of dealing with ephemeral data such as browser histories. The Internet usage data at issue in Nacco and Tener were central to the plaintiffs’ claims, without which the plaintiffs likely could not prove their cases. However, a defendant was required to bear the expense and burden of hiring specialists in computer forensics to identify, preserve, and collect this data. Additionally, a third party had to bear the expenses related to using forensic techniques to prove someone else’s case.
While these cases discuss Internet browser histories, the concepts apply equally to frequently overwritten metadata, fragments of deleted files in the slack and unallocated spaces, and any other type of data that is difficult to collect and preserve. Analysis of the slack and unallocated space may also be implicated if there are suggestions of intentional data destruction. Programs that “wipe” a computer’s memory leave distinctive signatures that can be found in these areas of the computer’s unused memory.
The forensic images necessary to collect and analyze any of these data types can be costly to create and even more expensive to analyze. The rules of civil procedure for federal and many state courts permit cost sharing and burden shifting. In the event that these data types are implicated, counsel should set the foundation early for equitable sharing of these litigation costs.
Judy Selby is a partner and Brian Esser is an associate at Baker & Hostetler. Email: email@example.com; firstname.lastname@example.org. A version of this article originally appeared in Law Technology News.