Leonard Deutchman ()
In Boston Scientific v. Lee, No. 1:13-cv-13156-DJC (N.D. Cal. August 4, 2014), the court addressed two areas of e-discovery of particular interest: the need for cooperation in conducting e-discovery successfully, and the digital forensic investigative steps frequently taken when a high-level employee leaves a company to start or join a rival and is suspected of taking with him or her important intellectual property—what I refer to as “departing employee triage,” or DET. I have written about both topics at length in this column.
In Boston Scientific, or BSC, the court approved of the protocol best used in such matters when the old company wants to examine the new company’s digital media, but refused to impose it upon the new company because the old one had played games with discovery rather than working sincerely to cooperate. A review of the opinion sheds light on both important topics.
The plaintiff, Boston Scientific Corp., manufactures devices that “treat chronic pain by delivering electrical pulses to a patient’s spinal cord.” The defendant joined BSC in 2006 as an engineer, signing confidentiality agreements. He left in 2013 to join rival Nevro Corp. BSC brought suit against the defendant but not Nevro. The defendant produced over 300,000 pages of BSC’s documents, which included BSC’s “plans for present and future research, research results and agenda for meetings regarding research,” as well as evidence BSC claimed supported its position that the defendant “retained additional [BSC] scientific materials.” The defendant was enjoined from using or disclosing any of BSC’s proprietary information.
BSC subpoenaed Nevro to produce, inter alia, all computers assigned to the defendant while employed by Nevro. Nevro’s objection was that such production would include information proprietary to Nevro to which BSC had no right and which, as a competitor, it could misuse. To show that its refusal to produce the computers was not cover for an attempt to destroy key data on them, Nevro explained that, following commencement of suit, it “took steps to segregate” the computer it had assigned to the defendant, which it called the first laptop, by giving it to “a third-party e-discovery vendor.”
Nevro also produced some of the evidence a forensic examiner would look for when performing a DET analysis of such a device: file listing reports, which disclosed “extensive metadata of the files contained on the laptop”; USB reports, which disclosed what external devices, such as USB flash drives often used to receive copies of proprietary information, had been attached to the first laptop and when; and Web browsing history reports, which would have included visits to Web-based email accounts used to send proprietary information as email attachments or cloud repositories to which such information could have been copied. Nevro further offered to produce full forensic images—that is, exact copies—of a flash drive and external hard drive used by the defendant.
To preserve all possibly responsive electronically stored information, Nevro also provided to the digital forensics vendor the defendant’s personal laptop and had the vendor change the passwords to cloud accounts maintained by the defendant. It provided the defendant with another laptop, referred to as the second laptop, which had been used by Nevro employees previously to work on some of its “most sensitive and confidential issues,” and was used by the defendant to store confidential Nevro data as well as attorney-client communications. BSC sought a forensic image of the second laptop as well.
When BSC demanded more than Nevro had produced, Nevro offered to have an independent vendor examine a “full forensic image of the first laptop,” but BSC refused. It also refused the defendant’s offer to meet and confer to try to come up with a mutually satisfactory plan. BSC then issued a subpoena to Nevro demanding full forensic images of both laptops and Nevro moved to quash. In response to the motion, BSC argued for the images and also proposed, as “a fallback,” the plan Nevro had initially proposed: having an independent digital forensics examiner review the “‘full forensic image’ of the first laptop.”
DET and Nevro’s objection
BSC sought the first and second computers to perform upon them the standard DET examinations common to such matters. Essential to performing any forensic analysis is having a full forensic image of the device to be inspected. Thus, BSC’s demand for those devices to make those images was, from a forensic point of view, legitimate. Nevro’s concern was, of course, that in obtaining those images, BSC would have within its control the same type of confidential information it was concerned that the defendant took and Nevro now possessed.
Desktop and laptop computers, particularly those with Windows operating systems, can leave considerable evidence of copying files—the evidence of interest to the old company when the departing employee leaves. Such evidence includes when external devices, such as flash drives and external hard drives, were attached (files frequently are copied to such devices); when files were last accessed (such times often correlate with copying); LNK (pronounced “link”) files, which are generated when the user accesses a file (if the employee accesses the copied file residing on the external device, the LNK file is proof positive that the file was copied to the device); deleted emails, recoverable by forensic examiners, of departing employees emailing files to their new company or to a personal email account; cached emails, saved by the operating system unbeknownst to the user, if the employee uses a Web-based email account to send the files; Internet access history showing that the employee copied files to cloud-based repositories (ostensibly to pull them down when the employee arrives at the new company or from home); and evidence that applications used to wipe any trace of files had been deployed on the targeted hard drive.
BSC, then, had good reason to demand full forensic images of the first and second computers, so as to have them examined for evidence that files of interest had been copied to them by the defendant when he arrived at Nevro. Nevro’s objection, however, was also well founded: by obtaining such images, BSC would also inevitably obtain such information confidential to Nevro that resided on the images.
The court understood the validity of both positions. It took no issue either with BSC’s professed need to have the laptops examined or Nevro’s concern in producing to its competitor confidential information on the laptops. The court noted that under Legal Voice v. Stormans, 738 F.3d 1178, 1184 (9th Cir. 2013), the U.S. Court of Appeals for the Ninth Circuit’s typical solution would be to order that the examination be done by a neutral examiner and have BSC pay for it—the solution proposed initially by Nevro and, eventually, by BSC. But the court refused to order that solution and, instead, granted Nevro’s motion to quash because it was troubled by what it perceived to be abuse by BSC of the meet-and-confer process.
Federal Rule of Civil Procedure 26(f) requires that the parties (and here Nevro, a nonparty served with the subpoena, would fall under the rule) meet and confer to try to work out, in good faith, discovery disputes before bringing them to the court for adjudication. In the years since the rules were amended to address e-discovery specifically, innumerable cases, articles, conferences and other outlets have underscored repeatedly that the discovery process in the digital age simply will not work if the parties do not cooperate.
As the court saw it, Nevro had tried to cooperate, while BSC had been uncompromising until faced with the motion to quash. Nevro had produced to BSC some of the information a forensic examiner would have obtained, such as the report of what devices had been attached to the first laptop. As well, it had met and conferred with BSC and offered what is a common solution to this problem—to turn over the laptops to a neutral examiner. BSC had rejected that solution, but, when responding to Nevro’s motion to quash, resurrected it as a fallback option.
In the court’s eyes, to deny Nevro’s motion to quash and order at this late date the examination by a neutral examiner, even with BSC paying for it, would be to put BSC in exactly the same position it would have been in had it cooperated properly and so, by not penalizing BSC, to “make a mockery of both parties’ obligation to meet and confer in good faith from the start. The time to tap flexibility and creativity,” the court pronounced, “is during meet and confer, not after.”
A reasonable response
The court’s position is harsh, yet by no means unreasonable. While the solution first offered by Nevro and later by BSC would have been the best way to accommodate the legitimate needs of both parties, by not cooperating with Nevro and trying to game the court, BSC forfeited its right to such accommodation. Moreover, as the courts, faced with innumerable e-discovery issues on a daily basis, try to rule so as to move these cases through the system, it is by no means surprising for courts to recognize that that task will be impossible to complete without the cooperation required by Rule 26(f) and so announce to present and future litigants that those who fail to cooperate will be noted and sanctioned. Such actions, like the suppression of evidence in criminal matters, may be the only way to police the system.
Leonard Deutchman is vice president and general counsel of LDiscovery LLC, a firm with offices in McLean, Va., New York City, Philadelphia, Chicago, Atlanta, San Francisco and London that specializes in e-discovery, data hosting, managed review, collections and digital forensics.