District of South Dakota: Forensic Examination Order Granted Where One Month Passes Between Subpoena

Yesterday, Judge Karen E. Schreier issued a decision, Beef Prods. v. Hesse, No. 4:17-CV-04130-KES, 2019 U.S. Dist. LEXIS 215845 (D.S.D. Dec. 16, 2019) granting the Plaintiff's motion to compel specific requests for production and forensic examinations.

The Court ordered the production of documents by the Defendant regarding salary and benefits; documentation about the start of benefits for certain individuals; and other data on sales. Judge Schreier also granted Beef Products's motion to compel the production of privilege and redaction logs from third parties. The third parties had not produced a privilege log more than 45 days after a deadline on which they agreed to, and their production included unexplained redactions and omissions.

Beef Products also requested the production of documents referenced during the 30(b)(6) deposition of a third party. The Court would not require the production of a preservation letter because spoliation was not proven, but it did require the production of documents about the preservation letter because an affidavit submitted by counsel regarding the preservation process and another affidavit submitted by an IT person about the search process were not sufficiently detailed to show reasonable compliance with the document request.

The Court cited precedents finding that search terms are not subject to work production protection and ordered a third party to produce them.

A third party objected to a request to produce an employee handbook because the Defendant had already produced it, albeit with missing metadata. The Court disagreed noting that, "A claim of duplication does not protect a person from having to produce documents in the first instance that may also have been produced previously by another party." Id. at *22.

A forensic examination was also ordered of third party hard drives and email accounts because of the following factors:

1. The record shows that certain emails were lost, and the producing party could not provide a good faith explanation for their loss.

2. The adequacy of the producing parties' search was questionable because, "IT only got full access to the email accounts a month after subpoenas were issued and after the individuals already conducted their own searches. It is possible the individuals deleted incriminating evidence during their initial searches. The download of the email accounts-after the fact-may not show these deleted emails; but a forensic examination can show if such deletion occurred." Id. at *26-27. Another basis for questioning the search was the fact that the third parties' email production omitted some messages between its employees and Hesse which the Hesse production included.

3. Certain documents were produced without metadata including text messages.

New Rule of Federal Criminal Procedure Points to Guidelines for ESI Production

A new addition to the Federal Rule of Criminal Procedure became effective on December 1, 2019. Rule 16.1 now requires parties to agree on a timetable and procedures for pretrial discovery within 14 days of the arraignment of a defendant. The committee note to the new rule states that the new deadline is of special importance in cases involving ESI; voluminous document production; or complex discovery.

While acknowledging that this new rule does not specify particular steps the parts should follow, it does recommend guidelines for counsel to follow. "Because technology changes rapidly, the rule does not attempt to state specific requirements for the manner or timing of disclosure in cases involving ESI. However, counsel should be familiar with best practices. For example, the Department of Justice, the Administrative Office of the U.S. Courts, and the Joint Working Group on Electronic Technology in the Criminal Justice System (JETWG) have published 'Recommendations for Electronically Store Information (ESI) Discovery Production in Federal Criminal Cases' (2012)."

Courts still retain authority to set a discovery timetable and procedures, and the rule states that parties can request that the court modify time and manner of discovery for the purpose of preparing for trial.

N.D. Cal.: TRO on CTO for lock out of AWS.

Last week, Judge William H. Orrick issued a decision, Bailey v. Nurmi, No. 3:19-cv-07669-WHO, 2019 U.S. Dist. LEXIS 210931 (N.D. Cal. Dec. 6, 3019), granting a temporary restraining order against the defendant, a Chief Technology Officer for Thorium Cybersecurity. It was shown that Nurmi received actual notice and that Bailey would suffer irreparable harm and greater hardship than Nurmi. The Court enjoined Nurmi from, “accessing, manipulating, altering, or destroying the source code or other confidential information he has allegedly stolen from Thorium's online accounts.”. Id. at *1. Nurmi resides in Luxembourg and must be served pursuant to the Hague Convention, Before Bailey can get relief beyond the TRO he must serve the documents in French and German to the proper central authority in Luxembourg. Judge Orrick extended the TRO to the maximum allowed by Fed R. Civ. P. 65(b)(2) - 28 days. Bailey is is the CEO of Thorium, the designer of Ambitrace, software used to trace sensitive data. Nurmi allowed the company’s domain names to expire and also drank excessively. Bailey used Signal to serve a summons on Nurmi which confirmed he received it. Irreparable harm was established by the fact that Baliey was locked out of Google Apps; Amazon Web Services; and GitHub.