District of Idaho: When the Government Picks the Finger, Fingerprints Used to Unlock Smartphones are

On Friday, Judge David C. Nye, issued a decision, In re A White Google Pixel 3 Xl Cellphone in a Black Incipio Case, 2019 U.S. Dist. LEXIS 125243 (D. Idaho July 26. 2019) granting the Government's motion to reverse a magistrate judge's order denying an application to place an individual's fingerprint on a smartphone so it could be unlocked and examined forensically. The Google Pixel cellphone was seized pursuant to a search warrant that allowed the search of the defendant's residence. The government applied for an additional search warrant to compel the subject to provide the biometric input needed to unlock the phone. The magistrate judge held that warrant would violate the Fifth Amendment by requiring the individual to give self-incriminating testimony.

Judge Nye noted that the cellphone in question could not be unlocked with a fingerprint 48 hours after it was last unlocked. Because the Magistrate Judge took several days to issue his order, and the Government waited 8 days to file its motion to reserve, the decision in this case would be moot. Even though there is no actual controversy, this situation qualifies as a controversy capable of repetition yet evading review, which is an exception to the general rule requiring a controversy. The Court found that, "A search warrant must be processed within 48 hours of the Government's seizure of a cellphone or the biometric data becomes meaningless. This situation fits the 'capable of repetition, yet evading review' exception to the mootness doctrine." Id. at *6.

Neither the Supreme Court nor any circuit court has issued a decision addressing the issue of unlocking a smartphone or other computer using biometric information. Judge Nye concluded that case law on this issue distinguishes between biometric information and passcodes, the latter being testimonial. There is a difference between compelling a person to communicate something and doing something that, "displays a physical characteristic that might be incriminating." Id. at 16. Blood samples can be provided, fingerprints taken, and handwriting exemplars given without a violation of the Fifth Amendment. "Where, as here, the Government agents will pick the fingers to be pressed on the Touch ID sensor, there is no need to engage the thought process of the subject at all in effectuating the seizure. The application of the fingerprint to the sensor is simply the seizure of a physical characteristic, and the fingerprint by itself does not communicate anything." Id. at *16-17. Fingerprints used to unlock smartphones are not testimonial evidence.

Bankr. D. Minn. Sanctions BMO Harris for 'Deceit and Obfuscation' in Loss of Email Backup Ta

Last week, Judge Kathleen H. Sanberg issued a decision, In re Jointly Administered Under Petters Co., No. BKY 08-45257,2019 Bankr. LEXIS 2001 (Bankr. D. Minn. July 1, 2019), granting the Plaintiff's motion for sanctions under Rule 37 for the Defendant's spoliation of evidence. The Court found that the Defendant acted in bad faith in failing to preserve email back-up tapes, and issued an adverse inference instruction. The Defendant, BMO Harris Bank, N.A., intended to deprive the Plaintiff of the use of the emails, and its actions took place after a duty to preserve arose. $2 billion in damages are sought in this case, which concerns an alleged Ponzi scheme.

The Court criticized the Defendant for failing to respond to discovery requests in general, and for resorting to, "deceit and obfuscation" on the issue of the back-up tapes. Id. at *6. The tapes were destroyed after the issuance of a preliminary injunction order demanding their production, and after a discussion with counsel about the need for preservation. No other source for the email data existed. The data was not destroyed pursuant to a routine process.

The Defendant argued that the question of whether or not to issue an adverse inference instruction should be determined by the District Court, and that the Plaintiff could not show prejudice or bad faith.

Before 2005, the Defendant used Lotus Notes, kept monthly back-ups for three years, and a back-up made at the end of the year for seven years. An email deleted from an employee's inbox before the end of the day would not be preserved on a back-up tape. After 2005, the Legato email archive system was used, which preserves same day deletions of emails. The Legato system did not backup the Lotus data, and was only used for email, not calendar and other data. The backup tapes for the Lotus Notes system were destroyed during the decommissioning of regional servers, by an employee who was aware of the litigation hold. A subsequent search made after the receipt of an interrogatory found six overlooked backup tapes, more than four years after the duty to preserve arose. These tapes were not searched, and their discovery was not disclosed. It is unclear if they still exist.

The Defendant's 30(b)(6) representative falsely testified at a deposition that the backup tapes had been previously destroyed, a fact known to its counsel at Mayer Brown. The Defendant's representative also falsely testified at a court hearing that he was not on a team which located the backup tapes. The Court rejected the Defendant's 'same tape theory', in which they claimed that the allegedly lost tapes were located in a locked, 'restricted access' cabinet. The Defendant could not establish a chain of custody for the tapes.

Judge Sanberg found that the information lost with the emails could not be replaced through the production of other documents or by deposition testimony. Two employees with responsibility for accounts relevant to the case testified that they could not remember key facts.

"Defendant argues that the information has been replaced as 'millions of pages of documents' have been produced and dozens of depositions have been taken in this adversary proceeding. This is a red herring. Defendant does not get to select what evidence it wants to produce or from what sources. The Federal Rules require a party to produce all responsive documents. Regardless of how many millions of pages of documents have been produced from various third parties and other sources, the appropriate focus here is whether the information contained on the destroyed backup tapes can be replaced. While it may be true that Plaintiff obtained some pre-March 2005 emails from other sources, this does not mean that all responsive emails have been recovered or that a complete record of Defendant's pre-2005 emails is now available." Id. at *38-39.

Although it may be proven that much of the lost email data was cumulative, or included in third party productions, prejudice still exists because it cannot be known what was lost. "And while there is no concrete indication that the backup tapes contained evidence that could be considered a 'smoking-gun,' that is not the standard. The fact that the tapes were the primary, if not only, source of Defendant's pre-March 2005 emails renders its loss prejudicial." Id. at *42.

Judge Sanberg found that the Defendant had intent, because of the following factors:

1. The back-up tape destruction was not part of a routine process, or pursuant to a standard retention and destruction policy.

2. The Defendant knew about the injunction order and two legal holds.

3. Steps were not taken to prevent the recycling of tapes; search the tapes; look for pre-Legato backup tapes; or get help from counsel.

4. When the servers were decommissioned the Defendant knew the email tapes might exist.

5. The regional backup tapes were the only source of emails from a relevant time period.

The Court also concluded that the Defendant acted with the intent to hide evidence based on its submission of incomplete and redacted records for an in camera review and because of the sheer number of its discovery motions.

The adverse inference instruction prevents the Defendant from objecting to the admission of emails produced by third parties, and allows the Plaintiff to present evidence about the destruction of the backup tapes. The Court rejected the Plaintiff's request to prevent the Defendant from offering testimony about its knowledge of the Ponzi scheme. It also found that it was not necessary to have the District Court issue the adverse injury instruction because judicial economy favored the bankruptcy court making the decision, and the authority to issue sanctions was within its inherent authority.

C.D. Cal.: Data Protection Measures Fail to Meet Minimum for Diversity Jurisdiction

On Wednesday, Judge Otis D. Wright II, issued a decision, Zarrabian v. Tech Rabbit, LLC, No. 2:18-cv-10648-ODW, 2019 U.S. Dist. LEXIS 107274 (C.D. Cal. June 26, 2019), granting a motion to remand the case back to state court and denied a motion to dismiss. The plaintiff brought state law claims against the defendant arising from a data breach on its web site that led to the disclosure of personal information to third parties. The defendant sought to remove the case to federal court on the basis of diversity jurisdiction. Federal law court requires that the amount in controversy in diversity cases exceed $75,000.

Zarrabian sought equitable relief in the form of Tech Rabbit being required to implement data collection, storage, and security measures for its customer data. While Tech Rabbit's COO submitted a declaration that implementing such measures was estimated by multiple vendors to cost in excess of $300,000, Judge Wright found it deficient because:

1. Vendor proposals were not included as exhibits to the declaration.

2. The estimates were based on security standards for banks, not a tech company like Tech Rabbit.

3. The COO himself stated that that the best technology platforms would be too expensive to implement.

4. The COO lacked expertise on the cost of data protection measures.