We live in a digital age, where information is stored and transmitted electronically, often with little regard to the science and technology that makes it possible. Digital information is much different than traditional hard copy, print, or other physical information. Electricity, magnetic disks, and fiber optics allow information to be created, modified, transferred, and destroyed in an instant.
Electronically stored information (ESI) is everywhere and plays an important part in the operation of almost every business. It should come as no surprise that issues regarding ESI often arise in litigation, especially when large corporations such as condominium associations and insurance companies are involved. Recently in a South Florida federal court, a discovery dispute arose when an insurance company sought a forensic examination of an association’s computer systems. In Wynmoor Community Council, Inc. v. QBE Ins. Corp., 10-62411, 2012 WL 716480, *5 (S.D. Fla. Mar. 5, 2012), the court explained what the requested examination would entail:
A forensic image, otherwise known as a “mirror image” will “replicate bit for bit sector for sector, all allocated and unallocated space, including slack space, on a computer hard drive.” A mirror image “contains all the information in the computer, including embedded, residual, and deleted data.” [Citations Omitted].
While this type of examination may sound innocuous to some, please consider the following analogy. Imagine a minor fender bender in which one party sues the other alleging neck pain caused by the accident. The defendant would likely seek to have the plaintiff examined by a physician to determine whether the plaintiff was indeed injured. This defendant doesn’t just want an examination of the plaintiff’s neck, however, this defendant wants a full body molecular scan that would meticulously scrutinize every cell in the plaintiff’s body. This would involve not only analysis of the plaintiff’s DNA, but also an examination of the plaintiff’s entire medical history and a full download of the plaintiff’s thoughts, memories, fantasies, and mental impressions. This examination would channel deep into repressed childhood memories, lost love and heartbreak, religious and ideological beliefs, and past indiscretions, including those that have long been forgotten.
This may sound invasive because it is. A full mirror image of a computer system would not only reveal information that may be relative to litigation, but could also reveal video games, music, movies, photographs, websites, and more. That half-written self-memoir, unfinished game of solitaire, spam email messages, Vanilla Ice discography, inappropriate websites, off-color jokes, including the ones thought to have been deleted, could turn up in a full forensic examination of a computer system. Even more serious, it could reveal privileged information such as attorney-client privileged communications.
Though this type examination is highly intrusive, the Wynmoor court held that it could not be compelled unless the requesting party shows “good cause.” The court must also consider, “whether the burden or expense … outweighs the likely benefit, taking into account the needs of the case, the amount in controversy, the parties’ resources, the importance of the issues at stake … and the importance of the proposed discovery in resolving the issues.”
In Wynmoor, the court found, among other things, that the plaintiff did not respond to discovery requests or object to them in a timely manner, did not respond at all to requests to produce electronic information, and had an increase in shredding hard copy paper documents in the recent months. Under those circumstances, the court ordered a forensic examination. The only saving grace for the association was that the court employed a previously used protocol to alleviate the invasive nature of the forensic examination:
Mindful of the potential intrusiveness of a compelling a forensic examination, the Court will employ a collection and review protocol as outlined in Bank of Mongolia. The Court is aware that Plaintiffs are non-profit and acknowledges that this procedure is likely to be costly. Therefore, the Court sets forth the following procedure:
1. An independent computer expert shall be appointed by the Court and shall mirror image Plaintiffs’ computer system. (To the extent it is possible, the independent expert shall conduct his examination in a manner that minimizes the disruption to the operation of Plaintiffs’ business.)
2. The parties have up through and including March 12, 2012, to meet and confer regarding their designation of an independent computer expert. If the parties cannot agree, on or before March 15, 2012, each party shall submit its recommendation to the Court, and the Court will select the expert.
3. The appointed expert shall serve as an Officer of the Court. Thus, to the extent that this computer expert has direct or indirect access to information protected by attorney-client privilege, such disclosure will not result in any waiver of the Plaintiffs’ privilege.
4. The independent expert shall sign a confidentiality order. Additionally, the expert shall be allowed to hire other outside support if necessary in order to mirror image the Plaintiffs’ computer system. Any outside support shall be required to sign the same confidentiality order.
5. The expert shall mirror image the Plaintiffs’ computer system.
6. The Defendant shall provide a list of search terms to the Court to identify responsive documents to Defendant’s document requests on or before March 15, 2012. After Defendant has submitted the search terms to the Court, Plaintiffs shall have 5 days to submit their objections to the Court regarding any of the search terms, which the court will rule upon. The Court will provide the search terms to the independent expert.
7. Once the expert has mirror imaged the Plaintiffs’ computer system, the expert shall search the mirror image results using the search terms. The results of the search terms and an electronic copy of all responsive documents shall be provided to the Plaintiffs and to the Court.
8. The Plaintiffs shall review the search term results provided by the independent expert and identify all responsive documents. The Plaintiffs shall either produce all responsive documents to the Defendant or identify those responsive documents not produced on a privilege log to the Defendant within 20 days of the date that the Plaintiffs receive the search term results from the independent expert. Any privilege log produced shall comply strictly with the Local Rules for the Southern District of Florida.
9. Defendant shall pay for all fees and costs of hiring the independent expert at this time. However, if at a later time there is evidence of the Plaintiffs improper deletion of electronic documents or any other associated improper conduct, the Court will revisit this issue and consider charging the Plaintiffs for the fees and costs of the independent expert or imposing the fees and costs on the parties in a duly appropriate apportioned manner.
10. The independent expert shall provide a signed affidavit detailing the steps he or she took in mirror imaging the Plaintiffs’ computer system and searching the mirror image for the search terms within 5 days of providing the Plaintiffs and the Court with the results of the search for search terms in the mirror image.
In addition to being highly intrusive, a forensic examination can be quite costly. Most courts have the authority to allocate the costs between the parties as justice requires. The best approach to electronic discovery requests is still a proper response or objection to the request. If the court compels a forensic examination of your computer system, it could reveal more than you think.
