Opinion
6:21-cv-00055
02-22-2023
WALTER SCOTT LAMB, Plaintiff, v. LIBERTY UNIVERSITY, Defendant.
MEMORANDUM OPINION AND ORDER
NORMAN K. MOON, UNITED STATES JUDGE
Defendant Liberty University seeks sanctions against Plaintiff Walter Scott Lamb for the spoliation of electronically stored information (“ESI”). Dkt. 84. The particular sanction requested-denial of Lamb's pending motion for leave to file an amended complaint-is severe in that its practical effect would be the dismissal with prejudice of Lamb's lawsuit. The standard for such a sanction is correspondingly rigorous, requiring Liberty to show, among other things, that additional discovery cannot restore or replace the lost ESI. The Court previously took Defendant's motion under advisement, ordering Defendant to provide a status report within sixty days of the Court's Order. Dkt. 110. Liberty has since filed three status reports. Dkts. 129, 137, 145. Plaintiff has responded to Liberty's interrogatories, Dkt. 137 (Ex. B), but has filed no status reports of his own. The Court will grant Liberty's motion for sanctions because Liberty has demonstrated that missing evidence cannot be restored or replaced by the parties' good-faith efforts.
The Court dismissed Lamb's first amended complaint for failure to state a claim on April 10, 2022. See Dkt. 67.
I. Background
The Court previously summarized evidence presented at the hearing on Liberty's motion for sanctions held July 27-28, 2022. See Dkt. 110 at 4-10. Therein, the Court described that Lamb kept all his Liberty work either on his work laptop or Evernote account, noting that “[i]t is curious that Lamb would have accessed materials meant to protect him from Liberty exclusively using Liberty equipment. And that he has not accessed those materials-the very evidence central to his Title IX case-since October 2021.” Id. at 8. The Court noted it was also curious that Lamb discussed having recorded his work-related conversations with Liberty but failed to make a recording device available to the parties' jointly retained independent expert, Christopher Racich. Id. And the Court recognized that when Racich used forensic software to create an image of the data from Lamb's Evernote account, he found only 87 megabytes of data, whereas Lamb had approximately 2.61 gigabytes of Evernote data on October 10, 2021-shortly after his October 6, 2021 termination from employment at Liberty. Id. at 9. Further, Racich testified that the iPhone Lamb turned over to him only “first went into use on or about March 2, 2022.” Id. At the time, Lamb “explained that while he had in his possession the phone that he used while working at Liberty through March of 2022, he turned that phone in to a phone carrier in exchange for a credit for a new one.” Id. at 10 (internal references omitted). To Lamb, that was not an issue because he believed that “any emails originating from Liberty's Microsoft Outlook account were remotely removed from the phone when he was fired . . . [a]nd the phone no longer had any texts because his ‘standard practice was to delete [his] texts constantly all throughout [his] time at Liberty.” Id. (internal references omitted).
The Court previously found that the evidence supports that Lamb spoliated ESI, and the only outstanding element to establish Liberty's right to have Lamb's claim dismissed is whether the missing evidence can be restored or replaced by the parties' good-faith effort. Dkt. 110 at 15.
A. Liberty's Investigation
Since the Court's Order, Liberty has undertaken numerous investigative steps to determine whether the missing evidence can be restored or replaced, including that Liberty:
(1) instructed [technology expert] Vestigant to re-enter Lamb's Evernote for forensic review and to draw conclusions about present content and potential reconstruction; (2) asked Vestigant to opine on the potential that the content of Lamb's Evernote can be reconstructed to exact pre-Order position; (3) asked Vestigant to gauge the impact of Lamb's disruption of the metadata that was affiliated pre-spoliation with Lamb's cloud-stored material; (4) conferred with Lamb's counsel to attempt consensual coordination on the court-ordered stored data, device, and audio file issues; (5) served comprehensive paper discovery to Lamb to address material issues on which Liberty could gain no interparty cooperation short of th[ese] compulsive means; (6) served third-party subpoenas to Lamb's cell phone, cloud, and data providers seeking destroyed content; (7) examined information that Lamb has already produced to Liberty seeking clues toward the volume and nature of matter Lamb may have spoliated; (8) reviewed the hearing record for statements by Lamb and party testimony that shed light on what missing ESI might be “restored or replaced;” and (9) analyzed the logistics and timing of further actions, to include meet-and-confer efforts with Lamb's counsel after resistance to Liberty's current round of paper discovery, Liberty's follow-up with Lamb to compel cooperation with outstanding subpoenas to Lamb's vendors, and a possible deposition of Lamb if his counsel remain murky on such things as the whereabouts of Evernote data, missing devices, and purged audio files.Dkt. 129 (“First Status Report”) at 10-11. Liberty's investigation reveals significant challenges to restoring or replacing ESI.
Vestigant is “the technology expert the parties agreed to in the Protocol.” First Status Report at 3; see also Dkt. 85 (Ex. 2) (Computer Forensics and Document Return Protocol).
(1) Cloud-Based Services Alteration
First, Liberty asked Vestigant to examine the status of Lamb's Evernote account. Id. at 12. Vestigant's examination led it to conclude that (1) “Lamb's Evernote still does not contain all the data identified in the Evernote shadow copy recovered from Lamb's Liberty computer,” id. (citing (Ex. 1) ¶ 5) (Racich Decl.); (2) it lacks the tools to “determine where Lamb has moved the missing data and how to move it back to Lamb's Evernote account,” id.; and (3) all the actions that Vestigant lists could be taken for the Court to determine if Lamb's Evernote account “could ever be reconstructed back to its exact 2.7 gigabyte level of October 2022,” fall on Lamb, id. at 13.
Liberty describes that “Vestigant's inability has to do with two factors: (1) Lamb's total and solitary control over the moved or destroyed data, and (2) Lamb's permanent alteration of the metadata that once existed in his Evernote-with metadata typically serving as a traffic mechanism to monitor the influx and egress of data.” Id. (citing Ex. 1 ¶¶ 6-11, 14-15) (Racich Decl.) (“From this early work, it is my interim conclusion that because [of] the way Mr. Lamb permanently altered his access to metadata in his Evernote account, the only way to know if Mr. Lamb actually deleted records from Evernote, and know what he deleted, would be to have a copy of baseline Evernote content available (i.e., the data from the Liberty Computer Shadow Copy). Because the shadow copy Vestigant extracted from Mr. Lamb's Liberty laptop in October 2021 is incomplete, I conclude it is impossible to know by forensic review for certain the breadth of what Mr. Lamb deleted from his Evernote account.”).
Liberty notes that “[t]his would require Lamb to retrace the steps he undertook to deconstruct his Evernote by 95%, and then to rebuild it with the exact content that he wrongly offloaded. Vestigant has concluded there is no functional way to make this happen without Lamb taking the lead.” Id.
Liberty subpoenaed Evernote to see if Evernote could “play a role in the reconstruction of Lamb's Evernote account.” Id. (citing id. (Ex. 2)). Evernote responded on October 24, 2022, indicating that a “full and complete search of its records” produced only the following information:
A printout from the Evernote User Administration Tool showing the username, email address, incoming email address for the Evernote service, account creation date of the subject account, and whether the user is a Premium user.
For Premium Users only: Name, billing address, and payment information, to the extent available.
A spreadsheet showing the IP addresses and associated timestamps of any activity in the Evernote service account for the requested time period.
A spreadsheet showing the account activity logs responsive to the legal process for the requested time period.Dkt. 137 (“Second Status Report”) at 6 (citing id. (Ex. G) at 2). And Evernote contended that it is “prohibited from disclosing the contents of user accounts in response to civil process, except pursuant to an account holder's explicit consent.” Id. (Ex. G) at 2-3.
(2) Physical Devices
Lamb moved Evernote data to his son's old laptop, put it on a thumb drive, then on an external hard drive. Dkt. 110 at 6. Lamb testified that he threw the thumb drive away. Dkt. 127 (“Hr. Tr. P.”) 180:17-25. Liberty “issued requests for production to Lamb seeking, among other things, the physical thumb drive and the decommissioned laptop,” First Status Report at 14 (citing id. (Ex. 3) (Requests for Production)), and issued interrogatories to Lamb. Id. (citing id. (Ex. 4) (Interrogatories)). Lamb did not produce any new documents or devices in his response to the interrogatories. Second Status Report at 3.
Liberty also notes that:
[i]f Lamb still had these devices, then his lawyers had a duty to surrender them on the heels of a meet-and-confer with Liberty counsel. Indeed, Liberty formally demanded via subpoena duces tecum that Lamb bring any devices to the July hearing that were subject to the protocol and had not yet been produced, so one would expect the Lamb lawyers had a duty to bring these devices to that hearing for surrender. And, certainly, if the devices were still recoverable, counsel had an obligation to see that they were properly tendered to Vestigant after this Court's definitive August 25, 2022 Order.First Status Report at 14-15.
(3) iPhone Destruction
Lamb testified that he turned in his iPhone to Verizon for it to be wiped and factory reset. Hr. Tr. P. 143:18-24. Liberty issued a subpoena on September 26, 2022 to Verizon. First Status Report 129 at 15-16 (citing id. (Ex. 5) (Verizon Subpoena)). Verizon provided “Lamb's call logs for a specified period, but indicated] that the contents of Lamb's texts were retained just 3-5 days after transmission.” Id. at 16 (citing id. (Ex. 6) (Response from Verizon)). Liberty also subpoenaed Apple for Lamb's iPhone content and other materials. Id.; id. (Ex. 7) (Apple Subpoena); Second Status Report at 5-6. In their third status report, Liberty confirmed that Apple could not provide the materials requested in the subpoena. Dkt. 145 (“Third Status Report”) at 8. On January 10, 2023, Apple stated that “the items requested in the subpoena are either not available from Apple, are already available from the account holder or contain contents of communication which federal law prevents Apple from providing.” Dkt. 145 (Ex. A).
Apple “does not store call logs or voicemail messages,” id. at 5 (citing id. (Ex. F) at 2), and cannot provide electronic communications without subscriber consent, which Liberty sent to Apple on December 6, 2022, id. at 5-6 (citing id. (Ex. F) at 2; id. (Ex. D) at 9).
(4) Metadata Alteration
When Vestigant regained access to Lamb's Evernote on September 14, 2022, it concluded that “Lamb irreparably disrupted the metadata in Evernote during multiple visits in and out of the data, all occurring after Lamb was terminated from Liberty and under court order not to destroy data.” First Status Report at 16. Vestigant's investigation showed that “at least 3,626 notes were updated by Lamb between the December court hearing and September 2022.” Id. (citing id. (Ex. 1) ¶ 8) (Racich Decl.). And “Vestigant concluded it is impossible to know what data existed within any particular note prior to the date it was uploaded by Lamb.” Id. at 16-17 (citing id. (Ex. 1) ¶ 11) (Racich Decl.) (“Because Mr. Lamb's access altered the dates and times of the existing records, Vestigant is unable to see the previous updated date and timestamp that establishes when the records was previously modified in Mr. Lamb's Evernote account.”)).
Liberty asserts that “Lamb's actions in accessing and updating Evernote, selecting the information he wanted to share with Liberty, deleting information from Evernote, and transferring information to his child's resurrected laptop and other devices disturbed critical metadata.” Id. (citing Dkt. 85-2; First Status Report (Ex. 1)).
(5) Audio File Destruction
Lamb has produced around 300 audio recordings downloaded from storage on his Evernote, and Liberty argues that, “[w]hile an extensive production, this is likely a small sample of Lamb's total library of Liberty-related recordings . . . because Lamb said he recorded all key meetings.” Id. at 17 (internal citations omitted). Liberty also describes as curious that, though “Lamb claimed incessant preoccupation with the topic of Title IX,” “there are no Title IX-related meetings among the material that Liberty has been able to review.” Id. Liberty hypothesizes that Lamb either destroyed such content instead of returning it to Liberty or never in fact had the Title IX related conversations or made the internal complaints about Title IX matters that he claimed to have made. Id. at 17-18. Liberty has demanded “that Lamb point to recorded content that pertains to Title IX,” and stated that “[i]f Lamb objects to clarifying any content within his recordings by topic, then Liberty will seek the aid of this Court in compelling him to do so.” Id. at 18.
B. Responses from Lamb
In response to interrogatories, Lamb admitted his inability to find or replace new responsive records. Second Status Report at 3; see id. (Ex. B) (“After a reasonable search, Lamb cannot locate any responsive records in his possession, apart from those produce[d] to Lamb by Liberty in discovery in this case.”) (also explaining, for example, that, for various requests, “Lamb believes that he delivered some or all of the responsive materials to Liberty”).
On December 5, 2022, Lamb's counsel sent Liberty's counsel a response letter that stated: “he has already disclosed under oath that he dispossessed himself of all Liberty documents. Further requests for information can be addressed in a deposition or in interrogatories, if you choose.” Id. (Ex. D) at 4.
II. Legal Standard
In addition to the common law duty to preserve evidence in anticipation of litigation, Liberty's motion implicates the Court's inherent power to vindicate the authority of its orders, see Chambers v. NASCO, Inc., 501 U.S. 43, 45 (1991), as well as the “bad faith” prong of the standard governing motions to amend a complaint, see Johnson v. Oroweat Foods Co., 785 F.2d 503, 509 (4th Cir. 1986) (“[L]eave to amend should be denied only when the amendment would be prejudicial to the opposing party, there has been bad faith on the part of the moving party, or the amendment would have been futile.”).
Rule 37(e)(2) allows for dismissal of an action (the practical upshot of Liberty's requested relief) upon a court's finding that:
The Court will be guided at this time by the Federal Rules of Civil Procedure addressing sanctions against a party that intentionally destroys ESI that should have been preserved in anticipation of litigation. That Rule provides the clearest guideposts and was the focus of the parties' briefing.
(1) ESI should have been preserved in anticipation of litigation;
(2) That ESI was lost because of a failure to take reasonable steps to preserve;
(3) The loss was due to an act by the nonmovant intended to deprive the movant of the use of the ESI during litigation; and
(4) The ESI cannot be restored or replaced through additional discovery.Fed. R. Civ. P. 37(e).
The relevant portion of the Rule reads:
Failure to Preserve Electronically Stored Information. If electronically stored information that should have been preserved in the anticipation or conduct of litigation is lost because a party failed to take reasonable steps to preserve it, and it cannot be restored or replaced through additional discovery, the court: ...
(2) only upon finding that the party acted with the intent to deprive another party of the information's use in the litigation may:
...
(C) dismiss the action or enter a default judgment.
Notably, Liberty need not show that it was prejudiced by the loss of the ESI. “This is because the finding of intent required by the subdivision can support not only an inference that the lost information was unfavorable to the party that intentionally destroyed it, but also an inference that the opposing party was prejudiced by the loss.” Id., Comm. Notes on Rules-2015 Amendment (hereinafter “Committee Notes”).
Finally, this Court will follow “the general approach of courts in the Fourth Circuit . . . to apply the clear and convincing evidence standard, especially where a relatively harsh sanction” like dismissal is sought. See Steve & Sons, Inc. v. JELD-WEN, Inc., 327 F.R.D. 96, 104 (E.D. Va. 2018) (Payne, J.).
III. Analysis
The Court finds that a substantial amount of the ESI at issue cannot be restored or replaced through additional discovery.
To determine impossibility of replacement under Rule 37(e), the Court need not find that Liberty “pursue[d] every possible avenue for replacing or restoring the ESI, but it must show that it has made some good-faith attempts to explore its alternatives before pursuing spoliation sanctions.” Steve & Sons, Inc., 327 F.R.D. at 109. Courts within the Fourth Circuit have noted that “spoliation sanctions motions often follow only where extensive ESI recovery efforts have failed, or after forensic review gives the movant a much better idea of the quantity and nature of unproduced, deleted ESI.” Id. at 108; see, e.g., E.I du Pont de Nemours and Co. v. Kolon Indus., Inc., 803 F.Supp.2d 469, 477-78 (E.D. Va. 2011) (“However, in that last report, [the forensic analyst] advised that, because [Defendant] had failed to provide any logs or documentation relating to the extraction and recovery of the emails in the dumpsters, [the analyst] was unable to independently confirm: (1) the actual source of the emails; (2) the precise method of their recovery; (3) whether they represent all emails for the thirteen custodians from [defendant's] Microsoft Exchange Server deleted after February 1, 2009; or (4) the type and timing of the backups made by [Defendant's] backup tapes.”); EPAC Tech., Inc. v. HarperCollins Christian Publishing, Inc., No. 3:12-cv-00463, 2018 WL 1542040, at *5 (M.D. Tenn. Mar. 29, 2018) (discussing a Special Master's work to investigate ESI related to discovery in the case and that none of the tasks the Special Master Assigned had been completed).
“Information is lost if it is irretrievable from another source.” Modern Remodeling, Inc. v. Tripod Holdings, LLC, 2021 WL 3852323, at *8 (D. Md. Aug. 27, 2021) (citing Steve and Sons, Inc., 327 F.R.D. at 107; Fed.R.Civ.P. 37, advisory committee notes to the 2015 amendments). Courts within the Fourth Circuit have found, for example, that ESI could not be recovered when “original cellphone images in their native format were lost due to [a] phone replacement.” Haysbert v. Bloomin' Brands, Inc., No. 4:20-cv-121, 2021 WL 5003284, at *4 (E.D. Va. July 9, 2021) (noting this but finding other elements needed for sanctions under Rule 37 were not met); see also Summers v. City of Charlotte, No. 3-18-cv-00612, 2022 WL 385163, at *5 (W.D. N.C. Feb. 8, 2022) (“While Plaintiffs have recovered select emails, they have not been able to obtain the complete records from the City. This is sufficient to show that the records are lost and irreplaceable.”) (internal citations omitted), Paisley Park Enters., Inc. v. Boxill, 330 F.R.D. 226, 235-36 (D. Minn. 2019) (finding that “the missing text messages cannot be replaced or restored by other sources” because individuals wiped their phones and now the plaintiffs can “obtain only ‘scattershot texts and [e-mails],' rather than ‘a complete record of defendants' written communications from defendants themselves.'”) (quoting First Fin. Sec., Inc. v. Lee, No. 14-cv-1843, 2016 WL 881003, at *5 (D. Minn. Mar. 8, 2016)).
Courts have found insufficient evidence of loss where a plaintiff could not, for example, show attempts to directly retrieve an email, that text messages “existed, or that they were deleted after the duty to preserve arose,” or that messages “were produced later in the discovery period than [the plaintiff] may have wished.” Modern Remodeling, Inc. v. Tripod Holdings, LLC, 2021 WL 3852323, at *9. But courts have found that plaintiffs have made a good-faith effort to replace or restore ESI, which was ultimately deemed irreplaceable, when plaintiffs issued subpoenas, engaged in forensic analysis of a defendant's laptop, and sent discovery requests encompassing the documents “in an effort to recover what [a defendant] destroyed.” GMS Industrial Supply, Inc. v. G&S Supply, LLC, No. 2:19-cv-324, 2022 WL 853626, at *6 (E.D. Va. Mar. 22, 2022).
Liberty has shown attempts to directly retrieve missing ESI, through subpoenaing third parties, pursuing forensic analysis, and directing interrogatories to Lamb. There is evidence that the missing Evernote data, physical data, iPhone data, and metadata existed. And this missing ESI has yet to be produced through discovery. The Court finds that Liberty has conducted extensive ESI recovery efforts, and such efforts have revealed that substantial ESI cannot be restored or replaced through additional discovery.
The Court has discussed above that it is curious that the audio files do not include Title IX meetings, but the existence of audio files covering Title IX meetings is less clear than the existence of the other missing forms of ESI.
IV. Conclusion
For the foregoing reasons, Liberty's motion for sanctions, denying Lamb's pending motion for leave to file an amended complaint, is GRANTED.
* * * *
The Clerk of the Court is hereby directed to send this Memorandum Opinion and Order to all counsel of record.