Summary
holding that the employee was not acting within the scope of his authority when he destroyed the thumb drive
Summary of this case from Edifecs, Inc. v. Welltok, Inc.Opinion
Adam C. Shearer, J.W. Nelson Chandler, James Walker Coleman, IV, Eric D. Welsh, William L. Rikard, Jr., Parker Poe Adams and Bernstein, Charlotte, NC, for Plaintiff.
Greg Horton, William C. Cleveland, Buist Moore Smythe and McGee, Charleston, SC, Randall D. Lehner, Reed Smith, Chicago, IL, Jeffrey P. MacHarg, Joseph F. Rodkey, Jr., Kristen R. Rydstrom, Tarek F. Abdalla, Reed Smith Shaw and McClay, Pittsburgh, PA, Wilbur O. Colom, Colom Law Firm, Columbus, MS, for Defendants.
ORDER and OPINION
DAVID C. NORTON, Chief Judge.
This matter is before the court on plaintiff's motion for sanctions based on defendants' alleged spoliation of electronic evidence. Specifically, plaintiff contends defendants intentionally destroyed or altered evidence found in a USB thumb-drive device (often referred to as the " SanDisk" ), on a SeverCorr laptop computer used by John Bell, and on a CD that Bell created in March 2006. Moreover, plaintiff argues defendants' expert witness destroyed evidence by improperly handling the SeverCorr laptop hard drive. In light of those allegations, plaintiff has asked the court to strike defendants' answer and enter judgment in its favor. Alternatively, plaintiff has requested that the court provide an adverse inference charge to the jury. For the reasons set forth below, the court grants plaintiffs motion and determines an adverse inference charge is the appropriate sanction.
I. BACKGROUND
John Bell is a former employee of Nucor Corporation. In 1987, he began working for Nucor in a steel mill in Arkansas and became the melt-shop manager at Nucor's Berkeley County, South Carolina steel mill in 1995. In 2004, Nucor promoted Bell to the position of General Manager of Steelmaking Technologies, and he continued working at the Berkeley County mill. Bell worked in that position until March 31, 2006, when he left Nucor to become SeverCorr's Executive Vice-President and General Manager of Operations. Bell is responsible for overseeing the construction and operation of SeverCorr's start-up steel mill in Columbus, Mississippi.
During his time at Nucor-Berkeley, Bell was intimately involved in the development of processes for manufacturing Interstitial-Free/Ultra Low Carbon (IF/ULC) steel. IF/ULC steel is a high-end product commonly used in exposed and unexposed automotive applications. Plaintiff contends that acquiring the ability to manufacture IF/ULC steel required a significant investment of resources and involved extensive trial-and-error, all overseen by Bell. Although other steelmakers manufacture IF/ULC steel, plaintiff contends that it is the only one to do so in a " mini-mill." A " mini-mill" is a steel mill that uses scrap metal as the base material and differs from " integrated mills," which produce steel from raw iron ore. Plaintiff contends that it acquired a competitive advantage because its method of producing IF/ULC steel in a mini-mill is unique and allows it to produce the steel less expensively than steelmakers with integrated mills. Nucor asserts the process it developed for producing IF/ULC steel in a mini-mill is a trade secret as defined in the South Carolina Trade Secrets Act, S.C.Code Ann. § 39-8-20(5)(a).
On October 6, 2006, plaintiff filed the instant action against defendants in the Court of Common Pleas for Charleston County, South Carolina. Plaintiff served process on Bell on October 6, 2006 and served process on SeverCorr on October 10, 2006. On October 11, 2006, the state court issued a preservation order that, inter alia, prohibited defendants from destroying or altering any electronic documents. Defendants removed the action to this court on October 17, 2006.
Plaintiff generally alleges that Bell and SeverCorr have misappropriated Nucor's trade secrets and plan to use that information to compete with Nucor, and that defendants have improperly solicited Nucor employees. Nucor's amended complaint asserts nine causes of action under South Carolina law: (1) misappropriation of trade secrets, (2) breach of contract, (3) breach of the duty of loyalty; (4) computer fraud and abuse; (5) tortious interference with contractual relations, (6) unfair trade practices, (7) civil conspiracy, (8) conversion, (9) unjust enrichment, (10) an equitable claim for imposition of a constructive trust, and (11) a request for injunctive relief. The court has issued an order dismissing the breach of contract claim to the extent it relied on a non-compete provision in the third confidentiality agreement. See Nucor Corp. v. Bell, 482 F.Supp.2d 714 (D.S.C.2007).
Nucor has moved for a preliminary injunction, asking the court to enjoin Bell's employment at SeverCorr, to enjoin SeverCorr from manufacturing or preparing to manufacture IF/ULC steel, to enjoin SeverCorr from hiring certain Nucor employees, and to enjoin defendants' use or disclosure of Nucor's trade secrets. Resolution of Nucor's motion for a preliminary injunction is partially dependent on the outcome of the instant motion; the motion for a preliminary injunction is therefore under advisement.
Nucor has also moved for sanctions based on defendants alleged spoliation of electronic evidence. As the basis for its motion, Nucor contends defendants negligently and/or intentionally destroyed evidence found on John Bell's SeverCorr laptop computer and the SanDisk device that Bell discarded. Nucor has requested that the court award sanctions in the form of default judgment or, in the alternative, by giving the jury an adverse inference charge. To support its claims of spoliation, Nucor offered the testimony of John Jorgensen, an expert in the field of computer forensics, who concluded that defendants engaged in the intentional deletion of data (known as " wiping" ). He also testified that the missing SanDisk contained Nucor-related documents. Bell has admitted that he destroyed the SanDisk. Jorgensen also testified that defendants' continued use of the SeverCorr laptop resulted in the loss of relevant data, and that defendants' expert spoliated evidence because he engaged in " destructive" testing on the laptop's hard drive. Defendants counter Nucor's claims with the testimony of Dr. Sean McLinden, another expert in the field of computer forensics, who testified that there is no evidence to indicate that wiping occurred, that no relevant data was lost as a result of defendants' continued use of the computer, and that he provided plaintiff with an exact copy of the laptop hard drive. The court has already considered the parties' motions to exclude the expert witnesses' testimony, and concluded that both experts' testimony meets the requirements of Federal Rule of Evidence 702 and the Supreme Court's decision in Daubert v. Merrell Dow Pharmaceuticals, Inc., 509 U.S. 579, 113 S.Ct. 2786, 125 L.Ed.2d 469 (1993).
The court granted defendants' Daubert motion to the extent Jorgensen offered opinions on programs known as " Ultimate Cleaner" and " Ultimate Defender."
II. STANDARD OF REVIEW
Spoliation is the " destruction or material alteration of evidence or ... the failure to preserve property for another's use as evidence in pending or reasonably foreseeable litigation." Silvestri v. General Motors Corp., 271 F.3d 583, 590 (4th Cir.2001) (citing West v. Goodyear Tire & Rubber Co., 167 F.3d 776, 779 (2d Cir.1999)). The court's ability to impose sanctions for spoliation stems from its " inherent power to control the judicial process and litigation." Id. The power " is limited to that necessary to redress conduct ‘ which abuses the judicial process.’ " Id. (quoting Chambers v. NASCO, Inc., 501 U.S. 32, 45-46, 111 S.Ct. 2123, 115 L.Ed.2d 27 (1991)). Accordingly, " ‘ the applicable sanction should be molded to serve the prophylactic, punitive, and remedial rationales underlying the spoliation doctrine.’ " Id. (quoting West, 167 F.3d at 779). The district court has " broad discretion in choosing an appropriate sanction for spoliation" and the court's decision is thus reviewed on appeal for abuse of discretion. Id.
Sanctionable spoliation of evidence occurs only when three prerequisites are met. First, the altered or destroyed evidence must have been relevant to the litigation. See Vodusek v. Bayliner Marine Corp., 71 F.3d 148, 156 (4th Cir.1995): Silvestri, 271 F.3d at 591. Second, the party must have been under a duty to preserve the evidence at the time it was altered or destroyed. See Silvestri, 271 F.3d at 591. A party has a duty to preserve evidence during litigation and at any time " before the litigation when a party reasonably should know that the evidence may be relevant to anticipated litigation." Id. (citing Kronisch v. United States, 150 F.3d 112, 126 (2d Cir.1998)). Finally, the spoliating party must have acted with the requisite level of intent, which varies depending on the sanction imposed. When dealing with adverse inference charges, the sanction is only appropriate if the spoliator's " willful conduct resulted in [the evidence's] loss or destruction." Vodusek, 71 F.3d at 156 (citing Nation-Wide Check Corp. v. Forest Hills Distribs., Inc., 692 F.2d 214, 217-18 (1st Cir.1982)). The court may impose the sanction even in the absence of bad faith. See Hodge v. Wal-Mart Stores, Inc., 360 F.3d 446, 450 (4th Cir.2004). The harsher sanctions of dismissal and default judgment require a showing of " bad faith or other ‘ like action,’ " unless the spoliation was so prejudicial that it prevents the non-spoliating party from maintaining his case. See Silvestri, 271 F.3d at 583 (quoting Cole v. Keller Indus., Inc., 132 F.3d 1044, 1047 (4th Cir.1998)).
III. DISCUSSION
A. Whether Spoliation Occurred
Plaintiff argues defendants have spoliated two items of evidence: (1) a SanDisk thumb-drive that Bell used to transfer Nucor documents to his home and SeverCorr computers, and (2) the data on Bell's SeverCorr laptop. The court agrees and concludes that defendants engaged in sanctionable spoliation with respect to both.
1. The SanDisk USB Thumb-Drive
To justify the imposition of a sanction for spoliation, " it would have to appear that the evidence would have been relevant to an issue at trial and otherwise would naturally have been introduced into evidence." Vodusek, 71 F.3d at 156. The non-spoliator does not have to show that the evidence would have been favorable to his case; it is enough to show that the evidence " naturally would have elucidated a fact at issue." See id. At various times, the missing SanDisk was connected to Bell's Nucor work computer, his home computer, and his SeverCorr laptop, making it a possible vehicle for the transfer of confidential files and documents. See Second Jorgensen Report at 12-16; PI Hrg. Tr. at 268-70, 273-77, 282-83. Moreover, the SanDisk contained files related to the processes and information that Nucor contends are trade secrets and which were viewed on the SeverCorr laptop. See PI Hrg. Tr. at 271-72; PI Pl. Exs. 3, 31, & 32. Bell admitted that he downloaded information on Nucor's IF/ULC production processes to the SanDisk from his Nucor computer, and he thereafter viewed some of the information on the SanDisk using his SeverCorr laptop. See Bell Dep. at 51-52, 63-64; see also PI Hrg. Tr. at 454-56, 470-72, 497-99; Pl. PI Ex. 2. Jorgensen testified that, although plaintiff has been able to locate a list of documents on the SanDisk, he believes it is only a partial list and that he cannot be sure what was on the device because Bell discarded it. See PI Hrg. Tr. at 283. McLinden agreed with Jorgensen's assessment, stating that he did not believe anyone could determine what was on the SanDisk because the device is not available. See Sanctions Hrg. Tr. at 269.
Bell had a duty to preserve the SanDisk at the time he destroyed it. As discussed above, a party has a duty to preserve evidence during litigation and at any time " before the litigation when a party reasonably should know that the evidence may be relevant to anticipated litigation." Silvestri, 271 F.3d at 591 (citing Kronisch v. United States, 150 F.3d 112, 126 (2d Cir.1998)). Bell stated that he could not remember the exact date he destroyed the SanDisk, but recalled that he did so at the end of the summer of 2006. See Bell Dep. at 54; see also PI Hrg. Tr. at 491 (Bell testifying that he destroyed the SanDisk in September 2006). The record demonstrates that Bell anticipated litigation prior to the time he admittedly destroyed the SanDisk:
• Nucor warned Bell, beginning shortly after his resignation, that he owed obligations to Nucor and that Nucor would take " appropriate" action if he violated those duties. See Bell Dep. at 61, Pl. Mem. Supp. P.I. Ex. P-7. Bell understood Nucor's use of the term " appropriate action" to mean it would sue him. See PI Hrg. Tr. at 494. Thus, Bell knew from the time he left Nucor that the potential for litigation existed, even if he did not think that litigation was imminent.
On March 31, 2006, Douglas R. Gunson, Nucor's general counsel, wrote Bell a letter explaining Bell's obligations with respect to confidentiality and proprietary information. Pl. Mem. Supp. P.I. Ex. P-7. He explained that Nucor had a significant interest in maintaining its confidential information and reminded Bell of his confidentiality agreements. Id. Gunson also noted that Nucor believed Bell would inevitably disclose trade secrets if he accepted a similar position with a competitor. Id. " In such a situation," Gunson wrote, " Nucor will take appropriate action, as deemed necessary to protect this information from improper use or disclosure." Id.
• Bell told Charles Fuhrman, SeverCorr's director of human resources, in April 2006 and late summer 2006 that he thought Nucor might sue him. See Fuhrman Dep. at 225. Bell therefore had a subjective expectation that Nucor might institute litigation.
• By his own admission, Bell destroyed the SanDisk precisely because he anticipated litigation. He testified he destroyed the device because he knew Nucor was " very litigious," because " things were starting to heat up" with Nucor, and because he " was concerned that [Nucor] would make an issue" of the device. SeeSee Bell Dep. at 54-56. • Bell agreed on SeverCorr's behalf to indemnify Mark Pole, a former Nucor employee who joined Bell at SeverCorr, for any " legal fees [Pole] might incur as a result of accepting employment with SeverCorr, LLC." Pl. Mot. Sanctions Ex. E. Bell wrote the letter, dated June 22, 2006, because Pole told him that he was worried about being sued by Nucor. PI Hrg. Tr. at 493.
• Pole received a letter from Nucor regarding Pole's potential possession of Nucor materials and data. Bell knew that Pole wrote a response to that letter, addressed to Ladd Hall, Nucor's Vice President and General Manager, stating that he did not have any Nucor company materials in his possession. Pole received the letter from Nucor on July 1, 2006 and responded to Nucor by July 18, 2006. See Pl. Mem. Supp. PI Ex. Px 41; PI Hrg. Tr. at 497.
The evidence therefore shows that Bell anticipated (or reasonably should have anticipated) litigation with Nucor by late Summer 2006, before he destroyed the SanDisk device.
Finally, Bell intentionally destroyed the SanDisk and acted in bad faith. Bell stated that he destroyed the SanDisk by throwing it away-not that he negligently lost it, spontaneously lost it, or that it suddenly quit working. See PI Hrg. Tr. at 472. Thus, he acted willfully and deliberately by choosing to destroy the device. Moreover, Bell stated that he did so specifically because he wanted to prevent Nucor from " making an issue" of it. See Bell Dep. at 54-56; PI Hrg. Tr. at 472-73. Although Bell testified at the preliminary injunction hearing that he " thought he was doing the right thing" by throwing SanDisk away, PI Hrg. Tr. at 472, his testimony shows that he willfully destroyed the device because he did not want Nucor to have it, id. at 471-73; Bell Dep. at 54-56. Destroying potential evidence in an effort to prevent another party from obtaining it certainly qualifies as " bad faith" under any reasonable definition of the term.
However, under the circumstances SeverCorr cannot be sanctioned for Bell's actions vis-a-vis the SanDisk thumb-drive. Ordinary agency principles govern a party's responsibility for spoliation committed by its employees. See Valentine v. Mercedes-Benz Credit Corp., 1999 WL 787657, at *4 (S.D.N.Y.1999) (Mukasey, J.): see also Phoebe L. McGlynn, Note, Spoliation in the Product Liability Context, 27 U. Mem. L.Rev. 663, 691 (1997) (" [I]f the third party is linked to one of the two litigants, the court may apply agency principles and impute a sanction to the party whose agent committed the spoliation." ) An employer is liable for any acts committed by employees acting within the scope of their employment. Armstrong v. Food Lion, Inc., 371 S.C. 271, 276, 639 S.E.2d 50, 52 (2006). " An act is within the scope of a servant's employment were reasonably necessary to accomplish the purpose of his employment and in furtherance of the master's business." Id. Bell's testimony implies that he was only trying to protect himself by discarding the SanDisk, and his testimony certainly does not require the inference that he discarded the SanDisk to protect SeverCorr. See Bell Dep. at 54-57. Moreover, the fact that he never disclosed the SanDisk's existence nor consulted with anyone at SeverCorr about discarding the device indicates that he was not acting within the scope of his employment, but for his own benefit. See id.
2. Bell's SeverCorr Laptop
Plaintiff contends defendants spoliated data on Bell's SeverCorr laptop in three ways: (1) intentionally using the laptop computer after this litigation began, thereby causing the loss of relevant data, (2) intentionally deleting and overwriting relevant data with zeros, and (3) their expert's attempt to create additional forensic copies of the laptop hard drive, which led to its failure. As explained in detail below, the court finds that defendants spoliated evidence by continuing to use the laptop. However, the court concludes that plaintiff has not met its burden with respect to its data wiping allegations, nor has plaintiff adequately shown that defendants' expert spoliated evidence.
Defendants argues Federal Rule of Civil Procedure 37(e) prevents the court from imposing any sanction for loss of data on the laptop. Rule 37(e) states, " Absent exceptional circumstances, a court may not impose sanctions under these rules on a party for failing to provide electronically stored information lost as a result of the routine, good-faith operation of an electronic information." Fed.R.Civ.P. 37(e) (emphasis added). Assuming arguendo that defendants* conduct would be protected under the safe-harbor provision, Rule 37(e)'s plain language states that it only applies to sanctions imposed under the Federal Rules of Civil Procedure (e.g., a sanction made under Rule 37(b) for failing to obey a court order), Thus, the rule is not applicable when the court sanctions a party pursuant to its inherent powers.
a. Spoliation Through Continued Use
The data on the laptop was relevant to this litigation. Bell used the laptop as his primary work computer from the time he started at SeverCorr until the hard drive was delivered to his lawyers in late October 2006. There can be little doubt that the data on Bell's SeverCorr laptop is relevant in a case involving, among other causes of action, misappropriation of trade secrets and computer fraud and abuse. The presence of confidential Nucor information on the laptop would tend to make it more probable that defendants misappropriated Nucor's trade secrets; the absence of confidential Nucor information would make it less probable. Analysis of the data on the laptop has shown that several USB thumb-drive devices with Nucor-related documents were connected to the laptop, and that Bell used the laptop to view Nucor documents. All of that information is relevant in this case.
Plaintiff served Bell with the original complaint on October 6, 2006 and served SeverCorr on October 10, 2006. See Pl. Mem. Supp. Sanctions Ex. J. Because a party is always under a duty to preserve relevant evidence when litigation is pending, defendants each had a duty to preserve the data beginning no later than those dates. On October 11, 2006, the Court of Common Pleas for Charleston County, South Carolina, issued an evidence preservation order. The preservation order stated:
Defendants dispute the validity of the ex-parte preservation order under state law. Even if the state court did not issue a valid order, the order evidences defendants' notice of the pending litigation and their duty to preserve evidence.
Defendants and all persons with notice are hereby prohibited from destroyed, removing, transferring, or altering any documents, whether in hard copy or computer format (disc or hard-drive or otherwise) requested by the attached request for production of documents or otherwise discoverable in this action under Rule 26.Id. See id. Id.
Aside from the pendency of this lawsuit, there is substantial evidence, discussed infra pages 7-9, that defendants anticipated, or reasonably should have anticipated litigation, in the summer of 2006. Bell's interactions with Mark Pole demonstrate that Bell anticipated litigation, but are imputable to SeverCorr because Bell was acting on its behalf in those discussions. Bell also communicated his feeling that Nucor might sue to SeverCorr's director of human relations in April 2006 and in late summer 2006. Finally, in July 2006, SeverCorr's counsel (Joseph Rodkey of the Reed Smith law firm) drafted the letter Mark Pole sent to Nucor concerning his retention of Nucor material and data. See Pl. Mem. Supp. P.I. Ex. Px 41.
The data on the hard drive was altered or destroyed when it was in defendants' control and when defendants had a duty to preserve. The evidence is uncontroverted that defendants continued to use the computer while under a duty to preserve evidence, specifically from October 6 (when Bell was served with the complaint in this matter) until October 20 (when the computer was unplugged for forensic analysis). See, e.g., Sanctions Hrg. Tr. at 215. The evidence also shows that mere continued use of the computer resulted in the alteration or loss of data. Among the lost data are: • Items in Unallocated Space -When a user " deletes" a file, that file is not actually removed from the computer's hard drive. Rather, the file is marked as " unallocated space," giving the computer permission to overwrite the file with new data. When that file is overwritten with new data, it is permanently lost and unrecoverable. See Sanctions Hrg. Tr. at 25-26. Jorgensen testified, and McLinden agreed, that data in unallocated space is lost every time a computer is turned on or shut down, when a program is installed or de-installed, when a user runs a program, or virtually any time anything happens on a computer. See Sanctions Hrg. Tr. at 40-41, 214-15; P.I. Hrg. Tr. at 287-88. It is inevitable that a substantial amount of data in unallocated space was lost because defendants continued to use the computer while under a duty to preserve evidence.
• Event Logs -The Windows XP operating system maintains event logs that record what actions are taken on a system, what programs were run, any problems the system encounters, any network connections, and other information. See Sanctions Hrg. Tr. at 25-26. As a user continues to use a computer, the system event logs create new entries and displace the oldest entries, making those displaced entries unrecoverable. See id. at 40-41. In this case, defendants use from October 10 to October 18, 2006, caused the loss of over 1,564 event log entries. Id.
• Restore Points -Windows XP automatically generates " restore points" that allow a user to undo some later changes made to the system. Windows generates the restore points periodically and provides a picture of the system registry. See id. at 44. As a result of defendants' use of the laptop after October 10, approximately twelve restore points were lost. Those lost restore points represent 447 megabytes of lost or missing data. Id.
Aside from the data loss that occurred through defendants' continued use of the computer, defendants significantly altered data during the relevant period by installing and de-installing programs. Defendants installed the eScan anti-virus program on September 11 and uninstalled it on October 11. They then reinstalled the program on October 11 and uninstalled it on October 20. See Sanctions Hrg. Tr. at 47. As Jorgensen testified, " The problem with going through the installation and uninstallation of a program is that every time you install a program like that and every time you uninstall a program like that, you are overwriting data that is in the unallocated space." Id. By uninstalling and reinstalling the program on October 11, defendants caused 73.3 megabytes of data to be permanently lost (in addition to the alteration caused because the uninstalled program is no longer available). Id. at 48, 219. Moreover, eScan automatically deletes the Windows prefetch folder when it is uninstalled. Id. at 52. Thus, eScan moved the prefetch folder to unallocated space both times it was uninstalled, where parts of these folders were overwritten with data and irretrievably lost. See id. at 52-54. And although the testimony is unclear regarding the Ultimate Cleaner program, it is clear that the program was installed on Bell's computer by SeverCorr's IT technician and uninstalled on October 20, 2006. See Sanctions Hrg. Tr. at 56, 61, 287.
Jorgensen described the prefetch folder as " tell[ing] you what software is commonly used or is currently being used by the individual. An of course, any other memory devices that you have attached, such as the SanDisk." Sanctions Hrg. Tr. at 26.
Defendants acted intentionally. A party acts intentionally if it knew the evidence would be relevant at trial and its " willful conduct" resulted in the evidence's loss or destruction. See Hodge, 360 F.3d at 450 (citing Vodusek, 71 F.3d at 156). Thus, it is not necessary that a party intends to bring about the loss of evidence. Rather, spoliation may be inferred when a party intended to take those actions that caused the evidence's alteration or destruction. See Vodusek, 71 F.3d at 156. Anything more (e.g., requiring that the party intended to bring about the evidence's loss) would be tantamount to requiring bad faith, and the Fourth Circuit has expressly rejected bad faith as an " essential element of the spoliation rule." Id.
It would strain credulity to believe that defendants did not know the laptop would contain relevant evidence in this litigation. As Bell's primary work computer, the laptop would certainly contain information about Bell's activities at SeverCorr, his development of processes for SeverCorr, his communications with Nucor and SeverCorr employees, and other potentially relevant documents. The evidence has shown that Bell willfully continued to use the computer, which directly caused the alteration or destruction of relevant data. Bell was SeverCorr's agent and, because the laptop was his work computer, he certainly used the computer in the course of his employment and " ‘ in furtherance of the master's business.’ " Murphy v. Jefferson Pilot Commc'ns Co., 364 S.C. 453, 462, 613 S.E.2d 808, 812 (Ct.App.2005) (quoting Crittenden v. Thompson-Walker Co., 288 S.C. 112, 115, 341 S.E.2d 385, 387 (Ct.App.1986)). SeverCorr is therefore liable for Bell's spoliation. Finally, SeverCorr is liable for the spoliation caused by Sholes's (SeverCorr's IT technician) deliberate, repeated installation and de-installation of programs while this litigation was pending.
The court therefore concludes that defendants engaged in spoliation by continuing to use the Bell SeverCorr laptop when they were under a duty to preserve the data on its hard drive.
b. Alleged Data Wiping
Plaintiff has failed to offer sufficient evidence to prove that defendants intentionally deleted and overwrote data with zeros. In support of its argument, plaintiff relies heavily (if not exclusively) on the expert testimony of John Jorgensen. The heart of Jorgensen's intentional wiping theory is the large blocks of zeros he found on the Bell SeverCorr laptop's hard drive. He described the hard drive as having large, multi-gigabyte blocks of zeros surrounded by data. " Based on drive write protocols," he opined, " there is no reason why such large areas of a drive, in these locations, should not contain data." Second Jorgensen Report at 10. He concluded the only explanation for the zeros " involves the use of specialized software to specifically write zeros to defined locations on the hard drive with the purpose of permanently removing (‘ wiping’ ) data from the hard drive." Id.
Jorgensen's opinions and conclusions, however, contain significant flaws. He was unable to determine how or when the large blocks of zeros were written to the drive. See Sanctions Hrg. Tr. at 553. Jorgensen concluded that it was not surprising that he could not determine what program defendants used to wipe the data because there are programs available, like the program WinHex, that leave no traces that they were run. See id. at 80-81. Jorgensen even conducted a test to show that he could delete data and overwrite it with zeros to create a pattern similar to the one on the Bell SeverCorr laptop. But Jorgensen neglected to test an important question: whether he could run WinHex without leaving any traces that could be found by a computer forensic analyst. Aside from WinHex, Jorgensen noted that all Windows XP systems contain a " cypher.exe" program that could be used to overwrite data with zeros. However, the testimony (including Jorgensen's own testimony) showed that it would be nearly impossible to use this program to create the pattern found on the laptop's hard drive. Id. at 576-77, 700-02.
Of course, the fact that there were no traces of any " wiping" program found could also lead one to reasonably conclude that no wiping program was ever run on the Bell SeverCorr laptop.
Notably, in the course of developing these conclusions regarding how the zeros were created, Jorgensen offered at least one theory with respect to Ultimate Cleaner and Ultimate Defender that this court ruled was so unreliable that it did not meet the minimum Daubert standard. See Nucor Corp. v. Bell, 2:06-CV-02972-DCN, slip op. at 15-17 (D.S.C. filed Jan. 11, 2008).
Defendant also offered substantial evidence to refute Jorgensen's theory that a new, fresh out-of-the-box Dell laptop should write data in a continuous left-to-right pattern. Jorgensen's theory that a laptop should always write data from the beginning to the end of the drive in a continuous manner, without interruptions, is essential to his wiping theory. When Jorgensen first opined that the existence of zeros automatically indicates wiping, McLinden discredited that theory by demonstrated that Dell includes a background pattern of zeros on new hard drives. Jorgensen then shifted his theory, stating that the pattern of zeros combined with large blocks of data at the end of the drive indicate wiping because the data should start at and run continuously from the beginning of the drive. McLinden offered testimony to refute this theory as well, demonstrating that Dell's initial installation processes may alter the system in a way that data on a new computer may begin writing at the end of the drive. See McLinden Sept. 21, 2007 Report at 12-17; Sanctions Hrg. Tr. at 794. Although McLinden's testimony does not disprove Jorgensen's theory, it means both parties have provided equally compelling evidence to support their positions.
Finally, Mandiant, the independent consultant retained by both parties, concluded that there is there were " no indicators of wiping" on the laptop. See Mandiant Prelim. Report at 8. Although Mandiant has only conducted a preliminary analysis so far, it examined the programs installed on the computer, the master file table entries, and the system registry. See id. at 6-7. Mandiant also did keyword searches on the computer's files for commonly used wiping tools, using terms like " Winhex" and " Evidence Eliminator." See id. Those searches returned no hits. Id.
Accordingly, the court declines to find that defendants intentionally wiped data on the Bell SeverCorr laptop. This case presents a classic " battle of the experts," and the competing evidence on data wiping is in equipose. Unfortunately for plaintiff, more is required to meet its burden to prove wiping by a preponderance of the evidence. There are various reasons, as explained above, for refusing to assign controlling weight to Jorgensen's testimony. It is also worthwhile to note that Jorgensen's constantly changing theories in this matter, particularly his theories concerning how defendants allegedly wrote zeros to the hard drive, only increases the court's reluctance to find that wiping occurred. When an expert arrives at his final theories only because the opposing party's expert discredits all previous theories (resulting in an ad hoc trial-and-error method of analysis), a court should rightly be concerned with the reliability of the final theories as well.
Although the court finds that plaintiff failed to prove wiping by a preponderance of the evidence, plaintiff may present evidence on this issue to the jury for its consideration. See infra at 202-203.
c. The Hard Drive's Failure
Plaintiff finally argues that defendants should be sanctioned because their expert engaged in testing that resulted in the failure of the laptop hard drive, However, plaintiffs have been unable to demonstrate that relevant evidence was lost or destroyed as a result of McLinden's testing. The relevant evidence is the data contained on the hard drive, and not the physical hard drive itself Thus, if the data is still intact and available for analysis, no spoliation occurred.
As discussed at length in the court's previous order on the parties' Daubert motions, plaintiff and plaintiffs expert were fully able to analyze a reliable, bit-for-bit duplicate of the laptop's hard drive. See Nucor Corp. v. Bell, 2:06-CV-02972-DCN, slip op. at 26-29 (D.S.C. filed Jan. 11, 2008). Before the hard drive failed, McLinden made a forensic copy using EnCase, which many authorities-including the Sedona Conference-recognize as a reliable tool for making an exact copy of a hard drive. Id. at 27 & n. 12. At bottom, plaintiff has offered only unsupported speculation that the duplicate it received is not a true copy of the original hard drive. Without more, it would be inappropriate to conclude that spoliation occurred with respect to the data on the laptop hard drive.
3. The Missing CD
On March 9, 2006, John Bell transferred a number of Nucor training documents relating to the production of steel from his Nucor desktop to a CD. See First Jorgensen Report at 14. Plaintiff argues that defendants spoliated the CD because they have failed to produce it in discovery. Plaintiffs argument fails, however, because it has not offered sufficient evidence to show that the CD was in defendants' control when they were under a duty to preserve evidence. Bell testified that he created the CD because Dave Leherbe, a Nucor melt-shop employee, requested training materials in order to prepare for a job-related test. See P.l. Hrg. Tr. at 453-54. After creating the CD, Bell gave it to the Leherbe and did not retain any copies of it. Id.
Jorgensen opined that Bell transferred a document from the CD to a USB device through his home computer on March 27, 2006. See Second Jorgensen Report at 16. His only basis for that opinion was that a document known to have been viewed on the SeverCorr laptop was only available on the CD. See id. But there is no evidence that the CD was used on Bell's home computer or on the SeverCorr laptop, which one would expect given the amount of information we know about Bell's computer use. Moreover, there is no evidence to contradict Bell's testimony other than the fact that Nucor cannot find the CD. That fact does not require a conclusion that the CD is in defendants' possession; equally plausible explanations are that Leherbe has the CD or that Nucor possesses but simply cannot find the CD. Finally, plaintiff argues the court cannot accept Bell's testimony because he is not credible. Bell, despite having acted in bad faith vis-a-vis the SanDisk, has-as far as the court can tell-been truthful with regard to his disposal of evidence, especially since he has given statements against his interest. Moreover, Jorgensen testified that the materials appeared on the Nucor desktop in a file marked as training materials for Dave Leherbe-a finding that corroborates Bell's testimony. See P.I. Hrg. Tr. at 322.
There is no evidence, nor has there been any argument, that defendants had a duty to preserve the CD when the events described above took place. Moreover, plaintiff has failed to show that defendants had possession or control of the CD, or that defendants altered or destroyed the CD, when they had a duty to preserve it. Accordingly, plaintiff has not met its burden to show that defendants acted wrongfully with respect to the CD created on March 9, 2006.
B. Choosing a Remedy
Default judgment is a harsh sanction and district courts should be reluctant to impose that penalty. See Hathcock v. Navistar Int'l Transp. Corp., 53 F.3d 36, 40 (4th Cir.1995); Mut. Fed. Sav. & Loan Ass'n v. Richards & Assocs., Inc., 872 F.2d 88, 92 (4th Cir.1989). Nonetheless, a district court may impose default judgment if that sanction " serves the twin purposes of ‘ leveling the evidentiary playing field and ... sanctioning the improper conduct.’ " King v. Amer. Power Conversion Corp., 181 Fed.Appx. 373, 376 (4th Cir.2006) (alteration in original) (quoting Vodusek, 71 F.3d at 156). To that end, the district court should examine both the " spoliator's conduct and the prejudice caused" by the spoliation. Silvestri, 271 F.3d at 593. Finally, default judgment should be imposed only if " a lesser sanction will [not] perform the necessary function." Id. at 590.
Defendants' spoliation does not warrant the extreme sanction of default judgment. Despite the alleged spoliation, plaintiff has considerable evidence available to support its argument that defendants, particularly Bell, misappropriated Nucor's confidential information. Plaintiff knows when the USB devices were connected to the various computers Bell used, including the SeverCorr laptop. See First Jorgensen Report at 14-17, 19-20; Second Jorgensen Report at 12-16; P.I. Hrg. Tr. at 266-68; 288-89. Plaintiff has a list of 51 files believed to have been on the destroyed SanDisk device, even if it cannot be certain that the list is complete. See P.I. Hrg. Tr. at 282-83. Because Bell's actions vis-a-vis the SanDisk have not made it impossible for plaintiff to determine what was on the device-and thus did not make it impossible for plaintiff to prosecute its claims-default judgment is not an appropriate sanction.
Through temporary files created by Microsoft Office (the " .LNK files" ), plaintiff has discovered that three Nucor-related documents were opened and viewed on the SeverCorr laptop even though the full files did not reside on the hard drive. See Second Jorgensen Report at 12-14; P.I. Hrg. Tr. at 270-72. Plaintiff recovered the full versions of those documents because they were still present on the Nucor computer system. See P.I. Hrg. Tr. at 272-73. Plaintiff has located a copy of every file believed to have been on the destroyed USB device because they were available on other USB devices, other computers, or on Nucor's computer network. See P.I. Hrg. Tr. at 282-86. Finally, plaintiff contends it has only a " partial" list of the documents that were on the destroyed USB device. Surely plaintiff would be able to confirm that its list of documents is complete had Bell not destroyed the device. However, the list came from a reliable source: data found on Bell's Nucor computer, which was not subject to spoliation. And there is simply no reason to believe that plaintiff's inability to confirm the drive's contents prevents it from prosecuting its case. See First Jorgensen Report at 17-18 and attachment 9; P.I. Hrg. Tr. at 282-83. Given the vast amount of information plaintiff knows was transferred from Bell's Nucor computer to various other storage media (including CDs, USB devices, and other computers), plaintiff has sufficient circumstantial evidence to support its argument that defendants misappropriated confidential Nucor information-even if it may not have a reliable list of documents on the destroyed USB device or have all of the information that was on the laptop.
This is also clear from a demonstrative aid Jorgensen used during his testimony at the preliminary injunction hearing.
Moreover, an adverse inference charge will adequately sanction the improper conduct and level the evidentiary playing field. Many courts have noted that an adverse inference charge is a heavy sanction. Judge Scheindlin discussed the effect of an adverse inference charge in Zubulake IV:
In practice, an adverse inference instruction often ends litigation-it is too difficult a hurdle for the spoliator to overcome. The in terrorem effect of an adverse inference charge is obvious. When a jury is instructed that it may " infer that the party who destroyed potentially relevant evidence did so ‘ out of a realization that the [evidence was] unfavorable,’ " the party suffering the instruction will be hard-pressed to prevail on the merits. Accordingly, the adverse inference instruction is an extreme sanction and should not be given lightly.
Zubulake v. UBS Warburg LLC (" Zubulake IV " ), 220 F.R.D. 212, 219-20 (S.D.N.Y.2003) (quoting Linnen v. A.H. Robins Co., No. 97-2307, 1999 WL 462015, at *11 (Mass.Super. June 16, 1999)). In the instant case, if the jury chooses to apply an adverse inference, the effect could certainly be detrimental to defendants' case. That sanction is not too harsh in light of the spoliation that occurred in this matter, particularly Bell's destruction of evidence in bad faith, and will have the effect of deterring future spoliation, of punishing the spoliators, and remedying any harm.
There is inconsistency in how courts deal with the division of fact-finding labor in spoliation cases. The court makes the findings of fact necessary to reach a conclusion on the spoliation issue. See, e.g., Leon v. IDX Sys. Corp., 464 F.3d 951, 958-61 (9th Cir.2006); Zubulake v. UBS Warburg (Zubulake V), 229 F.R.D. 422 (S.D.N.Y.2004). That practice follows the usual rule that the court, rather than a jury, is responsible for finding facts on a motion for sanctions. See Cooter & Gell v. Hartmarx Corp., 496 U.S. 384, 399-401, 110 S.Ct. 2447, 110 L.Ed.2d 359 (1990): Brubaker v. City of Richmond, 943 F.2d 1363, 1374 (4th Cir.1991): Blue v. U.S. Dep't of the Army, 914 F.2d 525, 540-44 (4th Cir.1990). Indeed, a district court is granted broad discretion to impose appropriate sanctions, Silvestri, 271 F.3d at 590, and the abuse of discretion standard accounts for the judge's role as a fact-finder. See Cooter & Gell, 496 U.S. at 400-01, 110 S.Ct. 2447: see also Brubaker, 943 F.2d at 1374 (" A district court abuses its discretion if it bases its ruling on an erroneous view of the law or on a clearly erroneous assessment of the evidence." ) Nonetheless, when imposing an adverse inference charge as a sanction for spoliation, district courts permit the jurors to re-assess the evidence and determine whether, in their judgment, spoliation has occurred at all. For example, in Zubulake V, the court engaged in a thorough and well-reasoned assessment of the evidence, and ultimately concluded that the defendant had spoliated relevant evidence. Nonetheless, the district court's charge stated that the jury should decide whether the defendant failed to produce relevant evidence and, if it answered that question affirmatively, then decide whether to apply an adverse inference. See Zubulake V, 229 F.R.D. at 439-40. The Zubulake court's instruction mirrors the instruction the district court gave and the Fourth Circuit affirmed in Vodusek. In Vodusek, the district court charged the jury that a party, a party's counsel and expert witnesses have a duty to preserve evidence. Vodusek, 71 F.3d at 155. The district court further charged the jury:
The charge stated, in part:
" If you find in this case the plaintiff's counsel and agents, including [plaintiff's expert], failed to fulfill this duty, then you may take this into account when considering the credibility of [plaintiff's expert] and his opinions and you are permitted to, if you feel justified in doing so, assume that evidence made unavailable to the defendants by acts of plaintiffs counsel or agents, including [plaintiff's expert], would have been unfavorable to the plaintiff's theory in the case."Vodusek, Id.
While this court is content to allow the jury to decide whether spoliation occurred for itself, the allocation of labor in Zubulake V , Vodusek, and other cases makes little sense when viewed in light of all the sanctions available to remedy spoliation of evidence. If a district court finds that a party spoliated evidence and sanctions that conduct by giving an adverse inference charge, the spoliating party gets an opportunity to re-argue the spoliation issue before the jury. However, if a district court makes the same findings and chooses to impose any other sanction, including the harsher sanctions of default judgment or dismissal, the spoliating party is not afforded the same opportunity. In other words, the judge is the final authority to make the relevant findings of fact (subject, of course, to appellate review) in those cases. Because good authority trends toward such an outcome, notably the Zubulake V and Vodusek cases, this court will permit the parties to present all spoliation issues anew before the jury. The inconsistency is noted simply because courts and parties should be mindful of the consequences the different sanctions may have on who ultimately gets to decide the factual disputes.
The court will therefore give the following charge:
Plaintiff has argued that defendants affirmatively altered or destroyed relevant evidence, or that they failed to prevent the alteration or destruction of relevant evidence. This is known as the " spoliation of evidence."
Spoliation is the destruction or material alteration of evidence or the failure to preserve property for another's use as evidence in pending or reasonably foreseeable litigation. To demonstrate that spoliation occurred, plaintiff bears the burden of proving the following three elements by a preponderance of the evidence:
First, that relevant evidence was materially altered or destroyed. Evidence is relevant if it would have clarified a fact at issue in the trial and otherwise would naturally have been introduced into evidence;
Second, that defendants had a duty to preserve the evidence at the time it was altered or destroyed. A party has a duty to preserve evidence if it is relevant to pending litigation, or if a party knows or reasonably should know that the evidence may be relevant in anticipated litigation; and
Third, that defendants intentionally failed to preserve the evidence. " Intent" for purposes of spoliation means defendants' wilful conduct resulted in the material alteration or destruction of the evidence.
If you find that defendants engaged in the spoliation of evidence, you are permitted, but not required, to infer that the altered or destroyed evidence would have been unfavorable to defendants. Any inference you decide to draw should be based on all the facts and circumstances in this case.
IV. CONCLUSION
For the foregoing reasons, it is hereby ORDERED that plaintiffs motion for sanctions be GRANTED. The court will give the above adverse inference charge to the jury.
AND IT IS SO ORDERED.
You have heard that UBS failed to produce some of the e-mails sent or received by UBS personnel in August and September 2001. Plaintiff has argued that this evidence was in defendants' control and would have proven facts material to the matter in controversy.
If you find that UBS could have produced this evidence, and that the evidence was within its control, and that the evidence would have been material in deciding the facts in dispute in this case, you are permitted, but not required to infer that the evidence would have been unfavorable to UBS.Zubulake V, 229 F.R.D. at 439-40. This charge appeared in the district court's opinion almost immediately after the court concluded that " UBS failed to preserve relevant e-mails, even after receiving adequate warnings from counsel, resulting in the production of some relevant e-mails almost two years after they were initially requested, and resulting in the complete destruction of others. For that reason, Zubulake's motion is granted and sanctions are warranted." Id. at 439.