QUOTIENT, INC., Plaintiff v. Brian TOON, Defendant No. 13-C-05-64087 Circuit Court of Maryland, Howard County December 23, 2005 Counsel Christopher J. Heffernan, Esq., Paul M. Finamore, Esq., Niles, Barton & Wilmer, LLP, Baltimore, E. James Thompson, Esq., Severna Park. Sweeney, Dennis M., Judge MEMORANDUM AND ORDER *1 On December 20,2005, Quotient, Inc. (“Quotient”), a computer consulting company, filed a complaint against Brian Toon (“Toon”), who was Quotient, Inc.'s vice president of technology solutions until October 31, 2005. The Complaint alleges claims against Toon of breach of contract, conversion, tortious interference with contractual relations, tortious interference with prospective economic advantage, and invasion of privacy. Quotient alleges that while still a Quotient employee, Toon intentionally and surreptitiously provided a former Quotient employee access to Quotient's computer system so that the former employee could obtain Quotient's trade secrets and confidential information and use such information to compete with Quotient. On December 21, 2005, Quotient filed an Emergency Motion for Expedited Discovery of Documents and Property Pursuant to Maryland Rules 2-404, 2-422 and 15-504 (“Emergency Motion”), seeking an order to permit Quotient's retained computer expert access to “Toon's personal computer system, hard drives and back-up hard drives, disks, C.D.'s and/or other data, back up devices or vehicles in order to capture an image of these items.” At the hearing held on the Emergency Motion on December 22, 2005, counsel for Quotient further limited the request to now have a forensic computer expert copy Toon's personal computer system without any examination of the contents by anyone, including the expert, and have it held in a sealed fashion until there is a further order of the Court. In support of the motion, Quotient alleges that it searched its own business computers and discovered various e-mails and instant messages (“IMs”) exchanged between Toon and the former employee that substantiates the allegations of the Complaint. Quotient alleges that these IMs and e-mails show that Toon engaged in unlawful and tortious conduct to the detriment of Quotient. By example, Quotient points to an IM dated July 6, 2005, in which Toon and the former employee discuss the former employee's plans to bid against Quotient on upcoming work with an existing Quotient client. Quotient also refers to other IMs which it believes indicate that Toon and the other ex-employee discussed competing against Quotient for the work submitted by various other Quotient clients. Quotient also submitted to the Court various other e-mails and IMs which it claims indicate that Toon was using not only Quotient's computers for such communications but was also using his personal computer and his “home” e-mail address to discuss the former employee's new business venture and the computer system being established by that employee. Quotient also submitted e-mails that show that after Toon left Quotient, he used his home computer to communicate with Quotient employees and the former employee previously referred to about the matters that are now the subject of this litigation. The request of Quotient is to have a computer expert not employed by Quotient to “copy” the home computer hard drive as soon as possible in order to preserve whatever relevant information may be on it. An affidavit submitted from Quotient's retained expert, Phillip A. Rodokanakis, indicates that digital evidence is fragile and can be easily lost through the continued use of a computer system. The expert asserts that the destruction of potential evidence can be completely unintentional: *2 By the mere fact that a computer is turned on or off, the Operating System (OS) writes data to the hard disk, which could be overwriting data of possible evidentiary value that may exist in unallocated clusters. Unallocated clusters may contain data that was written to the disk at an earlier time; this data or its fragments continue to reside on the system's hard disks even after the original files were deleted from the system. The data from the original files continue residing in these unallocated clusters until they are over-written by a new file. The OS routinely writes temporary files to the hard disk that may also contain data of possible relevance. Given that the OS only intends to cache this data to the hard disk on a temporary basis, any fragmentary information left behind could be overwritten at a later time, while a computer system continues to be in use. Rodokanakis Affidavit, paragraphs 9 to 11. Mr. Rodokanakis further states in his affidavit that acquiring a hard disk image is the least invasive way to examine the type of computer system at issue. He asserts that “a forensically sound image is acquired in a matter of hours that can be preserved and examined at a later time.” Rodokanakis Affidavit, Paragraph 18. He also asserts that “the image acquisition process is purely a mechanical process. At no time, does the forensic examiner view the underlying data while acquiring a forensically sound image of the suspect disk.” Rodokanakis Affidavit, Paragraph 19. Quotient has made the representation that they will pay the full and complete cost of the copying process and will abide by any restriction on access and use imposed by this Court. Toon raises several objections to this emergency request. First, he argues that there is no need shown for such emergency relief mere days after the filing of the law suit, and that the normal discovery and briefing process should be allowed to operate. Secondly, Toon argues that there has been no demonstration that he has intentionally destroyed documents of any type or sought to hide them. Indeed, it appears that Toon was cooperating with Quotient and their counsel in their investigation of the other employee's conduct until recently. Finally, Toon also raises the substantial concern that the relief requested here could lead to an invasion of the personal privacy of not only Mr. Toon but also of his spouse who, according to counsel's representations, uses the computer for her own purposes. While there is no way to quantify the percentages at this juncture, it certainly seems from what is before the Court that the percentage of data in Toon's personal computer that would be relevant to this litigation would be small in comparison to what would be completely irrelevant. There are legitimate concerns presented by both parties. There is no evidence at this juncture that Toon has concealed or destroyed evidence, and Quotient's argument on this point seems to be that he may have motive and opportunity to do so having now been sued for millions of dollars. While this may be true as a general theory, that theory would apply in every case. This is not a convincing rationale for the special extraordinary relief sought by Quotient. *3 More persuasive is the argument that the unintentional destruction of relevant evidence should be halted when it can be done so in a fashion that is minimally intrusive and where Quotient is willing to bear the full cost of the process. This Court is persuaded from the evidence before it that there is a substantial probability that evidence in the form of deleted or undeleted e-mails, IMs, and/or other files that are relevant to this case could be made less accessible to the parties merely by Toon's normal course of computer use, regardless of his intentions and motive. It does appear from the evidence currently before the Court by attachments, affidavits and the representations of counsel that communications relating to this litigation were in fact present in Toon's computer, and those items or the remnants thereof may still be there in a presently-retrievable format. While the Court is sympathetic to Toon's counsel's concern about being rushed into confronting this issue, it should be noted that all parties and the interest of justice will be likely advanced if the nature of the alleged communications can be determined without several more months of “overwriting” on the hard drive occurring. In light of the allegations in the Complaint, Toon does not dispute that he has a duty to preserve relevant evidence in his possession. However, Toon has not articulated how he will meet the preservation obligation by a means other than the one advocated by Quotient, i.e., the copying of the hard drive of Toon's personal computer. One of the leading authorities on electronic document production recognizes that preservation orders should only be entered when necessity has been shown. The Sedona Principles: Best Practices, Recommendations & Principles for Addressing Electronic Document Production, 27 (July 2005), available at http:// www.thesedonaconference.org. However, that report recognizes the value of such orders in promoting efficient litigation: Preservation orders may in certain circumstances aid the discovery process by defining the specific contours of the parties' preservation obligations ... Preservation orders should be tailored to require preservation of documents and data that are potentially relevant to the case, and should not unduly interfere with the normal functioning of the affected computer systems. The personal privacy concerns of Toon and his family are important ones. Quotient has assured the Court that a copy of the hard drive can be made without viewing any of the actual data within documents or communications themselves. This is supported by the expert's affidavit before the Court. Quotient has also indicated that the primary concerns can be satisfied by having Toon's counsel screen the available data for privilege, privacy and relevance concerns prior to any disclosure to Quotient. This would lessen, if not altogether obviate, the legitimate concerns of Toon and his family. This being the case, the Court will permit the copying process to proceed but under restrictions: *4 1. A sufficiently qualified forensic computer expert shall be allowed access to Toon's computer system to make a copy of the hard drive. 2. In making the copy, the expert shall not inspect or review any document or communication that may exist on the hard drive. 3. Once made, the copy of the hard drive shall be kept secure by the expert and not used by the expert or anyone else except by further order of this Court. 4. Toon, his counsel, and any expert of their choosing may observe the copying process. 5. The copying process shall proceed at a place and time agreed to by counsel but as quickly as possible to minimize the further loss of potentially relevant data. 6. Copies made shall be limited to those devices where the unintentional destruction of evidence is taking place by the routine continuing use of the device. For example, CDs not in current use and stored would not be unintentionally erased and will be subject to the usual discovery process. 7. The expert designated to perform this function shall be considered to be the Court's expert for this purpose and shall operate under the direction of the Court's order. 8. The expert, prior to beginning the expert's work, shall agree in writing to abide by the terms of this Memorandum and Order. 9. Quotient shall be responsible for any harm or damage to Toon's computer system that may result from the application of the process requested by Quotient and ordered by this Court. 10. The expert should follow a standard forensic protocol such as that of the National Institute of Justice[1] and shall file, upon completion of the process, a certification with the court that the process is complete and the precautions taken to secure the data obtained. The expert proposed by Quotient, Phillip A. Rodokanakis, appears to be well-qualified for the task, and Toon has not raised any objection to his qualifications. Quotient may proceed to have Mr. Rodokanakis perform this function, but must understand and agree that at this juncture that he will be acting as an expert under the direction of the Court. If given this restriction, Quotient chooses not to proceed with Mr. Rodokanakis, it shall propose to the Court, after consultation with Toon's counsel, another similarly-qualified forensic computer expert to perform the task. For these reasons, it is, this 23rd day of December, 2005, ORDERED, that the Emergency Motion for Expedited Discovery of Documents and Property is granted to the extent that the parties are ordered and directed to proceed as specified in this Memorandum and Order. Footnotes [1] U.S. Department of Justice, Office of Justice Programs. National Institute of Justice, Special Report: “Forensic Examination of Digital Evidence: A Guide for Law Enforcement,” April 2004 NCJ # 199408.