United States District Court, W.D. Tennessee, Western Division
October 19, 2005
Peter D. Marketos, Donald C. Templin, Travis M. Perry, Haynes & Boone LLP, Dallas, TX, Randall D. Noel, Butler Snow O'Mara Stevens & Canada, PLLC, Memphis, TN, for Plaintiff and Counter-Defendant.
John McQuiston, II, Evans & Petree, P.C., Memphis, TN, for Defendant and Counter-Claimant.
REPORT AND RECOMMENDATION ON PLAINTIFF'S MOTION TO DISMISS DEFENDANT PARTSBASE'S COUNTERCLAIMS DUE TO SPOLIATION OF EVIDENCE
*1 Before the court is the June 20, 2005 motion of the plaintiff, Inventory Locator Service (“ILS”), to dismiss the defendant's counterclaims due to spoliation of evidence and as a sanction pursuant to Rule 37(b)(2) of the Federal Rules of Civil Procedure. In the alternative, ILS requests that the court impose an adverse inference on the defendant regarding its destruction of the evidence or other sanctions that the court deems appropriate. Finally, ILS requests that the court award ILS its legal fees and costs (including expert fees) incurred in investigating, analyzing and litigating the counterclaim and the spoliation dispute. Defendant, PartsBase, opposes the motion. The motion was referred to the United States Magistrate Judge for a report and recommendation.
An evidentiary hearing was held on October 5, 2005. At the hearing, ILS called its expert, Lawrence Cowan. PartsBase called its expert, Douglas Rehman. PartsBase also proffered Brian Tolley, who is PartsBase's Chief Information Officer, and Fred Wagner, a PartsBase information systems employee. The parties stipulated that Tolley and Wagner's testimony would be consistent with their previously filed affidavits.
This motion involves the duty of litigants to preserve electronic evidence. At issue here is (1) whether PartsBase allowed original data to be lost when it allowed its WebTrends Server to be overwritten in its normal operations after it had copied the data supporting its counterclaim from the WebTrends Server to nineteen non-writeable compact discs (“CDs”) and (2) whether PartsBase further allowed original data to be lost when it placed a backup tape containing additional data supporting its counterclaim back into rotation in its normal operations and allowed it to be overwritten after PartsBase had transferred the data to another server. For the reasons stated below, it is recommended that the plaintiff's motion to dismiss or to impose other sanctions be denied.
Based on the parties' pleadings, relevant affidavits and testimony from the October 5, 2005 hearing,
this court finds as fact the following:
This case involves a dispute between two competing businesses, ILS and PartsBase. (Am.Countercl. 9.) ILS and PartsBase each operate a database on the Internet that serves as an “electronic marketplace” for aviation parts by allowing buyers and sellers to communicate and share information with one another. (Am. Compl. 5; Am. Countercl. 5.) Both ILS and PartsBase allow access to their respective databases only if an individual has subscribed to their service and has been issued an ID and password. (Am. Compl. 7; Am. Countercl. 7.)
On September 5, 2002, ILS sued PartsBase, claiming that PartsBase gained unauthorized access to its database by using a customer's ID and password. (Compl. 10; Am. Compl. 10.) ILS further claimed that PartsBase used such unauthorized access to gather information stored on ILS's database and solicit the business of ILS customers. (Id.
*2 Over a year into the litigation, PartsBase discovered evidence indicating that ILS was engaging in similar conduct and filed a counterclaim against ILS. On December 29, 2003, while making a routine assessment of “hits” on a customer's advertisement on its website, a PartsBase employee discovered an internet protocol number (“IP address”) assigned to ILS. (Am.Countercl. 14.) PartsBase conducted a preliminary investigation and determined that ILS had used many customer IDs and passwords to access the PartsBase database numerous times over a period of more than two years. (Id.
Specifically, PartsBase alleges that (1) between October 24, 2001 and early January 2004, ILS logged into the PartsBase database on 286 dates and viewed 6,106 PartsBase customer profiles; (2) ILS used 139 unique PartsBase passwords to log in to these profiles;(3) the 139 passwords belonged to 119 PartsBase customers in 26 states; and (4) using PartsBase customer IDs and passwords, ILS systematically accessed PartsBase's entire customer list in alphabetical order. (Id.
) PartsBase continued the investigation and discovered that persons using the ILS IP address used over 900 passwords belonging to PartsBase customers to access the PartsBase airplane parts and service database. (Id.
at 16.) In addition, PartsBase alleges that a person acting from the ILS IP address made changes in the PartsBase airplane parts and service database that prevented the database from operating correctly when PartsBase customers attempted to use it. (Id.
On January 26, 2004, PartsBase filed a motion for leave to amend to file a counterclaim based on its newly discovered evidence. (Mot. for Leave to Amend.) That motion was granted on March 18, 2004, and PartsBase filed its counterclaim against ILS on March 25, 2004. (Order Granting Def. Leave to File Countercl., March 18, 2004; Countercl.)
ILS sought discovery of the evidence supporting PartsBase's counterclaim. (Pl.'s Hem. in Supp. at 2.) Specifically, ILS requested “[t]he web server access log for the PartsBase database which supports the allegations set forth in the affidavits of Brian Tolley and Jesse C. Josephson attached in support of Defendant's Motion for Leave to Amend and File Counterclaim Based on Newly Discovered Evidence.” (Pl.'s App. in Supp., Ex. A at 3.) PartsBase responded on March 9, 2004 that “[c]opies of presently available information printed from the PartsBase database which supports the allegations ... will be provided.” (Id.
) PartsBase noted that the investigation was continuing. (Id.
On April 29, 2004, PartsBase hired a nationally recognized technical expert, Rehman, to take over the investigation. (Tolley Aff. 5, Feb. 18, 2005.) At the hearing, Rehman testified that he is currently employed as the president of Rehman Technologies Inc. He also testified that he has fourteen years of experience in computer forensics and has provided expert testimony on the subject in numerous cases. (Hr'g Ex. 9.) He has also worked with the FBI and the U.S. marshals on child exploitation cases involving computer forensics. (Id.
*3 At the hearing, Rehman testified that PartsBase uses three web servers that record visits to PartsBase's website. In addition, PartsBase uses a WebTrends Server and corresponding software. Every night, the data from PartsBase's three web servers is automatically transferred to PartsBase's WebTrends Server and deleted from the web servers. Once the data is on the WebTrends Server, the WebTrends software allows PartsBase to determine the amount of traffic on its website for marketing purposes and for sales of advertising.
Once retained by PartsBase, Rehman immediately requested that Tolley, PartsBase's Chief Information Officer, provide him with a copy of the server logs that reflected visits into the PartsBase database from ILS's IP address. (Tolley Aff. 1 & 5, Feb. 18, 2005; Rehman Aff. 15, Mar. 3, 2005.) Rehman testified that he did not advise PartsBase to make a forensic image of the WebTrends Server but to merely copy the data from the WebTrends Server on to non-writeable CDs.
At Rehman's request, Tolley searched PartsBase's WebTrends Server to find all files containing at least one entry of the ILS IP address 126.96.36.199. (Tolley Aff. 6, Feb. 18, 2005.) At that time, the only data on the WebTrends Server was from 2003. (Id.
at 13.) After searching the WebTrends Server, Tolley provided a list of such files to Wagner, a PartsBase information systems employee, and asked him to copy those files onto CDs. (Id.
at 7; Wagner Aff. 3, Feb. 18, 2005.)
As instructed, Wagner located the designated files on the WebTrends Server, transferred them onto a hard drive, and copied them from the hard drive onto CDs.
(Wagner Aff. 3, Feb. 18, 2005.) Wagner testified that he made a true and exact copy of the files on the WebTrends Server and that he did not alter or falsify any of the data in any way. (Id.
at 6, 9, 14.) After copying the files containing the server logs onto the CDs, Wagner left the original data on the WebTrends Server. (Id.
at 5.) On May 19, 2004, Wagner gave Tolley 19 CDs containing the requested information. (Tolley Aff. 8, February 18, 2005.) Tolley then sent the 19 CDs to Rehman, who copied the 19 CDs and sent them to ILS's counsel on June 21, 2004. (Id.;
Rehman Aff. 15, Mar. 3, 2005.) At the hearing, Rehman testified that Wagner used CDs that, once created, could not be altered or overwritten.
On September 24, 2004, as a routine part of his job, Wagner received a complaint from PartsBase's marketing department that the WebTrends Server was not functioning. (Wagner Aff. 7, Feb. 18, 2005; Hr'g Ex. 8.) To address the complaint, Wagner “freed up space” on the WebTrends Server by deleting records including, but not limited to, the server logs Tolley had asked him to copy. (Wagner Aff. 7, Feb. 18, 2005.) Before doing so, Wagner copied the data again, this time onto his personal external hard drive. (Id.
) He later transferred the data from his personal external hard drive on to his home computer. Wagner stated that freeing up space on the WebTrends Server is a routine part of his job and he has done it many times. (Id.
) Wagner testified that it did not occur to him that there was any reason not to free up space on the WebTrends Server since a complete and exact copy of the server log data had been preserved, both on the CDs and on his personal external hard drive. (Id.
*4 In September 2004, Tolley discovered that the server logs that had been copied onto the CDs were no longer on the WebTrends Server. (Tolley Aff. 15, Feb. 18, 2005.) Tolley instructed Wagner to make every effort to recover the server logs. (Id.;
Wagner Aff. 11, Feb. 18, 2005.) Wagner informed Tolley that he had preserved the data that was on the 19 CDs on his external hard drive which he then copied onto his home computer. (Tolley Aff. 16, Feb. 18, 2005; Wagner Aff. 11, Feb. 18, 2005.) Wagner recovered the data and placed it on PartsBase's PBSQL02 server where it remains today. (Id.
) It is undisputed that the server logs no longer exist on the WebTrends Server.
Despite the fact that PartsBase transferred the data from the WebTrends Server, it appears that ILS had an opportunity to inspect and copy the server logs on the WebTrends Server before Wagner deleted them from the WebTrends Server. At the hearing, PartsBase's counsel stated to the court that, at some point after the CDs had been produced to ILS but before the logs were deleted from the WebTrends Server, PartsBase offered to allow ILS or its expert, Cowan,
to inspect or “forensically image” the server logs on the WebTrends Server. ILS, however, failed to do so. According to PartsBase's counsel, Cowan said during his deposition that the copies would be okay. When asked at the hearing why he did not create a forensic image, Cowan testified that it was not his obligation to image the WebTrends Server and that PartsBase should have conducted the imaging itself. Based on the above statements, this court finds as fact that, sometime between June 21, 2004 and September 24, 2004, PartsBase produced the server logs-as they existed on the WebTrends Server at that time-by making them available to ILS to inspect and copy and/or image.
Sometime in September 2004, Wagner also located some older PartsBase server logs created prior to 2003 that had been stored on a backup tape. (Wagner Aff. 11-12, Feb. 18, 2005.) Wagner transferred the older server logs he found on the backup tape to the PartsBase PBSQL02 server where they remain. (Id.
at 12.) Wagner testified that he made a true and exact copy of the backup tape and that he did not alter or falsify any of the data in any way. (Id.
at 13 & 14.) Because all PartsBase backup tapes are used in rotation in PartsBase's normal operation, Wagner later used the backup tape in the ordinary course of rotation to store other files. (Id.
at 13.) Wagner stated that it did not occur to him that the backup tape should not be used because he had made a complete and exact copy of the data, which was just as good as the original. (Id.
) PartsBase produced a copy of the server logs from the backup tape to ILS on November 8, 2004. (Tolley Aff. I 27, Feb. 18, 2005.) It is undisputed that the server logs no longer exist on the backup tape.
*5 PartsBase also produced to ILS a copy of its Membership Services database, which is copied automatically to PartsBase's SQL server and periodically backed up. (Id.
at 3 & 13.) The MS_Member_Clicks Table from that database contains records from 2001, 2002 and 2003 that allegedly show intrusions from ILS's IP address. (Id.
at 13; Rehman Aff. 23, Mar. 3, 2005.)
On August 25, 2004, Tolley made a backup tape of the Membership Services database. (Tolley Aff. SI 13, Feb. 18, 2005.) Wagner then copied the backup tape onto a CD. (Id.;
Wagner Aff. SI 10, Feb. 18, 2005.) Rehman made a copy of that CD and produced it to counsel for ILS. (Rehman Aff. § 16, Mar. 3, 2005.) PartsBase also offered ILS the opportunity to examine and forensically image the SQL server. (Tolley Aff. at 3, Feb. 18, 2005.) This court therefore finds as fact that PartsBase produced to ILS the Membership Services database containing the MS_Member_Clicks Table both on CD and on its original media, the SQL server.
ILS claims that PartsBase has precluded ILS from defending itself against the counterclaim and disproving the authenticity of the server logs by destroying the “original electronic media” from which the logs derived. (Pl.'s Mem. in Supp. at 3.)
At the outset, the court must determine what the parties mean by the “original electronic media.” Cowan, ILS's expert, defines the term “media” as “a wide range of storage devices, including hard drives, CD-ROMS, floppy disks, zip disks. Jazz Disks, DVD-ROMS, backup tapes, Flash memory and any other device that can be used by a computer to store data.” (Hr'g Ex. 4 at 6.) According to PartsBase and Rehman, the media on which the “original” server logs were recorded was one of PartsBase's three web servers. (Def.'s Hem. in Opp. at 2; Rehman Aff., Aug. 2, 2005.) Each night, the server log files from PartsBase's web servers were automatically copied to PartsBase's WebTrends Server and deleted from the web servers. (Id.
) At the hearing, Cowan acknowledged that PartsBase had no duty to preserve the server logs on PartsBase's web servers because that data had been deleted from the web servers and transferred to the WebTrends Server before PartsBase ever discovered ILS's IP address on its server logs. At the hearing, ILS counsel stated to the court that by “original” electronic evidence, ILS meant the server logs on the WebTrends Server on December 29, 2003-the date when PartsBase first discovered ILS's IP address in the logs. For the purpose of ILS's arguments, references to the “original” data will be considered a reference to the server logs as they existed on the WebTrends Server on December 29, 2003.
In its motion, ILS claims that PartsBase spoiled the server log evidence by removing the server logs from the WebTrends Server and by overwriting the later-discovered backup tape. ILS argued that the copies PartsBase produced do not constitute exact duplicates and cannot be authenticated. As a result, ILS asked the court to dismiss PartsBase's counterclaim, or, in the alternative, impose an adverse inference regarding PartsBase's destruction of the server logs or other appropriate sanctions. In response, PartsBase argued that it produced an exact and authentic copy of the server logs on the WebTrends Server and on the backup tape. PartsBase also argued that the authenticity of the produced copy can be demonstrated through the contents of the server logs themselves and through comparisons with other PartsBase data, such as the MS_ Member_Clicks Table. The parties' positions and this court's findings regarding these issues are summarized below.
*6 ILS argues that the server logs produced by PartsBase are not true duplicates because (a) PartsBase “filtered” the data prior to copying and producing it, and (b) the metadata contained in the produced CDs is different than the metadata that would have been contained in the WebTrends Server. ILS also argues that, because PartsBase did not preserve or forensically image the server logs, it cannot conduct a cryptographic hash algorithm
to determine if the produced server logs are an exact duplicate.
First, ILS argues that the server logs PartsBase produced are not duplicates because PartsBase “filtered” the data prior to copying it. (Pl.'s Mem. in Reply at 6.) In support of this contention, ILS quotes Rehman's deposition, in which he defines filtering as “filtering out the ILS IP records from the mass of other non-ILS records.” (Id.
) In response, PartsBase argues that the PartsBase server logs were not “filtered” in any improper way, as suggested by ILS. (Def.'s Resp. to Reply at 8.) According to PartsBase, the term “filtering” simply refers to when Tolley conducted a search “to find all records containing within them at least one entry of the ILS IP address 188.8.131.52.” (Def.'s Resp. to Reply at 8; Tolley Aff. 6, Mar. 4, 2005.) Rehman states that the “filtering” of the server logs “is directly comparable to going through paper business records and producing all records that have any mention of ILS.” (Rehman Aff., Aug. 2, 2005.) This court finds as fact that PartsBase's “filtering” of the data does not preclude the data from being an exact duplicate, but merely equates to a search of the server logs for relevant records containing ILS's IP address.
b. The Metadata
Second, ILS argues that the server logs PartsBase produced are not true duplicates because the metadata is different than the metadata that would have been present on the WebTrends Server or on a forensic image of the WebTrends Server. (Pl.'s Mem. in Reply at 3-4.) It is undisputed that there are three kinds of metadata related to the server logs: the Creation Date, the Last Accessed Date, and the Last Written Date. (Rehman Rebuttal Rep. at Attach. B.)
At the hearing, Cowan testified that any type of media-i.e. a WebTrends Server, backup tape, or CD-has its own set of metadata. For example, Cowan testified that the WebTrends Server would have contained Creation Date metadata showing the creation date on that specific media, but that the Creation Date on the produced CDs only shows when the CDs were created. PartsBase objected to Cowan's testimony concerning the metadata because his opinions on metadata were not included in either his original or supplemental expert report. The court took the objection under advisement in order to review Cowan's report. After careful review of Cowan's expert reports, the court sustains the objection. Cowan failed to render an opinion on the issue of metadata in his reports, and he should not be allowed to offer testimony on the issue. His testimony, therefore, on this issue will be disregarded.
*7 Rehman's rebuttal report, however, appears to support Cowan's contention that the Creation Date metadata changed when the server logs were copied from the WebTrends Server onto the CDs. (Rehman Rebuttal Rep. at Attach. B.) Nevertheless, Rehman testified at the hearing that the Creation Date and the Last Accessed Date metadata are essentially useless in determining the authenticity of the server logs because they change every time the media is “touched” either manually or automatically, such as when the server logs are automatically transferred from the web servers to the WebTrends Server each day. Rehman also testified at the hearing that the Last Written Date metadata-which was retained during the copying process and produced to ILS-indicates that the produced server logs have not been altered. (Rehman Rebuttal Rep. at 13, July 8, 2005.) When a file is altered, the Last Written Date is changed to the date and time that the alterations were made. (Id.
at 14.) If a hypothetical forger made alterations to the server logs, that person would have to correct the Last Written Dates for each of the files. (Id.
) Rehman testified that the Last Written Dates for the server log files are consistent with the dates of the contents of each file. (Id.
This court finds as fact, therefore, that the Last Written Dates were retained when the server logs were copied to the CDs. Finding Rehman's testimony credible, this court further finds as fact that any potentially lost or unproduced Creation Date and Last Accessed Date metadata was irrelevant, given that the Last Written Date metadata was retained and produced to ILS, and does not preclude the CDs from being exact duplicates of the server logs.
c. Forensic Imaging And Cryptographic Hash Algorithms
At the hearing Cowan testified that, according to industry standards, PartsBase should have forensically imaged the WebTrends Server immediately after discovering the evidence in support of its counterclaim on December 29, 2003. Because PartsBase did not preserve or forensically image the original server logs, ILS claims it is unable to conduct a cryptographic hash algorithm, which could compare the forensic image to the CDs and thereby verify the authenticity of the produced server logs. (Pl.'s Mem. in Reply at 3-4.) At the hearing, ILS's counsel suggested that the WebTrends Server never contained any server logs with ILS's IP address, and therefore a hash comparing a December 29, 2003 image of the WebTrends Server with the produced CDs would show that all of PartsBase's evidence was fabricated.
Rehman testified at the hearing that even if PartsBase had forensically imaged the WebTrends Server logs on December 29, 2003, ILS would still not be able to demonstrate the authenticity of the produced server logs through a cryptographic hash. According to Rehman's testimony, identical hash values would merely show that no changes occurred to the data from the date of the imaging until the date of production. (Rehman Aff., Aug. 2, 2005.) Rehman testified at the hearing that this would not rule out or preclude the possibility that the logs were altered prior to the forensic imaging; it would merely show that the CDs were exact duplicates of the logs as the logs existed at the time of the imaging.
*8 There is no reason to believe that PartsBase would claim to discover evidence on the WebTrends Server on December 29, 2003, launch an investigation, petition the court for leave to amend, and file its counterclaim if the evidence-authentic or not-did not already exist there as of the date of the alleged discovery. This court therefore finds as fact that the inability of ILS to perform a cryptographic hash algorithm on the server logs does not preclude the nineteen CDs from being a true and exact copy of the server logs that existed on the WebTrends Server as of December 29, 2003, and the court further finds that the 19 CDs accurately reflect the data that existed on the WebTrends Server on December 29, 2003, with the exception of the Last Created Date and the Last Accessed Date, which are irrelevant.
ILS also argues that the server logs produced by PartsBase are not authentic because (a) they are incredible on their face, and (b) internal inconsistencies (referred to as “cookie anomalies”) indicate that the server logs have been manipulated. PartsBase opposes ILS's statements and claims that the authenticity of the server logs produced by PartsBase can be verified by other PartsBase data, such as the MS_Member_Clicks Table.
a. Credibility On The Face Of The Allegations
According to ILS, PartsBase's allegations are incredible on their face because the server logs show that ILS entered the PartsBase database about two million times in seventeen months, including on holidays and weekends and during ILS's office move. (Pl.'s Mem. in Supp. at 5.) Rehman testified at the hearing that viewing a single web page can create numerous records in the server logs. For example, of the two million ILS records in PartsBase's server logs, more than one million were generated for graphic images and more than 650,000 were generated for automatic activities such as changing the banner advertisement or indicating that the computer was still signed into the database. (Rehman Rebuttal Rep. at 12-13.) According to Rehman, ILS's server logs confirm that ILS accessed the PartsBase database even during weekends and holidays. (Id.
at 12.) Finally, Rehman claims that ILS maintained an internet connection during their office move that could have generated the server log records for that time period. (Id.
) in fact, the server log records generated during ILS's office move are automatically generated records indicating that two ILS computers were left logged into the PartsBase database. (Id.
According to ILS, PartsBase's allegations are also incredible because PartsBase's server logs suggest that 5.4% of PartsBase's total web traffic comes from ILS. (Pl.'s Hem. in Reply at 4.) ILS argues that this is too much activity for PartsBase not to notice, as it claims. (Id.
) Rehman testified at the hearing that, although activity from ILS's IP address constituted 5.4% of the produced server logs, that does not equate to 5.4% of the total traffic on PartsBase's website because PartsBase only produced server logs that contained ILS's IP address-not all of its server logs. (Rehman Aff., Aug. 2, 2005.) For example, on days where all the ILS activity occurred on one of PartsBase's three web servers, only that server's log files were produced and analyzed. (Id.
) As a result, Rehman claims that ILS activity is “well below” 5.4% of PartsBase's total web server activity. (Id.
*9 This court makes no factual findings as to the credibility of the server log evidence as this is a determination for the jury or fact finder. In its recent order, the court stated that “the copies of computer records will be considered ‘originals' for purposes of the Rules of Evidence if they are shown to reflect the data accurately.” Order on Pending Motions at 50, Sept. 6, 2005. As the order suggests, the parties can present their arguments regarding the authenticity of the produced server logs to the jury or fact finder.
b. Cookie Anomalies
ILS further argues that internal inconsistencies in the server logs, referred to as “cookie anomalies,” indicate that the logs have been manipulated. (Pl.'s Hem. in Supp. at 6.) When a user from a specific IP address logs on to the PartsBase database, an identifying record associated with a user's computer called a “cookie” is created and recorded alongside the entry in the server logs. (Id.
) The cookie contains, among other information, an “IP address” field for the IP address from which the user is logging in. (Id.
) The cookie's IP address normally matches the IP address recorded in the server log itself. (Id.
In Cowan's initial report, he stated that none of the records allegedly coming from ILS's IP address had a corresponding cookie that matched ILS's IP address. (Hr'g Ex. 4 at 4.) Furthermore, Cowan claimed that the cookie matched the server log IP address in every single instance except for the entries purportedly originating from ILS. (Id.
) Cowan concluded in his original report that the cookie anomaly suggests that the original IP addresses in the server logs were replaced with ILS's IP address. (Id.
Rehman testified that the cookie anomaly is caused by the web servers' failure to detect multiple logins using the same ID and password. (Rehman Aff., Aug. 2, 2005.) When this occurs, the second login is given the cookie that was created at the time of the first login. (Id.
) Contrary to Cowan's initial report, Rehman testified at the hearing that server logs from several other IP addresses besides ILS's address were found to contain the cookie anomaly. (Rehman Rebuttal Rep. at 5.) According to Rehman, almost 9% of all server log records contained the cookie anomaly, including over 1 million non-ILS records from 18,531 unique IP addresses. (Id.
at 5-6.) Furthermore, 14,121 other IP addresses also had 100% of their records contain the cookie anomaly, like ILS. (Id.
at 6; Rehman Aff., Aug. 2, 2005.) Rehman stated that, “[a]s all of the accounts ILS accessed belonged to others, it is not surprising to find the Cookie Anomaly in their records.” (Rehman Aff., Aug. 2, 2005.) At the hearing, Cowan conceded that there were other instances where the cookies did not match the IP address.
ILS argues, nevertheless, that the cookie anomaly suggests that ILS's IP address was cut-and-pasted into the server logs. (Hearing Ex. 4 at 4; Pl.'s Mem. in Supp. at 6.) At the hearing, Rehman testified that it would be impossible to alter the server logs with a simple cut-and-paste function and that a hypothetical forger would have to alter several features of the server logs-correctly and consistently-for the alterations to appear genuine. For example, with respect to the cookie anomaly, 5,034 different IP addresses were found encoded in the cookies of ILS server log records. (Rehman Rebuttal Rep. at 14.) According to Rehman, “[t]his would mean that the imaginary forger would have had to have done searches for each of these 5,034 IP addresses and then randomly chosen which records to alter with ILS's IP address.” (Id.
) Rehman also argues that if the cookie anomaly is the result of a forgery, the imaginary forger would have had to alter the non-ILS records “for absolutely no cognizable reason” so that they would also contain the cookie anomaly.
*10 At the hearing, Cowan also testified that PartsBase could have used a computer program to insert ILS's IP address into the server logs in an apparently random fashion. Rehman testified at the hearing that such a program would not create records that rationally traced a user's progress through the various pages of the PartsBase database, as the server logs from ILS's IP address do here.
Again, this court makes no factual findings as to the authenticity of the server log evidence based on the cookie anomalies. The court again finds Rehman's testimony to be credible and finds as fact that server logs from IP addresses other than ILS contained the cookie anomaly. The court further finds as fact that it would be impossible to alter the logs with a simple cut-and-paste function and that it would be impossible to create the produced server log records with a computer program such as the one proposed by Cowan.
c. Whether Other PartsBase Data May Verify Authenticity
Finally, PartsBase argues that the authenticity of the server logs it produced can be verified by other PartsBase data. (Def.'s Mem. in Opp. at 5-6.) For example, Rehman testified at the hearing that he compared some of the server log records containing ILS's IP address to PartsBase's “MS_Member_Clicks” Table. Rehman concluded that all the server log records he checked were found to have a matching entry in the MS_Member_Clicks Table. (Rehman Rebuttal Rep. at 9 & 14.) Rehman notes that, in addition to all modifications to server logs themselves, an imaginary forger would have to find and alter all corresponding records in the MS_Member_Clicks Table.
at 14.) Rehman testified that it would be difficult to counterfeit both the server logs and the MS_Member_Clicks Table in all places of overlap in a way that left no trace.
ILS argues that the HS_Member_Clicks entries do not match the server logs because the time records are different. (Pl.'s Mem. in Reply at 6-7.) PartsBase points out, however, that Rehman's report accounted for the time difference. (Def.'s Resp. to Reply at 4-5.) At the hearing, Rehman testified that the three web servers did not have their time synchronized. In addition, there is a four to five hour time difference because the server logs were generated using Universal Time Coordinated, whereas the MS_Member_Clicks Table was generated using local Florida time. As a result, matches were determined by finding records reflecting the same date, employee ID, and company ID and occurring in the same order. (Rehman Rebuttal Rep. at 9.)
At the hearing, Cowan suggested that the MS_Member_Clicks Table could have been created from altered server logs. Rehman noted, however, that the MS_ Hember_Clicks Table contains earlier records (from 2001 and 2002) for which PartsBase does not have corresponding server logs. In addition, Rehman suggested that the time discrepancy between the logs and the Table actually helps prove that the records are authentic and were not merely created from fraudulently altered server logs. PartsBase argues that “[i]f the records had been counterfeited the times also would have been counterfeited to be exactly the same.” (Def.'s Resp. to Reply at 5.)
*11 This court finds Rehman's testimony credible and, therefore, finds as fact that other PartsBase databases, such as the Membership Services database containing the MS_Member_Clicks Table, may be used to support the authenticity of the produced server logs.
The issue before the court is whether there has been destruction of data which gives rise to sanctions under either Rule 37(b)(2) or the court's inherent power to impose sanctions for spoliation of evidence. The court has the express power, under Rule 37 of the Federal Rules of Civil Procedure, to impose sanctions for a party's failure to make disclosures or cooperate in discovery. See
FED.R.CIV.P. 37. In its filings on this motion, ILS argues that sanctions should be imposed pursuant to Rule 37(b)(2) of the Rules of Civil Procedure. (Pl.'s Hem. in Supp. at 14; Pl.'s Mem. in Reply at 9.) ILS correctly points out that, under that Rule, the Court may refuse to allow a disobedient party to support or oppose designated claims or defenses, or prohibit the party from introducing designated matters into evidence. See
FED.R.CIV.P. 37(b)(2)(B). However, Rule 37(b) authorizes a court to impose such sanctions only in cases where a party has failed to comply with a court order. Here, no court order had been issued requiring PartsBase to preserve the data on the WebTrends Server and the backup tape or to forensically image the WebTrends server, and therefore sanctions pursuant to Rule 37(b)(2) are unwarranted.
The court may also impose sanctions for spoliation based on the court's inherent authority. See
Clark Constr. Group, Inc. v. City of Memphis, 229 F.R.D. 131, 137-38 (W.D.Tenn.2005); Link v. Wabash R. Co., 370 U.S. 626, 82 S.Ct. 1386, 8 L.Ed.2d 734. 631-32 (1962)(stating that a court's inherent power is “governed not by rule or statute but by the control necessarily vested in courts to manage their own affairs so as to achieve the orderly and expeditious disposition of cases.”). Spoliation is “the destruction or significant alteration of evidence, or the failure to preserve property for another's use as evidence in pending or reasonably foreseeable litigation.” Clark, 229 F.R.D. at 136 (quoting Zubulake v. UBS Warburg, LLC, 220 F.R.D. 212, 216 (S.D.N.Y.2003)). The rules that apply to the spoliation of evidence and the range of appropriate sanctions are defined by state law. Beck v. Haik, 377 F.3d 624, 641 (6th Cir.2004). As the court has already determined, Florida state law should apply to PartsBase's amended counterclaim. (Order on Pending Motions at 12-13, Sept. 6, 2005.) At the hearing, the parties agreed that Florida law on spoliation applies.
At the hearing, both parties discussed PartsBase's duty to preserve the server log evidence and the date that such a duty arose. See also
Pl.'s Hem. in Supp. at 10; Def.'s Resp. to Reply at 1-2. However, it is not clear whether Florida courts recognize the duty to preserve evidence as a prerequisite for imposing adverse inference sanctions. See Martin o v.
Wal-Mart Stores, Inc., 908 So.2d 342, 347-50 (Fla.2005) (Wells, J., concurring) (citing Martino v. Wal-Mart Stores, Inc., 835 So.2d 1251, 1257 (Fla.Dist.Ct.App.2003)).
*12 In Martino v. Wal-Mart Stores, Inc.,
the plaintiff brought a negligent maintenance claim against Wal-Mart after she was injured when a shopping cart collapsed. Martino v. Wal-Mart Stores, Inc., 835 So.2d 1251 (Fla.Dist.Ct.App.2003). When Wal-Mart failed to produce the shopping cart, the plaintiff requested an adverse inference jury instruction that the evidence regarding the cart's condition would have been unfavorable to Wal-Mart. Id. at 1256. The trial court denied the request, finding that Wal-Mart did not have a duty to preserve the evidence. At the close of the case, the trial court directed a verdict in favor of Wal-Mart on the negligent maintenance claim. Id.
The appellate court reversed the lower court's directed verdict on the negligent maintenance claim, finding that proper consideration of the adverse inferences that may arise when a party fails to produce evidence required that the plaintiff's claim be presented to the jury. In so holding, the court stated that “the adverse inference concept is not based on a strict legal ‘duty’ to preserve evidence. Rather, an adverse inference may arise in any situation where potentially self-damaging evidence is in the possession of a party and that party either loses or destroys the evidence.” Id.
at 1257 citing
New Hampshire Ins. Co. Inc. v. Royal Ins. Co., 559 So.2d 102, 103 (Fla.Dist.Ct.App.1990).
The Florida Supreme Court, addressing a separate issue raised in the case, affirmed. See
Martino v. Wal-Mart Stores, Inc., 908 So.2d 342, 346 (Fla.2005) (stating that the court was only considering on appeal the issue on which conflict was certified: whether an independent cause of action should exist for first-party spoliation of evidence). However, Judge Wells issued a concurring opinion to specifically note that sanctions should only be imposed where the party has a duty to preserve the evidence. Id.
at 347-51 (Wells, J., specially concurring with an opinion in which Bell, J. concurs). Wells found the lower court's conclusion, quoted above, “remarkable” and found no basis for the court's statement in New Hampshire Ins. Co.,
the case cited by the court. Id. at 349. Wells concluded that “just as tort claims have duty as a fundamental element, so must any presumptions, sanctions, or adverse inferences arising from failure to maintain or preserve property have duty as a basis. This Court has historically only recognized such a duty when there is a statute, regulation, court order, or discovery rule which provides the duty.” Id.
As recognized in Wells' concurring opinion, courts in other jurisdictions determine whether the party had a duty to preserve evidence as a prerequisite to imposing spoliation sanctions. See e.g.
Clark Constr. Group, Inc. v. City of Memphis, 229 F.R.D. 131, 136-37 (W.D.Tenn.2005); Zubulake v. UBS Warburg, LLC, 220 F.R.D. 212, 216-220 (S.D.N.Y.2003); Silvestri v. General Motors, Corp.,
271 P.3d 583, 591 (4th Cir.2001). Based on these decisions, the persuasive discussion in Wells' concurring opinion, and the court's inherent power to control discovery, this court concludes that spoliation sanctions should not be imposed unless a party has violated its duty to preserve evidence.
*13 A party has a duty to preserve all evidence that it knows or should know is relevant to any present or future litigation. Id.
Determining whether PartsBase had a duty to preserve the server log data on the WebTrends Server media and to preserve the backup tape itself involves two related inquiries: (1) the date the duty attached and (2) the scope of the duty to preserve. Clark, 229 F.R.D. at 136.
The trigger date is the date a party is put on notice that it has a duty to preserve evidence. Id.
Although this litigation commenced September 5, 2002, when ILS sued PartsBase, PartsBase did not discover that someone using ILS's IP address had been accessing its database until December 29, 2003. After that date, PartsBase launched an investigation of its server logs, which culminated in the filing of their counterclaim on March 25, 2004. Therefore, PartsBase should have known that its server logs would be relevant to the litigation on December 29, 2003, at the earliest, and on March 25, 2004, at the latest.
PartsBase clearly did not have a duty to preserve the server logs as they existed on the web servers. By the earliest possible trigger date of December 29, 2003, all of the server logs had been automatically transferred to the WebTrends Server and deleted from the web servers as part of PartsBase's routine operations.
At the hearing, Cowan acknowledged that the original server logs were already lost by the time PartsBase's duty to preserve arose.
PartsBase did have a duty to preserve the data from the server logs on the WebTrends Server and on the later-discovered backup tape because this data was in PartsBase's custody after the latest possible trigger date of March 25, 2003.
The court must now determine the scope of the duty to preserve. A party has a duty to preserve all relevant documents-but not multiple identical copies-in existence at the time the duty to preserve attaches and any relevant documents created thereafter. Zubulake, 220 F.R.D. at 218. PartsBase had a duty to preserve the server logs as they existed on the WebTrends Server and to preserve the actual backup tape if the server logs on the WebTrends server and the server logs on the backup tape were not identical to the server logs PartsBase produced.
This court's findings of fact indicate that none of the evidence ILS presented on filtering or forensic imaging precludes the produced CDs from being an exact duplicate of the server logs, as they would have existed on the WebTrends Server on December 29, 2003. The only data that was not exactly duplicated on the CDs were two types of metadata: the Last Creation Date and the Last Access Date, which are not relevant. Otherwise, the data itself was exactly duplicated. However, even if the produced logs are not an exact copy because of the two pieces of metadata, the facts of this case illustrate that sanctions are not appropriate, as discussed below.
*14 ILS asks the court to dismiss PartsBase's counterclaim due to spoliation of the evidence or, in the alternative, to impose an adverse inference on PartsBase regarding its destruction of the evidence. In Florida, courts have held that “[w]hat sanctions are appropriate when a party fails to preserve evidence in its custody depends on the willfulness or bad faith, if any,
of the party responsible for the loss of the evidence, the extent of prejudice suffered by the other party or parties, and what is required to cure the prejudice.” Sponco Mfg., Inc. v. Alcover, 656 So.2d 629, 630 (Fla.Dist.Ct.App.1995)(emphasis added).
These three factors are considered below with respect to the sanctions of dismissal and an adverse inference instruction.
Dismissal constitutes the ultimate sanction for spoliation of evidence and should be viewed as a remedy of last resort. New Hampshire Ins. Co. v. Royal Ins. Co., 559 So.2d 102, 103 (Fla.Dist.Ct.App.1990); Harrell v. Mayberry, 754 So.2d 742, 744 (Fla.Dist.Ct.App.2000). As a result, dismissal is only appropriate when the spoliator acts in bad faith or when the opposing party demonstrates that the prejudice it has suffered equates to “an inability to proceed.” Sponco, 656 So.2d at 630. See also
Aldrich v. Roche Biomedical Laboratories, Inc., 737 So.2d 1124, 1125 (Fla.Dist.Ct.App.1999)(noting that the intentional destruction of evidence is usually met with the most severe sanction, and that intentional destruction is not necessary if the opposing party's case is “fatally prejudiced”); Fleury v. Biomet, Inc., 865 So.2d 537, 539 (Fla.Dist.Ct.App.2004) (stating that the party must be “completely unable to proceed with its case or defense”).
a. PartsBase's Conduct
Here, there is no evidence that the server logs were erased from the WebTrends Server or backup tape in bad faith. The facts suggest that PartsBase was, at most, negligent. PartsBase took reasonable steps to preserve the server log data: PartsBase retained and consulted with a technical expert, Rehman; PartsBase, on the advice of its expert, instructed Wagner to make a copy of the relevant server logs on CDs that could not be overwritten, which he did; PartsBase stored copies of the data on its PBSQL02 server; and PartsBase made the data on the WebTrends Server available for inspection by ILS prior to the time it was overwritten. In addition, Wagner stated that “it did not occur to [him]” that there was any reason not to free up space on the WebTrends Server or reuse the backup tape “since a complete and exact copy of that information had been preserved.” (Wagner Aff. 7 & 13, Feb. 18, 2005.) In the case of the WebTrends Server evidence, Wagner even made an additional copy onto his external hard drive before freeing up space on the WebTrends Server to ensure that no evidence was lost. Finally, Wagner testified that he created exact copies and did not alter or falsify any information. Therefore, PartsBase's conduct does not justify dismissal of its counterclaim, absent a sufficient showing of prejudice suffered by ILS.
b. Prejudice Suffered By ILS
*15 In this case, ILS is not sufficiently prejudiced by the loss of some of the metadata in the server logs so as to justify dismissal. ILS argues that it has been prejudiced because it cannot compare the produced server logs to the logs on the WebTrends Server (as they existed on December 29, 2003) or the logs on the backup tape. According to ILS, this information would prove that the produced logs had been altered. However, as Rehman observed at the hearing, the logs on the WebTrends Server could have been altered prior to December 29, 2003, and a forensic image of the WebTrends server would therefore not prove or disprove an alteration. In effect, the only possible prejudice that has resulted from the alleged spoliation is that ILS has been denied the opportunity to determine if the server logs produced on the CDs were altered between the date PartsBase claims it discovered them, December 29, 2003, and the date of production, June 21, 2004,
and if the server logs from the backup tape were altered between September 2004 and November 8, 2004, the date they were produced.
There is no reason to believe that PartsBase would claim to discover evidence on the WebTrends Server on December 29, 2003, launch an investigation, petition the court for leave to amend, and file its counterclaim if the evidence-authentic or not-did not already exist there as of the date of the alleged discovery. In addition, this court's findings of fact indicate that none of the evidence ILS presented on filtering or forensic imaging precludes the produced CDs from being an exact duplicate of the server logs ILS claims were spoiled. Finally, PartsBase produced the server logs on the WebTrends Server and additional corroborative evidence from its MS_Member_Clicks Table on its original media. All these factors lead to the conclusion that the prejudice suffered by ILS is minimal.
At any rate, copies of the server log evidence, as well as evidence from the MS_Member_Clicks Table, still exist. The parties' experts may examine the copies and present evidence regarding their authenticity to the jury. As a result, any prejudice ILS has suffered does not equate to “an inability to proceed” with its defense.
Florida case law supports the conclusion that ILS has not been sufficiently prejudiced by the loss of the WebTrends Server and backup tape evidence. In New Hampshire Ins. Co., Inc. v. Royal Ins. Co., 559 So.2d 102 (Fla.Dist.Ct.App.1990), a Florida appeals court held that, without a showing of prejudice, the trial court reversibly erred when it entered final judgement in favor of the appellee because an underwriting file had been destroyed. Id. at 103. In so doing, the court noted that, “for all we know, any evidence which might have been contained within those files might be legally irrelevant to the issues framed in the pleadings.” Id.
Similarly, here, the evidence ILS seeks could be an identical copy of the server logs that have already been produced. Notably, ILS has presented no evidence that precludes the produced evidence from being an exact duplicate other than two items of metadata.
*16 ILS cites a Seventh Circuit case, Marrocco,
for the proposition that such prejudice is enough to justify dismissal. Marrocco v. General Motors, Corp., 966 F.2d 220 (7th Cir.1992). The case currently before the court is distinguishable from Marrocco,
however, because the Marrocco
court found that the spoliator's conduct was egregious and that the parties would be unable to reconstruct the spoiled evidence.
the court dismissed the plaintiff's claim against General Motors for the spoliation of rear axle bearings. In so doing, the court stated: “Perhaps that evidence was an irreplaceable part of GM's defense, as their expert witnesses asserted during the evidentiary hearing. Then again, perhaps not. But therein lies the prejudice-GM was denied any opportunity to find out one way or the other.” Id.
at 223. Although the Marrocco
court found that dismissal was warranted, it did so based in part upon the egregious conduct of the spoliator. The court stated, “[g]iven the record before us, it would be hard to imagine plaintiffs more deserving of civil sanctions than the Marroccos. The conduct of their experts and attorneys clearly transgressed the court's protective order.” Id.
The court also noted that the parties would be unable to reconstruct the evidence correctly. Id.
Because PartsBase's conduct was merely negligent, there was no protective order in this case, and a copy of the evidence was preserved and may be examined by the parties' experts, the weak showing of prejudice that was sufficient in Marrocco
is not sufficient here.
In addition, the Florida cases that ILS cites in support of dismissal are distinguishable because they involve the loss of physical evidence that was not, and could not be, duplicated and therefore could not be analyzed by the opposing party's experts. For example, in Sponco,
the plaintiff claimed he was injured by a defective ladder and sued Sponco, the ladder's manufacturer. Sponco Mfg., Inc. v. Alcover, 656 So.2d 629, 630 (Fla.Dist.Ct.App.1995). Sponco disposed of the ladder before the plaintiff was able to inspect it. Id.
Similarly, in Rockwell,
the defendant's experts inspected a table saw to determine what had caused the blade to rise and injure the plaintiff. Rockwell Int'l Corp. v. Menzies, 561 So.2d 677, 678 (Fla.Dist.Ct.App.1990). In the process, the experts “hacked off” two bolts securing the motor to the saw and determined it was not the saw that caused the injury, but defective bolts that had been inadequately attached. Id.
The defendants failed to retain the original defective bolts, but instead used replacement bolts to reattach the motor. Id.
at 678-79. The court noted that the plaintiff could not rebut Rockwell's expert testimony without the original bolts. Id.
Here, unlike Sponco
a copy of the evidence at issue was produced and, with the exception of the Creation Date and the Last Accessed Date metadata from the WebTrends Server, there is no evidence that any information was lost when the logs were copied from the WebTrends Server and backup tape. Unlike the ladder and the bolts, the Creation Date and the Last Accessed Date are not the crucial evidence. In contrast, the critical Last Written Date metadata, which would show the date of any alterations made to the server logs, was retained. Furthermore, unlike Sponco
where only one party's expert had the opportunity to inspect the original evidence, here neither party's expert had the opportunity to inspect the server logs as they originally existed on the WebTrends Server or the backup tape. As a result, both parties' experts are in the same position; they can examine the server logs produced on the CDs and present evidence regarding their authenticity to the jury.
c. What Is Required To Cure The Prejudice
*17 Because PartsBase's conduct was merely negligent and because the prejudice suffered by ILS does not amount to an inability to proceed, the court should find that the ultimate sanction of dismissal is not required in this case.
As an alternative to dismissal, ILS argues that the court should impose an adverse inference. Florida courts have held that, “where a party fails to produce evidence within his control, an adverse inference may be drawn that the withheld evidence would be unfavorable to the party failing to produce it.” New Hampshire Ins. Co., Inc. v. Royal Ins. Co., 559 So.2d 102, 103 (Fla.Dist.Ct.App.1990). Florida courts recognize that a court interferes with the jury's function when it gives an instruction about specific facts that are controverted. See
American Hospitality Mgmt. Co. of Minnesota v. Hettiger, 904 So.2d 547, 550 (Fla.Dist.Ct.App.2005)(citing Jordan ex rel. Shealey v. Masters, 821 So.2d 342, 346 (Fla.Dist.Ct.App.2002) and Palmas y Bambu, S.A. v. E.I. DuPont de Nemours & Co., 881 So.2d 565, 580 (Fla.Dist.Ct.App.2004)). The court in American Hospitality
concluded, however, that it is not per se
error to issue an adverse inference instruction where the lost evidence was “critical to prove the other party's claim.” American Hospitality, 904 So.2d at 550. Here, again, an analysis of the three factors established by Sponco
results in a finding that an adverse inference is not warranted.
a. PartsBase's Conduct
For the same reasons stated above, PartsBase's conduct does not justify the imposition of an adverse inference.
ILS argues. however, that an adverse inference should be imposed in this case because courts have imposed such sanctions for less egregious conduct, such as in Clark Constr. Group, Inc. v. City of Memphis, 229 F.R.D. 131 (W.D.Tenn.2005), a case from this district.
In the Clark
case, James Webber, a city employee, discarded and shredded several documents that “he thought were not relevant,” during the course of the litigation. Id.
at 135. The court concluded that Webber's actions were negligent because there was “no evidence that the City wilfully destroyed documents to hide key evidence or out of fear that the evidence would assist Clark in its preparation of the case.” Id.
Although ILS asserts that PartsBase's conduct was more egregious than the conduct in Clark,
this court finds the conduct similarly negligent. In addition, although the court in Clark imposed a rebuttable adverse inference against the City, this determination was also based on a review of the prejudice suffered by Clark. Unlike PartsBase, Webber destroyed some original documents and documents containing handwritten notes, without making any copies. Id.
at 137. Moreover, Clark
did not apply Florida law. As a result, the Clark
case does not convince the court that PartsBase's conduct merits the imposition of an adverse inference, as ILS argues.
b. Prejudice Suffered By ILS
*18 For the same reasons discussed above with respect to dismissal, ILS is not sufficiently prejudiced by the loss of the metadata on the server logs as they existed on the earlier media so as to justify the imposition of an adverse inference. Furthermore, case law supports the conclusion that ILS has not been sufficiently prejudiced by the loss of the WebTrends Server and backup tape media.
Florida cases that imposed an adverse inference are distinguishable. In American Hospitality,
a repairman borrowed a ladder from a hotel operator to conduct some repairs, fell from the ladder, and sustained severe injuries. American Hospitality Mgmt. Co. of Minnesota, v. Hettiger, 904 So.2d 547, 548 (Fla.Dist.Ct.App.2005). The hotel operator destroyed the ladder that same day. Id.
The repairman argued that without the ladder he was at a disadvantage because his expert could not testify as to the defect in the ladder and he could not prove his claim of negligence. Id.
Although the defendant claimed that the plaintiff could still prove his claim because hotel employees had testified in depositions that they knew the ladder was old and a cross support was broken, the court found that “the ladder was conceivably critical to its claim against the hotel operator.” Id.
In the case currently before the court, the copy of the server logs as they existed on the WebTrends Server and the backup tape are not “critical” to ILS's defense of the counterclaim because, with the exception of the irrelevant metadata, PartsBase produced an exact copy of the data from those media and because ILS can present other evidence regarding the authenticity of that copy to the jury. Unlike the plaintiff in American Hospitality,
who was left to prove his claim with only the defendant's deposition testimony, ILS can examine the produced copy of the server logs and submit its arguments as to their authenticity to the jury.
In addition, factually similar cases from other jurisdictions suggest that the imposition of an adverse inference is not appropriate. In Zubulake,
a United States District Court in New York considered whether sanctions were appropriate where the plaintiff alleged relevant e-mails were not saved and backup tapes that would have contained the e-mails were not preserved. Zubulake v. UBS Warburg, LLC, 220 F.R.D. 212 (S.D.N.Y.2003). The court declined to impose an adverse inference because there was not enough evidence that the deleted e-mails were likely to support the plaintiff's claims. Id. at 221. The court noted that, in the 68 e-mails produced to the court, there was no evidence that the supervisor disliked the plaintiff based on her gender. Therefore, the court found that there was no reason to believe that the lost e-mails would be any more likely to support the plaintiff's claims. Id.
Similarly, here, there is not enough evidence that the WebTrends Server and backup tape media evidence ILS seeks would support its claim that the produced server logs were fraudulently altered. PartsBase's expert has provided plausible explanations for the alleged inconsistencies in the produced server logs, as well as secondary evidence as to their authenticity, all of which may be presented to the jury. In addition, there is no reason to believe that if the produced logs were
indeed altered, they would not have been altered before December 29, 2003-the date PartsBase claims it discovered the WebTrends Server evidence. Finally, ILS has produced no other evidence that the WebTrends Server and backup tape media evidence would be different than the data that was produced; in fact, all PartsBase employees have testified that the produced server logs were an exact and accurate copy of the evidence ILS now seeks.
*19 A subsequent opinion from the Zubulake
court also supports this conclusion. Following additional court-ordered depositions, the court did impose an adverse inference instruction because it found that the new depositions demonstrated the scope and importance of the deleted e-mails. Zubulake v. USB Warburg, LLC, 229 F.R.D. 422 (S.D.N.Y.2004). The court reasoned, “[n]o one can ever know precisely what was on those tapes, but the content of e-mails recovered from other sources-along with the fact that UBS employees wilfully deleted e-mails-is sufficiently favorable to Zubulake that I am convinced that the contents of the lost tapes would have been similarly, if not more, favorable.” Id. at 437. The court noted “I am not sanctioning UBS for the loss of the tapes (which was negligent), but rather for its willful
deletion of emails. Those e-mails happen to be lost forever because the tapes that might otherwise have contained them were lost.” Id.
at FN. 99 (emphasis in original).
In contrast, ILS has not presented any secondary evidence that PartsBase fraudulently altered the produced server logs and that the lost WebTrends Server and backup tape media evidence it seeks would have supported this claim. Although ILS points out that the defendant in Zubulake
took more stringent measures to preserve evidence and had a greater volume of evidence to preserve, ILS fails to provide evidence that the WebTrends Server and backup tape evidence it seeks are indeed probative of alteration. ILS relies instead on the statement that “PartsBase denied ILS the opportunity to find out, one way or another, if the logs were manipulated.” (Pl.'s Hem. in Reply at 10.) As in the first Zubulake
decision discussed above, this is simply not enough to show relevance, and thus prejudice.
c. What Is Required To Cure The Prejudice
Because PartsBase's conduct was merely negligent and because ILS was not prejudiced by spoliation of “critical” evidence, the court should find that the imposition of an adverse inference is not required in this case.
The award of legal fees and costs is not appropriate in this case. The court should require each party to bear its own costs.
It is submitted that PartsBase took reasonable steps to preserve relevant data by copying the data to non-writeable Cds and that PartsBase did not lose or destroy any relevant data when it allowed the WebsTrend server and the backup tape to be overwritten in its normal operations. It is further submitted that a forensic image of the WebTrends Server on or about December 29, 2003 would not have proved or disproved the authenticity of the produced server logs. It is therefore recommended that the plaintiff's motion to dismiss be denied. It is also recommended that the plaintiff's request for the imposition of an adverse inference or any other sanctions be denied.
The parties filed a Memorandum in Support of the Motion (“Pl.'s Mem. in Support”), Memorandum in Opposition (“Def.'s Mem. in Opp.”), Memorandum in Reply (“Pl.'s Mem. in Reply”) and Memorandum in Connection with New Arguments Made in Reply (“Def.'s Resp. to Reply”). In addition, the record contains affidavits by Tolley and Wagner and expert reports and affidavits by Rehman. Expert reports by Cowan were admitted at the hearing as Exhibits 4 and 5.
It should be noted that the CD copies are digital copies.
At the hearing, Cowan testified that he is currently employed as a partner at G-C Partners, • LLC. At G-C Partners, Cowan serves as a digital expert for clients and provides clients with litigation support for electronic discovery. Cowan also testified that he has been working in the computer field since 1994 and has provided expert testimony in three previous cases involving electronic discovery. See also
Hr'g Ex. 4 at 2.
Cowan defines a MD5 Hash, which is a kind of cryptographic hash algorithm, as “the industry standard and court recognized form of documenting the contents of a file through a proven mathematical function.” (Hr'g Ex. 4 at 8.) Cowan explains that “[t]his specific mathematical function will take any length of data and create a fixed length representation of it that can be used to demonstrate that no evidence was modified in the process of data analysis or reconstruction. This means that you would take a ‘Hash’ of the original evidence and the ‘bit stream’ image created and compare the two over time to verify that they are still exact duplicates.” Id.
Rehman also argues that the imaginary forger would have to alter the Last Written Date (as discussed in Section C.1.b, above) and other PartsBase databases that contain some of the same data (as discussed in Section C.2.C., below). (Rehman Rebuttal Rep. at 14.)
According to Rehman's report, the same was true of PartsBase's “Products and Services” database. (Rehman Rebuttal Rep. at 10.)
Rule 37(d) allows for the imposition of sanctions for failure to respond to discovery requests but ILS has not specifically relied on this section. Even if it had, based on the discovery request produced to the court by ILS, PartsBase sufficiently responded to the discovery request by producing the CDs and copies of the backup tape. See
Pl.'s App. in Supp., Ex. A at 3.
Finding that PartsBase had no duty to preserve this evidence aligns with the proposed “safe harbor” amendment to Rule 37(f) of the Federal Rules of Civil Procedure, which states:
(f) Electronically Stored Information. Unless a party violated an order in the action requiring it to preserve electronically stored information, a court may not impose sanctions under these rules on the party for failing to provide such information if:
(1) the party took reasonable steps to preserve the information after it knew or should have known the information was discoverable in the action; and
(2) the failure resulted from loss of the information because of the routine operation of the party's electronic information system.
Prelim. Draft of Proposed Amendments to the Fed. R. of Bankruptcy, Civ., and Crim. P., and the Fed. R. of Evid. (Aug.2004) at 73-74. The Civil Rules Advisory Committee also continues to consider whether the level of culpability that takes a party outside of the safe harbor should be higher than negligence. Id.
Although PartsBase argues that a finding of bad faith is required prior to the imposition of sanctions, Florida case law clearly shows that whether a party acted in bad faith is just one factor in determining whether sanctions are appropriate. See e.g.
Sponco, 656 So.2d at 631 (finding that willful destruction was not necessary when the spoliation rendered the plaintiff unable to proceed); Aldrich v. Roche Biomedical Laboratories, Inc., 737 So.2d 1124, 1125 (Fla.Dist.Ct.App.1999)(noting that, “[w]hile the intentional destruction of evidence is usually met with the most severe sanction, the inadvertent destruction of evidence generally calls for a lesser sanction, unless
the opposing party demonstrates that its case is fatally prejudiced by its inability to examine the lost evidence.”)(emphasis added; internal citations omitted).
ILS also cites a Fourth Circuit case, Silvestri v. General Motors Corp.,
which articulates the standard for dismissal as follows: “[T]o justify the harsh sanction of dismissal, the district court must consider both the spoliator's conduct and the prejudice caused and be able to conclude either (1) that the spoliator's conduct was so egregious as to amount to a forfeiture of his claim, or (2) that the effect of the spoliator's conduct was so prejudicial that it substantially denied the defendant the ability to defend the claim.” Silvestri, 271 F.3d 583, 593 (4th Cir.2001)
The server logs from the WebTrends Server could not have been altered after May 19, 2004, the date that Wagner delivered the 19 CDs to Tolley, because Rehman testified that Wagner copied the server logs from the WebTrends Server onto CDs that could not be altered or overwritten.
Although Florida courts do not require a finding of bad faith prior to the imposition of an adverse inference, it is noted that in the 11th Circuit an adverse inference is drawn from a party's failure to preserve evidence only when the absence of that evidence is predicated on bad faith. Bashir v. Amtrak, 119 F.3d 929 (11th Cir.1997). The 11th Circuit reasoned that mere negligence in losing or destroying records was not enough for an adverse inference because negligence alone does not sustain an inference of consciousness of a weak case. Id. at 931.
End of Document.