OCÉ NORTH AMERICA, INC. v. MCS SERVICES, INC. et al Civil Action No. WMN–10–0984 December 07, 2011 Counsel Jonathan K. Cooperman, Nicole M. Hudak, Richard E. Donovan, Kelley Drye and Warren LLP, New York, NY, Ira T. Kasdan, Kelley Drye and Warren LLP, Washington, DC, for Océ North America, Inc. Scott Adam Mirsky, Barry Jay Rosenthal, Eugene W. Policastri, Bromberg Rosenthal LLP, Rockville, MD, Sheldon H. Klein, Butzel Long PLLC, Bloomfield Hills, MI, Thomas Joseph Fisher, Oblon Spivak McClelland Maier and Neustadt LLP, Alexandria, VA, for MCS Services, Inc. et al. Nickerson, William M., United States District Judge MEMORANDUM *1 Pending before the Court is a motion for spoliation sanctions and contempt, filed by Plaintiff Océ North America, Inc. (Océ), ECF No. 138. The parties have fully briefed the motion. Upon a review of the pleadings and applicable case law, the Court determines that no hearing is necessary, Local Rule 105.6, and the motion for spoliation sanctions and contempt will be granted in part and denied in part as set forth below. I. BACKGROUND The motion sub judice is one of a number of discovery motions filed by the parties in this case and its companion case, Civil Action No. WMN–10–1042. The present motion concerns the alleged spoliation of electronic evidence possessed by Defendant MCS Services, Inc. (MCS) in violation of two orders issued by this Court on April 22, 2010. Paragraph four of the Temporary Restraining Order (TRO) issued on that date states: Defendants are hereby enjoined from, directly or indirectly, destroying, mutilating, concealing, altering, disposing of, or otherwise rendering illegible in any manner any documents or electronically stored information-including writings, drawings, graphs, charts, photographs, sound recordings, images, and other data or data compilations-stored in any medium from which information can be obtained either directly or, if necessary, after translation by the responding party into a reasonably usable form, wherever located and in whatever media, that refers or pertains to the issues in this action. ECF No. 10. The second order, an Order Granting Expedited Discovery of Computer Hard Drives and Directing Preservation of Evidence (Preservation Order), ECF No. 11, gives Océ permission to have its forensic experts image the hard drives of MCS laptops and repeats, in substantially similar language, the paragraph quoted above. MCS sought to comply with the TRO and Preservation Order by sending an email that same day to all employees advising them about the orders. The email stated, among other things: “For any MCS Services owned computers, do not delete, destroy, erase or alter any data files, programs or other information from your computer ... Failure to comply with the above policies will result in immediate disciplinary action.” Opp'n Ex. 1. MCS also scheduled a conference call for the next morning with all available field technicians to explain the orders, strongly emphasize the need for strict compliance, and warn that any violation would result in immediate disciplinary action, which could include termination. Opp'n Ex. 2 at ¶ 4. Sometime later, in late April or early May, Charles Harding, MCS's regional manager for states west of the Mississippi River, instructed the employees he supervised to provide him with any MCS laptops in their possession so that he could forward them to MCS headquarters for inspection and imaging. Opp'n Ex. 3 at ¶ 8. Despite these precautions, Océ alleges that it has found evidence of the intentional destruction of data subject to the TRO and Protective Order on two of the twenty-two MCS owned laptops that it has imaged. Océ experts imaged the laptop used by Barry Garafola, an MCS Field Engineer who worked on MCS accounts, including Farmers Insurance, in California, and found evidence that a program called “Incinerator” had been installed on the laptop on May 7, 2010, and used five times between the date of installation and May 17, 2010. Per its website, “Incinerator is designed to permanently and irrecoverably destroy data.” Cooperman Decl. Ex. F. Océ also notes that it recovered very little Océ data from Mr. Garafola's laptop. *2 Océ also found evidence that Restore Points data had been deleted from a laptop assigned to Charles Harding that was also used at Farmers Insurance. Restore Points are snapshots of a computer's configuration at a specific point in time and are created automatically by the Windows operating system ... [A restore point] allows you to restore the computer to a previous state, by choosing a restore point on a date or time prior to when you made the change. Cooperman Decl. Ex. E at 7–8. Océ forensic experts used recovered Restore Points data to analyze how often Océ programs were used and which programs in particular were used on each laptop. II. SPOLIATION SANCTIONS “Spoliation refers to the destruction or material alteration of evidence or to the failure to preserve property for another's use as evidence in pending or reasonably foreseeable litigation.” Silvestri v. Gen. Motors Corp., 271 F.3d 583, 590 (4th Cir.2001). Océ, as the party seeking sanctions for spoliation, must prove the following elements: (1) The party having control over the evidence had an obligation to preserve it when it was destroyed or altered; (2) the destruction or loss was accompanied by a “culpable state of mind;” and (3) the evidence that was destroyed or altered was “relevant” to the claims or defenses of the party that sought the discovery of the spoliated evidence, to the extent that a reasonable factfinder could conclude that the lost evidence would have supported the claims or defenses of the party that sought it. Goodman v. Praxair Servs., 632 F.Supp.2d 494, 509 (D.Md.2009). It is undisputed that the TRO and Preservation Order obligated MCS to preserve the electronically stored information that was deleted from the two laptops. Opp'n at 8. MCS argues, however, that Océ has failed to prove the remaining required elements for both alleged instances of spoliation. In the Fourth Circuit, “there are three possible states of mind that can satisfy the culpability requirement: bad faith/knowing destruction, gross negligence, and ordinary negligence.” Goodman, 632 F.Supp.2d at 518–519. The degree of fault assessed by the Court is significant because it bears on the severity of the sanction the Court will order. Id. “Sanctions that a federal court may impose for spoliation include assessing attorney's fees and costs, giving the jury an adverse inference instruction, precluding evidence, or imposing the harsh, case-dispositive sanctions of dismissal or judgment by default.” Victor Stanley, Inc. v. Creative Pipe, Inc., 269 F.R.D. 497, 533 (D.Md.2010). The harshest sanctions are only appropriate when the spoliator acts in bad faith, and an adverse inference is only warranted if the spoliator acts willfully. Goodman, 632 F.Supp.2d at 518–519. MCS argues that, though it is true Mr. Garafola installed and used the Incinerator software on his business laptop, any deletion of Océ data was not done with a culpable state of mind because Mr. Garafola's intent was to delete illegal child pornography,[1] not Océ data, from his laptop. This argument is flawed. As stated supra, culpability is not limited to acting with a specific intent; acting with even ordinary negligence is sufficient to be culpable. Mr. Garafola intentionally installed and used the Incinerator software on his laptop; there is no argument that this could have been done inadvertently or negligently, particularly because he ran the program on five separate occasions over a ten day period. While it is unclear what Mr. Garafola's intent was when he installed the Incinerator program, i.e. to delete the child pornography alone or to delete the child pornography and Océ data, it is clear that he at least disregarded the fact that a likely consequence of using the Incinerator program would be the deletion of protected Océ data. Such negligent conduct is sufficient to satisfy the culpability element with respect to spoliation of evidence on Mr. Garafola's laptop. *3 With respect to Mr. Harding's Farmers laptop, MCS again concedes that Restore Points were deleted from the hard drive after the TRO and Preservation Order were issued, but argues that there is no culpability because their deletion was inadvertent and the result of a Windows update.[2] Though the Restore Points were not necessarily deleted intentionally, the Windows update that likely caused the deletion was intentionally completed. Therefore, assuming that the Windows update caused the inadvertent deletion, the MCS user who installed the update was culpable because he or she at least acted negligently by failing to appreciate that the update would likely alter the laptop and thus spoil electronically stored information.[3] The final element that Océ must satisfy is that the lost evidence was relevant. “In the context of spoliation, lost or destroyed evidence is ‘relevant’ if ‘a reasonable trier of fact could conclude that the lost evidence would have supported the claims or defenses of the party that sought it.’ ” Victor Stanley, 269 F.R.D. at 531 (quoting Thompson v. U.S. Dept. of Hous. and Urban Dev., 219 F.R.D. 93, 101 (D.Md.2003)). The burden is on Océ, as the aggrieved party, to “establish a reasonable possibility, based on concrete evidence rather than a fertile imagination, that access to the lost material would have produced evidence favorable to [its] cause.” Sampson v. City of Cambridge, Md., 251 F.R.D. 172, 180 (D.Md.2008) (quoting Gates Rubber Co. v. Bando Chem. Indus., Ltd., 167 F.R.D. 90, 104 (D.Colo.1996)). Though Océ is unable to specify what kind of data was deleted from Mr. Garafola's laptop, it notes that the Windows Registry on Mr. Garafola's laptop makes reference to trace evidence of Océ data, suggesting that there was likely more relevant data present prior to execution of the Incinerator program. Océ also emphasizes the fact that all twenty-one of the other imaged laptops contained Océ data, implying that Mr. Garafola's laptop would have similarly contained substantial Océ data. MCS counters by suggesting that as Océ's expert was able to find traces of Océ data on Mr. Garafola's laptop, there is no reason to suspect that other traces were deleted. It also argues that any data that may have existed prior to deletion by the Incinerator program would have been “very limited” because the laptop was only in use for eight weeks prior to the imaging. Opp' n 13–14. With regard to Mr. Harding's Farmer's laptop, MCS concedes that Restore Points were deleted from the laptop, but contends that the absence of the deleted Restore Points does not prejudice Océ because the same type of data is available via still-existing Restore Points and entries in the Windows Registry, so Océ will be able to analyze the existing entries in the same way it would analyze the deleted Restore Points. Océ has met its burden and sufficiently shown that there is a reasonable possibility that the deleted data from both laptops would have been favorable to its case. Though it is unable to articulate exactly what data was deleted from Mr. Garafola's laptop because the Incinerator program, by its very design, obliterated the deleted data, Océ's presentation of trace evidence from the Windows Registry and circumstantial evidence that all other imaged laptops contained Océ data is sufficient for the Court to reasonably determine that the lost data would have benefited Océ's case, and thus meets the burden with regard to Mr. Garafola's laptop. *4 Furthermore, Océ's forensic experts explained that they use Restore Points to reconstruct the patterns and extent of usage of Océ proprietary data and noted the heightened importance of Restore Points, which are sequentially numbered, in light of the fact that MCS tampered with the laptop clocks, making it difficult to accurately predict when Océ software was accessed if solely using Windows Registry data chronicled by calendar date. Sun Decl. ¶ 20. The Court is satisfied that the availability of the deleted Restore Points evidence would have benefitted Océ's case and been unique from the existing Restore Points data still available on Mr. Harding's Farmers Computer, thus Océ has met its burden with regard to this laptop. As such, the Court finds that MCS is subject to spoliation sanctions for negligently failing to comply with the TRO and Preservation Order. The Court has broad discretion in choosing an appropriate sanction, but it should consider whether the chosen sanction serves the rationales underlying the spoliation doctrine. Victor Stanley, 269 F.R.D. at 533. In other words, appropriate sanctions should (1) deter parties from engaging in spoliation; (2) place the risk of an erroneous judgment on the party who wrongfully created the risk; and (3) restore the prejudiced party to the same position he would have been in absent the wrongful destruction of evidence by the opposing party. Id. at 534. Because Océ has only proven that MCS acted with some degree of negligence and not that it acted willfully or in bad faith, it is not appropriate to impose the harshest sanctions of dismissal or default judgment. Moreover, it is too early in the litigation to determine if an adverse instruction is warranted or how it might be framed, particularly because it is presently unclear what type of evidence the parties plan to present to the jury and what the implications of the lack of data on these two laptops may be in light of the fact that there are at least twenty other laptops containing Océ data. As such, the Court will reserve judgment as to whether some type of jury instruction is appropriate in order to shift the risk of erroneous judgment to MCS and prevent Océ from being further prejudiced. The Court will also require that MCS reimburse Océ the reasonable expenses incurred in making this motion, including attorney's fees.[4] See Goodman, 632 F.Supp.2d at 524. This sanction will help restore Océ to the position it would have been absent MCS's negligent spoliation which necessitated that Océ bring this issue to the Court's attention. Océ has also requested that MCS pay the costs to depose Barry Garafola and re-depose Charles Harding. If Océ wishes to conduct these depositions to further build its case it is welcome to do so, but because it is not apparent that these depositions need to be taken as a result of the spoliation, the Court will not impose the costs of these depositions as an additional sanction.[5] III. CONTEMPT *5 In order for the Court to hold Océ in civil contempt, Océ must establish, by clear and convincing evidence, the following four elements: (1) the existence of a valid decree of which the alleged contemnor had actual or constructive knowledge; (2) ... that the decree was in the movant's “favor”; (3) ... that the alleged contemnor by its conduct violated the terms of the decree, and had knowledge (at least constructive knowledge) of such violations; and (4) ... that [the] movant suffered harm as a result. Ashcraft v. Conoco, Inc., 218 F.3d 288, 301 (4th Cir.2000) (quoting Colonial Williamsburg Found. v. The Kittinger Co., 792 F.Supp. 1397, 1405–6 (E.D.Va.1992), aff'd, 38 F.3d 133, 136 (4th Cir.1994)). MCS concedes that the first two elements are satisfied, but disputes that it knowingly violated the TRO and Protective Order. The Court agrees that Océ has been unable to prove by clear and convincing evidence that MCS actually or constructively knew that its conduct, through its employees, would cause the deletion of Océ data from Mr. Garafola's laptop and Mr. Harding's Farmers laptop. As discussed above, Océ has only shown that MCS acted negligently, not that it acted willfully or intentionally in deleting the data, and so has not satisfied the elements for contempt.[6] IV. CONCLUSION For the foregoing reasons, the Court concludes that Plaintiff Océ North America, Inc.'s motion for spoliation sanctions and contempt will be granted in part and denied in part, and Defendant MCS Service, Inc. will reimburse Plaintiff for the reasonable expenses incurred in making this motion, as outlined above. The Court will issue a separate Order. Footnotes [1] While it has not been verified that there in fact was child pornography on Mr. Garafola's laptop, in reviewing the laptop's registry, MCS's forensic expert, Mr. Briody, discovered a number of file names that suggested the files contained such content. Opp'n Ex. 5 at ¶ 32. Mr. Briody returned the hard drive to defense counsel, who reported the contents to the National Center for Missing and Exploited Children, which forwarded the report to law enforcement. Subsequently Detective Cates of the Montgomery County Police Department took possession of the hard drive. Opp'n at FN 7. For purposes of this motion, and because Océ has not denied the possibility of its presence, the Court will assume that there was in fact child pornography on Mr. Garafola's laptop at the time he installed the Incinerator software. [2] Océ does not concede that the deletion resulted from a Windows update, though it does not explicitly state why this is an unacceptable explanation. Reply at 4. [3] I n its Reply, Océ relies on non-binding precedent from the District of South Carolina, Nucor Corp. v. Bell, 251 F.R.D. 191 (D.S.C.2008), to make an additional argument that MCS is culpable for the spoliation of both laptops because it allowed MCS employees to continue using the laptops after this Court issued the TRO and Preservation Order. Even though deletions at issue would likely not have occurred if MCS had taken possession of all employee laptops immediately after the TRO hearing, such drastic action was not required by the explicit language of either the TRO or the Preservation Order. MCS is a relatively small company, employing approximately forty employees at the time of the TRO hearing. Opp'n at 5. Had the TRO required that MCS immediately suspend use of all 22 laptops that were eventually imaged, it would have experienced a disruption in its ordinary business operations not contemplated by the parties or the Court. Therefore, the Court does not agree that MCS violated the TRO or engaged in spoliation merely by allowing its employees to continue using their laptops prior to the laptops being imaged. [4] To clarify, Océ is not entitled to reimbursement for the costs of the forensic reports originally prepared by Mr. Bobb or Mr. Sun, as these reports would have been prepared regardless of the discovery of any spoliation. It is, however, entitled to reimbursement for the costs of the two Declarations prepared by these experts, both of which responded to MCS's Opposition and were attached as exhibits to Océ's Reply. [5] MCS also argues that Océ's motion was not timely filed because Océ knew about the alleged spoliation when it received its first expert report from Mr. Bobb at Elijah Technologies, Ltd., which Océ submitted on July 9, 2010, during the expedited discovery period. Opp'n at 15–16. Océ acknowledges that the first report contains this information, but explains that it did not file the present motion until June 7, 2011, because it was not until May 2011 that it received detailed expert reports that more fully explained the type of data that could be gleaned from the hard drives and thus illustrated the extent of the prejudice Océ suffered due to MCS's conduct. Reply at 15. The Court accepts Océ's explanation and notes that at the time the motion was filed discovery was still ongoing and the deadline for dispositive motions was months away. These factors weigh in favor of finding that the motion was timely filed. See Goodman, 632 F.Supp.2d at 507–507. [6] As Océ has failed to prove the elements of contempt, the Court need not address whether Charles Harding could be held in personal contempt.