*1 Pending before the Court is a motion filed by defendant/counter-plaintiff Chicago Transit Authority (“CTA”) to compel plaintiff/counter-defendant Christopher Pable (“Pable”) to produce his cell phone for inspection and forensic imaging and to provide complete, accurate copies of his archived personal website in accordance with the CTA's request for production. The motion is fully briefed [45, 47, 48]. For the following reasons, the CTA's motion is granted.

This whistleblower suit arises from Pable's resignation from the CTA in 2018, in lieu of termination. Pable, a CTA computer programmer and analyst, and his supervisor Michael Haynes (“Haynes”) discovered a “Skeleton Key” in the CTA's BusTime system, an application that provides alerts and service information to public transit users. The Skeleton Key was a flaw in the BusTime application that could allow an unauthorized user to take control of the application and post unauthorized alerts on the system. Pable alleges that he urged Haynes to report the flaw to the CTA, but Haynes wanted to test whether it was in fact possible to gain control of the BusTime application using the Skeleton Key. In doing so, Haynes posted an alert on the BusTime system being used in Dayton, Ohio, which automatically posted that alert to Dayton's public Twitter account. After an investigation, the CTA determined that Pable's actions violated multiple CTA rules, policies, and procedures, warranting his termination. Pable chose to resign instead of being fired.

Pable thereafter filed a single-count complaint against the CTA and Clever Devices Ltd., which created the BusTime application and informed CTA about the Dayton incident, alleging a whistleblower claim under the National Transit Systems Security Act, 6 U.S.C. § 1142. [1]. The CTA has raised several affirmative defenses, including that it would have taken the same personnel action (i.e., firing Pable), regardless of any protected activity that Pable allegedly engaged in, because of Pable's misconduct and unclean hands respecting the BusTime system. [8]. The CTA also brought a counterclaim against Pable, alleging that he violated the Computer Fraud & Abuse Act, 18 U.S.C. § 1030, et seq., by gaining unauthorized control over the BusTime application and by encrypting his work computer without CTA's knowledge or approval. [32].

In its motion to compel, the CTA asks that Pable be ordered to produce his personal cell phone for forensic imaging because the phone may contain communications between Pable and Haynes about the Skeleton Key. [45]. Although the CTA acknowledges that Pable's cell phone has been imaged once, it argues that Pable conducted this imaging without notifying the CTA that he was doing so, conferring with the CTA about who would conduct the imaging, or obtaining any input from the CTA about the parameters of the imaging. The CTA also argues that there is good cause to conclude that the forensic imaging produced by Pable is incomplete or otherwise compromised, given that the image contains only .2 GB of user-generated data (which represents only 0.625% of the device's storage capacity). [45] 13. Pable responds that he should not be required to produce his cell phone to the CTA because a second imaging would be an extraordinary remedy, he has already produced all communications from his phone, and the CTA has failed to demonstrate that he has withheld any communications. [47]. Pable concedes that the first imaging produced only a small amount of data, but he contends that most of the data was wiped from his phone when the CTA disabled Pable's access to the CTA network and databases in late October 2018. [47] 6.

*2 The CTA also requests that Pable produce complete and accurate copies of his archived personal website, www.menchi.org, and any other websites that he owned or operated. [45]. In support, the CTA emphasizes that Pable posted proprietary information about certain CTA projects to the website. The CTA wants copies of that information and to discover if any similar information appeared on Pable's website. Pable argues that the production related to his personal website constitutes harassment. Pable states that the site mainly displays photos of his dog, that the code he posted was for the benefit of the CTA, and that he removed the code as soon as the CTA asked.

Federal Rule of Civil Procedure 26(b)(1) permits discovery as follows:

Federal Rule of Civil Procedure 34 governs requests for inspection of a party's electronic devices:

When determining whether to grant a motion to compel the forensic imaging of a cell phone or other electronic device, the court must decide whether the examination will reveal information that is relevant to the claims and defenses in the case and whether such an examination is proportional to the needs of the case given the cell phone owner's compelling privacy interest in the contents of his or her cell phone. Hardy v. UPS Ground Freight, Inc., Case No. 3:17-cv-30162-MGM, 2019 WL 3290346, at *2 (D. Mass. July 22, 2019). The court may compel a forensic examination of a party's personal devices where the moving party demonstrates that the responding party has concealed information or lacks the expertise necessary to search and retrieve all relevant data. Belcastro v. United Airlines, Inc., No. 17 C 1682, 2019 WL 7049914, at *2 (N.D. Ill. Dec. 23, 2019). Further, before permitting an intrusion into an opposing party's information system – particularly where that party has undertaken its own search and forensic analysis and has sworn to its accuracy – the inquiring party must present at least some reliable information that the opposing party's representations are misleading or substantively inaccurate. Williams v. Mass. Mut. Life Ins. Co., 226 F.R.D. 144, 146 (D. Mass. 2005).

The Court finds that the CTA has demonstrated good cause and a justified need for a second forensic imaging of Pable's phone.

First, the original imaging was undertaken unilaterally by Pable without notice to, and thus without seeking input or agreement regarding the protocol for the imaging from, the CTA. [45] 10-12. By proceeding in this manner, Pable denied the CTA an opportunity to propose or comment on a protocol for the imaging or its parameters – and thus to avert the very concerns the CTA has now raised. Cf. Antioch Co. v. Scrapbook Borders, Inc., 210 F.R.D. 645, 652-53 (D. Minn. 2002) (recognizing the prudence of parties agreeing upon a neutral third-party forensic expert, who will make a report to the Court regarding the scope of the forensic work performed and a description of the volume and type of records provided to counsel).

*3 Second, the extremely small amount of data produced by the imaging underscores the reasonableness of the CTA's request. As noted above, the forensic imaging produced only .2 GB of user-generated data, which represents less than 1% of the phone's storage capacity. Among the data that was produced, there were no communications exchanged on third-party applications; internet browsing and/or search histories; audio or visual files, including photos; information or data associated with 151 of the 200 third-party applications contained on the cell phone; or information or data associated with the cell phone's SD card(s). [45-1] Ex. H ¶¶ 10, 12, 13, 15. Moreover, when Pable produced the image to CTA and Clever Devices, neither defendant's expert could access the image because the software that Pable's forensic expert had used to produce the image is not commonly used to produce forensic images of cell phones. [45] 10. In addition, the CTA's technical expert submitted an affidavit stating that the phone image only held 5 SMS text messages, all of which were exchanged on either May 26 or May 27, 2020. [45-1] Ex. H ¶ 10. Furthermore, besides call log history, the data contained in the phone image did not predate June 5, 2020. [Id.] Ex. H ¶ 13. All of this demonstrates that the CTA has raised a legitimate question about the completeness of the forensic imaging that Pable unilaterally produced. And while the Court is aware of Pable's contention that his cell phone was “wiped” when the CTA disabled his access to its network and databases, Pable has not cited to any evidence in the record to corroborate or substantiate this claim.

Third, the information that the CTA seeks by way of a second forensic imaging – communications between Pable and Haynes about the Skeleton Key – goes to the heart of Pable's claim against the CTA and the CTA's counterclaim. Relevant to Pable's claim, the phone may contain communications regarding Pable's discovery and use of the Skeleton Key. The CTA's counterclaim specifically alleges that Pable encrypted his CTA computer at multiple points of access without the CTA's authorization or knowledge, including encrypted applications on his cell phone. [32] ¶¶ 20, 22, 23. For these reasons, the Court finds that the CTA has shown that the subject matter is relevant and proportional to the needs of the case.

Fourth, the privacy concerns that a forensic imaging of a cell phone would ordinarily raise carry less force here, given Pable's unilateral decision to submit his cell phone for the first imaging. While the Court recognizes that a forensic imaging of a personal cell phone represents a major intrusion into personal privacy, Pable has no basis to invoke privacy concerns after voluntarily turning his phone over for the first imaging.

For these reasons, the Court orders Pable to produce to the CTA his personal cell phone, along with any and all affiliated SD cards and/or storate devices, for inspection and re-imaging.

The Court also grants the CTA's request for an order directing Pable to produce complete and accurate copies of Pable's archived personal website and any other websites owned or operated by Pable.

There is no dispute that Pable had previously posted detailed and proprietary information about CTA technology projects on his website. CTA represents that this information was available on the website as recently as mid-October 2020. [45] 21. Since that time, Pable has deleted the information (though he contends that he did so at CTA's request) and has refused to provide archived copies of the website to the CTA. The CTA also represents that, as of the filing of its reply brief, the website was inaccessible and labeled by Google Safe Browsing as a security threat. [48] 9. Under Rule 26, the Court finds that the CTA is entitled to gather information about Pable's website. The request is reasonable because any posts revealing proprietary CTA code could be relevant to the parties’ claims and defenses. It is also plausible, given Pable's admission that the website “has references to his work for the CTA,” [47] 10, to infer that the website contains or contained other information relevant to the case, such as admissions by Pable or other statements about the CTA and his work there that bear on the parties’ claims and defenses. Finally, while Pable denies that he “has” an archive of his website, [47] 11, that does not answer the question whether such an archive is within his possession, custody, or control and therefore can and should be produced to CTA in accordance with Fed. R. Civ. P. 34(a)(1).[1]

*4 For these reasons, the Court finds that the CTA's request seeks relevant information, and Pable has not carried his burden to show that the discovery is improper. Mendez v. City of Chi., 18-cv-6313, 2020 WL 4736399, at *3 (N.D. Ill. Aug. 14, 2020) (“If the discovery appears relevant, the party objecting to the discovery request bears the burden of showing why that request is improper.”). The Court therefore orders Pable to (1) identify all websites that he owned or operated from May 1, 2018 to the present and, (2) with respect to any such websites, including but not limited to www.menchi.org, produce all archived copies of that website in his possession, custody, or control.

The CTA's motion to compel Pable to produce his cell phone for inspection and forensic imaging and to provide complete, accurate copies of his archived website [45] is granted. Within ten days of the date of this order, Pable shall produce to the CTA (1) his personal cell phone, along with any and all affiliated SD cards and/or storage devices, for inspection and re-imaging; and (2) archived copies in his possession, custody, or control of any websites owned or operated by Pable, including but not limited to www.menchi.org, as they appeared from May 1, 2018 through the present. On or before April 16, 2021, Pable shall file a response to the CTA's request for costs and fees under Fed. R. Civ. P. 37(a)(5). The CTA may, but need not, file a short reply by April 23, 2021.