*1 Pursuant to Judge Kearney's Order of January 5, 2022, the parties have conferred with me as the designated discovery master under Fed.R.Civ.P. 53 to resolve various pending discovery motions, including Plaintiffs’ Motion for Discovery Sanctions (D.I. 350) and Defendants’ response thereto (D.I. 365), as well as Defendants’ Motion to Compel Production of Allscripts’ Activity Logs (D.I. 361) and Plaintiffs’ response thereto (364). The motions shall be addressed below.[1]

1. These motions have a rather complicated history and, therefore, I start my analysis with some background. As I understand the most relevant of the pending allegations asserted by the Parties, Plaintiffs accuse Defendants’ software developers Mahathi Software Pvt., Ltd., (“Mahathi”) of illegally copying confidential and trade secret source code to build a competing product. Defendants in turn allege that Plaintiffs hacked into Mahathi's systems to access Mahathi's tenant (user interface source code) in order to remove subscription-level data and code to its own tenant.

2. By motion dated March 22, 2022, Plaintiffs moved to compel Defendants to produce a complete revision history (a source code repository) for Defendants’ source code, which motion was granted at least in part because Plaintiffs had already produced a complete repository of its source code. (D.I. 282) To the best of my understanding, the Parties’ respective experts have completed their opening reports based on their review of these source code revision histories. (See, e.g., D.I. 350 at 4, fn.1) Nevertheless, Plaintiffs assert in their Motion for Discovery Sanctions that further proof of Defendants’ wrongdoing could be/could have been found on dozens of laptop computers used by Mahathi employees in India, and Defendants assert in their Motion to Compel Production of Allscripts’ Activity Logs that more information regarding Plaintiffs’ alleged conduct could be had from such a production.

3. Plaintiffs’ Motion for Discovery Sanctions (D.I. 350). In this motion, Plaintiffs request sanctions for spoliation of evidence, that is, for destroying “all copies of Allscipts’ source code and other data stored on 30-40 laptops” at Mahathi's operations in India. (D.I. 350 at 6) It is Plaintiffs’ burden to demonstrate that the imposition of sanctions is warranted.

4. Plaintiffs base their motion on what I find to be a confusing record; however, having reviewed the papers submitted by the Parties, I find the following: As part of their work, Mahathi employees downloaded from a cloud-storage repository onto their local computers portions of the source code for Plaintiffs’ MPE Application on which they were working. They would work on select portions of the source code on their local computers and then upload the revised portions of the code back into the cloud repository. Mahathi employees worked on Mahathi's source code using the same protocol. At least for some period of time, therefore, source code would be stored on local computers. However, a complete copy of the source code remained stored in the cloud-storage repository. (D.I. 365-1)

*2 5. By email dated May 13, 2021, an Allscripts representative asked that all Mahathi employees “check-in” (i.e., upload) their “in-progress code” by the end of the day. (D.I. 365-2) On May 14, 2021, another Allscripts representative notified Defendants that the 2018 SOW was not going to be renewed, and demanded that Defendants (a) “promptly destroy all PHI in your possession,” and (b) “immediately cease all use of all Allscripts materials, software and Confidential Information, and promptly return all such information ... to Allscripts.” (D.I. 350-2) On May 18, 2021, Plaintiffs’ counsel forwarded a copy of the complaint filed in this litigation to Defendants’ counsel. (D.I. 350-3)[2] On May 20, 2021, Plaintiffs wrote to Defendants complaining that Defendants were retaliating against Plaintiffs for filing the litigation by depriving Plaintiffs access to their Azure tenant. By this email, Plaintiffs’ counsel demanded that Defendants restore access, functionality, and all data they had impacted, and to preserve all evidence of their activities.[3] (Id.) Also on May 20, Defendants allege that Mahathi's computer system was hacked by unauthorized access to its Azure tenant, (D.I. 365-8)

6. On May 21, 2021, Madhu Maddi (the Vice President of Engineering for Mahathi) asked Mahathi employees to delete any of Plaintiffs’ source code they might have in their local machines (D.I. 350-6), and also requested that Mahathi's IT administrators reformat the hard disks on the local computers that had been used to work on Plaintiffs’ source code in order to eliminate any remnants of PHI or any other confidential information that had originated with Plaintiffs. According to Mr. Maddi, he made the request based on the termination of the contract with Plaintiffs and his understanding that “reformatting the computers was the most effective way to ensure that all PHI originated from Allscripts that might remain on any Mahathi computer had truly been deleted.” (D.I. 365-1, ¶ 11) According to Defendants, Mr. Maddi's requests for deletion and reformatting never occurred, as Mahathi's attorneys in India instructed the IT administrators to preserve all evidence – including the local computers – for purposes of filing a criminal complaint in India in connection with the May 20 events. (D.I. 365-4, D.I. 365-8) In support of this proposition, Defendants submitted declarations and screenshots of the local computers which allegedly demonstrate that none of the computers have been reformatted since before May 20, 2021. (D.I. 365-4 at ¶ 5) Because Defendants have declined to produce copies of the computers for forensic examination, however, Plaintiffs urge me (and ultimately the Court) to assume that the hard drives were wiped, thus denying Plaintiffs: (a) the opportunity “to prove those developers’ hard drives contained Allscripts’ source code and the details of their misappropriation;” and (b) the ability to disprove Defendants’ allegations that Plaintiffs stole Mahathi's proprietary source code. (D.I. 350 at 4)

7. Rule 37(e) of the Federal Rules of Civil Procedure provides that “[i]f electronically stored information [“ESI”] that should have been preserved in the anticipation or conduct of litigation is lost because a party failed to take reasonable steps to preserve it, and it cannot be restored or replaced through additional discovery,” the court may impose sanctions. The first question to be addressed, therefore, is whether ESI has been lost. According to the sworn testimony of Mahathi employees, the answer is “no,” despite the fact that Allscripts ordered that its source code be removed from Mahathi's local computers (D.I. 350-2) and Mr. Maddi directed his staff to delete “any other source code you may have in your local machines.” (D.I. 350-6) According to this same testimony, because Defendants anticipated litigation at least in India, the local computers were preserved, as evidenced by the screen shots provided through the declaration of Mr. Rao. (D.I. 365-4)

*3 8. As noted above, copies of these computers’ hard drives have not been provided for forensic examination so as to resolve this issue. Left with the record made by the Parties – Plaintiffs relying on Mr. Maddi's original directive and Defendants countering with the declaratory explanations – I am hard pressed to find that Plaintiffs have carried their burden of proving loss. Nevertheless, because the evidence has not been forthcoming, I will examine the next question, that is, whether the information can be restored or replaced through additional discovery. I note in this regard that Plaintiffs are not asking in this motion for access to the computers. Defendants declined to provide such access based on undue burden, conduct which was not tested through the Parties’ vigorous motion practice.

9. Even assuming for purposes of this discussion that the ESI in question was lost, the Court will further consider whether Plaintiffs have been prejudiced by the loss, as per Rule 37(e)(1). Certainly with respect to the allegations that Defendants copied Plaintiffs’ source code, the answer should be “no”. Despite the fact that Plaintiffs included Mr. Zeidman's entire opening expert report as an attachment to their motion, there is no mention in the report of needing the ESI contained on the local machines; his focus was on obtaining the complete revision history of Defendants’ source code from the cloud-storage repository, yet another topic covered by the Parties’ motion practice. Plaintiffs also complain that, without access to the hard drives on the local machines, they will have difficulty disproving the allegation that they stole Defendants’ proprietary source code. Plaintiffs have not provided any persuasive evidence tending to indicate that the local Mahathi computers had any unique, relevant ESI that was not duplicated in the Parties’ respective cloud-storage repositories, to which the Parties have had mutual access.

10. Finally, with respect to Rule 37(e)(2) (upon which Plaintiffs rely for their requested relief of an adverse inference), the question is whether the destruction of ESI was intentional. If the Court discredits Defendants’ evidence and finds that the ESI was destroyed upon Mr. Maddi's directive, then the following factors would have to be considered: “(1) whether the party seeking sanctions suffered prejudice by destruction of evidence; (2) whether the prejudice can be cured; (3) practical importance of the evidence; (4) whether the spoliating party acted in good or bad faith; and (5) the potential for abuse if the evidence is not excluded.” DVComm, LLC v. Hotwire Communications, LLC, 2016 WL 6246824, at *7 (E.D. Pa. Feb. 3, 2016). Given the importance attributed to the cloud-storage repositories in the Parties’ past motion practice, Plaintiffs have not proffered persuasive arguments, let alone evidence, that the local machines in India harbor different, significant information; i.e., Plaintiffs have not carried their burden in connection with the first three factors. With respect to the question of whether the alleged destruction was carried out in bad faith, Mr. Maddi's declaration (not inconsistent with his deposition testimony) and the circumstances surrounding his conduct are not indicative of bad faith. The last factor explores the potential for abuse if the relief is not granted. In this regard, I come back to the fact that Plaintiffs filed a motion for sanctions rather a motion for access to the computers, leaving the Court without actual proof of loss in the first instance. In sum, I am not persuaded that Plaintiffs have carried their burden to prove any of the factors identified above in DVComm LLC. v. Hotwire Communications, LLC.

11. Defendants’ Motion to Compel Production of Allscripts’ Activity Logs (D.I. 361). As noted above, Defendants in this case allege that on May 20, 2021, Plaintiffs removed certain proprietary source code from Defendants’ tenant and moved the code of a new tenant controlled by Plaintiffs. Defendants’ expert would like to review various categories of Plaintiffs’ log data in order to conduct a complete forensic investigation of these allegations. According to Defendants, “Microsoft Azure tenants, such as those involved in the events alleged in this case, typically automatically generate log data that breaks down into six standard categories,” including (1) Azure Audit Logs, (2) Azure Application Sign in Logs, (3) Azure Privileged Identity Management (PIM) audit history, (4) Compliance Audit Logs, (5) OneDrive Sign in Activity, and (6) OneDrive Audit Logs. (Id. at 3) (Emphasis added) According to the declaration of Defendants’ expert, “[b]ecause these standard categories of log data are typically generated automatically for activity within a Microsoft Azure tenant, I would expect them to exist within Allscripts’ system (unless they were not preserved). Because Allscripts controlled the new tenant, this log data would be in Allscripts possession, not Mahathi's.” (D.I. 361, Ex. A, ¶ 12) (Emphasis added)

*4 12. The Parties agree that Plaintiffs have produced the requested logs for the first two categories. Plaintiffs reiterate in their response that they have produced 50 log files spanning the date range of June 12, 2018 through May 26, 2021. (D.I. 364 at 2) Plaintiffs go on to argue (without supporting declarations) that they do “not have access to the data required to create the other reports that Defendants requested,” and argue further that “Defendants could access the data and crate the reports using their own Office 365 Compliance Manager.” (Id.) When asked if some proof of these assertions were contemplated, Plaintiffs’ counsel responded that it was too burdensome for their client to undertake at this time.

13. Consistent with my past recommendations, I do attach significance to the sworn testimony submitted in support of this motion and, therefore, I find it more likely than not that Plaintiffs have access to the remaining categories of log data.[4] When balancing the need for the information requested versus the burden of producing it, however, I do not recommend granting the motion. Aside from the burden of production (even of an opposing declaration) and the timing of the decision (this order will issue on the date rebuttal expert reports are due and within days of the close of discovery), at some point discovery has to close. Although experts “seek to correlate all available relevant logs to tell the complete story” (D,I, 361, Ex. A ¶ 11) (emphasis added), the expectations of experts and the reality of the discovery process typically are not coextensive. I am not convinced that Defendants have been deprived of essential data.

THEREFORE, IT IS ORDERED this 25th day of April, 2022, that:

1. Plaintiffs’ Motion for Discovery Sanctions (D.I. 350) is denied.

2. Defendants’ Motion to Compel Production of Allscripts’ Activity Logs (D.I. 361) is denied.

3. As per Judge Kearney's January 5, 2022 Order, the Parties have 24 hours to submit objections not exceeding five pages to this recommended Order.