Sanctions that courts may impose for spoliation of evidence are well-documented, and range from costs and attorneys’ fees to adverse inference jury instructions. But the ultimate spoliation sanction is the award of a default judgment against the spoliating party. That was the penalty recommended last month by a federal magistrate judge in Gutman v. Klein, 2008 WL 4682208 (E.D.N.Y. Oct. 15, 2008). Gutman should serve as a warning to all parties engaging in electronic discovery. The case is remarkable both for the egregiousness of the defendants’ spoliation and for the ability of forensic computer technicians to track and uncover every step of the defendants’ destruction of evidence.
During a five-year discovery period, Federal Magistrate Judge RobertM. Levy instructed defendant Klein “to advise opposing counsel . . . of the location of all desktop and laptop computers under [his] dominion and/or control.” Id. at *1. Klein alerted plaintiffs to a desktop and a laptop computer in his possession, which were scheduled for computer imaging at his residence on December 8, 2005. Id.
Prior to that date, Klein engaged in a series of activities meant to alter or destroy litigation evidence contained on his laptop computer. On December 6, two days before the scheduled imaging by plaintiffs’ forensic expert, Klein—logging onto his computer as “user ‘M’”—visited websites that related to the Windows XP operating system, data recovery, and data deletion. Id. at *3. User “M” downloaded a file containing the Active@ Boot Disk tool suite, which purported to “securely erase data through the use of one of its tools, the Kill Disk program” and also “contain[ed] a utility to recover lost data.” Id. Subsequently, user “M” deleted hundreds of files from the laptop and reinstalled Windows XP, which overwrote the many previously deleted files and rendered them unrecoverable. Id. Furthermore, theWindows XP installation was back-dated to July 15, 2003. Id. at *4. After the reinstallation, approximately three hundred additional files were deleted, many with labels such as “privileged” or “confidential” in their file names. Id. at *3. “Thousands” of documents were subsequently reloaded onto the laptop from an external drive, bearing “erroneous, backdated time stamps.” Id. Sometime between December 6 and the morning of December 8, user “M” was deleted from the computer and a new “user ‘ZK’” was added. User “ZK” then changed the system clock at least seven times, while uploading replacement files. Id.
On December 8, when plaintiffs’ counsel and their forensic computer expert Douglas Vitale (“Vitale”) arrived to “image” Klein’s desktop and laptop computers, Klein refused to produce the laptop for nearly two hours. Id. at *1. When the laptop was finally made available, Vitale observed that it was “hot to the touch” and that “a screw was missing from the hard drive enclosure.” Id. This led plaintiffs to conclude that the laptop had been tampered with. Based on the belief that Klein had engaged in spoliation, plaintiffs moved the court to (1) enter a default judgment or similar terminating sanction against the defendants, (2) assess punitive monetary sanctions against defendants, and (3) reimburse plaintiffs’ attorney’s fees and costs incurred as a result of the discovery dispute. Id.
The Forensic Investigation
Judge Levy appointed a computer forensic expert, Stroz Friedberg LLC (“Stroz”), to:
analyze Mr. Klein’s hard drives for evidence that Mr. Klein (a) visited the web sites listed in the deletion log . . . (b) downloaded a program which can delete files so they are not recoverable, (c) changed the name of the program and then deleted it and (d) subsequently deleted files.
Id. at *2. The court initially ordered plaintiffs to bear the cost of the court-appointed forensic expert, with the caveat that plaintiffs could seek “additional relief ” if Stroz “concluded that Mr. Klein engaged in the activities described . . . above.” Id.
For its investigation, Stroz used the forensically copied or “imaged” version of Klein’s laptop, taken by Vitale on December 8, 2005. Id. at *3. Stroz was able to determine from the laptop’s Internet Explorer cache and Internet History logs that a user “M” had visited websites relating to the XP operating system and downloaded the Active@ Boot Disk tool suite on December 6, 2005. Id. Additionally, Stroz examined a system file in the Recycle Bin named “INFO2,” which maintained the dates and times when files and folders entered the Recycle Bin, and discovered that user “M” had deleted “hundreds of user documents . . . in the days prior to the forensic imaging.” Id. Furthermore, Stroz uncovered “substantial evidence of large-scale modifications to the Klein laptop’s operating system in the thirty-six hours prior to the forensic acquisition of the Klein laptop by Vitale,” including the reinstallation of Windows XP, which overwrote deleted documents, rendering them unrecoverable. Id.
Stroz further was able to determine that the computer had been backdated to indicate a false reinstallation date, and that multiple external storage media were connected to the laptop “shortly” before the forensic imaging. Id. at *4. Stroz was able to recover a limited number of the many files deleted prior to the reinstallation ofWindows XP. Id. at *3. Additionally, Stroz determined that thousands of files bearing erroneous time-stamps had been copied onto the laptop on December 8. Id. at *5.
Stroz ultimately concluded that the evidence, taken as a whole, was “indicative of the behavior of a user who was attempting to permanently delete selected files from the machine and then cover up the chronology of system changes occurring in the hours and days just prior to a forensic preservation.” Id. at *5.
The Spoliation Hearing
At the spoliation hearing, Judge Levy found Klein’s responses to Stroz’s findings to be less than convincing. Id. at *5. Klein first alleged that his original laptop had been stolen sometime in 2004 and that the imaged laptop was a replacement. Id. at *10. Then Klein alleged that he had hired a computer consultant prior to December 8, requesting that he “remove potentially embarrassing files” before the imaging. Id. at **5-6. The consultant testified that he reinstalled Windows XP to enhance computer performance and troubleshoot computer “sluggishness.” Id. at *9.
Judge Levy rejected Klein’s explanation that the laptop had been stolen and held that he had not done enough to ensure the preservation of the evidence on the laptop. The court ultimately determined that plaintiff had successfully proven that: (1) Klein had control over the laptop-evidence and an obligation to preserve it at the time it was tampered with, (2) Klein destroyed evidence with a culpable state of mind, and (3) the destroyed evidence was relevant to the plaintiffs’ claims such that a reasonable trier of fact could find that it would support those claims. Id. at *7. Judge Levy held that Klein’s obligation to preserve the laptop arose, at the latest, in April 2003, when a predecessor-state court litigation was transferred to federal court in Brooklyn. Id. at *7. Moreover, the court held that defendants knew of the laptop’s specific relevance by October 2005, when the plaintiffs moved for the production of all computers, and November 2005, when the court ordered the discovery of all relevant real-estate and financial documents. Id. Furthermore, Judge Levy held that Stroz’s findings proved Klein’s culpable state of mind. Finally, the court determined that the spoliated evidence was relevant to plaintiffs’ claims based on the following three facts: (1) “many of the files deleted from the Klein laptop were listed in Klein’s privilege log”; (2) “defendants [had] previously stated that the laptop contained relevant information in a letter to the court”; and (3) “the record demonstrate[d] that Klein [had] acted in bad faith when he destroyed evidence on the Klein laptop.” Id. at *8. The court noted that “the burden of proving that [the] evidence would have been relevant to [plaintiffs’] claims . . . is proportional to the mens rea of the [defendant] who destroyed the evidence.” Id. at *7. Taking into consideration Stroz’s findings and all of Klein’s proffered excuses for the alterations to the laptop, the court determined that the sanction of a default judgment was appropriate. Id. at *11.
The Ultimate Sanction
In determining the appropriate sanction for spoliation, Judge Levy recognized that a court must consider:
(a) willfulness or bad faith on the part of the noncompliant party; (b) the history, if any, of noncompliance; (c) the effectiveness of lesser sanctions; (d) whether the noncompliant party had been warned about the possibility of sanctions; (e) the client’s complicity; and (f ) prejudice to the moving party.
Id. at *11 (citation omitted). Additionally, a court must consider the purpose for the sanctions when crafting the appropriate judicial response to the specific spoliation. “[T]he sanction should ‘(1) deter parties from engaging in spoliation; (2) place the risk of an erroneous judgment on the party who wrongfully created the risk; and (3) restore the prejudiced party to the same position he would have been in absent the wrongful destruction of evidence by the opposing party.’” Id. at *11 (quoting West v. Goodyear Tire & Rubber Co., 167 F.3d 776, 779 (2d Cir. 1999)).
Mindful that terminating the case was the “ultimate” sanction, appropriate “only in extreme circumstances,” id. at **11-12, Judge Levy recommended a default judgment as appropriate under the circumstances. “Because defendant spoliated the files, it is impossible to identify which files were relevant to plaintiffs’ claims and how they might have been used. Accordingly, it is impossible to know what plaintiffs would have found if defendants and their counsel had complied with their discovery obligations.” Id. at *12. This decision was reached, in part, because Judge Levy determined that lesser sanctions would not adequately deter the misconduct and because an adverse inference instruction was “ill-suited to a case like this, where the spoliator has, in bad faith, irretrievably deleted computer files that likely contained important discovery information.” Id. (citations omitted). In addition, Judge Levy granted plaintiffs certain attorney’s fees and costs “related to the Klein laptop.”
How Likely is the “Ultimate Sanction”?
Judge Levy is not alone among judges in the Second Circuit who have decided that a default judgment is the appropriate penalty for spoliation of electronic evidence. As recently as this summer, a district judge in Connecticut imposed that sanction for defendants’ willful violation of discovery orders, including the destruction of computer files. See S. New Eng. & Tel. v. Global NAPs, Inc., 251 F.R.D. 82 (D. Conn. July 1, 2008). There, the evidence suggested that the defendants used a software application to “shred” files, “permanently destroying” them in what the court found to be “willful” spoliation. Id. at 93. After a detailed spoliation and sanctions analysis, the court held that “lesser sanctions would not deter the defendants from further delaying discovery in this case.” Id. at 96. In granting the default judgment, the court expressed doubt that “the discovery sought continue[d] to exist.” Id.
Southern District of New York Judge Loretta A. Preska— recently nominated to the Second Circuit Court of Appeals—also granted a motion for default judgment after numerous and cumulative discovery violations, including spoliation of electronically stored information, in a well publicized case, Metropolitan Opera Ass’n, Inc. v. Local 100, Hotel Employees & Rest. Employees Int’l Union, 212 F.R.D. 178 (S.D.N.Y. 2003). Judge Preska struggled with the extreme nature of the default judgment sanction, writing “[i]n the ordinary course, lawsuits should not be resolved based on who did what to whom during discovery. Indeed, a result driven by discovery abuse is justified only on the rarest of occasions and then only after the miscreant has demonstrated unquestionable bad faith and has had a last clear chance to comply with the rules.” Id. at 181. In Metropolitan Opera, the defendants, among other things, had failed to preserve emails and other forms of electronic discovery, despite repeated discovery conferences and orders requiring such preservation. Id. at 190. Holding that adjudication on the merits was “impossible” due to “wholesale destruction of documents, by omission or commission” and that lesser sanctions “would not be effective in [the] case,” Judge Preska granted plaintiffs’ motion for a default judgment and awarded attorneys’ fees necessitated by the defendants’ discovery abuses. Id. at 230-31.
Beyond New York and the Second Circuit, courts around the country have turned to the ultimate sanction of default judgment to punish the most extreme and egregious spoliation of electronically stored information. For example, in August 2008, a federal judge in Arizona granted a motion for default judgment after the defendant removed programs and deleted content from his computer, burned backup DVD’s that were inaccurate, and reinstalled his computer’s operating system a few weeks after he received a request for copies of various files on his computer. Atl. Recording Corp. v. Howell, 2008 WL 4080008 (D. Ariz. Aug. 29, 2008). Additionally, a federal judge in Missouri granted a default judgment in Ameriwood Indus., Inc. v. Liberman, 2007 WL 5110313 (E.D. Mo. July 3, 2007), after defendants installed “WindowWasher”—a scrubbing software designed to permanently delete or scrub files from a computer’s hard drive—and conducted a mass deletion of over 600 files from two hard drives.
These cases illustrate that extreme instances of spoliation can result in the sanction of a default judgment. Judge Levy’s Report and Recommendation in Gutman is the latest example of that sanction. If adopted by the district court, it will send a strong message to those who would egregiously and intentionally spoliate evidence: judgment may swiftly be levied against them.