Blackberries ‘N SYNC’d with company servers did not prevent the imposition of sanctions for failing to preserve ESI on the Blackberries

September 18th, 2009 | By Steve Puiszis

Southeastern Mechanical Servs., Inc. v. Brody, 2009 WL 2883057 (M.D.Fla. Aug 31, 2009)

Blackberries, iPhones and similar devices used by a company’s employees contain electronically stored information (“ESI”), that must be preserved when a litigation hold is imposed. Many companies today have hundreds, if not thousands, of employees who use PDAs for company business, complicating the litigation hold process.

If you are a general counsel who believes the use of PDAs shouldn’t pose much of a litigation concern because they are synchronized to your company’s email servers so that any emails sent or received by your employees from those devices reside on your company’s servers, think again, and then read Brody. The fact that employee Blackberries were synced to the company’s email server did not preclude sanctions from being entered. Brody appears to be the first reported ediscovery decision where sanctions were imposed for failing to preserve data on individual Blackberries. Electronic information on individual PDAs must be preserved with no strings attached.

The facts which prompted the underlying litigation are not unique. The plaintiff, Southeastern Mechanical Services (“SMS”), and several of the defendants, Babcock Power Services, Inc. (“Babcock”) and Thermal Engineering Construction Services, Inc. (“TEI”), are business competitors. Several years before the underlying litigation was initiated, Babcock had entered into negotiations with SMS to acquire its business operations. The negotiations failed, and subsequently, several SMS employees, including its national and regional sales directors and the director of quality control, left the company and went to work for a competitor, TEI, which is an affiliate of Babcock.

One of the former SMS employees downloaded a proprietary bid software program onto a thumb drive from a company laptop prior to his resignation. That employee then transferred that program to a TEI computer once he joined his new employer. Another took six computer discs and a flash drive containing confidential SMS information with him when he went to work for TEI. Plaintiff filed suit against Babcock, TEI and its former employees seeking injunctive relief and damages under the Computer Fraud and Abuse Act (18 U.S.C. § 1030), Florida’s Uniform Trade Secrets Act, Florida’s Deceptive and Unfair Trade Practices Act, and under several common-law theories of recovery.

The district court in Brody initially granted a temporary restraining order. Following an evidentiary hearing, the court entered a preliminary injunction which prohibited the defendants from using, copying, distributing, disclosing or examining any of SMS’s confidential or proprietary information and requiring the defendants to return all information and property. The court also ordered the defendants to preserve all computer files, data, and documents relevant to the plaintiff’s claims.

TEI placed on administrative leave the former SMS employees who were named in the temporary restraining order. TEI also ordered them to turn in their Blackberries and laptop computers, froze their email accounts and locked their passwords to prevent access to TEI’s information systems. All data in their TEI email folders was copied and backed up.

After their Blackberries and laptops were turned in, TEI produced them for a forensic examination. The forensic examination found no data whatsoever on any of the TEI Blackberries used by the former SMS employees. As you would expect, this prompted the filing of a sanction’s motion claiming spoliation of evidence. Although the parties’ experts disagreed as to what might have caused that data loss, the district court concluded that the Blackberries had been wiped of all data before the forensic examination occurred.

The wiping of data from the TEI defendants’ Blackberries was not the first time the district court had encountered that kind of activity in the case. Discovery also revealed that after resigning from SMS, a former employee had “wiped” his company laptop before he returned the computer, in an apparent attempt to conceal his activities before leaving the company.

In opposing the plaintiff’s motion for sanctions, the defendants in Brody argued that all of the data on those Blackberries was preserved on the company servers, and therefore, it was irrelevant whether any information was deleted from those devices. The court observed however, that all data had been completely wiped from those Blackberries after a duty to preserve had arisen. The court recognized that emails sent using personal web-based email accounts via those Blackberries would not be captured on the company’s email servers, nor would the telephone records (call logs) and text messages sent using those devices. In addition, because the Blackberries had been used for TEI business by the former SMS employees before the devices had been synced to the company’s servers, any emails sent or received during that time were also irretrievably lost when the Blackberries were wiped. Thus, the fact that those devices were synced to the company’s email servers did not prevent the court from imposing sanctions. Because the court concluded that the former SMS employees were the most likely culprits, it ordered that an adverse inference instruction be issued as to plaintiff’s claims against them.

The use of wiping software can look awfully suspicious whenever it occurs, but especially once litigation has commenced. Additionally, most wiping programs leave some telltale signs of use which can be discovered through a forensic examination. So while the data itself may not be recoverable, the fact that wiping software was used can be uncovered, and evidence of its use is perhaps even more damaging than the electronic information that was destroyed.

The use of wiping software creates the opening for a potentially devastating argument about a conscious attempt to conceal damaging evidence. Even when the deleted information or data was not particularly relevant or helpful to a particular claim or defense, its intentional destruction will become the smoking-gun evidence in the case. Therefore, companies should consider including a provision in their computer/email use policies and employee handbooks that prohibits employees from using wiping software or otherwise deleting or destroying information or emails in a manner inconsistent with the company’s document retention/destruction policies. The existence of such a policy will provide a basis for the company to argue that it shouldn’t be sanctioned for clearly unauthorized acts of its employees.

So why the reference to the once popular American boy band in the title of the blog post you ask? Well here at Practical Ediscovery, we try to be creative with our blog posts and ‘N Sync’s fourth album was titled: No Strings Attached, which is how the ESI on your employees PDAs must be preserved following Brody. So dig out of storage a copy of No Strings Attached, blow the dust off the album cover and give it a listen, unless you no longer have a turntable, in which case, consider it legacy data, and evaluate whether you have any duty to preserve it.

Leave a Comment »

---