1. August 30, 2015 Using Electronic Evidence in IP Litigation Tips, Tactics, Technology Presented by Christopher Wall, Esq.

2. Discussion Outline 21 st Century Discovery Preservation / Spoliation Trial & Evidentiary Issues E-Discovery Technology & Costs Tips, Tactics & Technology

3. Investigative & detailed analysis Typically a single hard drive or PC Searching for deleted information Determine who, what, when Recreation of time-critical events Reporting & expert testimony Breaking of passwords/encryption Gathering, searching, culling & producing large volumes of relevant information for legal review Data is accessed but not analyzed Includes active & archival data Typically does NOT include discarded, hidden or deleted data Email systems, network shares, desktops and backups Electronic Evidence Computer ForensicsElectronic Discovery 21 st Century Discovery

4. Investigative & detailed analysis Typically a single hard drive or PC Searching for deleted information Determine who, what, when Recreation of time-critical events Reporting & expert testimony Breaking of passwords/encryption Electronic Evidence Computer Forensics 21 st Century Discovery

5. Computer Forensics Case Profiles Securities Litigation Trade Secret Misappropriation Corporate Fraud Wrongful Termination Sexual Harassment Divorce Settlement 21 st Century Discovery

6. Electronic Evidence 21 st Century Discovery Gathering, searching, culling & producing large volumes of relevant information for legal review Data is accessed but not analyzed Includes active & archival data Typically does NOT include discarded, hidden or deleted data Email systems, network shares, desktops and backups Electronic Discovery CID HSR Second Request Subpoena Duces Tecum Request for Production Interrogatories

7. E-Discovery Case Profiles Product Liability Litigation Intellectual Property Disputes Complex Employment Suits Securities Litigation HSR Antitrust Investigation by FTC or DOJ Becoming increasingly common in almost every large scale litigation 21 st Century Discovery

8. About 31 billion emails are sent daily, on the Internet and elsewhere, a figure which is expected to double by 2006. The average email is about 59 kilobytes in size, thus the annual flow of emails worldwide is 667,585 terabytes. –IDC Email Usage Forecast and Analysis (analysis available at http://www.sims.berkeley.edu/research/projects/how-much-info-2003) http://www.sims.berkeley.edu/research/projects/how-much-info-2003 The average volume of discovery data collected from a custodian has increased more than 500% in the past five years. –Daryl Teshima, “7 Deadly Sins of Electronic Discovery” Law Office Computing, June/July 2003. 21 st Century Discovery

9. 96% Digital 4% Paper 21 st Century Discovery

10. Source: U.S. News & World Report 70% of electronic documents are never printed Considering only paper documents is the equivalent of managing only 3 of 10 file drawers of potentially relevant information. 21 st Century Discovery

11. Theft of intellectual property was the second most expensive computer crime last year. – 2004 CSI/FBI Computer Crime and Security Survey. http://i.cmpnet.com/gocsi/db_area/pdfs/fbi/FBI2004.pdf http://i.cmpnet.com/gocsi/db_area/pdfs/fbi/FBI2004.pdf Firms with annual sales under $10M spent an average of approximately $500 per employee on computer security, while the largest firms, spent an average of about $110 per employee. – 2004 CSI/FBI Computer Crime and Security Survey. http://i.cmpnet.com/gocsi/db_area/pdfs/fbi/FBI2004.pdf http://i.cmpnet.com/gocsi/db_area/pdfs/fbi/FBI2004.pdf

12. 4 Internal Hard Drives 4 Floppy Disks 4 PCMCIA Cards 4 Notebook Computers 4 Personal Digital Assistants 4 Microdisks 4 Flash USB Devices 4 Tape Back-Ups 4 External Hard Drives 4 Offsite Storage 4 Internet 4 Digital Voicemail 4 Proprietary Systems Where can you find the data? 21 st Century Discovery

13. Discoverability FRCP 34 – “data compilations” –“Today it is black letter law that computerized data is discoverable if relevant.” Anti-Monopoly, Inc. v. Hasbro, Inc., 1995 WL 649934 (S.D.N.Y. Nov. 3, 1995). –“A discovery request aimed at the production of records retained in some electronic form is no different in principle from a request for documents contained in any office file cabinet.” Linnen v. A.H. Robins Co., 1999 WL 462015 (Mass. Super. June 16, 1999).

14. 21 st Century Discovery Electronic production may be required; i.e. traditional paper printouts alone may be insufficient –Anti-Monopoly, Inc. v. Hasbro, Inc., 1995 WL 649934 (S.D.N.Y. Nov. 3, 1995). –Zakre v. Norddeutsche Landesbank Girozentrale, 2004 WL 764895 (S.D.N.Y. Apr. 9, 2004). Backup tapes must be produced if relevant –In re CI Host, Inc., 92 S.W.3d 514 (Tex. 2002) Mere copies of files aren’t enough – bit-by-bit forensic image is the standard –Taylor v. State, 93 S.W.3d 487 (Tex. App. 2002)

15. 21 st Century Discovery What can be requested: –Requesting party may be able to receive a copy not only of business data but of opposing party’s personal hard drive. Superior Consultant Co. v. Bailey, 2000 WL 1279161 (E.D. Mich. Aug. 22, 2000). –Opposing party must produce all data relevant to material facts and preserve data compilations and computer data. Kleiner v. Burns, 2000 WL 1909470 (D. Kan. Dec. 15, 2000). –Requesting party should have access to active and deleted data alike. Simon Property Group v.mySimon, Inc., 194 F.R.D. 639 (S.D. Ind. 2000).

16. Active Data: Data which exists on a hard drive on a particular date and time. –Captured by use of copying or mirror imaging technology Archival / Legacy Data: Data which is located on “back up” tapes and systems –Restored from archival media for processing, in many instances is obsolete 21 st Century Discovery

17. Delete does NOT mean delete File Allocation Tables (FATs) Delete simply makes space available for overwriting 21 st Century Discovery

18. The filename is kept in your directory along with a reference to the File Allocation Table (FAT). The File Allocation Table ( FAT) is a map of where data is stored on the drive. SmokingGunEmail.pst LINK 1234 User ’s view: FAT 21 st Century Discovery 1234 1 2 3 4 Disk Surface SmokingGunEmail.pst

19. σ 1234 BROKEN LINKS FAT 1 2 3 4 Disk Surface LINK 21 st Century Discovery When you delete a file, you simple break the link between the FAT and the data on the hard drive. Once the links are broken, the space on the hard drive used by the deleted data can be overwritten. mokingGunEmail.pst User ’s view:

20. 21 st Century Discovery [A] computer’s DELETE key acts somewhat like a thief who steals a card from the old library’s card file. When the card was in place, the librarian could decode the library’s filing system and find the book. If the card was gone, or unreadable, the book was still in the library, but it could no longer be found amidst the library’s stacked shelves. In a computer, the “lost” book can be found with very little effort. Judge James M. Rosenbaum, D. Minn.

21. Deleted electronic evidence is fully discoverable. Prior to termination of their employment, Defendants copied and took with them volumes of computerized data maintained in Plaintiff’s files and storage media. Court required electronic evidence preservation and ordered Defendants to allow a court-appointed expert to recover lost or deleted files and perform automated searches of the evidence under guidelines agreed to by the parties or established by the court. Dodge, Warren, & Peters Ins. Servs. v. Riley, 130 Cal.Rptr.2d 385 (Cal. Ct. App. 2003). 21 st Century Discovery

22. 14% of companies have been ordered by a court or regulatory body to produce employee email (a 5% increase since 2001). –American Management Association (2003) 13% of employers have battled workplace lawsuits triggered by employee e-mail. – AMA/ePolicyInstitute Research. 2004 Workplace E-Mail and Instant Messaging Survey. www.epolicyinstitute.comwww.epolicyinstitute.com

23. 21 st Century Discovery If anything will bring about the downfall of a company... it is blind copies of e-mails that should never have been sent in the first place.... - Michael Eisner ( Forbes, May 2000)

29. The Search for E-mail

30. Discussion Outline 21 st Century Discovery Preservation / Spoliation Trial & Evidentiary Issues E-Discovery Technology & Costs Tips, Tactics & Technology

31. 37% of employers do not know or are unsure about the difference between an electronic business record that must be retained, versus an insignificant message that may be deleted. ― AMA/ePolicyInstitute Research. 2004 Workplace E-Mail and Instant Messaging Survey. www.epolicyinstitute.comwww.epolicyinstitute.com Preservation / Spoliation 65% of all companies responding lack document retention policies. ― AMA/ePolicyInstitute Research. 2004 Workplace E-Mail and Instant Messaging Survey. www.epolicyinstitute.comwww.epolicyinstitute.com

32. Hypothetical: –Your client is a multinational conglomerate –Patent infringement suit is filed against your client –Multiple product lines implicated in the lawsuit –Specific allegations of wrongdoing by named individuals Preservation / Spoliation

33. Response Plan 1.Suspend document destruction policy 2.Distribute document preservation letter to employees, opponent and 3 rd parties 3.Assemble electronic discovery response team (including outside expert) 4.Create an inventory of hardware and software 5.Make a list of individuals likely to possess responsive documents Preservation / Spoliation

34. Response Plan (cont’d) 6.Define relevant time period 7.Make forensically sound image of hard drives from key individuals 8.Consult with opposition to define the scope of discovery (key words, file types, etc.) 9.Prepare an electronic discovery plan (potential appointment of 3 rd party neutral expert) 10.Determine method of document review and production (for relevance and/or priv) Preservation / Spoliation

35. Planning: –Develop (and/or negotiate, if feasible) keyword searches to run across universe of data –List types of files you will need to consider (text, email, CAD, JPG, MPG, etc.) –Determine whether to consider deleted files (may or may not be relevant) –Decide how you will conduct your priv/confidential review –Decide how you will produce your ultimate data set Discovery Plan

36. Preservation / Spoliation Duty to Preserve Electronic Data: When does the duty arise? Proctor & Gamble v. Haugen, 179 F.R.D. 622 (D.Utah 1998). Duty to preserve exists independent of a court order. NOW v. Cuomo, 1998 WL 395320 (S.D.N.Y., July 14, 1998). Duty to preserve arises at the latest with service of the complaint and counsel has a DUTY to advise client of pending litigation and the need to preserve potentially relevant data. United States v. Smithfield Foods, Inc., 972 F.Supp. 338 (E.D. Va. 1997). The producing party has a duty to preserve once it was on notice of a government investigation.

37. Preservation / Spoliation Document Retention Policy Does Not Protect Plaintiff from Consequences of Document Purge in Patent Case In a patent infringement suit, the defendant alleged that the plaintiff instituted a document-purging program despite being on notice of impending litigation for the patents at issue. The plaintiff held a “Shred Day,” an event in which the plaintiff’s employees shredded about two million documents as part of its document retention and destruction policy. At trial, the plaintiff did not dispute that it “destroyed some documents because of their ‘discoverability’.” The court concluded that even if the plaintiff “ did not institute its document retention policy in bad faith, if it reasonably anticipated litigation when it did so, it is guilty of spoliation.” The court granted the defendant’s motion and ordered the plaintiff to immediately produce documents containing information about or relating to the creation, preparation, or scope of the plaintiff’s document retention policy. - Rambus, Inc. v. Infineon Techs. AG, 2004 WL 383590 (E.D.Va. Feb. 26, 2004), amended by, 220 F.R.D. 264 (E.D.Va. 2004). Duty to Preserve Electronic Data: When does the duty arise?

38. Preservation / Spoliation Golden Rule Golden Rule of E-Evidence: Sector-by-Sector Image (Gates Rubber) Corollary to the Golden Rule Golden Rule of E-Evidence: Work only from the copy

39. Common Spoliation Mistakes 1. Failing to cease document destruction with notice of pending or impending suit [intentional or negligent] 2. No sector-by-sector or bit-by-bit image made ….aka – mirror image of media [Gates Rubber Co. v. Bando Chem. Ind.] 3. Booting a computer 4. Clicking on a file 5. Modifying Web site links and content Preservation / Spoliation

40. Potential Sanctions for Spoliation Keir v. UnumProvident, 2003 WL 21997747 (S.D.N.Y. Aug. 22, 2003). Court found the Defendant’s failure to preserve was unintentional, but criticized the Defendant’s poor compliance with the preservation order, and recommended further action to determine feasibility of retrieving lost data and the extent of prejudice to the Plaintiffs in order for the court to fashion a remedy for the Plaintiffs. Danis v. USN Communications, 2000 WL 1694325 (N.D. Ill. Oct. 23, 2000). CEO was fined $10,000 and negative inference instruction given.

41. Preservation / Spoliation Potential Sanctions for Spoliation Linnen v. A.H. Robins, 1999 WL 462015 (Mass. Super. June 16 1999). Failure to preserve e-mails resulted in “inexcusable conduct” jury instruction. William T. Thompson Co. v. General Nutrition Corp., 593 F.Supp. 1443 (C.D. Cal. 1984). Court ordered default judgment and $450,000 in sanctions for destruction of e-documents.

42. How Serious was the Spoliation? In a patent infringement suit, the plaintiff produced email and other electronic documents after the close of the discovery period. To the extent that it had not already done so, the plaintiff was ordered to produce all emails generated or received by the inventor relating to the patent at issue. The court found that while the plaintiff did not engage in a good faith effort to produce all requested discovery in a timely manner, the cost to the defendant was minimal and therefore refused to issue sanctions. Lakewood Eng’g v. Lasko Prod., 2003 WL 1220254 (N.D.Ill. Mar. 14, 2003). Preservation / Spoliation

43. Court Sanctions Defendant by Transferring Defendant’s Domain Names to Plaintiff In a trademark infringement case, the plaintiff accused the defendant of illegally using the Internet to sell the plaintiff’s brand of cigarettes, which was intended only for sale abroad, to customers in the United States. The plaintiff’s computer forensics expert examined the defendant’s sales data and found inconsistencies in computer programming formulas, individual sales records, and customer email confirmations. After being confronted with the expert’s analysis, the defendant admitted its sales data was unreliable, and likely fraudulent. Finding the defendant’s “supporting testimony and data … so riddled with fabrication and deception as to warrant the inference that the truth is the exact opposite of what [the defendant] contends,” the court ordered the transfer of the defendant’s domain names to the plaintiff. - Philip Morris USA, Inc. v. Otamedia Ltd., 2004 WL 1878751 (S.D.N.Y. Aug. 20, 2004). Preservation / Spoliation

44. Computer Expert Exposes Attempts to Destroy Electronic Data in Copyright Case In a copyright infringement suit, the plaintiffs’ computer expert inspected the defendant’s servers and discovered the defendant ran a program, designed to erase electronically stored information, more than 50 times from a remote location in an attempt to delete all electronic data from the servers. The defendant attempted to attack the plaintiffs’ methodologies for extrapolating the number of users and downloads. The court indicated that the defendant was “in a poor position to attack plaintiffs’ evidence,” noting that “[ d]estruction of evidence raises the presumption that disclosure of the materials would be damaging.” The court decided not to issue sanctions but instead encouraged the plaintiffs to move for appropriate sanctions as the case progressed. - Arista Records, Inc. v. Sakfield Holding Co. S.L., 314 F.Supp.2d 27 (D.D.C. 2004).

45. Zubulake V: Sanctions Defendant Sanctioned for Destruction of Email Evidence An employee moved for sanctions against the employer for failing to produce backup tapes containing relevant emails in a timely manner. Determining that the employer had willfully deleted relevant emails despite contrary court orders, the court granted the motion for sanctions and also ordered the employer to pay costs. The court further noted that defense counsel was partly to blame for the document destruction because it had failed in its duty to locate relevant information, to preserve that information, and to timely produce that information. --Zubulake v. UBS Warburg, 2004 WL 1620866 (S.D.N.Y. July 20, 2004). Preservation / Spoliation

46. Zubulake V: Role of Counsel Counsel Has Duty to Locate, Preserve, & Produce E-Data Addressing the role of counsel, Judge Scheindlin declared that "it is not sufficient to notify all employees of a litigation hold and expect that the party will retain and produce all relevant information. Counsel must take affirmative steps to monitor compliance so that all sources of discoverable information are identified and searched." Preservation / Spoliation

47. Discussion Outline 21 st Century Discovery Preservation / Spoliation Trial & Evidentiary Issues E-Discovery Technology & Costs Tips, Tactics & Technology

48. What to Ask for in Discovery 1.Must seek specific relevant information –Objections re: excessive scope & burden 2.Begin narrowly & expand 3.“Goose & Gander” phenomenon 4.The Sorcerer’s Apprentice Problem (a.k.a. Be careful what you wish for! ) Trial & Evidentiary Issues

49. Chain of Custody Hearsay, Foundation and Other Admissibility Issues

50. Trial & Evidentiary Issues Guard yours / Question theirs Temperatures, smoke, dust, magnetic fields Chain of Custody

51. Was the file altered during imaging process?Was the file altered during imaging process? Was the file altered during the analysis?Was the file altered during the analysis? How sound was the capture process?How sound was the capture process? Was the image forensically sound? Did it need to be?Was the image forensically sound? Did it need to be? How secure is the data during analysis? While it is stored?How secure is the data during analysis? While it is stored? From what media is the analysis being done? From the original? From an image?From what media is the analysis being done? From the original? From an image? Who handled and processed the data? Can you prove the data is still sound?Who handled and processed the data? Can you prove the data is still sound? Chain of Custody Trial & Evidentiary Issues

52. Hearsay, Foundation and Other Admissibility Issues –State of Wash. v. Ben-Neth, 663 P.2d 156 (Wash. Ct. App. 1983). Computer-generated evidence is hearsay but may be admitted as a business record provided a proper foundation is laid. Business Records Exception –Harveston v. State, 798 So.2d 638 (Miss. Ct. App. 2001). Court refused to allow in computer database print-outs under business records exception because no evidence offered as to the means by which the information…was compiled.

53. Discussion Outline 21 st Century Discovery Preservation / Spoliation Trial & Evidentiary Issues E-Discovery Technology & Costs Tips, Tactics & Technology

54. Technology & Costs Technology: Overview of Process Stage 1 Legal and Technical Consulting Stage 2 Data Gathering Data Filtering Data Processing Output Options Secure Web- based Repository Printed Paper Litigation Support Database Stage 4 Stage 3 Stage 5

55. Technology & Costs Filtering Technology File identification Effective keyword searching Elimination of blank pages & duplicative documents Segregation of potentially privileged documents Identification of very large files

56. Technology & Costs

58. Technology: Output Option 2 (Print)

59. Technology: Output Option 3 (Litigation Database ) Litigation Support Database –Introspect Concordance Summation DBTextworks JFS Litigators Notebook ™ UR Law ™ Documatrix Virtual Partner ™ Load Files Technology & Costs

60. Discovery represents 50 percent of litigation costs in the average case and up to 90 percent of litigation costs in cases in which it is actively used. - http://www.uscourts.gov/ttb/oct99ttb/october1999.html http://www.uscourts.gov/ttb/oct99ttb/october1999.html On average, attorneys spend more time on discovery (16.7% of their time on the case) than they spend conferring with clients, working on pleadings, negotiating settlements, or conducting legal research. -http://polisci.wisc.edu/~kritzer/research/CLRP/clrp.htmhttp://polisci.wisc.edu/~kritzer/research/CLRP/clrp.htm Technology & Costs Costs

61. Technology & Costs “Paper discovery costs an average of $.70 a page. Electronic discovery costs an average of $.23 per page” –Daryl Teshima, “7 Deadly Sins of Electronic Discovery” Law Office Computing, June/July 2003. Costs

62. Costs: Containment Tips –Identify and address electronic document issues early –Negotiate scope – seek a protective order early if necessary –Propose culling techniques Data sampling De-duplication Keyword searching –Use technology to increase speed and accuracy of document review Technology & Costs

63. General Rule – Producing Party Pays Inherent Power of Court to Shift Costs The Texas Solution – Tex.R.Civ.P. 196.4 –“Reasonable Availability” vs. “Extraordinary Steps” Costs

64. Technology & Costs Costs: Cost-shifting Producing Party Pays for Production (traditional rule): –Delozier v. First Nat’l Bank of Gatlinburg, 109 F.R.D. 161 (E.D. Tenn. 1986). Requesting Party Pays Requesting Party Pays for Production: –Oppenheimer Fund, Inc. v. Sanders, 437 U.S. 340 (1982). Combination or Cost Splitting: –Rhone-Poulenc Rorer, Inc. v. Home Indemnity Co., 1991 WL 111040 (E.D. Pa. 17, 2001).

65. Technology & Costs Costs: Burden & Proportionality A party producing electronic evidence must be protected against undue burden and expense associated with the production. Southern Diagnostic Assoc. v. Bencosme, 833 So.2d 801 (Fla. Dist. Ct. App., Oct. 2002)

66. Technology & Costs In a trade secret violation suit, the defendant moved for the production of approximately 996 network backup tapes and argued that the plaintiff should bear production costs. Medtronic objected to the defendant’s requests as “unduly burdensome” and “astronomically costly.” The parties did not dispute the relevance of the electronic data at issue. Court applied an 8 factor cost-shifting test to determine burden and cost. Finding that the majority of the factors favored shifting a portion of discovery costs to the defendant, the court outlined a detailed discovery protocol. The court also ordered the plaintiff’s vendor to “search the extracted data using [identified] keywords” and to “produce to [the defendant] a complete list of the files identified by the backup tape restoration keyword search.” Medtronic Sofamor Danek, Inc. v. Michelson, 2003 WL 21468573 (W.D.Tenn. May 13, 2003). Costs: Cost-shifting

67. Technology & Costs Zubulake’s Revised Cost Allocation Test 1.Extent to which the request is specifically tailored 2.Availability of information from other sources 3.Total cost of production compared to amount in controversy 4.Total cost of production compared to resources available to each party 5.Relative ability of each party to control costs and incentive of each party to do so 6.Importance of the issue at stake in the litigation 7.Relative benefits to the parties in obtaining the information Zubulake v. UBS Warburg, 217 F.R.D. 309 (S.D.N.Y. 2003) Costs: Cost-shifting (cont’d)

68. Parting Thoughts 1.Electronic Evidence is Unique 2.Electronic Evidence Requires Education & Expertise 3.Electronic Evidence Provides Opportunity

69. Questions? Christopher Wall Kroll Ontrack cwall@krollontrack.com (703) 668-1357 (800) 846-7430