It is an oddity of how people react to their own computers that they feel the hard drive within the computer containing the user’s stored confidential and private information is somehow a “private” arena that is not accessible to third parties.
Of course that is simply not true. Most passwords are easily broken and if a computer has any access to the internet, unknown clever hackers can access the majority of computers.
But there is an even blunter instrument that is available in litigation which is becoming a central part of the discovery process. The reader should read our article on American Litigation and on Computer Discovery before proceeding further with this article.
This article shall concentrate on the ability of parties in litigation to gain access to the hard drive on all the computers and personal devices of opposing parties and witnesses. Put simply, in most litigation, at least limited access to the hard drive will be gained and made available to computer experts on the other side for full examination for relevant evidence though what can be revealed to the other parties will be a matter of relevance and law and motion.
The key fact to realize, however, is that your hard drives will be in the hands of strangers to pour over and determine what will be made a matter of public record. And this includes all of your computers, from desk top to lap top, from Blackberries to iPhones.
How to handle that fact is the theme of this article.
Basic Discovery Tools and Computers:
As discussed in our article on American Litigation, the discovery aspect of American litigation is a unique and powerful instrument available to the parties. By formally demanding written answers, oral examination and/or production of documents, and access to relevant evidence, a party can investigate aggressively and proactively the other party’s evidence and documents. Indeed, the first year of any litigation is normally spent in achieving some mix of the above discovery by and for all parties.
Most cases are won or lost in the discovery arena in which each side seeks to gain advantage by obtaining admissions, documents and information from third parties and opposing parties to either make their own case or destroy another party’s case.
Given the pervasive use of every type of computer by both businesses and individuals in most of the world, including hand held, and the constant use of e mail, it was only a matter of time before gaining full access to such information was made a standard part of litigation. More and more cases are being decided by use of access to e mail in which parties make admissions or discuss aspects of the case that they never would have expected to be available to the other side. A party that would never write a letter making destructive admissions can often be found to have written numerous e mails that achieve the same effect.
While communications to legal counsel may be privileged (see our article on Attorney Client Privilege) most other communications are not and are thus susceptible to standard discovery, whether stored on a computer, handheld device, or in the server of the company or third party.
One of this writer’s favorite admissions in a case began with a writer stating in an e mail, “I never would put this in writing, but….” He failed to realize that writing an e mail…is writing!
But there is an aspect of computer discovery that goes far beyond the more traditional discovery of documents.
Information stored on a computer is stored in a device commonly known as the “hard drive” and all information of the user is normally stored on that device. It is as if all your business records were kept in a single file and in a discovery dispute, in order to allow the party to search the critical file for evidence…they had to be given your files of all your matters regardless of relevance. And even documents once stored and deleted are still available for inspection by the experts…as is information as to every website you may have visited and viewed on your computer.
Nor is the solution of having your own expert provide the relevant documents likely to solve the problem since the opponents will not want to rely on your expert but have their own expert review the hard drive to determine what relevant documents exist.
This can lead to a whole series of discovery disputes in which your counsel seeks a protective order and the court or court appointed commissioner becomes involved to determine a procedure for allowing access to the entire hard drive to determine what relevant documents may exist.
The usual result is some expert is given the task of copying your entire hard drive and either reviewing it himself or having some third party review it to determine what relevant documents may exist to be produced for the other side.
And what is on your hard drive? First, not only e mails but every document that was ever on your computer. Every website you have ever visited. Every document you have ever downloaded. Everything you have ever bought. It is as if your private life was suddenly a subject of public examination by experts hired by your adversaries.
And even if you deleted documents or e mails, the odds are good that an experienced expert will be able to recover most if not all of them or, at the least, the fact that you deleted them. Deleting documents can, itself, be evidence that is of key import to a Trier of fact. Just ask Richard Nixon about the thirteen minutes of missing tapes in the White House conversations…which were “accidently” deleted. And spelled his doom.
That is what will be in the hands of your adversaries or the experts selected by your adversaries.
Steps to Expect
1. Opening Shots: At the very commencement of the litigation an aggressive adversary will immediately stop the other party from taking any steps that could alter the data on the computer. The usual step is to send a variation of the letter sent below, which has been redacted.
June x, 200x
See Attached Service List
Via Email and U.S. Mail
Re: XXXXXX Trust
San Francisco Superior Court Case No. XXXXXX
Preservation of Evidence
Dear Lady and Gentlemen:
We respectfully demand that you immediately preserve and retain all evidence relating to this matter, including, but not limited to, all documents, tangible things, and electronic data in the possession, custody, or control of you or your agents.
For purposes of this letter, such “electronic data” includes, but is not limited to, text files (including word processing documents), spread sheets, e-mail files and information concerning e-mail (including logs of e-mail history and usage, header information and “deleted” files), internet history files and preferences, graphical image files (including “.JPG, .GIF, .BMP and TIFF files), data bases, calendar and scheduling information, computer system activity logs, instant message text and all related information and/or data related, and all file fragments and backup files containing the above electronic data. Additionally, the continued operation of any computer systems (including standalone personal computers, network workstations, notebook and/or laptop computers, or desktop computers) in the possession, custody or control of you or your agents will likely result in the destruction of relevant evidence due to the fact that electronic evidence can be easily altered, deleted, overwritten or otherwise modified. We hereby demand that you and your agents refrain from operating (or removing or altering fixed or external drives and media attached thereto) such computer systems (or segregate all storage systems and devices, or create and retain true and compete images of all related storage systems and devices) and suspend all overwriting practices and protocols until further written notice from me.
Please note that the failure to preserve and retain evidence, including electronic data, constitutes spoliation or destruction of evidence and may subject you to sanctions under California law. See Code of Civil Procedure § 2023; Penal Code § 135; Cedars-Sinai Medical Center v. Superior Court, 18 Cal. 4th 1, 12 (1998).
Please contact me if you have any questions or concerns.
Sincerely,
ZZZZZZZZZZ, Esq.
cc Client
Once you receive that letter any actions you take that could alter or endanger data on your hard drive can lead to severe sanctions from the Court. Of course, if you have already altered or deleted files before receiving that letter, that fact will eventually come out in discovery and if an expert can recreate what was deleted…not an impossible task much of the time…your deletion can be disastrous to your case if the document was relevant.
After the above letter is received, you will receive formal notice of demand to obtain access to your hard drive and computer…and that is most likely when the law and motion before the discovery commissioner will ensue…but in most instances at least limited access to the hard drive is likely to be granted.
2. The Inspection: An entire industry of computer experts now exist who assist attorneys in analyzing information on hard drives. They are normally subject to court orders as to restrictions on what they can advise parties (assuming your counsel obtained the correct protective order) but the issue of what data is relevant can be a matter of hot dispute before the court.
You will be required to give access to the expert to copy your hard drive and that will include each and every device you used to either send or receive e mails or store information. That will include computers you may have only used occasionally or even other person’s computers that you used once or twice. They will discover which computers you may have used by written discovery that you will have to answer under oath.
Keep in mind that this may include your home computer, your spouse’s computer, your children’s computers. It will include friend’s computers and family members that you may have visited if you used their computers.
The courts do impose certain restrictions and will normally only grant access to such computers if the likelihood of discovering evidence can be demonstrated. But the tradition of the courts is to broadly grant discovery.
A simple rule is that the less you used a computer and the more ancillary the person is to the case, the more likely the court will prohibit access.
3. The Copying of the Hard Drive: The expert does not normally remain on your premises going through your computer. Normally, they make a copy of each and every hard drive and remove the copy from the premises, to be kept by the expert for the examination either allowed by your counsel or ordered by the court. Usually, upon conclusion of the case, the hard drive is returned. Most parties do worry that additional copies of the hard drive may be created which is why experts rather than opposing parties are normally the ones who retain possession, it being reasoned they are less likely to abuse access to the hard drive.
4. Employment Issues: But the situation is radically different for a computer you use at work which is owned by the company. In those cases, the employer will normally own and have unfettered access to the hard drive since they own it. It is up to the employee to try to restrict access to the employer in court and that may be an uphill fight. While the law is in flux and some courts are beginning to stress the employee’s right to privacy, normally the employer will seize the hard drive immediately, make a copy, and by the time the court is involved, may have viewed its contents in detail.
Courts recognize that employers have a right to protect their own information and that such information is normally found on computers accessed by employees. Most courts will freely allow the company to regain access to the computer and the issue of what information may be used from their examination of their own hard drive is a matter of some dispute in most cases.
5. Trial: The standard rules of evidence will apply to data obtained from the computers. If the information is relevant to the issues at bar, e mails, websites, etc. will not only be admitted into evidence, but will often be reproduced on computers within the court room and shown on the various visual equipment that is routinely used in trial.
Unique Problems with Computers
Perhaps an illustration from a case will exemplify the unique issues facing the holder of such evidence. In one case the home computer of a party was given access to our opposing party since our client often worked at home. It was a business dispute having to do with breach of contract but the question of when notice was given was before the court and e mails that may have given notice were thus relevant.
Our client had once used his teen aged son’s computer. Over the son’s strident protests, his hard drive was viewed by the expert. As one can expect, the websites visited by the boy were not ones he wished his parents to know about, but a real crisis arose since one site could be considered child pornography which is subject to remarkable restrictions. To even possess such pornography
is a crime. See our article on child pornography. Suddenly our client and his family were faced with a catastrophe that had nothing to do with the case.
The law required the expert to report the existence of such evidence to the authorities. He had no choice. Our opponents expressed regret but were secretly delighted that their adversaries were suddenly on the defensive.
The authorities were reasonable and the problem was quickly resolved, but the lesson is clear. Once litigation begins, the access to the hard drive can become a very troubling event.
Trends
Given the increasing use of such tools and, indeed, the rapid growth of social networking that has data stored on servers possessed by third parties, one can expect these issues to become even more central. As one client commented, every cased can become an invasion of privacy.
Recognizing this, the courts are seeking to develop rules to restrict access to data and the commissioners routinely issue protective orders to attempt to limit the inherent harm that can arrive. Certainly counsel in California are held to high standards of ethical conduct as are most experts.
But those same legal counsel are required by duty to seek to obtain access to all such information…and to defend access. As one judge commented, whether a letter in a paper file or an e mail in a hard drive file, if it is evidence, it is evidence, and counsel are obligated to seek it out.
To some extent mutual deterrence can apply. Few want their own hard drives subject to review by opponents and once that battle begins the courts will normally grant equal access to both sides. Knowing this, counsel normally try to negotiate a methodology as to reasonable access and only if those negotiations break down is the court brought in.
But there are parties and counsel who are “scorched earth” in their approach to litigation and will gladly fight for months in the courts to attempt to gain access to hard drives, enjoying the anger, embarrassment and frustration that may ensue if such access is granted in the wrong way.
Courts now expect reasonable restrictions to be agreed upon by the parties and that has become the norm. A party seeking to gain further access for “fishing expeditions” will have to convince the court that the evidence that may exist is worth the invasion of privacy of a party.
Pro Active Steps
Once the case begins, destroying evidence, even before a restrictive order is received, can be both criminal and foolish. To destroy a hard drive requires far more than erasing or buying a program that promises to delete. It usually means physically destroying the unit and recall that all servers….including third party servers…will often have full copies of all that was on the computer.
Once such destruction is discovered, opposing parties will emphasize that “guilty” act before any Trier of fact.
A much more intelligent approach is to restrict what one puts on one’s business computer and use personal computers for strictly personal matters. This would solve the problem-but in reality it is unrealistic. Most people work long hours and must use business computers interchangeably with personal use. With more and more handhelds and telephones becoming mini computers, it is perhaps unrealistic to expect such division of use to last. But if you can…you should.
It is vital to recall that whatever you type will be subject to scrutiny if litigation arises, at least by some expert, and not to make the typical mistake of thinking computer writing is not writing. It is all discoverable evidence. If you have something important to state that is in any way legal in nature, copy your attorney since the attorney client privilege applies to communications to counsel.
A planned program of destruction of business records is good practice for any business since otherwise they can be submerged in ancient records. This program cannot be used merely to destroy evidence, however. It must be regular, organized, and instituted before the case began.
Above all, it is important to realize that your hard drive is a piece of evidence and will be subject o investigation if such evidence is relevant to the issues at bar.
Of course, the same is true for your opponent’s computers.
Conclusion
It is vital to educate employees and family members as to the facts of life of access to hard drive. It is vital to realize that tens of millions of dollars in damages has been obtained by legal counsel obtaining access to e mails foolishly sent by employees. It is vital to understand that the screen sitting on your desk is not a window to your private world. It is merely a device to store information and make it available and it sits there as a remarkable convenience…and a dangerous trap.
One of our clients put a note on his computer that he says is a useful reminder. “If Mom Can’t Stand to See It…Neither Can the Judge.”’
A bit extreme…but not much.