Informative Articles About Digital Forensics Litigation Support
Analog Devices, Inc. v. Michalski, 2006 NCBC 14
STATE OF NORTH CAROLINA COUNTY OF GUILFORD ANALOG DEVICES, INC., Plaintiff, v. CHRISTOPHER MICHALSKI, KIRAN KARNIK AND MAXIM INTEGRATED PRODUCTS, INC., Defendants. IN THE GENERAL COURT OF JUSTICE SUPERIOR COURT DIVISION 01 CVS 10614 ORDER AND OPINION {1} This matter is before the Court on Defendants’ Motion to Compel. Defendants have requested that Plaintiff produce e-mails from each of the originators of twenty-one trade secrets at issue for a two-year period surrounding the release dates of products implementing those trade secrets. Much of the information requested is contained in inaccessible form. {2} The opinion in this case and the opinion in Bank of America Corp. v. SR International, Inc., 2006 NCBC 15 (N.C. Super. Ct. Nov. 1, 2006), filed contemporaneously, discuss for the first time the extent to which inaccessible electronic data is discoverable and who should pay for its production under the North Carolina Rules of Civil Procedure. This case addresses the issues in the context of a party-to-party request for production of documents, and the Bank of America decision addresses those issues in the context of a subpoena to a nonparty. In some instances the considerations are the same, and in others they differ dramatically. In both contexts, trial judges should be guided by the language of the applicable Rules of Civil Procedure, supplemented by the Guidelines adopted by the Conference of Chief Justices. In this instance the Court has decided…
Read MoreZubulake v. UBS Warburg, ZUBULAKE 5
Commenting on the importance of speaking clearly and listening closely, Phillip Roth memorably quipped, “The English language is a form of communication! . . . Words aren’t only bombs and bullets — no, they’re little gifts, containing meanings!”1 What is true in love is equally true at law: Lawyers and their clients need to communicate clearly and effectively with one another to ensure that litigation proceeds efficiently. When communication between counsel and client breaks down, conversation becomes “just crossfire,” and there are usually casualties. I. INTRODUCTION This is the fifth written opinion in this case, a relatively routine employment discrimination dispute in which discovery has now lasted over two years. Laura Zubulake is once again moving to sanction UBS for its failure to produce relevant information and for its tardy production of such material. In order to decide whether sanctions are warranted, the following question must be answered: Did UBS fail to preserve and timely produce relevant information and, if so, did it act negligently, recklessly, or willfully? This decision addresses counsel’s obligation to ensure that relevant information is preserved by giving clear instructions to the client to preserve such information and, perhaps more importantly, a client’s obligation to heed those instructions. Early on in this litigation, UBS’s counsel both in-house and outside instructed UBS personnel to retain relevant electronic information. Notwithstanding these instructions, certain UBS employees deleted relevant emails. Other employees never…
Read MoreZubulake v. UBS Warburg, ZUBULAKE 4
“Documents create a paper reality we call proof.” The absence of such documentary proof may stymie the search for the truth. If documents are lost or destroyed when they should have been preserved because a litigation was threatened or pending, a party may be prejudiced. The questions presented here are how to determine an appropriate penalty for the party that caused the loss and the flip side — how to determine an appropriate remedy for the party injured by the loss. Finding a suitable sanction for the destruction of evidence in civil cases has never been easy. Electronic evidence only complicates matters. As documents are increasingly maintained electronically, it has become easier to delete or tamper with evidence (both intentionally and inadvertently) and more difficult for litigants to craft policies that ensure all relevant documents are preserved.2 This opinion addresses both the scope of a litigant’s duty to preserve electronic documents and the consequences of a failure to preserve documents that fall within the scope of that duty. I. BACKGROUND This is the fourth opinion resolving discovery disputes in this case. Familiarity with the prior opinions is presumed, and only background information relevant to the instant dispute is described here. In brief, Laura Zubulake, an equities trader who earned approximately $650,000 a year with UBS,4 is suing UBS for gender discrimination, failure to promote and retaliation under federal, state, and city law.…
Read MoreZubulake v. UBS Warburg, ZUBULAKE 3
On May 13, 2003, I ordered defendants UBS Warburg LLC, UBS Warburg, and UBS AG (collectively “UBS”) to restore and produce certain e-mails from a small group of backup tapes. Having reviewed the results of this sample restoration, Laura Zubulake now moves for an order compelling UBS to produce all remaining backup e-mails at its expense. UBS argues that based on the sampling, the costs should be shifted to Zubulake. For the reasons fully explained below, Zubulake must share in the costs of restoration, although UBS must bear the bulk of that expense. In addition, UBS must pay for any costs incurred in reviewing the restored documents for privilege. I. BACKGROUND The background of this lawsuit and the instant discovery dispute are recounted in two prior opinions, familiarity with which is presumed.1 In brief, Zubulake, an equities trader who earned approximately $650,000 a year with UBS,2 is now suing UBS for gender discrimination, failure to promote, and retaliation under federal, state, and city law. To support her claim, Zubulake seeks evidence stored on UBS’s backup tapes that is only accessible through costly and time-consuming data retrieval. In particular, Zubulake seeks e-mails relating to her that were sent to or from five UBS employees: Matthew Chapin (Zubulake’s immediate supervisor and the alleged primary discriminator), Jeremy Hardisty (Chapin’s supervisor and the individual to whom Zubulake originally complained about Chapin), Rose Tong (a human…
Read MoreZubulake v. UBS Warburg, ZUBULAKE I,
The world was a far different place in 1849, when Henry David Thoreau opined (in an admittedly broader context) that “[t]he process of discovery is very simple.”1 That hopeful maxim has given way to rapid technological advances, requiring new solutions to old problems. The issue presented here is one such problem, recast in light of current technology: To what extent is inaccessible electronic data discoverable, and who should pay for its production? I. INTRODUCTION The Supreme Court recently reiterated that our “simplified notice pleading standard relies on liberal discovery rules and summary judgment motions to define disputed facts and issues and to dispose of unmeritorious claims.” Thus, it is now beyond dispute that “[b]road discovery is a cornerstone of the litigation process contemplated by the Federal Rules of Civil Procedure.” The Rules contemplate a minimal burden to bringing a claim; that claim is then fleshed out through vigorous and expansive discovery. In one context, however, the reliance on broad discovery has hit a roadblock. As individuals and corporations increasingly do business electronically5 — using computers to create and store documents, make deals, and exchange e-mails the universe of discoverable material has expanded exponentially.6 The more information there is to discover, the more expensive it is to discover all the relevant information until, in the end, “discovery is not just about uncovering the truth, but also about how much of the truth the parties…
Read MoreFederal Trade Commision – Staff Workshop Report: Technologies for Protecting Personal Information, 2003
Benchmarks and Standards Panelists discussed the extent to which benchmarks and standards can help provide guidance to industry on the effective management of privacy issues. In particular, such standards have been valuable in providing guidance on how to develop effective security programs. Several industry groups outlined policy initiatives or programs to promote better information security. For example, the Visa Card holder Information Security Program (CISP) requires Internet merchants and processors that are authorized to handle Visa payments to meet 12 different security criteria. The criteria include the installation and maintenance of firewalls, security patching, and encryption. Visa audits companies to ensure compliance and has fined one major processor $500,000 for non-compliance. One of the criteria for the CISP is based on the benchmarks produced by the Center for Internet Security (CIS), which produces security benchmarks for a variety of technologies, including operating systems, routers, and databases. The benchmarks, which are freely available at the CIS Web site, provide technically detailed guidance on how to configure technologies for increased security. Standardized professional training programs in information protection also are gaining acceptance. The Certified Information System Security Professional (CISSP) and the Global Information Assurance Certification (GIAC) from the SANS Institute are two examples of formalized training programs for aspiring information protection professionals. Internet service providers also are coordinating their responses to network security threats, such as worms and denial-of-service attacks. Additional security guidance may come…
Read MoreKnow What to Ask – Ensuring a Successful E-Discovery Request
Electronic discovery may be at the crux of a case in proving the culpability of the opposing party but when the requesting party is not careful in their request for electronic evidence, they could face the possibility of losing key information that would have otherwise provided a favorable resolution to their case. When requesting electronic discovery, there are certain essential issues to consider. Under the Federal Rules of Civil Procedure, Rule 26(b)(2) states the courts have the power to limit discovery if the court finds that (i) the discovery sought is unreasonably cumulative or duplicative, or is obtainable from some other source that is more convenient, less burdensome, or less expensive; (ii) the party seeking discovery has had ample opportunity by discovery in the action to obtain the information sought; or (iii) the burden or expense of the proposed discovery outweighs its likely benefit, taking into account the needs of the case, the amount in controversy, the parties’ resources, the importance of the issues at stake in the litigation, and the importance of the proposed discovery in resolving the issues. Consider the following case laws whereby a party’s request for discovery has been denied due to one of the limiting factors above: Farmers Insurance Company v. Peterson, 2003 OK 99; 81 P. 3d 659 (Nov. 25, 2003) Oklahoma Supreme Court overturns a district court’s discovery order that compels an insurer to search three…
Read MoreComputer Evidence Recovery Plan
Preface and Methodology A court order may authorize the seizure of a computer so that evidence may be extracted from the computer’s hard drive. This paper outlines five phases required to recover computer evidence data. By following the outlined procedure one would minimize the chance that the extracted evidence could be compromised. To insure the integrity of the computer evidence it is proposed that all data files should be copied onto write once only CD-Read Only Memory (ROM) disks. The alternative approach is to “clone” the computer hard drive. While the cloning approach at first sounds logical, there are some problems involved with this method. All hard drives by their very definition are read and write media. This means that once information is cloned onto a hard drive it can be altered. It would be nearly impossible to change or alter data on a write once only CD-ROM. Secondly, when you copy a hard drive, you would be copying everything, including all the operating software. This can occupy a fair amount of memory. In reality, the evidence is usually found on data files. Data files typically account for a much smaller portion of the hard drive’s space and so would be easier to deal with. In the event that time or circumstances does not permit the sorting out of operating software and data files from the computer, the hard drive may be cloned.…
Read MoreE-Discovery Opens a New World in Drug Litigation
As most large pharmaceutical companies face dozens of lawsuits at any given time, the rapid growth of electronic documents and e-mail has opened up the new legal frontier of electronic document discovery (EDD). Recent cases have made plain that plaintiffs’ attorneys will attempt any legal maneuver to gain access to drug companies’ internal electronic documents during the discovery part of litigation — and that many judges are granting access. “The e-discovery landscape is changing rapidly, and pharmaceutical companies face exploding costs attempting to manage oceans of electronic data,” says Robert Owen, a partner with the law firm Fulbright & Jaworski, headquartered in Houston, who launched his firm’s e-discovery group in 2003. “Many firms are struggling with this transition from paper to electronics.” At stake is the vast trove of data related to drug safety and communications between management, marketing and research. Generally speaking, EDD entails gathering and organizing electronic documents on databases that can be easily searched and accessed. Legal teams can enter search words, such as “cardiovascular risk,” to identify all relevant documents. But EDD programs aren’t simply means to satisfy judges and regulators. Drug firms that do not maintain electronic document retention programs and store relevant electronic communications run the risk that key documents may be unavailable for their defense in litigation. “Pharmaceutical companies need to put their e-discovery houses in order,” Owen says. “Litigation is a huge risk factor for…
Read MoreWhat is Forensic Hard Drive Imaging?
What is Forensic Hard Drive Imaging? When a computer is identified as possibly containing electronic evidence, it is imperative to follow a strict set of procedures to ensure a proper (i.e. admissible) extraction of any evidence that may exist on the subject computer. The first thing to remember is the “golden rule of electronic evidence” – never, in any way, modify the original media if at all possible. Thus, before any data analysis occurs, it usually makes sense to create an exact, bit stream copy of the original storage media that exists on the subject computer. This may include a single or multiple hard drives, floppy disk(s), CD(s), Zip drive(s) or DVD(s), plus many other types of storage media that now exist. Imaging the subject media by making a bit-for-bit copy of all sectors on the media is a well-established process that is commonly performed on the hard drive level, hence often referred to as hard drive imaging. The creation of a true forensic hard drive image is a highly detailed process. If you do not have it performed by a trained professional, you may severely compromise your chances of obtaining admissible evidence as a result of your discovery efforts. Also, to avoid accusations of evidence tampering or spoliation, it is a recommended best practice that imaging be performed by an objective third party. Suggested protocols for hard drive imaging can be found…
Read MoreContact us
(Free initial consultation – no spam)
Contact form (1)
"*" indicates required fields