Defending The Digital Workplace

An publication

Failing to Preserve the “Digital Crime Scene” In Employment Litigation Results in Dismissal

Spoliation in litigation generally refers to the destruction or significant alteration of evidence, or the failure to preserve crucial items as evidence in pending or reasonably foreseeable litigation. Spoliation has become an increasingly hot issue in the context of digital information, such as e-mails and hard drives. The Michigan Court of Appeals recently reaffirmed that spoliation can result in severe sanctions by affirming a trial court’s decision to dismiss a plaintiff’s sexual harassment lawsuit with prejudice. Gillett v. Michigan Farm Bureau, Mich. Ct. App., No. 286076, (Dec. 22, 2009). The dismissal was a sanction for  the plaintiff’s deletion of digital evidence.

In Gillett, the plaintiff’s lawsuit arose out of alleged sexual harassment by defendants in his workplace. Plaintiff resigned, then retained an attorney to pursue possible causes of action against defendants. The plaintiff’s attorney wrote a demand letter to defendants. Defendants’ attorney responded with a notification that plaintiff should preserve his personal e-mails. Plaintiff’s counsel represented that plaintiff would submit his personal e-mails and his personal laptop computer hard drive for defendants’ inspection.

But in plaintiff’s deposition, plaintiff acknowledged that he had deleted e-mails from his personal account after receiving the notification from defendants. In addition, a forensic analysis of plaintiff’s computer indicated that he had deleted massive numbers of files from the hard drive shortly before plaintiff submitted his computer for defendants’ inspection. The forensic analyst determined that the deleted files were not recoverable, and opined that the deletions were intended to interfere with the discovery process. The analyst also noted that although plaintiff claimed the deletions were due to uninstalling of problematic software, that software was still installed on plaintiff’s computer.

On appeal, the plaintiff contended that the trial court abused its discretion by imposing the “drastic sanction of dismissal” and failed to determine whether the deleted electronic evidence was relevant. Specifically, plaintiff acknowledged that he deleted e-mails, but maintained that the deletion was a result of his routine procedures rather than a deliberate attempt to destroy evidence. The trial court rejected plaintiff’s contention, finding the number of data files deleted to be “[e]xtremely significant.” The court observed that plaintiff deleted on average 2,000 files each month through September 2007, but that in October 2007 the deletions increased to more than 200,000 files, with an additional 28,000 files deleted in the first six days of November.

The Court of Appeals rejected the plaintiff’s arguments and in doing so relied heavily on Leon v. IDX Systems Corp., 464 F3d 951 (CA 9, 2006), a case in which the federal district court explored the many sanctions short of dismissal before concluding that dismissal was the appropriate sanction. Similar to Gillett, Leon involved there was no manner in which to verify the recovery of all the deleted information and no way to know the content of the deleted information. The Court further observed that plaintiff’s “spoliation threatened to distort the resolution of the case … because any number of the … files could have been relevant to [defendants’] claims or defenses, although it is impossible to identify which files and how they might have been used .” Id. at 960. The Court noted that plaintiff “did not have the authority to make unilateral decision about what evidence was relevant in this case.” Leon, supra at 956-957.

The Take-away:

This case illustrates a number of key points that business organizations and their attorneys must consider when it comes to litigation and preserving digital information.

First, even when an action has not been commenced and there is only a potential for litigation, a duty to preserve evidence may arise where the prospective litigant knows or reasonably should know information is relevant to the prospective action.’” Bloemendaal v Town & Country Sports Ctr, Inc, 255 Mich App 207 (2002). The problem for business organizations, however, is nailing down when that duty arises and what steps must be taken. This is especially true when the appropriate decision-makers have – at best – a vague awareness of a potential dispute of unknown parameters. Implementing preservation efforts under such conditions can be very expensive and burdensome. And that expense and burden may prove to be unnecessary if litigation is never filed. But, if you guess wrong, the organization may be open itself up to sanctions like the one in Gillett. For a ridiculous example see Phillip M. Adams & Associates, L.L.C., v. Dell, Inc., 2009 WL 910801 (D.Utah March 30, 2009) (Magistrate held that a defendant should have imposed a hold eight years before the suit was filed); See also KCH Services, Inc. v. Vanaire, Inc. 2009 WL 2216601 (W.D.Ky. July 22, 2009) (Sanctions awarded against the defendant for pre-suit spoliation). It can be a razor’s edge  between the routine and efficient disposal of information that no longer has a business purpose and the destruction of potential evidence.

Second, once the duty to preserve arises, counsel – including in-house counsel – must carefully determine and understand what sources of discoverable information are in the custody or control of the client. It is not uncommon for courts to impose sanctions on both for failing to do so. See Phoenix Four, Inc. v. Strategic Resources Corp., 2006 WL 1409413 (S.D.N.Y. May 23, 2006)  (Court sanctioned a law firm and client for failing to identify and preserve “all” information which a “methodical survey of [the client’s] sources of information” should have produced – A partitioned hard drive contained 200-300 boxes worth of evidence, and was not discovered until the discovery deadline); Swofford v. Eslinger, Case. No.6:08-cv-Orl-35DAB (FL.M.D. Sept. 28, 2009) (Court imposed sanctions against in-house counsel for failure to preserve evidence, including email and laptops); Green v. McClendon, 2009 WL 2496275 (S.D.N.Y. Aug. 13, 2009) (Magistrate entered sanctions against a defendant and her attorney for or their mutual failure to implement a proper litigation hold and preserve digital information and for the attorneys handling of digital information). In this regard, it is essential to communicate with the key stakeholders, which include the business organization’s IT professionals as well as the actual authors and recipients of any digital information relating to that litigation to ascertain the full scope of the organization’s digital universe. From that universe decisions can then be made as to what needs to be carved out for preservation.

Third, parties must realize when it comes to deleting/destroying digital information the cover up, i.e. the “deletion,” almost always becomes worse than the crime. The Gillett Court highlighted this point by noting that “any number of the … files could have been relevant to [defendants’] claims or defenses, although it is impossible to identify which files and how they might have been used.” Speaking from experience, letting a judge or jury’s imagination run wild as to why a litigant destroyed digital evidence and what that evidence may or may not have shown is a big bat to swing in trying to resolve litigation.

Additionally, failing to preserve digital information may also result in the loss of favorable information. A common such scenario arises in employment litigation where an employer  seeks to assert an “after-acquired evidence defense.” Such a defense generally arises when during the course of the litigation the employer learns of something that, had it known of the information earlier, would have justified terminating the employee for legitimate, non-discriminatory reasons. See Olson v International Business Machines (D.Minn. 2006) (Addressing after-acquired evidence in employment litigation: IBM learned about allegedly pornographic materials on plaintiff’s laptop after he was terminated and only learned during discovery that plaintiff actually cleaned out the hard drive).

Fourth, deleting unfavorable digital information is more often than not almost always detectable. Michael Ahern of the Center for Computer Forensics explains that, “[i]t is relatively easy for forensic experts to see the volume of deleted files and recover those files. If the volume of deleted data is unusually low, the forensic expert can look for evidence of a wiping utility or program that indicates the intentional destruction of digital information.” As technology advances, detecting wrongful deletion of evidence becomes more challenging. Mr. Ahern further explained that with older wiping programs, it was easy to detect their use. But newer wiping utilities are designed to hide their process so that there is no digital fingerprint of its existence when it is deleted. There are,  however, common “tell-tale” signs that forensic specialist will use to identify suspicious or outright wrongful deletion in addition to technical mistakes of even savvy would-be digital saboteurs. Mr. Ahern notes, “I always say, we rely on people’s computer ignorance to find some level of evidence, especially if they are in a hurry.”


Gillett reinforces the conclusion that Courts expect litigants and their attorneys to properly preserve digital information pertaining to litigation. And failure to do so will often result in range of sanctions from adverse jury instructions to dismissal of an entire case. Accordingly, it is critical for litigants and their attorneys to properly address the preservation and handling of digital information that may be relevant to litigation. For more information about what steps your business organization can take to minimize the risks of  sanctions for destroying digital evidence, please contact Jason Shinn.

A special thanks to Michael Ahern of the Center for Computer Forensics for sharing his experience and technical insight into computer forensics.

Michael Ahern of the Center for Computer Forensics explains that, “[i]t is relatively easy for forensic experts to see the volume of deleted files and recover those files. If the volume of deleted data is unusually low, the forensic expert can look for evidence of a wiping utility or program that indicates the intentional destruction of digital information.”
%d bloggers like this: