Can use of computer wiping software be innocuous once litigation commences, or is such use sufficient evidence of wrongdoing to establish spoliation sanctions? The court considered this question in HCC Insurance Holdings, Inc. v. Valda Flowers, No 1:15-cv-3262-WSD (N.D. Georgia, January 30, 2017).
Plaintiff sued Defendant for alleged misappropriation of trade secrets. During the course of litigation, Plaintiff filed a discovery motion, alleging three specific instances it claimed gave rise to spoliation sanctions against Defendant:
- Emails. Defendant moved over 8,683 emails to an H drive on Plaintiff’s network, then deleted 1,384 emails. Plaintiff found that activity suspicious, as Defendant had never moved emails to the H drive before and her email box was not near capacity.
- Hot Sheets. Defendant also copied 500 “Hot Sheets” from Plaintiff as electronic data to the H network, then the C driver of her work computer. She then deleted them from her work computer. Plaintiff thought this activity was suspicious because she did not regularly update the Hot Sheets, although Defendant countered that she did that because she as instructed to do so on that day. Also, the Hot Sheets were found in her computer’s recycle file and were restored.
- Returning the computer. Plaintiff alleged that on the day Defendant resigned, she had her work computer. They called three times to get the computer back, and she returned it at 4:15pm. Plaintiffs were suspicious because she had logged in to her the network the night before and during the day of her resignation. Defendant claimed she did that to finish an expense report for reimbursement of $1,272.
Defendant’s husband is an IT professional, and Plaintiff asked the court for a forensic review of Defendant’s personal laptop and a thumb drive. The forensic expert noted that the computer had been cleared with wiping software CCleaner, but her husband testified it was to clean out issues with the laptop, since it was an older computer (2008) and frequently crashed. A program called Defragger had also been run on the laptop prior to being turned over to Plaintiff’s expert, but Defendant’s husband contended that was done in June 2015 for maintenance purposes, which was over two months before the litigation arose. Finally, WinUnDelete, which is used to recover deleted files, had been used on the laptop the day before Defendant was to turn over the personal computer. Plaintiff alleged this was done to ensure no files remained. However, the husband testified he used it from his work thumb drive to familiarize himself with it for his own employment.
Although Plaintiff alleged all this activity on the personal computer evidenced spoliation, the court noted that simply using such software, while troubling, did not alone give rise to spoliation sanctions. The activities were suspicious, but Plaintiff only offered a bare speculation that any trade secrets or electronic data were on the personal computer in the first place. Plaintiff’s forensic expert did not find any evidence or data that shows anything was transferred to her personal computer. Further, Defendant’s husband’s testimony was consistent with the computer forensics expert’s findings. The court held Plaintiff had not fulfilled the burden of proving sanctions were warranted.