Adverse Inference Not Warranted By Party’s Re-Installation Of Operating System On Computer Servers Subject to Preservation Order

Creative Sci. Sys., Inc. v. Forex Capital Mkts., LLC, 2006 WL 870973 (N.D. Cal. Apr. 4, 2006) (Unpublished)

In this case involving copyright infringement and related claims, plaintiff moved for sanctions, claiming that defendant had not complied with the court’s Preservation Order. Plaintiff sought monetary sanctions, an adverse inference instruction, and an order barring defendant from presenting a particular defense. Ultimately, the court denied the non-monetary sanctions, ordered the defendant to cover the cost of plaintiff’s expert’s forensic analysis of certain computer servers, and imposed monetary sanctions for defendant’s failure to preserve an employee’s notebook.

The court’s September 10, 2004 Preservation Order provided, in part:

FXCM and Refco shall preserve all relevant documents as defined under Federal Rule of Civil Procedure 34(a), including but not limited to all electronic evidence or evidence stored on computers regardless of the medium on which it is stored. This Order applies to and includes, but is not limited to: (1) all copies of NetZyme�� Enterprise or portions thereof; (2) any configuration file on any load balancing server used by FXCM, including but not limited to the “Big IP” server used by FXCM; and (3) all evidence of distribution of FXCM and/or Refco client software, including but not limited to any FXCM customer database.

For purposes of this Order, “preserve” is to be interpreted broadly to accomplish the goal of maintaining the integrity of all documents, data, and tangible things including all documents as defined above and those that are reasonably anticipated to be subject to discovery under Federal Rules of Civil Procedure 26 or 34 in this action. To preserve includes taking steps to prevent the partial or full destruction, alteration, testing, deletion, shredding, incineration, erasing, wiping, relocation, migration, theft or mutation of such material, as well as negligent or intentional handling that would make material incomplete or inaccessible.

The Preservation Order also required the forensic inspection of defendant’s computer servers:

Defendant FXCM must allow EvidentData, Inc. [a computer forensic firm hired by plaintiff’s counsel] . . . to enter Defendant’s place of business located at Financial Square, 32 Old Slip, 10th Floor, New York, New York 10005 . . . and FXCM must give EvidentData access to all necessary computer servers or network equipment. . . .

EvidentData shall limit its inspection of Defendant’s computer network to copying the configuration file of any load balancing servers and running a utility program that generates a specific digital signature (a “MD5 hash value”) for each file on the FXCM computer servers to generate a file listing along with each file’s corresponding MD5 hash value. EvidentData will retain these results in a computer text file. EvidentData shall be permitted to compare the MD5 hash values for the files on the FXCM servers with the MD5 hash values for file unique to the NetZyme software. If EvidentData identifies files unique to the NetZyme software, EvidentData shall make a forensic image or logical backup of the file, at the discretion of the EvidentData computer forensic examiner on site.

After the Preservation Order was entered, counsel for the parties exchanged emails and ultimately scheduled the inspection for September 20, 2004. FXCM’s general counsel declined plaintiff’s counsel’s request to “acknowledge in writing that all FXCM employees had been advised of the Court’s Order, and that FXCM had taken required steps such as preserving all existing back-up media such that the back-up media would not be re-used or erased.”

On September 20, 2004, EvidentData inspected and imaged 40 of defenfant’s computers, including computer servers, at FXCM’s New York City office and its Main Data Center, located in leased space elsewhere in New York. EvidentData inspected five of these forty computers, and discovered that the operating systems on three of these computers had been reinstalled very recently — reinstallation on two on September 10, 2004, and reinstallation on the third on September 14, 2004.

As further support of its motion for sanctions, plaintiff presented evidence indicating that several high level employees of FXCM received little or no guidance related to the Preservation Order. Brandon Palmer (“Palmer”), FXCM’s Director of Information Technology, testified that the only step he took in response to the Preservation Order was informing the approximately six to eight people who worked for him at the time. Defense counsel did not give Palmer “any significant explanation of the court order beyond what the court order literally said.” A partner at FXCM testified that he was never told of the Preservation Order, and the person who was Chief Financial Officer of FXCM through September 2005 testified that he did not remember having conversations with anyone other than FXCM’s general counsel regarding compliance with the Preservation Order.

In opposition, FXCM argued that while it did reinstall the Linux operating system on a number of servers, it did so as part of a program to test new middleware. FXCM alleged that because plaintiff’s software, “NetZyme,” did not perform as well as had been promised, it asked CSS in April, 2004 to cure its breach of contract. FXCM asserted that CSS “purported to terminate the Software License Agreement” in response to the request to cure. During that same month, FXCM decided to use Fiorano software rather than NetZyme. A document dated August 25, 2004 detailed the steps and tasks required for implementing the new software at FXCM.

Palmer testified that between five and fifteen servers were moved from FXCM’s leased space to its office, and that the Linux operating system was reinstalled on these servers, in the time between Palmer’s notification of the Preservation Order and EvidentData’s investigation. Palmer stated that it was standard practice at FXCM to rotate servers through different functions and to reinstall operating systems on the servers prior to installing new software applications. On September 10, 2004, Palmer and his team reinstalled the operating systems on ten servers, none of which had been running NetZyme previously. Palmer stated that he was not aware of the instant litigation or the Preservation Order at that time, and that he received the Preservation Order on Sunday, September 12, 2004. On September 14, 2004, Palmer was informed that five additional servers were needed for testing, and he and his team reinstalled operating systems on five servers which Palmer stated had not been running NetZyme.

The court concluded that there was insufficient evidence to merit imposing the particular non-monetary sanctions requested. It found that, while it was possible to conclude from the evidence that FXCM’s reinstallation of operating systems on certain servers was done in willful disregard of the Preservation Order, it was not clear that this was the only conclusion that could or should be reached. FXCM provided evidence supporting the alternative explanation that its actions were motivated by the need to test and install new middleware.

However, while the record does not contain convincing evidence that the reinstallations were motivated by bad faith, the court concluded that the failure of FXCM and its counsel to take affirmative steps to comply with the Preservation Order – which would have caused FXCM not to reinstall the operating systems on the servers at issue – was evidence of at least some degree of bad faith. Thus, the court ordered defendant to bear the cost of analyzing those servers that had been copied but not yet analyzed. “This will serve the dual purposes of sanctioning FXCM for its noncompliance with the Preservation Order and producing more precise information about the installation of NetZyme.” The court ordered the parties’ experts, counsel, or other representatives to meet and confer in order to establish a list of servers that will be analyzed. It further ordered FXCM to bear the cost of analyzing the servers, but stated that if the evidence obtained from the analysis showed that FXCM’s non-compliance with the Preservation Order was limited, the court would consider a request by FXCM to reallocate the costs between the parties.

Finally, the court imposed monetary sanctions for defendant’s failure to preserve a notebook which contained an employee’s notes of his daily activities, which might have included detailed notes about FXCM’s middleware servers. The employee brought the notebook to his deposition, but plaintiff’s counsel was prevented from accessing it. Thereafter, the notebook was apparently lost – defense counsel stated he did not have it and that the employee had retained it, but the employee stated he had given it to defense counsel on the date of his deposition. The court concluded: “While it is possible that Alexander did not give the notebook to FXCM or FXCM’s counsel, it is undisputed that FXCM failed to preserve the notebook.” The court awarded $12,175 to compensate plaintiff for FXCM’s failure to preserve the notebook. The court derived this amount by adding $4,075 (one quarter of the costs incurred by plaintiff related to the instant motion for sanctions) and $8,100 (the cost of reviewing the hundreds of FXCM e-mails for evidence of NetZyme installation, which could have been reduced significantly or obviated entirely if the notebook included detailed records of such installation).