Court Defers Ruling on Spoliation Sanctions Until After Voluntary Forensic Examination of Defendants’ Computers Is Complete

Anadarko Petroleum Corp. v. Davis, Slip Copy, 2006 WL 3837518 (S.D. Tex. Dec. 28, 2006)

The facts underlying the lawsuit are as follows. In June 2006, Davis, a long-time employee of plaintiff Anadarko Petroleum Corporation, resigned to join GeoSouthern Energy Corporation. It was undisputed that just before leaving Anadarko in July 2006, Davis downloaded confidential or proprietary information from Anadarko’s computers. When he joined GeoSouthern, Davis transferred that information to GeoSouthern’s computers. Anadarko sued Davis and GeoSouthern in September 2006. Davis admitted that he misappropriated confidential or proprietary information, but denied any significant use of it and denied any use of it to Anadarko’s detriment.

On the same day the complaint was filed, counsel for Anadarko sent a three-page letter to GeoSouthern’s owner/president and vice-president, reminding them of their duties to preserve relevant documents and electronic information. The letter set out detailed instructions on the preservation of electronic files, and stated:

Each of you has an obligation to preserve all digital or analog electronic files in electronic format, regardless of whether hard copies of the information exist. This includes preserving:

1. active data (i.e., data immediately and easily accessible on your systems today); 
2. archived data (i.e., data residing on backup tapes or other storage media); and 
3. deleted data (i.e., data that has been deleted from a computer hard drive but is recoverable through computer forensic techniques).

Within days, and at his attorney’s direction, Davis began a process of removing the information he had taken from Anadarko and downloaded to his own laptop, his GeoSouthern desktop, and the GeoSouthern server, and providing a record of that information to Anadarko. On advice of counsel, Davis deleted the Anadarko files from his laptop, his GeoSouthern desktop, and the GeoSouthern server. At the same time, he copied the information he had taken back onto his thumb drive to return to Anadarko. Davis also created a list of documents he had taken from Anadarko. Davis’s counsel produced this list to Anadarko along with the thumb drive containing the Anadarko information.

Shortly thereafter, the parties entered into an Agreed Order that was entered by the court. The Agreed Order required Davis and GeoSouthern to: return all confidential or proprietary information; account “fully and completely” for any such information; refrain from using any such information; and provide access to their business and personal computers and related equipment and systems to allow plaintiff to inspect and verify that no information belonging to plaintiff is or was present.

In this decision, the court rejected Anadarko’s request for the imposition of additional restraints on both Davis and GeoSouthern, since it had failed to meet its burden of proof for such injunctive relief. The court also addressed Anadarko’s request for spoliation sanctions. Anadarko argued that sanctions were appropriate because Davis and GeoSouthern deleted ESI that they were obligated to preserve. Further, Anadarko’s forensic computer analyst testified that Davis returned only 1.14 gigabytes but that he had downloaded 7.21 gigabytes. Davis explained that he had eliminated duplications which accounted for the difference.

The court distinguished the case from the typical spoliation scenario:

This is an unusual set of facts for a spoliation claim. In most cases in which a party asserts that the alteration or deletion of electronically stored information amounts to spoliation, the party wanted that information to remain available in the form that it was maintained by the other party. In this case, by contrast, Anadarko specifically asked Davis and GeoSouthern to return all the electronically stored confidential and proprietary information Davis had taken from Anadarko and to prevent anyone at GeoSouthern from accessing or using that information. That request makes it necessary for GeoSouthern to make the Anadarko information Davis had placed on the GeoSouthern computer system inaccessible, which requires that such information be deleted. The second aspect that distinguishes this case from the typical spoliation case is that at the same time Davis deleted the information from the GeoSouthern computers and his own laptop, he testified that he placed the information on a thumb drive and delivered it to Anadarko. In most spoliation cases, when information is deleted, no other record of its existence is created, much less promptly produced to the other side. The third aspect that distinguishes this case is that Davis and GeoSouthern have agreed to allow Anadarko to conduct a forensic audit of their computer systems to ensure that no proprietary or confidential Anadarko information remains accessible and to ensure that Davis returned all that he took.

The court observed that the defendants could have avoided the issue if they had approached Anadarko’s request to have its protected information returned and kept from dissemination in a different fashion. It stated that they could have conferred with Anadarko and, if necessary, involved the court, to design and implement steps to sequester the Anadarko information without deleting it from their computers. It noted that defendant’s decision to act unilaterally created the issue, and that Anadarko’s assertion of harm was supported, at least superficially, by the discrepancy in the volume of electronically stored information Davis took compared to what he returned. However, the court found that the record did not support a finding of bad faith on the part of defendants.

The court further observed that the defendants had since agreed to a court-ordered forensic audit of their computers which was in progress. It therefore ordered the parties to supplement their briefs on the motion for sanctions after the completion of the forensic analysis.