The Lawsuit, the Subpoena and Dropbox

This post examines two opinions a federal  judge issued in a civil suit that resulted when Integral Development Corporation sued Viral Tolat, “alleging that he has violated his employment contract, breached his fiduciary duties, and misappropriated its trade secrets.”  Integral Development Corp. v. Tolat, (U.S. District Court for the Northern District of California 2013) (“IDC v. Tolat #1”). 

(You can, if you are interested, find some background on the previous relationship between the two in this article.)

The issue in both opinions was the scope of “discovery.”  As Wikipedia notes, in U.S. law discovery is “the pre-trial phase in a lawsuit in which each party, through the law of civil procedure, can obtain evidence from the opposing party by means of discovery devices including requests for answers to interrogatories, requests for production of documents, requests for admissions and depositions.”  Since this is a federal suit, the process of discovery is governed by the Federal Rules of Civil Procedure.  Wikipedia outlines the applicable rules and the roles they play in the process.

The opinions actually address two discovery issues, but since one of them -- that Tolat “improperly failed to respond to questions during his deposition” – does not directly involve electronic evidence, this post only focuses on the second issue.  IDC v. Tolat #1, supra.  This is how the opinion describes that issue, which does involve electronic evidence:

Integral asserts that Tolat returned his office Blackberry without the memory card, and . . . that he synchronized it with his home computer. Integral also has information that he took his email folders with him and uploaded company files into a personal Dropbox account.

Integral wants Tolat to (1) produce the hard drive for forensic analysis (to be returned as soon as is reasonably possible), (2) return the Blackberry memory card, (3) produce for analysis any media with information belonging to Integral, (4) return confidential information uploaded to Dropbox, and (5) return any source code he took from Integral.

IDC v. Tolat #1, supra.  As to the first issue, the judge ordered Tolat “to return within 7 days any memory card he has” and, if he “does not have the card, he should provide a declaration saying he does not have it.” IDC v. Tolat #1, supra.  The judge said that if “he had one and lost it, he should explain that in the declaration.” IDC v. Tolat #1, supra. 

This is the judge’s ruling on the second, omnibus electronic evidence issue:

As to the computer hard drive, computer media, source code, and Dropbox, the court orders the following. Tolat is to return all confidential information to Integral, including any source code that he took. He may not possess it on any media, including his computer or any storage devices or Dropbox. . . .

[H]e offered to have an independent expert confirm that he deleted information from his home computer and Dropbox. At the hearing, he offered to have Integral review his Dropbox, and counsel will meet and confer on a procedure. If they cannot agree, they will use the independent expert Tolat agreed to for the hard drive.

As to the hard drive, the parties will agree to a mutually-agreed to expert to review [it], return any personal information to him on a new storage device (without disclosing to Integral what it is), and perform a forensic analysis to see if any information was transferred from that computer (and when) to other storage devices.

IDC v. Tolat #1, supra.  (She noted that Tolat says he did not take source code, and if “that is the case, then there is no issue” here.  IDC v. Tolat #1, supra.)

That order was entered on April 22, 2013.  On May 30, 2013, the judge entered the second order, which basically dealt with a new development concerning one of the discovery issues noted above.  Integral Development Corp. v. Tolat, 2013 WL 2389691 (U.S. District Court for the Northern District of California 2013) (“IDC v. Tolat #2, supra.”)

The issue now is Integral's April 9, 2013 Rule 45 Subpoena to Dropbox for broad information beyond that . . . ordered by the court. . . . For example, it asks for all documents uploaded to, downloaded from, or accessed and viewed from Tolat's Dropbox from January 19, 2012 to the present, even though the court devised procedures to segregate out personal information. . . .

IDC v. Tolat #2, supra.

The judge began this opinion by noting that the

court's last discovery order was about forensic analysis of computer hardware to show what Tolat did or did not do with Integral's private information, and it also was about confirming that Tolat did not retain any sensitive information (while still protecting his private information and any information attributable to his new employer). 

The second point is all that is addressed in the court's order about the Dropbox account.

IDC v. Tolat #2, supra.

She then explained that the subpoena at issue in this matter

is broader, and its relevance apparently is about showing what Tolat did and did not do with Integral information. The content it sought is broader than what is relevant (in that its `all documents’ approach is not limited to Integral information). It also violates the court's approach to protecting private information. Integral also should have fronted the issue.

Dropbox apparently is resisting providing content under the Electronic Communications Privacy Act, 18 U.S.Code § 2703, although it will produce non-content information such as subscriber information.  See Joint Letter Brief, ECF No. 80 at 6, and Ex. 7, ECF No. 8–7 at 5–6 (for subscriber viral.tolat@gmail.com). Integral's view is that this non-content information is all that is at issue now, and it reserves its option of moving to compel the content information from Dropbox. . . .

IDC v. Tolat #2, supra.

At the hearing the judge held on these issues, she “asked defense counsel [i.e., Tolat’s attorney] whether he objected to the production of the noncontent information such as subscriber information, and he said that he did not object.”  IDC v. Tolat #2, supra. The judge also noted that she discussed with

the parties what Integral apparently wants to do, which is reconstruct a forensic evaluation of what Tolat did with Integral's private information and his Dropbox account.

Possible things that could be revealed are what he uploaded (which is information that duplicates and confirms what Integral can see from its analysis of its own servers), what he downloaded to his personal computer (which is information that may be confirmed through the forensic analysis of the computer hard drive contemplated in the court's last order), and what was transferred to other computers (such as possibly a computer or storage media device affiliated with his new company).

Intermingled with all of this are the privacy concerns (both Tolat's and his new employer's) that the court tried to address in its previous order. There also is a burden articulated by Dropbox, the overbroad content of what Integral seeks, and the interplay with Tolat's own discovery obligations to provide documents relevant to any party's claim or defense.  Federal Rules of Civil Procedure 26(b)(1). That obligation does not change just because the information is with Dropbox.

IDC v. Tolat #2, supra.

Yet another issue was that Tolat

has agreed to give the independent expert full access to his Dropbox account to accomplish the forensic investigation consistent with maintaining the privacy interests. Integral countered that not all information will be accessible from end user access and instead, the subpoenaed information is necessary for the forensic analysis it wants to do.

IDC v. Tolat #2, supra.

The judge found that the solution to all this is

that the content information will be produced not to Integral but to Tolat and the independent expert. This addresses Dropbox's concerns about disclosing content because it is disclosure to Tolat (through his attorney). It addresses Integral's `don't trust him’ issues because Tolat's attorney will disclose it to the independent expert. It addresses privacy issues by the use of the independent expert.

If there are additional burden issues on Dropbox, they should be narrowed by the parties by having their technical people discuss with Dropbox what can be ascertained by the independent expert's end user access and what needs to be provided by Dropbox. Also, Integral can tell when the uploads happened (presumably after January 19, 2012).

At some point, it may become clear what happened to the uploaded information (thus obviating the need for production of all information from 2012 `to the present). The court also ordered that Tolat does not need to give his passwords to Integral.

The process here mimics the process already devised by the court to analyze Tolat's hard drive and is designed to show what happened to Integral's information and make sure that Tolat does not have it any more.

IDC v. Tolat #2, supra.  (The order concerning the password is not included in the prior opinion to which I have access, so it must have come at a different point in this process.)

Having resolved the outstanding issues, the judge concluded by explaining that in

a different case, the court would stage this by conducting the hard drive analysis, having the expert evaluate what he can from end user access (particularly with an eye toward clarifying that Tolat has no information that he is not entitled to), and then seeing what else should be done.

But here, Integral cannot meaningfully engage in settlement conversations until it clarifies what happened with its sensitive information. The court thus orders this process now.

At the same time, the parties should consider the costs of this process and how it bears on the dollar values at stake in the litigation and should include the court in the process if the costs exceed the value to Integral. The parties also should be mindful that at some point, the forensic analysis will provide enough clarity that the expert can stop.

IDC v. Tolat #2, supra.