Friday, December 12, 2014

The Resume Site, Discovery and Spoliation of Evidence

This post examines an opinion by a U.S.District Court Judge who sits in the U.S. District Court for the Eastern District of California:  Olney v. Job.com, 2014 WL 5430350.  She began the opinion by explaining that on August 12, 2012,
 [Peter Olney] registered his resume with a website called `Resume–Now’ as part of his efforts to seek new employment. Resume–Now is owned and operated by LiveCareer, Inc. (`LiveCareer). Registration with Resume–Now generally consists of three steps. First, the registrant is prompted to create or upload a new resume. Second, the registrant is asked for information regarding the job he or she seeks. Third, the registrant is asked to enter and confirm his or her email address.

According to Job.com, at this point the registrant also (1) is given an opportunity to review Resume–Now's terms of use and privacy policy; (2) is asked to acknowledge that he or she has read and agrees to the terms of use and privacy policy; and (3) is allowed to uncheck a box that reads: `[R]eceive . . . free information on managing my career.’

On August 13, 2012, [Olney] used Resume–Now's resume posting service, a service that is offered only to subscribing members. To initiate the resume posting service, [he] clicked a button labeled: `Post Resume. Instantly post your resume to 90 + job boards.’ [Olney] was then directed to the resume posting splash page, where [he] was given the option to choose from various categories of job-search websites where he wished his resume to be posted. [Olney] chose to post his resume on `General Sites.’ Upon choosing `General Sites,’ [he] was directed to a pop-up page displaying a list of additional job sites where his resume would be sent. `Job.com’ was one of the websites listed in the pop-up page.
Olney v. Job.com, supra.
The judges on to explain that as part of this process, Olney was required to
provide additional contact information. The website reads: `Enter your mailing address and current phone [number] so that recruiters and potential employers can contact you.’ [Olney] entered his cell phone number on this page. [He] was then given another chance to review Resume–Now's terms of use and privacy policy. [Olney] reviewed the policy and completed the resume posting process by clicking `Post.’

On August 17, 2012, [Olney] registered an account withJob.com via Resume–Now's website. The registration process consisted of populating fields on five pages, one of which was the `Profile’ page. On the Profile page, [Olney’s] cell phone number was entered in the `Home Phone’ field. Job.com asserts that [Olney] also left a box checked that read `[B]y keeping the box above checked, I'd like to be contacted by phone to discuss educational opportunities to help prepare me for my dream career.’ Although the box was checked by default, a registrant may uncheck the box if he or she wishes to opt out of the service. [Olney] claims that he never visited Job.com, never saw the opt-out box, and therefore could not have checked it nor left it unchecked.

Job.com forwarded [Olney’s] profile, including his phone number, to a third party, Windy City. Windy City operates the Windy City Call Center, which is used to provide `education leads’ to higher learning institutions. Job.com, through Windy City, placed multiple calls a day to [Olney] on August 17, 2012, through September 4, 2012, for the purpose of sellingJob.com and Windy City's or a third party's services.
Olney v. Job.com, supra.
On October 19, 2012, Olney filed this lawsuit on behalf of
himself and all other similarly situated individuals. According to the currently operative Second Amended Complaint (`SAC’), [he] seeks statutory damages and injunctive relief againstJob.com and Windy City for negligent willful violations of the Telephone Consumer Protection Act (`TCPA’).
Olney v. Job.com, supra.
The issue the judge addresses in this opinion involves “motions for sanctions against [Olney]” filed by Job.com and Windy City “for spoliation of evidence during the course of discovery.”  Olney v. Job.com, supra.  As Wikipedia explains, in U.S. law “discovery” is “the pre-trial phase in a lawsuit in which each party can obtain evidence from the opposing party by means of discovery devices including requests for answers to interrogatories, requests for production of documents, requests for admissions and depositions.”  
On October 4, 2013, Job.com took Olney’s deposition and asked him “about his job search and job-related websites he visited at or around the time he paid to have his information provided toJob.com.” Olney v. Job.com, supra.  He was also asked to  “identify the computer he used to perform his job search” and indicated he used his home computer. Olney v. Job.com, supra.  Olney was  “instructed not to `take any steps to delete any Web browsing history or any information from that computer and we may be requesting access to that through discovery.’” Olney v. Job.com, supra.  On October 11, 2013, Job.com served Olney with a set of Request for Production of Tangible Things that sought production of
(1) the cell phone [Olney] alleges he was called on in violation of the TCPA; and (2) the home computer [he] testified at his deposition he used to conduct his job search. Regarding [his] home computer, Job.com specifically indicated its examination would include `internet history, cookies, and temporary files related to [Olney’s] access and visitation of job-related websites’ as well as `local electronic files pertaining to any and all emails related to [his] job search and access of job-related websites, including any attachments to those emails, and any and all resumes or cover letters.’ . . . [Olney] (Doc. objected to Job.com's request for production. . . .

On January 10, 2014, following an informal telephonic conference with the Court, [Olney] was ordered to turn over his computer and phone to the parties' agreed-upon neutral expert for imaging by no later than January 14, 2014, which was extended by stipulation of the parties to January 17, 2014. . . .[Olney’s] computer was turned over to neutral expert BCT Consulting (`BCT’) on Friday, January 17, 2014. The results of BCT's initial investigation were produced on January 21, 2014. . . .
Olney v. Job.com, supra.
BCT's report indicated the presence of a computer program called
`Winclear’ on [Olney’s] computer. This program is used to delete internet history, cookies, and web files. On February 19, 2014, the parties held a conference with Marshall Moll of BCT and requested further investigation of the Winclear program. On February 21, 2014, Moll provided further investigation results which revealed the Winclear program was run only once on January 16, 2014, the day before [Olney] turned over his computer for inspection. . . .

[Olney] informedJob.com that Winclear was not run manually by [him], but had `popped up’ on [his] computer. The parties again contacted Moll at BCT to ask him to investigate the issue further in light of [Olney’s] explanation.

Moll responded . . . on March 3, 2014, indicating it was `very unlikely’ that the program ran on its own. Moll also discovered two additional programs, PC Doctor and PC Optimizer Pro, which were run on January 16, 2014, and January 17, 2014. Moll was asked to prepare a report, which [he] produced on April 1, 2014. . . . Job.com's and [Olney’s] counsel met and conferred regarding Job.com's request to obtain its own expert to analyze [his] hard drive, but [Olney] refused to stipulate to further expert examination of the computer data.
Olney v. Job.com, supra.
On May 1, 2014, the parties held an “informal telephonic discovery dispute conference with the judge,” after which he issued an order allowing Job.com to retain its own expert to examine a mirror image of Olney’s hard drive.  Olney v. Job.com, supra. Job.com hired forensic expert Global Digital Forensics, Inc. (“GDF”) to inspect the image. Olney v. Job.com, supra. On May 30, 2014, GDF reported its findings:
GDF concluded that the computer clock setting had been intentionally manipulated to roll the computer date backwards to December 1999. The computer system event log showed four entries confirming the date change was a user-initiated action, not something the system did without intervention. . . . GDF also concluded that a program named PC Optimizer Pro was initially installed in November 2012, and re-installed on May 27, 2013. The program was set to run on a scheduled basis to destroy and remove data from the computer hard drive. The last time PC Optimizer was run, on January 17, 2014, 2,318 items were `cleaned’ off the system. Between December 21, 2012, and December 28, 2013, a total of 15,686 files were purged from the system. . . .

GDF summarized the Windows prefetch data in relevant part as follows:
`It is possible to determine the number of times a program has been used, and the last date it was run, by examining the metadata of the prefetch files.’

`Based on the analysis of the extracted metadata . . . the PC Optimizer program was run only once, on January 17, 2014. Since we know the PC Optimizer program was used more than once, evidenced by the recovered log files, the only way the prefetch metadata could display a single use is that the prefetch files were deleted. Additional review of other program files listed in the prefetch folder also indicate single or very few runs. This condition would indicate that multiple prefetch files were deleted. Further analysis indicated that in excess of 70 prefetch files were created between January 12, 2014, and January 17, 2014. . . .  GDF concluded the Winclear program was run on [Olney’s] computer and detected 12,775 items on January 16, 2014.
Olney v. Job.com, supra.
At that point, Olney retained “Jeffrey Hansen to review GDF's findings and conduct another evaluation of Plaintiff's computer regarding the spoliation issue.”  Olney v. Job.com, supra.  Hansen reported, among other things that the data on the computer
does not reflect that [Olney] manually attempted to manipulate the date, but that the computer system was `simply synchronizing with the NTP server.’ Any log entries showing a change in date was momentary and showed only that Windows . . . was synchronizing its time with an NTP server. . . .

GDP determined that the PC Optimizer program was set to run automatically every two weeks, three times a week, on Tuesday, Thursday, and Saturday at 11 a.m. Hansen determined that PC Optimizer was actually configured to run every Tuesday, Thursday, and every other Saturday at 11:00 a.m. Nevertheless, the data on the computer indicates the program was last run on Friday, January 17, 2014. Hansen asserts that when PC Optimizer is scheduled to run and the time it actually runs can vary. For example, [he] notes PC Optimizer ran on December 16, 2013, which was a Monday, and not a regularly scheduled scan day. Hansen states there are many reasons why the scheduled run of PC Optimizer could be delayed, such as the computer being placed in sleep mode at the time of a scheduled run.  Hansen opines there is no evidence to suggest [Olney] had any involvement with PC Optimizer being run on a day other than when it was scheduled, and it ran on an unscheduled day because the computer was sleeping or shut down on the day it was scheduled to run. . . .

The version of on [Olney’s] computer was an unregistered version, and Winclear's system summary shows that no items were removed on the previous scans. According to GDF, there was a registry in the Windows Operating system that tracked access to files in an area known as `mru’ or `Most Recently Used.’ Within this registry key, there was direct navigation and access to a Winclear log. When the drive was searched, the log was identified in the recycle bin, indicating it had been deleted by the user. Hansen opines that [Olney] did not perform the deletion, but that PC Optimizer scanned that file, and the access time of the file was changed. PC Optimizer then sent the file to the recycle bin, and emptied the recycle bin. . . . Hansen also notes the log shows when the file was created and deleted. The Winclear log file was sent to the recycle bin at 3:43 and 20.716999 seconds, and 0.007999 seconds later the file was deleted. [Olney] could not have deleted the file, moved it to the recycle bin, and emptied the bin all within 0.00799 seconds. Moreover, PC Optimizer runs using the pmojjo2003 account on [his] computer. Because GDF mistakenly assumed [Olney] was the only user of that account, GDF pointed to this user account recorded in the log as additional evidence that [he] was manually directing the deletions of the Winclear scan. In actuality, PC Optimizer also runs under that account. In sum, Hansen opines that only a software program can access a file, delete it, and navigate to the recycle bin to empty it in 0.007999 seconds; PC Optimizer can perform such a task, and would have done so under Plaintiff's user account pmojj o2003.

When comparing files deleted from the recycle bin, the MFT entries showed files were deleted on January 18, 2014, after [Olney] turned his computer over to BCT. This deletion occurred before a `dd image’ was made of the hard drive—i.e., `all forensic examinations done on this drive . . . , were done on an image in which log files and restore points that are at issue in this case [were] modified, accessed, or deleted while in the custody of the neutral expert.’ . . . Six items were deleted on January 18, 2014. According to Hansen, the system was not turned on after the last entry in the log files of January 17, 2014, yet the drive has time stamps of January 18, 2014, spanning over a four-hour period showing 60 files being created, accessed, modified, or deleted. `This can only be done by booting a computer with a different operating system than what is on the drive and accessing that drive.’ Mr. Hansen opines that either the neutral expert was not reliable or erased the data purposefully. . . .
Olney v. Job.com, supra.  In sum, Hansen “opines [Olney] is a novice computer user, the neutral expert deleted or modified files which calls into question the integrity of any examination of the hard drive, and the web history and files were automatically deleted by PC Optimizer.” Olney v. Job.com, supra. 
There was more back and forth between the parties, one result of which was that Olney got a supplemental report from Hansen which said, among other things, that with regard to
PC Optimizer's scan being cancelled on January 17, 2014, users will routinely stop scans when they interfere with the processing speed of the computer. Also, if [Olney] were truly attempting to delete data, he would not have stopped the scan. Winclear was purchased by Plaintiff in 2008, but [he] allowed his license to expire, rendering the program unregistered. When unregistered, Winclear will run automatically but will not delete data. According to Hansen, `Winclear did not delete anything long before litigation began and to investigate it further would accomplish nothing.’ 
Olney v. Job.com, supra (emphasis in the original). 
As the result of all this, Job.con and Windy City each filed motions for sanctions, asking the judge to dismiss Olney’s Complaint, pay them monetary sanctions for the “fees and costs associated with their motions” and/or give “an adverse jury instruction” if and when there was a trial.  Olney v. Job.com, supra. Olney argued, in response, that any all data relevant to the lawsuit “was deleted long before his October 2013 deposition”, that he did not make any deliberate effort to delete relevant data and that since “no relevant data” was destroyed “at a time when the duty to preserve was triggered”, no sanctions were warranted. Olney v. Job.com, supra. 
In deciding whether sanctions were warranted, the judge explained that “to determine whether spoliation has occurred, the Court must consider (1) when [Olney’s] duty to preserve evidence was triggered; (2) whether relevant evidence was destroyed or altered by [him] after the duty was triggered; and (3) whether [he] acted with a culpable state of mind in destroying or altering relevant evidence. Olney v. Job.com, supra.  She found, first, that by August of 2012 Olney should have known “his computer data was relevant to Defendants' defenses”, which meant he had a duty to preserve evidence. Olney v. Job.com, supra.  She also found Olney had destroyed and/or altered relevant evidence after August 2012. Olney v. Job.com, supra.  And, finally, that he acted “with a culpable state of mind”.  Olney v. Job.com, supra.  As to the last issue the judge explained that Olney’s use of PC Optimizer in November 2012 was
at least negligent. Even though the duty to preserve computer data, particularly internet data, should have been known to [Olney] when he contemplated his lawsuit in August 2012, neither he nor his attorneys took any steps to mirror image [his] hard drive at that time or at any time after the lawsuit was filed in October 2012. [He] installed PC Optimizer in November 2012, only one month after filing his lawsuit. . . .

It has not been established that [Olney] knew PC Optimizer would delete internet history relevant to the litigation and installed it for that purpose. [His] deposition testimony indicates, however, that he had enough computer knowledge to understand that PC Optimizer would delete files on his computer. In light of the pending litigation, [Olney] should have ascertained the precise nature PC Optimizer's deletion function before it was installed. The failure to take steps to do so was negligence.
Olney v. Job.com, supra (emphasis in the original).  She also found that in July, 2013,
defendants served discovery requiring [Olney] to identify all websites where he posted his resume, which further implicated the relevance of [his] use of his computer during his job search as a likely source of potentially relevant evidence to Defendants' defenses. Yet, neither [Olney] nor his counsel made an attempt to mirror image the hard drive or confirm whether evidence on the computer was being preserved.

At [Olney’s] October 2013 deposition, he and his attorneys were expressly directed by Job.com's counsel to preserve internet history on [his] computer, but no steps were taken to do so.Job.com sought production of [Olney’s] computer data through formal discovery later in October 2013, and even at this point no steps were taken by [Olney] or the three law firms representing him to either mirror image the computer or ascertain whether data on the computer was being preserved. . . .

In sum, [Olney] was negligent with regard to the installation of PC Optimizer in November 2012 and its routine deletions of data after installation; he was grossly negligent in failing to take any steps whatsoever to preserve his computer data after Defendants' counsel instructed him at his October 2013 deposition to preserve his computer data; and, as discussed below, [his]  failure to preserve evidence after the court ordered production of his computer hard drive constituted willful and deliberate spoliation.
Olney v. Job.com, supra (emphasis in the original). 
The judge therefore found that the appropriate sanction was to give the jury an adverse inference instruction if and when the case went to trial. Olney v. Job.com, supra.  More precisely, she held that, if and when the case went to a jury trial, the jury would be given this instruction:
Plaintiff has failed to prevent the destruction of relevant evidence for Defendants' use in this litigation. This is known as the `spoliation of evidence.’

I instruct you, as a matter of law, that Plaintiff failed to preserve evidence after his duty to preserve arose. This failure resulted from his failure to perform his discovery obligations.

You shall presume that Defendants have met their burden of proving the following two elements by a preponderance of the evidence:  first, that relevant evidence was destroyed by Plaintiff after the duty to preserve arose. Evidence is relevant if it would have clarified a fact at issue in the trial and otherwise would naturally have been introduced into evidence; and second, the lost evidence was favorable to Defendants.

Whether this finding is important to you in reaching a verdict in this case is for you to decide.
Olney v. Job.com, supra (emphasis in the original). 


No comments: