Searching over 5,500,000 cases.


searching
Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.

Postle v. Silkroad Technology, Inc.

United States District Court, D. New Hampshire

February 19, 2019

Frank D. Postle
v.
SilkRoad Technology, Inc.

          MEMORANDUM ORDER

          Joseph N. Laplante United States District Judge.

         This motion for spoliation-related sanctions turns on whether an employee intentionally deleted information relating to both his claims and his employer's counterclaims from his work-issued laptops before returning them. Plaintiff and counterclaim-defendant Frank Postle, a former IT administrator for defendant and counterclaim-plaintiff SilkRoad Technology, deleted information from his assigned Dell laptop and a Microsoft Surface Book laptop and reset the Dell to factory default before returning both devices to SilkRoad. SilkRoad contends that both devices contained information relevant to Postle's wage claim under N.H. Rev. Stat. Ann. § 275:44 and SilkRoad's counterclaims for breach of contract, fraudulent concealment, and tortious interference with economic advantage premised on the theory that Postle engaged in or supported hacking activities against the company. SilkRoad also contends that a private Virtual Machine that Postle deleted also contained information relevant to its counterclaims.

         After hearing oral argument and testimony from the plaintiff, [1] the court grants SilkRoad's motion in part. Postle intentionally deleted information related to the parties' claims from his Dell laptop, despite being aware of - and himself invoking - the potential for litigation at the time. Concluding that Postle intentionally spoiled relevant evidence unobtainable elsewhere, the court may presume that the information deleted from his Dell laptop was unfavorable to Postle and may so instruct the jury at trial. The court also awards SilkRoad a portion of its attorneys' fees and costs accrued in bringing and litigating its spoliation motion.

         I. Applicable legal standard

         Federal Rule of Civil Procedure 37(e) governs a party's failure to preserve electronically stored information such that it “cannot be restored or replaced through additional discovery.” If the court finds “prejudice to another party from loss of the information, ” it “may order measures no greater than necessary to cure the prejudice.” Id. Rule 37(e)(1). If the court finds “that the party acted with the intent to deprive another party of the information's use in the litigation, ” it may impose one of three sanctions. Id. Rule 37(e)(2). It may “presume that the lost information was unfavorable to the party; instruct the jury that it may or must presume the information was unfavorable to the party; or dismiss the action or enter a default judgment.” Id.

         SilkRoad, as the moving party, bears the burden of proving the threshold requirements that relevant evidence has been lost and cannot be replaced, that it should have been preserved, and that it was not preserved because Postle failed to take reasonable steps to preserve it. See Watkins v. New York City Transit Auth., No. 16 CIV. 4161 (LGS), 2018 WL 895624, at *10 (S.D.N.Y. Feb. 13, 2018). It is also SilkRoad's burden to prove that Postle acted with the intent to deprive it of use of that evidence in this litigation. See Id. “The rule does not, ” however, “place a burden of proving or disproving prejudice [under Rule 37(e)(1)] on one party or the other.” Fed.R.Civ.P. 37(e)(1), advisory committee's note to 2015 amendment.

         The quantum of evidence by which SilkRoad must meet these burdens is unresolved. Some courts have required that spoliation be proven by only a preponderance of the evidence. See Watkins, 2018 WL 895624, at *10. The First Circuit Court of Appeals has in the past applied a clear-and-convincing standard to discovery misconduct resulting in severe sanctions. See Anderson v. Cryovac, Inc., 862 F.2d 910, 926 (1st Cir. 1988). Citing Anderson, a court in this Circuit has applied that clear- and-convincing standard to Rule 37(e) sanctions. See Wai Feng Trading Co. Ltd v. Quick Fitting, Inc., No. CV 13-33WES, 2019 WL 118412, at *5 (D.R.I. Jan. 7, 2019) (Sullivan, M.J.).

         II. Background

         SilkRoad employed Postle in an information-technology role for about fifteen years. In March 2017, Postle began to work for SilkRoad pursuant to a contract with a stated term of March 6 to June 19, 2017.[2] Under this contract, Postle worked from home and remotely accessed SilkRoad's computer system.

         About a month into that contract, on April 4, an unidentified and unauthorized individual accessed SilkRoad's computer system and sent an email to its employees, board of directors, and customers that appeared to come from its CEO, John Shackleton. SilkRoad suspended Postle's work and his ability to access its computer systems two days later in light of a suspected connection between Postle and the hacker. It informed him that his contract was “hereby suspended pending investigation.”[3]

         On April 12, 2017, SilkRoad requested that Postle return four devices that he used for work: a Dell laptop, a Surface Book tablet, an iPad, and an iPhone. Specifically, SilkRoad requested he “return SilkRoad's assets, ” which “consist of” those four devices.[4] Its attorneys followed up with an emailed letter on April 14, reiterating the request that Postle return those four devices and including the following litigation-related language:

In addition, we wish to remind you of your obligations with regard to Silkroad [sic] property, which includes the preservation of any information, messages, emails, documents or other materials on these devices. You may not destroy or delete any such information on such a device without our express authorization.[5]

         According to Postle, he did not read - or, at least, did not appreciate the import of - this language until April 17. At some point between April 12 and April 17, Postle deleted his user profile from the Dell and browsing history and other data from the Surface Book.[6] Postle testified at the hearing that he deleted the information in such a way as to render it unrecoverable. He also began to restore both devices to their factory settings, a process that, both parties agree, renders deleted information functionally unrecoverable.

         He completed the process on the Dell, though he testified at the hearing, consistent with an April 17 email, that he interrupted the factory reset on the Surface Book upon realizing that SilkRoad wanted him to retain all data on the devices. He claimed he was able to load the Surface Book after interrupting the reset. When SilkRoad and its experts have attempted to recover data from the Surface Book, however, they have encountered BitLocker encryption.[7] Postle's testimony concerning just when BitLocker was enabled on the Surface Book has undergone several iterations. During his deposition, he testified that he enabled it shortly after the April 6, 2017 attack on SilkRoad's systems.[8] This is consistent with a search he ran on April 4, 2017, on how to “convert existing drive to bitlocker.”[9] In his deposition errata and at the hearing, on the other hand, he revised his position to claim that it had been enabled around June 20, 2016.[10] In any event, Postle confirmed that he discarded the recovery key at some point after it was enabled; and because he did so, SilkRoad has not been able to access any data that may remain on that device.[11]

         On May 1, 2017, Postle noticed suspicious activity directed against the Virtual Machine that he used to access his personal email server.[12] That day, he emailed SilkRoad and, among other things, informed them about this activity.[13] SilkRoad's counsel responded the next day, reminding Postle of his duty to preserve information “on [his] Apple backup, ” but without mentioning the Virtual Machine.[14] Postle then deleted the Virtual Machine. By doing so, Postle testified, he did not delete any emails from his account. SilkRoad argues, instead, that he deleted any data relating to the source of the potential hack of that Virtual Machine. He received an email on May 5 from the purported hackers, claiming he had foiled their efforts.[15]

         III. Analysis

         A. Threshold requirements

         The party moving for spoliation-related sanctions must establish, by clear-and-convincing evidence, see Wai Feng, 2019 WL 118412, at *5, the following threshold requirements: (1) that relevant electronically-stored information (ESI) has been lost and cannot be restored or replaced through additional discovery; (2) that it should have been preserved; and (3) that it was not preserved because a party failed to take reasonable steps to preserve it. Fed.R.Civ.P. 37(e). Here, SilkRoad has satisfied these threshold requirements with respect to the Dell laptop and Surface Book. The court is not satisfied that it has done so with respect to the Outlook Virtual Machine.

         1. Lost ESI

         SilkRoad “must establish, first, that ESI has been lost and is not available in any other location.” Wai Feng, 2019 WL 118412, at *5. This further requires SilkRoad to demonstrate that information relevant to the claims at issue existed on the devices, was removed from those devices, and does not exist anywhere else. SilkRoad has made this showing with respect to all three devices.

         Information relevant to both Postle's wage claim and SilkRoad's counterclaims probably existed on the Dell laptop and Surface Pro, including information concerning Postle's search histories, [16] when he edited his LinkedIn profile to reflect self-employment, [17] and the history of his remote access to SilkRoad's systems.[18] Though Postle argued that no relevant information existed on those devices because he used them solely to remotely access his workspace on SilkRoad's systems, he testified at the hearing that he used the devices for other purposes - including to conduct internet searches - and that information such as his search history is neither backed up nor available elsewhere.

         With respect to the Dell, Postle conceded at the hearing that he deleted his search history, user profile, and temporary files. He further admitted that he completed a factory reset, rendering any information the device previously held unrecoverable.

         Postle also deleted information on the Surface Book. He testified during his deposition that he deleted his user profile and temporary files from his Surface Book.[19] At the hearing, however, he testified that he deleted only his personal files and search history, and did not delete the user profile. He further testified that he did not complete a factory reset of the Surface Book, once he realized his obligation to preserve information, and that he was able to access the data remaining on the device before he returned it to SilkRoad.[20]

         Finally, SilkRoad has raised an inference that information relevant to its counterclaims may have existed on Postle's Outlook Virtual Machine.[21] Specifically, Postle claims that his Virtual Machine was targeted by the same individuals who attacked SilkRoad.[22] He reported some information concerning the attack - including the manner of it and the IP address of the attacker - to SilkRoad after it occurred.[23] Such information certainly relates to whether or not Postle participated in some manner in the attacks; additional forensic information along that line may well have been obtained from the Virtual Machine had Postle not deleted the Virtual Machine entirely.[24]

         Accordingly, SilkRoad has demonstrated that ESI, relevant to both parties' claims, has been lost and is not available through other discovery.

         2. Duty to preserve

         Second, SilkRoad must demonstrate that the lost ESI should have been preserved. Wai Feng, 2019 WL 118412, at *5. This requires a showing that, at the time Postle deleted the ESI, he knew or reasonably should have known about the pending litigation and that his ESI would be relevant to that litigation. Id. SilkRoad has made this showing with respect to the Dell and Surface Book, but not with respect to the Virtual Machine.

         Postle began deleting information from his Dell and Surface Book at some point after receiving the April 12 email requesting that he return them. As discussed supra, information on those devices was relevant to his wage claim. He reasonably should have been aware of the potential for litigation over his wage claim before that day.

         SilkRoad suspended his contract on April 6.[25] Four days later, Postle emailed SilkRoad's head of human resources to explain that, despite the suspension, he considered the contract active “[a]bsent of termination for cause . . . .”[26] At the hearing, he testified that, as of this time, he did not believe he had done anything that constituted cause for termination of the contract.

         Postle certainly contemplated litigation over that claim no later than April 13, 2017, when he responded to the April 12 email requesting that he return the Dell and Surface Book by claiming to have “contracted an attorney, ” who “recommended that I do not return anything until such time that I am fully paid on the contract that you have suspended.”[27] While the record is unclear as to whether Postle deleted information from the Dell and Surface Book before sending that April 13 email, he appears to have been in the process of doing so at the time he sent it. An hour after sending it, and after being informed that SilkRoad sought information from other domain administrators' hard drives, Postle responded: “They should have asked for that. I am busy clearing off my machines to return them. They are going to be unhappy with the image on my dell as I just deleted my SilkRoad user profile.”[28] In deposition, he clarified that, at the time he sent this text, he had deleted information but had not yet begun to reset the Dell or Surface Book to factory default.[29]

         Postle began deleting information from his Dell and Surface Book no earlier than April 12, two days after his email contesting whether SilkRoad had “cause” to suspend his contract. He reasonably should have been aware of the ...


Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.