Ericksen v. Kaplan Higher Education, LLC, 2015 U.S. Dist. LEXIS 142789 (D. Md. Oct. 21, 2015):

Plaintiff Karen Ericksen filed this case against Defendants Kaplan Higher Education, LLC and TESST-KAP, LLC, alleging employment-related violations of federal and Maryland state law. (Am. Compl., ECF No. 16.) This case has been referred to me for all discovery and related scheduling matters. (ECF No. 34); See 28 U.S.C. § 636(b); Loc. R. 301 (D. Md. 2014). Pending before the Court is Defendants' Motion for Sanctions. (ECF No. 51.) I have also considered the parties' initial informal correspondence with the Court regarding the dispute underlying Defendants' motion.¹ (ECF Nos. 29, 30, 31, 32.) I find that no hearing is necessary. See Loc. R. 105.6 (D. Md. 2014). Although the basis for Defendants' motion is a discovery dispute, because Defendants have requested dispositive relief, I am issuing a Report and Recommendations concerning the action I recommend this Court take. See 28 U.S.C. § 636(b); Loc. R. 302 (D. Md. 2014). For the reasons set forth below, I recommend that [*2]  Defendants' Motion for Sanctions be granted in part and denied in part.

1   Although Plaintiff did not file an opposition to Defendants' Motion for Sanctions, in light of her pro se status, the Court will consider the arguments raised in Plaintiff's earlier correspondence with the Court as her opposition to Defendants' motion. See Saravia v. Select Portfolio Servicing, Inc., Civil Action No. 13-01921-RDB, 2014 U.S. Dist. LEXIS 84783, 2014 WL 2865798, at *7 (D. Md. Jun. 23, 2014) ("The Court affords Plaintiff a more lenient standard given his status as a pro se Plaintiff.").

I. Background

On August 27, 2014, Karen Ericksen, a former Information Technology Instructor for Defendants' TESST College of Technology, brought claims against Defendants alleging failure to pay wages, violations of wage and hour laws, and retaliation/wrongful discharge in the Circuit Court for Baltimore City, which were ultimately removed to this Court. Plaintiff filed an Amended Complaint on October 28, 2014. (Am. Compl.) In factual support of her claims, Plaintiff alleged that she was promised a raise from $25.00 per hour to $26.50 per hour, but that she was not ever paid $26.50 per hour and was also not paid for all of the hours she worked. (Am. Compl. ¶¶ 45-47, 54, 62-64, 74.) As evidence for [*3]  this, Plaintiff's Amended Complaint referenced a letter purportedly written by one of her supervisors, Charles Blount, documenting that she was paid an hourly wage and promising her a raise from $25.00 per hour to $26.50 per hour (the "Blount Letter"). (Id. ¶¶ 48, 68.) In support of her allegation that her termination was the result of retaliation, Plaintiff's Amended Complaint referenced an email purportedly written by one of her supervisors, Heather Gollnow, to the chair of the department in which Plaintiff worked, Marques Dent (the "Gollnow Email"), stating:

   Karen has to go. You can finish doing what needs to be done to discredit her with Comptia certifications. There is nothing in her file I can use, so we need to use her certs. Keep that change you made with the different Comptia ID, that way we can use that against her. Make sure the contact at Comptia can support this. See if there is an ID of someone who failed; use that. I want her out before the next class starts, and so she cannot be rehired.

(Id. ¶ 88.)

In response to Defendants' written discovery requests, Plaintiff produced several documents that she purportedly received from Defendants during her employment. These documents [*4]  included, among others, the Blount Letter and Gollnow Email described above. Because conflicting versions of the Blount Letter were produced (including a purported "original") and Mr. Blount denied ever writing the letter (ECF No. 51-6), and because the Gollnow Email could not be located on its email servers, Defendants questioned the authenticity of both documents. Plaintiff did not produce either of these documents in "native format," as originally requested by Defendants in their discovery.²

2   Native format production of a document created electronically allows verification of its so-called "metadata"--the information embedded in an electronic document that would detail such things as when the document was created and edited, and by whom.

On February 17, 2015, given Plaintiff's failure to produce documents in native format and suspecting that both the Blount Letter and Gollnow Email (and perhaps other documents) may have been created by Plaintiff, Defendants served Plaintiff with a copy of their Third Request for Production of Documents, containing a request for inspection of her personal computers by Vestigant Digital Forensics ("Vestigant"), a third-party forensic computer expert hired [*5]  by Defendants. (ECF No. 51-8.) On March 20, 2015, Plaintiff agreed to this request without objection. (ECF No. 51-9.)

On March 24, 2015, counsel for the parties conferred and agreed that the examination would occur on April 1, 2015. Plaintiff identified three devices to be examined, including a Western Digital hard drive that was used in Plaintiff's laptop. Vestigant imaged the devices. The forensic examination took place at the offices of Plaintiff's then-counsel.³

3   Plaintiff's counsel originally moved to withdraw on April 23, 2015. (ECF No. 25.) That motion was denied by Judge Bennett of this Court on May 22, 2015, but was subject to refiling after resolution of the instant discovery dispute. (ECF No. 33.) The Motion to Withdraw was refiled on July 30, 2015 (ECF No. 39), and was granted by Judge Bennett on September 30, 2015 (ECF No. 55).

Vestigant's initial examination revealed that on March 30, 2015--two days before the scheduled forensic examination--a program called CCleaner was used on Plaintiff's Western Digital hard drive. CCleaner is variously described by Vestigant as a "tool to speed up a computer," a "data cleanup" tool, and a "destruction tool." (Vestigant Initial Report at [*6]  2, ECF No. 51-12; Vestigant Suppl. Report at 8, ECF No. 51-14.) However it is described, running CCleaner had the effect of deleting over 400,000 files on Plaintiff's hard drive, according to Vestigant. (Vestigant Initial Report at 3.) Defense counsel shared Vestigant's findings with Plaintiff's then-counsel and demanded that Plaintiff dismiss her lawsuit. Plaintiff declined to do so, taking the position that she had neither created nor destroyed evidence using CCleaner. (ECF No. 51-13 at 2.) Further, Plaintiff challenged the procedures utilized by Vestigant and denied having utilized a version of CCleaner that had the ability to delete files. (ECF No. 29-2.)⁴ Defendants then requested that sanctions be entered against Plaintiff for spoliation of evidence in a letter to Judge Bennett, to which Plaintiff filed a response supported by her own affidavit. (ECF Nos. 29, 30.)

4   Plaintiff referred to this as CCleaner's "Drive Wiper" capability, a capability that she denies her version of CCleaner possessed. (ECF No. 29-2.)

On June 1, 2015, finding that the factual record was not yet fully developed given Defendants' requested sanction of dismissal and the competing assertions of Vestigant's initial [*7]  report and Plaintiff's own affidavit, I issued an Order Regarding Necessary Discovery and Briefing Schedule, providing for limited discovery regarding the spoliation issue, including allowing for Plaintiff's deposition on this limited issue, allowing Vestigant to file a supplemental report to respond to Plaintiff's affidavit, allowing Plaintiff to retain her own forensic expert to respond to Vestigant, and allowing Plaintiff the opportunity to depose Vestigant. (ECF No. 34.)

Plaintiff was deposed. (Ericksen Dep., ECF No. 51-9.) Vestigant issued a supplemental report. (Vestigant Suppl. Report.) Plaintiff chose not to depose Vestigant. Plaintiff did retain a forensic expert, Prudential Associates, that performed its own imaging of her hard drive, however no report was ever produced regarding its findings.

At deposition, Plaintiff testified that she was made aware of Defendants' February 25, 2015 request to inspect her computers and the inspection date of April 1, 2015, and was generally aware of her duty to preserve evidence. (Ericksen Dep. 83:4-17, 85:9-13, 85:20-86:5, 86:21-87:4, 106:12-20.) Plaintiff also described the hard drive at issue as her primary hard drive and a likely repository [*8]  of potentially responsive documents. (Id. at 88:13-16, 108:17-20.) Plaintiff confirmed that the hard drive was in her possession on the three days immediately before the scheduled inspection. (Id. at 90:10-91:20.)

For its part, Vestigant's analysis, as reflected in its supplemental report, showed that CCleaner and four other programs that can destroy data were run on the hard drive at issue between March 29 and March 31, 2015, just prior to the April 1, 2015 inspection. (Vestigant Suppl. Report at 11.) Vestigant also explained that the user of CCleaner must affirmatively set the option to securely delete data in order to ensure that the deleted data is removed permanently (Id. at 29), and that a user of Plaintiff's computer took this affirmative action. (Id. at 30-31). Vestigant indicated that another program called "Wipe.exe" was used on March 29 and 30, 2015. (Id. at 20, 24.) Like CCleaner, Vestigant explained that Wipe.exe must be affirmatively downloaded from the Internet and requires that the user affirmatively click the "delete" option to run it. (Id.) A third software tool called "Preventrestore.exe" was also used on March 29, 2015 and on the morning of March 31, 2015, according to Vestigant. (Id. at 20, 25.) As with Wipe.exe, [*9]  Preventrestore.exe must be affirmatively downloaded from the Internet and requires the user to affirmatively check data destruction options. (Id. at 20, 26.) Yet another program, SysClean.exe, was run on March 29, 2015, erasing certain files according to Vestigant. (Id. at 27.) It also must be downloaded by the user. (Id.) Finally, Vestigant found that a fifth program called RegCLean.exe was run on March 29, 2015 after being downloaded, removing entries from the Windows Registry. (Id. at 28.) In each case, the username "Gigi" was tied to the running of these data deletion and destruction tools. (Id. at 38.)

Notwithstanding the running of the five programs described above, Vestigant was able to recover electronic "PDF" versions of three letters purportedly written by Charles Blount that had been produced in hard copy paper format, including the Blount Letter relied upon by Plaintiff in her Amended Complaint, and in reviewing the metadata for these PDF versions, determined they were created by "Gigi" when the original files were "printed" to PDF format by Gigi. (Id. at 5.) According to the metadata uncovered by Vestigant, two of the letters were printed to PDF from Microsoft Word and Microsoft Excel, and one appears to have been scanned [*10]  to Plaintiff's computer. (Id. at 31.) Vestigant was unable to recover any evidence on Plaintiff's computer of the original document files that had been created using Microsoft Word and Microsoft Excel. Vestigant's report does not reference finding any information on Plaintiff's computer relating to the Gollnow Email that she contends she received in her email anonymously.

Plaintiff confirmed at deposition that "Gigi" was the profile she used most. (Ericksen Dep. 54:2-7.) She confirmed that she ran CCleaner on March 29, 2015 and a program she described as "Advance System Optimizer." (Id. at 99:18-100:2, 102:4-104:10.) Her stated purpose in doing so was to enhance her computer's performance because it was running slowly, and that she routinely ran such programs. (Id. at 102:4-104:10.) She acknowledged that the effect of running these programs would delete certain files, such as temporary files and Internet history. (Id. at 102:19-21.) She did not acknowledge running programs to permanently delete information known to be relevant to the case. Plaintiff claimed that the only files she deleted from her computer were temporary files that did not relate to the case. (Id. at 108:9-13.)

Plaintiff also [*11]  attempted to create a question by suggesting that two other individuals had access to her computer during the time in question First, Plaintiff claimed that she was training someone, and that the person was physically present and had access to Plaintiff's computer. However, Plaintiff also testified that her trainee had no Internet access and that Plaintiff's computer was therefore no more useful to the trainee than a book. (Id. at 125:11-21.) Plaintiff also suggested that a second trainee may have been able to access her computer remotely while she trained him from home. This testimony, however, is inconsistent with Plaintiff's testimony that she did not have Internet access at her home. (Id.)

II. Analysis

Based on all of the above, the Court concludes that Plaintiff likely did run the five software programs while on notice of her general duty to preserve data and on notice of the April 1, 2015 computer inspection date. Additionally, Plaintiff acknowledged she was aware that running such programs would have the effect of deleting information from her computer even if, as she claims, she ran the programs to increase computer efficiency and not with the specific intent to destroy relevant [*12]  evidence. Given Plaintiff's background and training (as explained in her affidavit), her position as an Information Technology adjunct instructor, and her allegation that she was the de facto IT Department Chair for TESST (albeit not paid as such), it is difficult to conclude that Plaintiff did not understand that running such programs would put relevant electronic evidence at risk, even if, as she claims, it was not done with the specific intent to target such evidence.

The Court is unable to definitively conclude based on the evidence before it whether the Blount Letter and Gollnow Email were fabricated by Plaintiff as Defendants charge. However, Defendants' inability to put forth potential evidence of fabrication is a direct result of Plaintiff's actions in running these software programs on her computer, knowing its inspection was imminent. Therefore, Defendants are entitled to sanctions for Plaintiff's spoliation of evidence. These are discussed below.

Spoliation is the "destruction or material alteration of evidence . . . in pending or reasonably foreseeable litigation." Goodman v. Praxair Servs., Inc., 632 F. Supp. 2d 494, 505 (D. Md. 2009) (quoting Thompson v. U.S. Dept. of Hous. & Urban Dev., 219 F.R.D. 93, 100 (D. Md. 2003)). If spoliation has occurred, potential sanctions [*13]  include preclusion of evidence, imposition of an adverse inference, assessment of attorney's fees and costs, and, in extreme cases, dismissal or judgment by default. Praxair, 632 F. Supp. 2d at 506. This Court and others have conditioned the imposition of spoliation sanctions on proof by the moving party of the following elements:

   (1) [T]he party having control over the evidence had an obligation to preserve it when it was destroyed or altered; (2) the destruction or loss was accompanied by a "culpable state of mind;" and (3) the evidence that was destroyed or altered was "relevant" to the claims or defenses of the party that sought the discovery of the spoliated evidence, to the extent that a reasonable factfinder could conclude that the lost evidence would have supported the claims or defenses of the party that sought it.

Id. at 509 (quoting Thompson, 219 F.R.D. at 101).

In the present case, the first and third elements are easily satisfied. Plaintiff concedes that she had control of the computer at issue, knew of her general obligation to preserve evidence, and was aware of the April 1, 2015 inspection date when the software programs that imperiled the potential evidence were run. Additionally, given the significant extent to which Plaintiff relied on the [*14]  Blount Letter and Gollnow Email to support her claims--including specifically referencing both in her Amended Complaint--there can be no doubt that the computer evidence sought by Defendants that could potentially fatally undermine the already questionable authenticity of those documents was relevant to Defendants' defenses. While Defendants cannot point to specific evidence that would have definitively established this, that is not fatal to their position. Under the circumstances, the very evidence that Defendants would point to has been destroyed, and they therefore need only show the reasonable possibility that the data would be favorable to their case. See Oce N. Am. v. MCS Servs. Inc., Civil Action No. WMN-10-0984, 2011 U.S. Dist. LEXIS 141209, 2011 WL 6130542, at *3 (D. Md. Dec. 7, 2011) ("Though it is unable to articulate exactly what data was deleted from [the] laptop because the Incinerator program, by its very design, obliterated the deleted data, [Plaintiff's] presentation of trace evidence from the Windows Registry and circumstantial evidence that all other imaged laptops contained [Plaintiff's] data is sufficient for the Court to reasonably determine that the lost data would have benefitted [Plaintiff's] case, and thus meets the burden with regard [*15]  to [the] laptop.").

The "state of mind" element requires further discussion. There are three possible states of mind that can satisfy the culpability requirement and will, therefore, help determine which sanction is most appropriate: bad faith/knowing destruction, gross negligence, and ordinary negligence. Thompson 219 F.R.D. at 101 (citing Residential Funding v. Degeorge Fin. Corp., 306 F.3d 99, 108 (2d Cir. 2002)); see also Sampson v. City of Cambridge, 251 F.R.D. 172, 179 (D. Md. 2008). Generally, dismissal, for which Defendants argue here, is only justified upon a showing of bad faith. Silvestri v. Gen. Motors Corp., 271 F.3d 583, 593 (4th Cir. 2001). Such conduct and its effect must cause a court to conclude either "(1) that the spoliator's Conduct was so egregious as to amount to a forfeiture of his claim, or (2) that the effect of the spoliator's conduct was so prejudicial that it substantially denied the defendant the ability to defend the claim." Id. I decline to find that Plaintiff's conduct in this case meets the requirements of "bad faith" based on the record before me. Plaintiff claims that she ran the programs in question to optimize her computer that had been running slowly, and, while acknowledging that some data would be lost, did not believe that data relevant to the case would be lost. There are facts that belie Plaintiff's position, including her relative sophistication in computer matters [*16]  by virtue of her training, education, and position, and the fact that five different programs were run shortly before the scheduled inspection, resulting in the loss or corruption of approximately 400,000 files according to Vestigant. But even Vestigant, in its description of these programs, alternates between terming them "optimizer" programs versus data destruction programs. In the face of such mixed evidence, and the fact that Defendants' ability to defend the claim has not been substantially denied, the sanction of dismissal is not warranted.

I do find, however, that even accepting Plaintiff's version of events, she acted willfully in that she acknowledged potentially relevant evidence was contained on her computer and nonetheless ran a program that she knew would destroy some data. That is, spoliation, "though not conducted in bad faith, could yet be 'intentional,' 'willful,' or 'deliberate.'" Buckley v. Mukasey, 538 F.3d 306, 323 (4th Cir. 2008). Plaintiff's willful state of mind could justify an adverse inference about Plaintiff's consciousness of the weakness of her case. See Vodusek v. Bayliner Marine Corp., 71 F.3d 148, 155-57 (4th Cir. 1995).

This case is analogous to the situation in Praxair, where Judge Grimm found that the destruction of a laptop and of certain emails--though not necessarily [*17]  in bad faith--was willfull and supported the issuance of an adverse inference instruction. Praxair, 632 F. Supp. 2d at 522-23. Likewise, Plaintiff's conduct in this case justifies a remedy that "levels the evidentiary playing field." Vodusek, 71 F.3d at 156. This Court's goal is that the sanction should "(1) deter parties from engaging in spoliation; (2) place the risk of an erroneous judgment on the party who wrongfully created the risk; and (3) restore the prejudiced party to the same position he would have been in absent the wrongful destruction of evidence by the opposing party." Victor Stanley Inc. v. Creative Pipe, Inc., 269 F.R.D. 497, 534 (D. Md. 2010). The court must "impose the least harsh sanction that can provide an adequate remedy." Victor Stanley, 269 F.R.D. at 534 (quoting Pension Comm. Of Univ. of Montreal Pension Plan v. Banc of Am. Sec., 685 F. Supp. 2d 456, 469 (S.D.N.Y. 2010)).

With this in mind, I recommend that the Court preclude the Blount Letter and the Gollnow Email from evidence. Having been deprived of the opportunity to definitively disprove the authenticity of those documents, Defendants should not suffer any risk that the documents will be deemed authentic by the jury, especially given that the documents, if believed by a jury, are significantly favorable to Plaintiff's case, as can be inferred by their specific inclusion in her Amended Complaint.⁵ This alone, however, does not level the evidentiary playing field. Plaintiff's [*18]  computer may have contained additional evidence helpful to Defendants' case including possible admissions by Plaintiff, evidence that corroborates other portions of Defendants' defense, or additional evidence supporting a potentially improper motive in Plaintiff's filing of the instant suit. Accordingly, I also recommend that Defendants, at their discretion, be permitted to present evidence to the jury of Plaintiff's conduct concerning the circumstances of the loss of evidence in this case as well as the likely relevance of that evidence, and that the jury be instructed that they may consider such circumstances, along with all the other evidence and testimony in the case, in reaching their decision. Of course, the trial judge is in the best position to fashion the precise language for this instruction based on the evidence and testimony at trial. Finally, I recommend that Defendants be awarded reasonable attorney's fees incurred in drafting ECF No. 51, unless the District Judge determines that Plaintiff has no practical ability to pay. See Fed. R. Civ. P. 37(a)(5)(A).⁶

5   Without reaching this substantive issue, I recognize that the preclusion of this evidence given its prominence in Plaintiff's Amended Complaint [*19]  may form the basis for a dispositive motion by Defendants and thus, as a practical matter, could result in the summary disposition of this case depending on whether Plaintiff has any other evidence supporting her claims.

6   The Court notes that all of these remedies, in addition to being consistent with the current Federal Rules of Civil Procedure, are also consistent with the 2015 revisions to Rule 37 (e) of the Federal Rules of Civil Procedure addressing the failure to preserve electronically stored information that will take effect on December 1, 2015 absent action from Congress. See new Rule 37(e) and Comments.

III. Conclusion

For the foregoing reasons, I recommend that Defendants' Motion for Sanctions (ECF No. 51) be GRANTED IN PART AND DENIED IN PART. Any objections to this Report and Recommendations must be served and filed within fourteen (14) days, pursuant to Federal Rule of Civil Procedure 72(b) and Local Rule 301.5(b).