9th Circuit Allows Seizure of "Intermingled Files" in Balco Steroid Cases

Posted on April 7, 2008 by Kevin McBride

In US v. Comprehensive Drug Testing, Inc. et al, the Ninth Circuit Court of Appeals addressed a Fourth Amendment issue arising from an IRS seizure of "intermingled computer files" in executing a subpoena related to the steroids investigation of the Bay Area Lab Cooperative ("Balco").

 

Fans of Major League Baseball will immediately recall that the Balco steroids investigation has implicated numerous MLB players and their trainers in distribution and use of illegal steroids.

 

A Ninth Circuit panel of three judges addressed the questions of when and under what circumstances the government can seize, retain and use computer records that are "intermingled" with other computer files that fall outside of the scope of a subpoena or search warrant.

 

The original subpoena was issued to a Long Beach testing Laboratory, Comprehensive Drug Testing, Inc. ("CDT") targeting 10 MLB players who had been clients of Balco.

 

Intermingled in documents seized from CDT was a computer file referred to as the "Tracey directory" which contained drug testing results of more than 100 MLB players that were not Balco clients, but who had tested positive for steroids.  The government used information from the Tracey directory to the seize specimens and records of these 100 MLB players through issuance of additional subpoenas.

 

Three US district courts heard objections filed by the Major League Players Association in behalf of the players whose specimens and records had been seized.  All three district judges sided with the MLB Players Association, finding the government's search and seizure illegal under the Fourth Amendment.  These district judges were Florence-Marie Cooper (C.D.Cal.), Susan Illston (N.D.Cal) and James Mahan (D. Nev.). 

 

The Ninth Circuit, with one dissent, disagreed with each of the district courts' rulings.  The rulings by Judge Illston (N.D.Cal.) and Judge Mahan (D.Nev.) were reversed, and the decision by Judge Cooper (C.D.Cal) was affirmed, but only because the government did not properly perfect its appeal of that ruling.

 

The Ninth Circuit panel (opinion by Diarmuid O'Scannlain) explained:

 

Although the Players Association contends that the government behaved unreasonably by copying the entire Tracey directory, an analysis of the difficulty of segregating intermingled electronic data reveals the opposite. The Federal Judicial Center recently explained:

[S]ome computer-based transactions do not result in a conventional document, but instead are represented in integrated databases. Even less-complex ESI [electronically stored information] may be incomprehensible and unusable when separated from the system that created it.

Moreover, the volume and multiple sources of ESI may lead to disputes about the scope of discovery and may make review to identify and segregate privileged information more difficult .

At the risk of losing data, the government ensured that CDT could continue its business activities, thus evidencing the reasonableness and restraint.

 

The subpoena had allowed the government agents to "make an initial review of any computer equipment and storage devices to determine if the search could take place on location."  If the agents determined an on-site search was not feasible, they were authorized to remove the computers and storage equipment to an "appropriate law enforcement testing laboratory for further review."

 

Because of the breadth of the subpoena, and because the seizure allowed the testing laboratory (CDT) to continue its business activities with minimal constraint, the seizure was deemed by the Ninth Circuit to be a "reasonable" restraint, notwithstanding the lack of logical connection between the Fourth Amendment rights of the MLB players and the business convenience of the third-party testing laboratories.

 

As a result, government agents were allowed to remove and review the intermingled files, including the "Tracey directory" containing the names of 100 additional MLB players who were not the target of the original investigation.

 

And because the search itself was not "unlawful," the government was thereafter allowed to use the information provided in the seized Tracey directory to obtain testing specimens and records of 100 additional MLB players.  This was not, according to the Ninth Circuit, "fruit of the poisonous tree."

 

While civil cases receive the majority of focus of electronic discovery analysis, the sweeping breadth of ESI's potential treatment under the Fourth Amendment is an issue for all attorneys to be aware of, as this Ninth Circuit case demonstrates.

 


 
Tags: , , , , ,

CACD Mag. Judge Chooljian Orders Production of Server Log Data

Posted on February 29, 2008 by Kevin McBride

Columbia Pictures v. Bunnell (CACD) is one of the music industry’s noted cases against illegal file sharing of downloaded music.  The opinion was authored by Magistrate Judge Jacqueline Chooljian (Spring Street Courthouse).

 

The discovery dispute centered around: (a) whether information temporarily recorded in RAM could be defined as “electronically stored information” under FRCP Rule 34(a), (b) whether the court could order activation of the server log functions to record the identity of users, (c) whether Netherlands law prevented discovery, and (d) whether other US laws prevented discovery.

 

Columbia Pictures et al. were represented locally by Loeb & Loeb (Santa Monica) with Jenner & Block (New York City) as lead counsel.  Defendants were represented by Kirk J. Retz (Torrance).

 

This case offers an example of the potential reach of electronic discovery in an extraordinary case where a party intentionally makes discovery information inaccessible.

 

Opinion Highlights:

 

1. Random access memory (RAM) stored in defendants’ servers constitutes “electronically stored information” within the meaning of FRCP Rule 34(a).


2. Contracting the server maintenance functions to third party did not change the fact that the servers were within the “possession custody and control” of defendants by virtue of the defendants ability to manipulate at will how the data in issue is routed.


3. On the balance of interests, it was appropriate to require defendants to active the server logging function in order to identify and produce pertinent user data (with IP addresses masked) that had been temporarily recorded in the servers’ RAM.


4. Locating the servers in the Netherlands did not put the servers out of reach of a US court‘s discovery order.

 


Discussion:

 

Defendant Justin Bunnell and others had created a software program (“BitTorrent”) to facilitate peer-to-peer file sharing, widely used to share music files. Defendants also created an Internet web site search engine that enabled users to locate and download the musical performances (or other “dot-torrent” files) identified on the Internet by the user’s search.

 

 The servers that facilitated search and download were physically located in the Netherlands.

 

Defendants did not keep records of the identity of users who searched and downloaded music files from its Netherlands-based servers. In addition, defendants disabled the server logging functions that would have recorded the IP address of persons accessing its servers. Finally, the job of managing the servers facilitating music downloads was outsourced to a third party.

 

 It would seem that these management decisions were designed, at least in part, to protect the identity of users who were downloading music without paying for it.

 

The plaintiff music companies sought to discover the IP addresses of persons who had used the BitTorrent software and website to show the number of downloads that originated within the United States, and therefore were illegally downloaded. Defendants claimed that it had no such information since no login files were maintained; and that discovery was beyond the reach of US law since the servers were located in the Netherlands.

 

 The music companies countered, explaining in an evidentiary hearing that identity of users could be determined by activating the server log function in the website servers and recording login activity available from the servers’ random access memory (RAM). (RAM is temporary computer memory that remains active for about 6 hours—long enough to be logged.) 

 

After evaluating the interests for and against activation of server log data to record the information sought in production, Judge Chooljian agreed with the music companies and ordered defendants to activate server log functions to record data stored in RAM.

 

 Judge Chooljian’s order in this case has been criticized by technology companies and their counsel who fear that RAM will now become an ordinary part of discovery in all cases and that routine preservation RAM will be mandatory. I don’t read the order that broadly. In fact, Judge Chooljian went out of her way to comment in footnote 31 that:


The court emphasizes that its ruling should not be read to require litigants in all cases to preserve and produce electronically stored information that is temporarily stored only in RAM. The court’s decision in this case to require the retention and production of data which otherwise would be temporarily stored only in RAM is based in significant part on the nature of this case, the key and potentially dispositive nature of the Server Log Data which would otherwise be unavailable, and defendants’ failure to provide what this court views as credible evidence of undue burden and cost.

Thus, Judge Chooljian’s order was because the Server Log Data was potentially dispositive to the case, it was the key evidence in the case, the evidence would otherwise be unavailable, and defendants could not show undue burden or cost of requiring the data to be logged and produced.

 

 There was really no other way of getting at this critical information. Server activation logs had been disabled. Servers were located outside the United States. A third party company was retained to manage server accounts. This was seemingly done to prevent any kind of discovery into the identity of the BitTorrent file sharing users. Judge Chooljian would not reward these efforts to avoid potential legal responsibility through a front of anonymity.

 

First, the judge addressed a threshold issue of whether RAM data could even be categorized as “ESI” under FRCP Rule 34(a).  Judge Chooljian cited the Advisory Committee Notes that explain Rule 34(a)(1) “is expansive and includes any type of information that is stored electronically,” and that it “is intended to be broad enough to cover all current types of computer-based information, and flexible enough to encompass future changes and development.”

 

 She then cited a Ninth Circuit case, MAI Systems Corp. v. Peak Computer, Inc., 991 F.2d 511, 518-19 (9th Cir. 1993) which determined that RAM was “fixed” in a tangible medium and “was sufficiently permanent or stable to permit it to be perceived, reproduced, or otherwise communicated for a period of more than a transient duration.”

 

 With these two steps, she concluded that RAM can be defined as ESI for the purposes of FRCP Rule 34(a).

 

Second, she ruled that defendants maintained “possession, custody and control” over the information, even though it was technically in the hands of third parties, reasoning that “[f]ederal courts have consistently held that documents are deemed to be within a party’s possession, custody and control for purposes of Rule 34 if the party…has the legal right to obtain the documents on demand.” In re Bankers Trust Co., 61 F.3d 465, 469 (6th Cir. 1995).

 

 Because the defendants retained the right to modify server routing information, Judge Chooljian concluded that defendants factually and contractually had possession custody and control over the servers.

 

Third, Judge Chooljian dealt with the unusual circumstance of requiring defendants to activate server log functions in order to preserve server log data for production. Defendants had correctly argued that a party “cannot be compelled to create, or cause to be created, new documents solely for their production.” Paramount Pictures Corp. v. Replay TV, 2002 WL 32151632, *2 (C.D.Cal. 2002)(Judge Florence-Marie Cooper), citing Alexander v. FBI, 194 F.R.D. 305, 310 (D.D.C. 2000).  

 

 But in rejecting defendants argument, Judge Chooljian reasoned that because the server log data already exists, is temporarily stored in RAM, and is controlled by defendants, an order requiring defendants to preserve and produce such data is not tantamount to ordering the creation of new data.

 

 Judge Chooljian explained that in determining whether to issue a preservation order in these circumstances, courts balance at least three factors: (1) the level of concern the court has for the continuing existence and maintenance of the integrity of the evidence in the absence of an order directing preservation; (2) any irreparable harm likely to result to the party seeking the preservation of the evidence absent an order directing preservation; and (3) the capability of the party to maintain the evidence sought to be preserved, not only as to the evidence’s original form, condition or contents, but also the physical, spatial and financial burdens created by ordering evidence preservation. Capricorn Power Co. v. Siemens Westinghouse Power Corp., 220 F.R.D. 429, 432-33 (W.D.Pa. 2004).

 

 In undertaking this balancing test, Judge Chooljian noted that defendants had conceded that the activation of a logging function to enable the retention of server log data in RAM would not be difficult. Thus, she found there was no undue burden. She expressed a high degree of concern for continuing existence of the evidence since, in fact, there would be no evidence of the identity of users absent activation of the logging function. On balance, Judge Chooljian found the test weighed to ordering this specific preservation order.

 

 Fourth, Judge Chooljian rejected the conflicts of laws arguments raised by defendants arising from the fact that physical location of most of the servers was in the Netherlands. She pointed out that defendants had retained the ability to manipulate the routing of the server log data from the US and also that the party resisting discovery has the burden of proving a foreign statute should be read to bar discovery in an issue, United states v. Vetco, 691 F.2d 1281, 1289 (9th Cir. 1981)—a burden not met in this case. She also relied on case law holding that foreign blocking statues do not deprive an American court of the power to order a party subject to its jurisdiction to produce (let alone produce) evidence even though the act of production may violate that statute. Richmark Corp. v. Timber Falling Consultants, 959 F.2d 1468 (9th Cir. 1992).

 

Defendants objected to the magistrate judge’s order and moved for review, but District Judge Florence-Marie Cooper denied the motion. Judge Cooper noted that amici briefs had been filed in opposition to the finding that RAM could constitute electronically stored information for the purposes of FRCP 34(a). Defendants (and the amici briefs) argued that information in RAM was temporary and therefore not “stored” information.  Judge Cooper rejected this argument, pointing out, inter alia, that Merriam-Webster’s Collegiate Dictionary (Frederick C. Mish et al eds., 10th ed. 1993) defined the word “store” to mean “to lay away, to accumulate or to place or leave in a location (as a warehouse, library, or computer memory) for preservation or later use or disposal.” (Emphasis by the court.)

 

 Judge Cooper also turned to the definition of “RAM” itself for support: RAM is defined as a storage unit and, due to its speed relative to hard disk drives, is typically used as the computer’s primary storage.” Judge Cooper then reasoned that “Rule 34 requires no greater degree of permanency from a medium than that which makes obtaining the data possible.

 

 As information can be obtained from RAM, it is within the scope of Rule 34 and subject to discovery under the appropriate circumstances.” In response to the amici’s concerns over the “potentially devastating impact of this decision on the record-keeping obligations of businesses and individuals,”

 

 Judge Cooper noted (as did Magistrate Judge Chooljian before her) that “this decision does not impose an additional burden on any website operator or party outside of this case.”

 
Tags: , , , , , , , ,