Don’t Blame Your Niece for Sinking Your iPhone in Diet Coke When You Own an eDiscovery Company

The case of Shawe v. Elting, is the eDiscovery version of War and Peace. It is a case study on how a party’s level of knowledge can impact its duty to preserve ESI, along with a long list of bad acts warranting awarding costs. The case is a battle between business partners who owned an eDiscovery company. Shawe v. Elting (In re Shawe & Elting LLC), C.A. No. 9661-CB (Del. Ch. July 20, 2016).

The Court ultimately found by clear evidence that Shawe acted vexatiously in bad faith by destroying data on his laptop that he was ordered to preserve; recklessly failing to preserve his iPhone; and repeatedly lying under oath about accessing Elting’s hard drive and the deletion of information from his laptop. Moreover, he was the co-owner of an eDiscovery company. He had people who could perform computer forensics to preserve data, but instead had people with no training in data preservation be responsible for preserving an iPhone.

Advertisement

Then there was the amateur spying and intraoffice espionage. The timeline reads like a pulp fiction novel.

THE TIMELINE

• OCTOBER 2013. Elizabeth Elting hired attorneys at Kramer Levin Naftalis & Frankel LLP to try to negotiate a resolution of the increasingly acrimonious disputes between the parties.
• OCTOBER 2013. The hired law firm enraged Phillip Shawe. Instead of hiring his own lawyers, and in the words of the court, “engage in a mature dialogue,” Shawe undertook a campaign to spy on Elting in pursuit of what had become a personal battle in which Shawe was determined to get his way over Elting at all costs, even if (to use Shawe’s words) it meant “shutting down” or “dismantling” the company.
• DECEMBER 31, 2013. Shawe had employees intercept Elizabeth Elting’s mail and monitor phone calls. Shawe went full Mission Impossible on New Year’s Eve 2013. He used a master cardkey to access Elting’s office and took her computer. Shawe then had Michael Wudke, president of TransPerfect’s Forensic Technology division, waiting in his office to make a forensic image of Elting’s computer. Wudke was unaware of whose computer it was. After Shawe returned Elting’s computer to her office, he directed Wudke not to document the copying.
• JANUARY 1-2, 2014. On January 1 or 2, 2014, Shawe ordered Wudke to search for emails on the image Wudke had made of Elting’s hard drive. Wudke saw that one of the files was named “[email protected],” from which he deduced that the hard drive was Elting’s. Wudke then gave the external device containing Elting’s emails to Shawe.
• FEBRUARY 2014. Wudke taught Shawe how to use Nuix, a forensic searching tool, to search Elting’s emails extracted from her computer.
  MARCH 31, 2014. Shawe began accessed Elting’s computer remotely. Event logs from Elting’s and Shawe’s work computers show that Shawe used this method to access Elting’s computer at least 44 times on 29 different dates between March and July 2014. Of these events, 18 occurred late in the evening or in the early hours of the morning. Through these stealthy means, Shawe ultimately gained access to approximately 19,000 of Elting’s Gmails, of which two-thirds were privileged communications with her counsel.
• APRIL 1, 2014. Shawe hired Nathan Richards to act as a spy under the pretense of a marketing assignment. Richards used a card key on April 6, 2014 to enter Elting’s office at 4:47 a.m., took photos, including the inside of her file cabinets, and removed hard copies of documents, which Richards delivered to an investigator working for Shawe’s lawyers at Sullivan & Cromwell LLP.
• APRIL 11, 2014. Litigation Hold notices were sent out to employees. The notice applied to both text messages and data on laptop computers. The hold notice instructed that recipients were
  “to retain and not destroy any documents or communications, either in hard copy or electronic form, relating in any way, either directly or indirectly, to Shawe & Elting LLC. If you are uncertain as to whether a particular document related to this matter, it should be retained.” Shockingly, Shawe did not preserve his own iPhone or laptop. Moreover, no one instructed Richards that he had to preserve his own ESI, despite his key task was “document preservation.”
• MAY 2014. Shawe entered a Consulting Agreement with Richards in May 2014. The document was backdated to April 4, 2014. Richards was to perform paralegal and litigation support services, something he had no experience in. Instead, Richards’ background was marketing. Richards received $30,000 a month and earned $250,000 for nearly 10 months of work – twice as much as his prior earnings and highly beyond average litigation support paralegal wages. Under the guise of a baseless fraud investigation, Shawe had Richards enter the offices of Elting and Gale Boodram in the early mornings to photograph their files with procedures Richards gleaned from TV crime shows.
• MAY 2014. Shawe and Elting filed four separate lawsuits against each other.
• SEPTEMBER 3, 2014. Elting served Shawe discovery requests seeking Shawe’s text messages, communications from Shawe’s personal email addresses, and documents concerning Richards.
• SEPTEMBER 3, 2014. Elting also sent a litigation hold notice, which called for the preservation of documents, including emails and text messages on personal phones and laptops.
• SEPTEMBER 26, 2014. The court held a conference and granted Elting leave to retain Deloitte to collect the company’s electronically stored information.
• NOVEMBER 15, 2014. Elting learned Shawe had accessed her personal Gmail and attorney-client communications.
• NOVEMBER 18, 2014. The court ordered consolidated trial for February 23, 2015.
• NOVEMBER 22, 2014. It is never a good sign when the court uses the word “allegedly.” Shawe claimed his niece submerged his iPhone in a Diet Coke. The court noted the phone ended up being discarded in a strange episode and was never made available for a forensic examination.
• NOVEMBER 24, 2014. Without any mention of the litigation hold, Shawe asked his assistant Joe Campbell to try to revive the phone.
  THANKSGIVING WEEK 2014. Campbell did not visit Apple or ask the forensic team for assistance. After “modest” efforts to restore the phone, he put it in his desk.
• DECEMBER 2014. As if circumstances were not odd enough, things got “bizarre.” Campbell claimed he threw out all his desk contents because a rat got in his drawer and ate a PowerBar. Problems with this story: Campbell’s office was on the 39th floor of a commercial office at 3 Park Avenue. Campbell was paralegal for five years and received both Litigation Hold Notices.
• DECEMBER 2, 2014. Elting moved for expedited discovery, in aid of a motion for sanctions.
• DECEMBER 11, 2014. The court ordered Expedited Discovery. The order granted discovery on an expedited basis into “[t]he full extent of, and reasons for, Shawe’s attempt to access Elting’s Gmail,” including the “identity and role of all persons who assisted Shawe in such conduct and who were aware (or should have been aware) of such conduct (and when).” It directed Shawe to respond to Elting’s interrogatories and document requests, and permitted Elting to depose “Shawe and other individuals who either assisted Shawe in accessing Elting’s Gmail . . . or individuals who were otherwise involved or knew of Shawe’s conduct.” The order also permitted Elting to take forensic discovery of Shawe’s “computers, telephones, and any other devices or systems that may contain information relevant to the issues presented in the Expedited Discovery Motion.”
• DECEMBER 11-19, 2014. Shawe deleted approximately 19,000 files from his laptop prior to imaging on December 20. Shawe’s data deletion took three forms: (1) Shawe’s uncharacteristic emptying the computer’s recycle bin of several thousand files, some dating back to August 2014; (2) Shawe cleared his temporary internet files, including three different internet browsers’ history dating back to at least August 2013; (3) Shawe deleted software applications’ temporary files including NUIX. Michael Bandemer, Shawe’s expert, testified that Shawe deleted 18,970 files from his computer on December 19, contradicting Shawe’s trial testimony that he did not delete any files before the forensic imaging on the 20th.
• DECEMBER 20, 2014. Wudke forensically imaged Shawe’s computer and, based upon Shawe’s instruction, did not document his work. Before leaving for Europe, Richards deleted all his text messages.
• DECEMBER 22, 2014. Using CCleaner, a robust anti-forensic software tool, Shawe and Wudke deleted another 22,000 files. The unrecoverable deleted files included the extracted Elting’s privileged emails with her attorneys. Shawe claimed he was protecting his “personal, medical, and privileged” information. Shawe’s attorneys engaged Michael Bandemer to perform computer forensics. Shawe
  did not tell Bandemer (nor his attorneys) about the extent of the data destruction activities.
• DECEMBER 26, 2014. Bandemer imaged Shawe’s computer. Bandemer observed the telltale use of CCleaner since many files had been renamed with “random Z characters.”
  JANUARY 2015. Campbell could not recall when he discarded Shawe’s phone whether it was before or after the Expedited Discovery Order. He did recall Shawe asking him about the phone in January and Campbell told him he had thrown the phone out.
• JANUARY 9, 2015. Bandemer reported to Shawe’s counsel his findings about the data deletion.
• JANUARY 12, 2015. Shawe flew to San Diego from New York
  to personally deliver Wudke’s December 20 image to Bandemer.
• JANUARY 16, 2015. Shawe’s professional responsibility counsel sent a letter to Elting that was also filed with the court that disclosed Shawe’s data deletion. The letter reported, “Mr. Shawe states as follows: After the Court issued the Expedited Discovery Order, Mr. Shawe continued to use his personal laptop in the ordinary course of business. At that time, he did not believe that the Expedited Discovery Order required him to disclose personal, medical or privileged material to Ms. Elting’s counsel or anyone else.”
• JANUARY 20, 2015. Prior to his scheduled deposition on the 20th, Shawe did not tell his lawyers about the data deletion. He only disclosed the information after being apprised of Bandemer’s findings. Shawe gave false testimony at his deposition to conceal Wudke’s involvement in copying Elting’s hard drive and deleting data. Shawe omitted Wudke’s involvement in the New Year’s Eve extraction of information from Elting’s hard drive. Instead, Shawe falsely claimed he performed DIY forensics to image Elting’s computer and exported the files using Wudke’s borrowed equipment. Shawe testified that Richards assisted in both making an image of Elting’s hard drive and in deciding what privileged information to delete. The court conjectured Shawe made Richards his scapegoat because Richards was quitting his job with Shawe and moving back to Washington state.
• FEBRUARY 2, 2015. The court order provided, “Shawe has failed to allow Elting to conduct forensic discovery of computers, telephones, and other devices or systems in his possession, custody, or control that may contain information relevant to the issues presented in the Expedited Discovery Motion, despite Elting having requested on multiple occasions that Shawe comply fully with the Expedited Discovery Order.”
• FEBRUARY 11, 2015. Counsel informed the court that Shawe made no effort to preserve his text messages.
• FEBRUARY 15, 2015. Shawe produced 537 text messages spanning two weeks. Counsel stated in an affidavit that Phillip Shawe could not find his cell phone.
• FEBRUARY 19, 2015. The court ordered production of text messages between Shawe and Richards. Shawe did not tell the court that Richards had quit.
• FEBRUARY 23, 2015. At trial, Shawe testified falsely that Richards performed the data deletions. Shawe also lied under oath that he did not know who made the December 20 image.
• APRIL 3, 2015. Shawe repeated the lie in an affidavit that Richards made the December 20 image.
• NOVEMBER 25, 2015. Shawe’s counsel disclosed Wudke’s involvement. Wudke’s deposition followed. Dirt all comes out during this deposition.
• JANUARY 7, 2016. Bandemer recovered 17,902 out of the 18,970 deleted records from a Windows “volume shadow copy.” 1,068 records were not recovered.

DESTRUCTION OF DATA THAT THE COURT ORDERED PRODUCED

There was not one, but two, litigation hold notices that had been sent out to both parties to their company. Moreover, the Expedited Discovery Order after the first signs of wrongdoing, granted Elting leave to conduct forensic discovery of Shawe’s computers. There is no denying that Shawe’s laptop would have been covered by the Expedited Discovery Order. Instead of turning his computer over to counsel for the forensic expert to preserve the data, Shawe secretly deleted data on the laptop, without the assistance of counsel. He almost got away with it, if not for two events. The first was the “shadow copy” that preserved deleted files. The second was the December 22 deletions after the December 20 imaging.

The very existence of the December 20 image was what the court called Shawe’s “get out of jail free card” in the event he got caught. This demonstrates there was intent to deprive the other party data. Moreover, this forensic image was not turned over to the expert witness until the expert witness found evidence of data destruction.

Advertisement

There was no question Shawe violated the court order to turn over his laptop for forensic analysis. First, the order was “not a license to self-define the universe of information to be searched forensically.” The point of the order was to make the computer available for forensic investigation.

Moreover, the files he deleted had an organizational structure he created for noteworthy Gmail, such as voicemails from Elting’s attorneys. In addition, unlike Shawe claimed, the very subject matter of these deletions had nothing to do with any personal information on his laptop.

The court did not believe that there was any ESI permanently lost, however, this was an experiment in driving up costs and wasting the court’s time. It took two months for Elting to get the laptop data, a mere three weeks before trial.

THE “MY NIECE DESTROYED MY IPHONE IN DIET COKE” AND “RAT ATTACK” ARGUMENTS

Shawe had a duty to preserve his iPhone because, (1) he should have known it was relevant to the action; (2) was reasonably calculated to lead to the discovery of admissible evidence; (3) was reasonably likely to be requested during discovery; and (4) was subject to a pending discovery request.

First, Shawe used text messages to communicate with employees, thus would have had relevant information. The court found it was reckless to not safeguard the phone when he was in four lawsuits by September 2014, that included discovery being served on him, and he had two litigation hold notices, one sent by him.

The twin suspicious stories of a niece dropping his iPhone in Diet Coke and then Campbell throwing out the entire contents of a drawer because of rat droppings (in an office on the 39th Floor) also raised questions about what really happened to the phone.

The court held that Shawe was reckless in the loss of his phone. Moreover, the Court noted that Shawe had a modus operandi of using others to do his dirty work, from Wudke imaging hard drives on New Year’s Eve, to Richards with no paralegal training being paid $30,000 a month to photograph offices before dawn, to Campbell being given the iPhone with no instructions for preservation. This was highly suspicious, since Shawe owned an eDiscovery company with qualified individuals to perform computer forensics and had attorneys who had retained computer forensic experts.

Recklessness in Delaware is “as a conscious awareness of the risk that one’s action or inaction may cause evidence to be despoiled.” Shawe should have known that giving his phone to someone who was not an expert in computer forensics had a high risk for losing evidence.

THE REMEDY

The court shifted all reasonable attorney’s fees and expenses to Shawe for his actions in the Sanctions Motion. Given the bad faith actions, the court also shifted 33% of the trial expenses to Shawe.

The knowledge and over the top actions of Shawe were the grounds for the high sanctions award. Moreover, Shawe had the resources to preserve the ESI on his computer and phone, but decided to play spy master instead of complying with discovery.