Should flash drives be produced by Defendant during expedited discovery for a preliminary injunction? If so, who should pay for it? Such were the issues in an Order regarding a Motion to Compel in Network Cargo Systems, U.S.A. v. Pappas, No. 13 C 9171 (N.D.Ill. May 7, 2014).
Plaintiff was the former employer of Defendant. Plaintiff alleged Defendant, after leaving her job in June 2013, downloaded and destroyed files containing confidential and proprietary information to share with her new employer. At a hearing in February 2014, the court ordered Defendant to disclose all devices used between 4/1/13 and 2/14/14. Of the six devices disclosed, the court ordered an independent computer forensic examination of three devices. The examination was to:
1. Search the images for search terms;
2. Look for evidence of wiping software used to eliminate data; and
3. Whether additional storage devices, such as flash drives, had been attached to the devices.
The independent forensic examination uncovered that the flash drives had indeed been attached to the devices during the designated time period: in August, October and December 2013 as well as January 2014. Plaintiff moved to compel the production of the flash drives, but Defendant objected, claiming the search of the flash drives would unnecessarily expand the scope of the search as originally contemplated. Defendant also claimed that she, as an individual, could not afford further discovery expenses but Plaintiff, as a business entity, could.
The court ordered Defendant to produce the flash drives for forensic examination, but with a caveat. As the flash drives were inserted into the personal devices months after Defendant left her job with Plaintiff, the court recognized that the likelihood of her using these drives to transfer confidential information would be more remote as time went on. Therefore, Plaintiff was ordered to bear the costs for the forensic examination of the flash drives.