Electronic Discovery and Computer Forensics Case List - Kroll Ontrack

� U.S. v. Ziegler, 456 F.3d 1138 (9th Cir. 2006). In an appeal from Montana district court, defendant
claimed that child pornography and other information found on his workplace computer was
protected as private information under the 4th Amendment. Plaintiff argued that a workplace
computer is much like a locked desk drawer in an office and that a similar expectation of privacy
should follow. However, the government argued that no employee can possibly have an
expectation of privacy when the computer and internet access is paid for by the employer and
when there is an entire company department dedicated to monitoring employee’s internet use. The
court held that the defendant could not have an objective expectation of privacy since his employer
published and practiced a computer monitoring policy. The court noted that the defendant’s
personal password protection did not increase privacy expectations. Furthermore, the court stated
that if the employer did not have a properly practiced policy in place, than an objective expectation
of privacy may have existed for defendant. However, the court concluded “[s]ocial norms suggest
that employees are not entitled to privacy in the use of workplace computers.”
� Barton v. United States, 2005 WL 1355481 (9th Cir. June 9, 2005). In a suit relating to an
antidepressant drug, the trial court denied the plaintiff’s writ of mandamus to prevent disclosure of
answers to a law firm questionnaire completed online by prospective clients. The trial court’s
decision rested on a disclaimer on the bottom of the questionnaire that stated filling out the
questionnaire "does not constitute a request for legal advice and that I am not forming an attorney
client relationship by submitting this information." On appeal, the court reversed the trial court’s
decision and determined the questionnaire answers were submitted in the course of prospective
attorney-client relationship and were thus confidential and protected by the attorney-client privilege.
� United States v. Gordon, 393 F.3d 1044 (9th Cir. 2004). After discovering missing stock shares,
an employer suspected embezzlement and requested the defendant’s laptop computer for
examination. The employer specifically told the defendant not to delete anything from the hard
drive. A computer forensic analysis revealed the defendant attempted to overwrite files on the
computer by running “Evidence Eliminator,” a software wiping program, at least five times the night
before he turned over the computer. The defendant was convicted of embezzlement and ordered
to pay restitution, including reimbursing the employer for a portion of the investigation costs. On
appeal, the defendant argued the trial court should not have awarded the employer investigation
costs, including the costs of the forensic examination. The appellate court rejected this argument
and affirmed the district court’s award, noting the defendant “purposefully covered his tracks as he
concealed his numerous acts of wrongdoing from [his employer] over a period of years. As the
victim, [the employer] cannot be faulted for making a concerted effort to pick up his trail and identify
all the assets he took amid everything he worked on.”
� Theofel v. Farey Jones, 341 F.3d 978 (9th Cir. 2003), amended by, 359 F.3d 1066 (9th Cir.
2004), cert. denied, 125 S. Ct. 48 (2004). Seeking e-mail discovery, a party in a commercial
litigation issued a third party subpoena on the opposing party’s Internet Service Provider (ISP).
Instead of limiting the scope of the subpoena to particular subject matters, custodians, or time
periods, the subpoena sought all e-mail to or from the opposing party. The ISP substantially
complied, but when the opposing party learned of the subpoena, it moved to quash. The court
severely criticized the subpoenaing party for its overbroad subpoena and issued $9,000 in
sanctions. The employees of the subpoenaed party then brought a new civil suit against the
subpoenaing party and its attorney under the Stored Communications Act, the Wiretap Act and the
Computer Fraud and Abuse Act. The trial court granted a motion to dismiss the new suit, finding
that no claim was stated. The Ninth Circuit reversed and reinstated the civil suit, holding that an
overbroad subpoena is not valid especially when directed against a third party that may not have
218