STIPULATED ORDER GOVERNING DISCOVERY OF ELECTRONICALLY STORED INFORMATION
BARBARA J. ROTHSTEIN, District Judge.
In compliance with the Court's December 17, 2019 Minute Order, the parties stipulate to the following order governing the imaging of Defendant's personal and work electronic devices and the production of electronically stored information contained therein.
STIPULATION
1. Purpose and Effect. The Purpose of this Stipulated Order is to facilitate the efficient and cost-effective inspection and production of electronically stored information ("ESI") consisting of emails, documentation, and other ESI in any of Defendant Daniel Semsak's ("Defendant") personal or work computers, communication devices, other equipment, and e-mail, social media accounts, cloud storage and other ESI storage accounts. This Stipulated Order governs all discovery of ESI contained therein, and compliance with this Stipulated Order shall fully satisfy the Parties' and Murphy Company's obligations to produce from the Electronic Devices (as that term is defined below). This Stipulated Order, however, does not obviate the Parties' respective obligations to produce hard copies of documents responsive to future requests for production, to produce other ESI not located on the Electronic Devices, or to provide written responses to discovery requests in accordance with the Federal Rules of Civil Procedure.
2. Imaging of Electronic Devices. Subject to the terms of this Stipulated Order and to facilitate efficient and cost-effective production of ESI, Defendant and his current employer, Murphy Company, which is not a party to this action but stipulates to the entry of this Order, shall make the following electronic devices (each an "Electronic Device," and collectively, the "Electronic Devices") available to Certified Computer Examiner Allison Goodman of eDiscovery Inc. ("eDiscovery") for forensic imaging and analysis, in consultation as suggested by her with Plaintiff's expert consultant, Brandon Leatha of Leatha Consulting, LLC ("Leatha"), and defendant's expert consultant, Tom Howe of Howe & Associates Law Firm ("Howe"): (a) all of Defendant's personal computers, however denominated, whether portable (laptop, tablets, etc.)), desktop, server, or otherwise, used at any time in 2019 or 2020, including scanning devices and printers with memory, devices that may be claimed to be no longer operable, and any and all memory at any time in 2019 and 2020 contained within such personal computers, even if subsequently removed and/or claimed to be no longer operable; (b) all computer devices (of any type) owned or provided by, or through, Murphy Company ("Murphy"), and used by Defendant at any time since Defendant commenced work with Murphy. For the avoidance of doubt, the "computer devices" referred to in this section include only those devices used specifically by Defendant, and do not include Murphy Company's general server or network systems; (c) all of Defendant's personal cellular telephones and other communication devices that were used at any time in 2019 and 2020; (d) all cellular telephones and other communication devices, used by Defendant at any time since Defendant commenced work with Murphy; (e) all USB flash drives or other removable storage drives that Defendant used at any time in 2019 or 2020 and continues to own, possess, or control; (f) all of Defendant's email accounts (including at Murphy) accessed at any time in 2019 or 2020; social media accounts used by Defendant at any time in 2019 or 2020; and cloud storage folders, cloud backup locations, or other internet based electronic data storage account folders and locations, created or used by Defendant at any time in 2019 or 2020 (including at Murphy but only to the extent created or used by Defendant), including Apple iCloud or Google accounts used by Defendant for work or personal purposes, whether while employed by Murphy or with Plaintiff Pacific Woodtech ("Plaintiff"). For the avoidance of doubt, nothing in this Order may be interpreted as permitting or requiring the imaging or inspection of data at Murphy other than Defendant's employee-specific devices and accounts. The direct cost of such imaging shall at this time be shared equally by the parties, subject to later reallocation by the Court as either "costs" or "attorney's fees" and subject to the following procedure:
a. Physical Transfer of the Electronic Devices to eDiscovery. eDiscovery shall obtain the Electronic Devices from Defendant and Murphy, at a mutually agreed upon date and time but before February 25, 2020, and Defendant shall arrange to transport the Electronic Devices to eDiscovery's office in Bellevue, Washington, for forensic imaging, analysis, and production of ESI pursuant to this Stipulated Order and the Stipulated Protective Order ("SPO)."
b. Chain of Custody Log. Industry-accepted evidence handling and storage considerations shall be used when securing, transporting, and storing the Electronic Devices. eDiscovery shall thereafter maintain a written chain of custody log for each of the Electronic Devices (each a "Chain of Custody Log"), which contemporaneously details all custodial activity related to the Electronic Devices. The Chain of Custody Logs shall remain with the Electronic Devices, until their return to Murphy and Defendant (excluding any information belonging to PWT) pursuant to this Stipulated Order. eDiscovery shall retain the original Chain of Custody Log for each Electronic Device.
c. Write-Blocking. eDiscovery shall use an industry-standard and industry-validated hardware write-blocking device when conducting any forensic imaging of the Electronic Devices in order to prevent inadvertent changes from being made to the original Electronic Devices. In the event the use of a hardware write-blocking device is not feasible, a bootable forensic operating system may be used to acquire the original Electronic Device. The bootable forensic operating system shall mount all original physical storage devices in a "read only" mode to prevent making changes and details about the bootable forensic operating system shall be included in the imaging log.
d. Imaging. eDiscovery shall create a full physical forensic image of each of the Electronic Devices. The forensic image may be segmented for storage purposes. The Electronic Devices and images shall be hashed with (i) a combination of MD5 and SHA1 hashes, or (ii) a singular SHA256 hash. The hashes from each of the original Electronic Devices and the corresponding image shall be compared to ensure a match. eDiscovery shall maintain an imaging log for each of the Electronic Devices (each an "Imaging Log"), which contemporaneously details, among other things, all imaging activity related to the Electronic Devices and the above-referenced hash verification. If eDiscovery cannot obtain a physical image from one or more of the Electronic Devices and if eDiscovery recommends creating a logical image or other type of image in order to create a forensic image, counsel for the Parties and eDiscovery shall meet in person or by telephone to discuss the issues and limitations encountered by eDiscovery and the approach recommended by eDiscovery in an effort to reach an agreed-upon approach to image such device.
e. Storage. The Electronic Devices shall be stored in a secure evidentiary location at eDiscovery's office in Bellevue, Washington, at all times. All images of the Electronic Devices shall be stored on Bitlocker-encrypted media using the NTFS file system and shall be retained in a secure eDiscovery evidentiary or forensic lab at all times. Any transfer of images shall be on encrypted media using Bitlocker encryption.
f. Forensic Analysis of Images. eDiscovery shall perform forensic analysis of all collected images for the time period of January 1, 2019 to present, and provide the results of the forensic analysis in a report format to both parties. Forensic analysis shall be "Confidential" pursuant to the parties' Protective Order, and shall include:
i. Device Summary: This report should detail the operating system type, build number, installation date, list of user profiles, MAC times for NTFS $MFT and $MFTMirr for the active OS partition. For mobile devices, the operating system and version, Apple ID/iCloud, web-based or Google (and similar) account details, device last backup date, and synchronization status shall be included.
ii. USB and External Storage: This report should detail the use of external storage devices including USB flash drives, hard drives, CD/DVD, SD cards, cellphones, cameras, and other removable or portable storage devices which may have been used to store PWT confidential information. The report should include at least the unique evidence source or ID, device description, device serial number or UID, first connection date, last connection date, last disconnection date, and all other know connection dates.
iii. File and Folder Interaction: This report should detail the user's interaction with PWT confidential information, if any, stored on the source devices, external storage devices, network storage devices, or other data storage locations. The report should include at least the unique evidence source or ID, file/folder path and name, volume information and drive letter, date of interaction event, relevant file or MAC dates, interaction type (created, accessed, opened, modified, etc.), and interaction source (LNK, Jumplist, Shellbag, etc.).
iv. Internet Browser History: This report should detail the user's Internet Browser History including the use of cloud storage, email, file transfer, or other browser-based activity which may have been used to download, upload, access, or interact with PWT confidential information. The report should include at least the unique evidence source or ID, the browser history location, the date(s) of the visit or activity, the URL, the page title, and user profile or account.
v. File and Folder Deletion: This report should detail the file deletion activity which may have been performed to eliminate existence of or interaction with PWT confidential information. The report shall include information from the Recycle Bin, trash, USNJrnl, FSEvents, or similar locations which may show evidence of file deletion.
vi. Data Wiping and Hiding: This report should detail the use of file wiping, disk cleaning, file encryption, or other anti-forensic tools or techniques which may have been used to hide or eliminate the existence of or interaction with PWT confidential information.
vii. Data Backup and Synchronization: This report should detail the use of file synchronization or backup software that may have synchronized or backed up PWT confidential information. This should include OneDrive, Dropbox, Box, Sugar Sync, iCloud, Google Drive, Carbonite, Crash Plan, BackBlaze, and other similar applications or services.
viii. Document Printing/Scanning: This report should detail the use of Printers/Scanners to print out documents or digitize physical documents, and forensic artifacts related to those. The printing/scanning device may also be examined if it has the capacity to store processed documents.
g. Industry-accepted evidence hard drive handling and storage considerations shall be used when transferring any images. eDiscovery shall initiate a chain of custody log for such images, and the original chain of custody log for these images shall be retained by eDiscovery.
h. Collection Report. Within five (5) business days of completion of imaging of the Electronic Devices, eDiscovery shall prepare and deliver to each party's counsel (simultaneously) a written collection log or report (the "Collection Report") that evidences the process and procedures used by eDiscovery to image each of the Electronic Devices. The Collection Report shall include, among other things, for each Electronic Device: (i) the date, time, and time zone of image creation; (ii) the name and version number of the imaging tool used; (iii) the write blocking method used; (iv) the make, model, serial number, and firmware version of the write-blocking device used or the name and version of the write-blocking software used; (v) the make, model, serial number, hard drive make, hard drive model, hard drive serial number, BIOS/UEFI date and time stored in the Electronic Device, and the hard drive capacity and size; (vi) the hash algorithm and values for each image; (vii) name and contact information for the person who created the image; (viii) any notes of the forensic imaging process; and (ix) any errors or other issues encountered during the imaging process and the steps performed by eDiscovery to remediate any such errors or issues.
i. Physical Transfer of the Electronic Devices. The Electronic Devices shall be returned to Defendant and Murphy immediately upon completion of imaging by a mutually agreed upon delivery method. The parties shall work with eDiscovery to ensure the fastest possible turnaround time, and Defendant and Murphy shall provide a list prioritizing the Electronic Devices in order of most to least urgent to be returned, to ensure the most efficient process.
3. Imaging of Additional Electronic Devices. To facilitate efficient and cost-effective production of ESI, the Parties may agree to make available other computers, laptops, hard drives, servers, tablets, cellular telephones, or other electronic device(s) for forensic imaging subject to the terms of this Stipulated Order using the process outlined in Section 2 above; provided, however, that in the event that technical limitations or requirements necessitate modifying such imaging process for such other computers, laptops, hard drives, servers, tablets, cellular telephones, or other electronic device(s), the Parties shall meet in person or by telephone to discuss the limitations and requirements and any suggested modifications to the imaging process in an effort to reach an agreed-upon approach to image any such device. If the Parties agree to image any such electronic device pursuant to this Stipulated Order, the duty of a producing Party(ies) to produce ESI from such, computers, laptops, hard drives, servers, tablets, cellular telephones, or other electronic device(s) in response to any pending or future request for production shall be limited to making such devices available for imaging using the process outlined in Section 2 above. No Party may argue in any written submission, in open court, or to a jury that the producing Party has withheld ESI from any computer, laptop, hard drive, server, tablets, cellular telephones, or other electronic device that was actually imaged using the process outlined in (and subject to) Section 2 above. Notwithstanding the foregoing, nothing in this Stipulated Order shall preclude any Party from asserting that another Party has failed to preserve or intentionally withheld any documents or ESI.
4. Search Criteria. The Parties will negotiate a list of Boolean key word search terms and other criteria to identify responsive documents ("Search Criteria"). eDiscovery shall run the Search Criteria across all of the data preserved from the Electronic Devices for the period of January 1, 2019 through the present, and a report stating the number of search hits for each term shall be provided to both Parties for review. In the event that a particular search term yields more than 500 results, the parties will work in good faith to agree upon a more restrictive substitute term if needed. Once the parties arrive at a final list of search terms, eDiscovery shall prepare a Search Hit Report that includes the following metadata; unique ID, source Electronic Device, record type (Email, MS Word, Excel, etc.), file path, file name/email subject, email FROM, email TO, email CC, email BCC, email attachment name(s), search hit(s), file size, and MD5 hash, and deliver it to the parties. The Search Hit Report shall be designated "Confidential" pursuant to the parties' Protective Order.
5. Data to be provided to Defendant's counsel for initial review. Within five business days after completion of key word searches, eDiscovery shall deliver to Defendant's counsel native copies of all responsive emails, attachments, and electronic files. Defendant's counsel shall promptly review the responsive data for relevancy and privilege, and shall within 30 days provide a privilege log and a log of documents claimed to be non-responsive ("Withheld Documents"). These logs are anticipated to be auto-generated and shall include the data set forth in Fed. R. Civ. P. 26(b)(5). Defendant and Murphy may designate produced Documents as Confidential or Attorneys' Eyes Only, consistent with the Parties' Protective Order.
6. Production of Responsive and Non-Privileged data. eDiscovery shall exclude the Withheld Documents identified by Defendant's counsel and produce the remaining relevant and non-privileged data to Plaintiff's counsel in native format, subject to the confidentiality and attorneys' eyes only designations assigned by Defendant and/or Murphy. Alternatively, Defendant may produce the remaining relevant and non-privileged data to Plaintiff's counsel in load-file format, providing at least the data set forth on Exhibit A hereto, subject to the confidentiality and attorneys' eyes only designations assigned by Defendant and/or Murphy. In such event, Defendant shall simultaneously provide a copy to eDiscovery. The data shall be provided in encrypted format, and the password therefor shall be separately provided. Defendant's counsel shall provide both a privilege log and a log of documents claimed to be non-responsive to the issues raised in Plaintiff's complaint.
7. eDiscovery shall be the initial level to resolve disputes regarding the relevance of any Withheld Documents, subject to ultimate resolution by the Court at the request of any Party or Murphy. In no event may eDiscovery produce a disputed document to Plaintiff prior to resolution by the Court.
8. Claw Back Of Inadvertently Produced Privileged ESI. To facilitate efficient and cost-effective production of ESI, and in accordance with the Protective Order, the Court hereby adopts the following claw back provision:
a. For purposes of this claw back provision, an "Inadvertently Produced Document" is any privileged document or ESI that is produced through inadvertence, oversight, mistake, neglect, accident, or other error to a party without intent to waive privilege and that could have been withheld, in whole or in part, based on a good faith claim of the attorney-client privilege, work product protection, or any other applicable privilege.
b. Inclusion of any Inadvertently Produced Document in any production of documents or ESI shall not result in the waiver of any privilege or protection associated with such document or ESI, nor shall it result in a subject matter waiver of any kind.
c. A producing Party may at any time prior to commencement of trial demand the return and/or destruction of any Inadvertently Produced Document, which demand shall be made to the receiving Party's counsel in writing and shall contain information sufficient to identify the Inadvertently Produced Document. Within three (3) business days of the demand for the return and/or destruction of any Inadvertently Produced Document, the producing Party shall provide the receiving Party with a privilege log for each such document or ESI that is consistent with the requirements of the Federal Rules of Civil Procedure, setting forth the basis of the claim of privilege for the Inadvertently Produced Document. Additionally, in the event that any substantial portion of the Inadvertently Produced Document does not contain privileged information, the producing party shall provide a redacted copy of the Inadvertently Produced Document omitting the information that the producing Party believes is subject to a claim of privilege within the three (3) business day time period.
d. Upon receipt of a written demand for return of an Inadvertently Produced Document, the receiving Party shall immediately return to the producing Party the Inadvertently Produced Document (and any copies thereof) and shall immediately delete all electronic versions of the document or ESI as well as any reference to the substance of that document or ESI in any work product. Further, the receiving Party shall take steps to exclude the Inadvertently Produced Document from any examination of the forensic image and shall not attempt to re-export or otherwise obtain the Inadvertently Produced Document from any forensic image. No reference to an Inadvertently Produced Document shall be made in connection with the proof of the facts or claims in the above-captioned action unless referenced in a motion to the Court as described in Section 6(e) below or such document is deemed to not be protected by privilege and, thus, not an Inadvertently Produced Document.
e. If a receiving Party receives a document or ESI that, upon review, it has reason to believe may be an Inadvertently Produced Document, the receiving Party shall immediately notify the producing Party in writing in order to permit the producing Party an opportunity to demand its return in accordance with the claw back procedure set forth in this Stipulated Order. If the Parties do not agree regarding the privileged nature of any document that is demanded to be returned by the producing Party, the Parties shall meet and confer in person or by telephone within seven (7) business days from the date that the producing Party receives written notice from the receiving Party. If the Parties are unable to come to an agreement regarding the privileged nature of such document, the receiving Party may seek relief from the Court. Until a determination is made regarding the privileged nature of any such disputed document by the Court or the Parties' expressly agree in writing otherwise, the receiving Party shall ensure that such document is not further disclosed to any person or used for any purpose.
9. Deletion Protocol.
a. After the parties identify and agree to delete certain files, emails, and phone data, if any, containing PWT confidential information, eDiscovery will purge the PWT confidential information from all devices and accounts. eDiscovery will provide both counsel the following:
i. A hard drive or download link to all deleted files, emails, and phone information. Defendant's counsel will maintain this information for "attorneys' eyes only" and will not disclose this information to Daniel Semsak or the Murphy Company.
ii. A report specifying the processes and procedures, including software and technology used to delete the PWT confidential information.
b. Any dispute regarding whether a particular file, email, phone data, or other ESI contains PWT confidential information shall be resolved by the Court. eDiscovery may not purge disputed ESI before the matter is resolved by the Court.
10. Miscellaneous.
a. Nothing in this Stipulated Order shall be deemed to constitute a waiver of any objection that any Party may have to any pending or future discovery request or deposition question, nor shall this Stipulated Order prevent any Party from objecting to production of documents or objecting to other discovery requests on any available grounds, or from seeking alternative protective orders from the Court.
b. Nothing in this Stipulated Order shall limit the right of a Party or nonparty to disclose or use any information and items that it has designated as "CONFIDENTIAL," "ATTORNEYS' EYES ONLY — INTERIM DESIGNATION," or "HIGHLY CONFIDENTIAL — ATTORNEYS' EYES ONLY".
c. Nothing in this Stipulated Order shall prohibit any Party from moving the Court for modification of this Stipulated Order for good cause.
d. Except as specifically provided in this Stipulated Order, the terms, conditions, and limitations of this Stipulated Order shall survive the termination of the above-captioned action.
Dated this 6th day of March, 2020 Dated this 6th day of March, 2020
STOEL RIVES LLP JAMESON BABBITT STITES &
LOMBARD
By: /s/ James M. Shore
James M. Shore, WSBA No. 28095 By: /s/ Bruce P. Babbitt
Reid E. McEllrath, WSBA No. 49668 Bruce P. Babbitt, WSBA No. 4830
600 University Street, Suite 3600 801 2nd Avenue, Suite 1000
Seattle, WA 98101-4109 Seattle, WA 98104-1515
Telephone: (206) 386-7578 (206) 292-1994
Facsimile: (206) 386-7500 Email: bbabbitt@jbsl.com
jim.shore@stoel.com
reid.mcellrath@stoel.com
HAGLUND KELLEY LLP
Marc A. Al (MN ID 247923) (pro hac vice)
33 South Sixth Street, Suite 4200 By: /s/ Eric J. Brickenstein
Minneapolis, MN 55402 Michael E. Haglund, OSB 772030
Telephone: (612) 373-8801 (pro hac vice)
Facsimile: (612) 373-8881 Eric J. Brickenstein, OSB 142852
marc.al@stoel.com (pro hac vice)
200 SW Market Str., Ste. 1777
Attorneys for Plaintiff Pacific Woodtech Portland, OR 97201
Corporation (503) 225-0777
Email: mhaglund@hk-law.com
Email: ebrickenstein@hk-law.com
Attorneys for Defendant
II. ORDER
IT IS SO ORDERED.
EXHIBIT A
Required Fields. BEGDOC, ENDDOC, PAGEAMT, CDVOL (these are the minimum standard only).
Data Load File. A Concordance delimited text file (.DAT) with the standard Concordance delimiters is required.
IMAGE FILE FORMAT & NAMING CONVENTION
File Format. Image files should be 300 dpi, Group IV, B&W tif files (black and white documents) or color jpegs (produce color for color).
File Naming Convention. Image file names should match the bates number (ABC000001.TIF).
IMAGE REGISTRATION FORMAT
File Format. Concordance Image Opticon Format (".OPT" or ".LOG" file). This is a standard file format that should include the first page (document break) "Y" flags. A page count for each document is required.
OCR TEXT FILE FORMAT & NAMING CONVENTION
File Format. Multi-page OCR .txt files are the preferred delivery format.
File Naming Convention. OCR files should be named to match the BEGDOC number of the record the text represents (example: ABC000001.txt).
VOLUME STRUCTURE
Volume label. The volumes should be labeled consecutively with some shortened version of the party name (example: ABC001, ABC002, etc).
ELECTRONIC STORED INFORMATION (ESI) FILES
ESI will contain a tiff image, metadata, and a link to the native. Excel spreadsheets, AutoCAD files, Microsoft Project files, and other non-printable files will be produced with a tiff slipsheet stating document produced in native form with a link to the native. Please provide the metadata for the following fields:
Field Description
NATIVELINK Link to native file when native is provided
PAGEAMT Document Page Count
BEGDOC Beginning Review Document Number
ENDDOC Ending Review Document Number
BEGATTCH Beginning Review Attachment Range
ENDATTCH Ending Review Attachment Range
DOCTITLE Email Subject; Office Doc Title; FileName
DOCDATE Email received date; file creation date — MM/DD/YYYY Format
DOCTIME Email received time; file creation time — 00:00:00 AM/PM
Format
DOCTYPE MIME Type
PARENTDATE Parent Doc Date — MM/DD/YYYY
AUTHOR Document or Email Author
RECIP Document or Email Recipient
COPIED Document or Email Copied
BCC Email BCC
CUSTODIAN Document Custodian (collected custodian)
SOURCE Document Source (collected party)
FILEPATH Full file path as collected
FILEPFOLDER Name of last folder containing file or email
FILENAME Collected file name
FILEEXT Collected file extension
PSTNAME Collected PST File name containing document
SEARCHTERMS Search Term hit for culled data
OTHERPROPS Additional file properties requested
MD5HASH Document MD5 Hash code
CDVOL Processed Volume Name
