When I read it, the first thing that entered my mind was that it's a warning not to use IE or Windows. But really it's more a warning about how hard it is to spoliate evidence in the digital age and get away with it. You should never destroy evidence anyway, whether someone will catch you or not, but I couldn't help but wonder how these folks, assuming the judge is correct, thought they could get away with it. You'll note the alibi in what the judge writes.

If you are a lawyer, you most especially need to read this, particularly if you or your clients use Microsoft Windows. It's a clear cautionary warning about the lack of privacy in proprietary software. There may be a way to cover your tracks in Windows, but self help, even clever self help, isn't likely to work. How, I asked myself, could these folks not know that IE keeps a record of sites visited? Actually, if I was their lawyer, I'd probably have argued that it indicated the alibi was truthful, that they did know and were obviously not trying to cover up any misdeeds. Well. Maybe.

It's a ruling in a situation that involved a motion for sanctions, then, one which was granted based on evidence the judge ruled indicated deliberate efforts to avoid discovery. The sanctions granted were a default judgment and having to pay some of the other sides' legal fees and costs. No punitive damages were granted. You'll also see that discovery went on for five years, just in case you thought such things only happen to SCO. And notice how some judges are becoming more clueful when it comes to computers. Personally, I find that encouraging. But what I want you to focus on is how the party got caught. To me, anyway, it's funny. It's a geek thing, I guess.

********************************

UNITED STATES DISTRICT COURT
EASTERN DISTRICT OF NEW YORK

-------------------------------------------------------X

ARYEH GUTMAN, et al.,

Plaintiffs,

-against-

ZALMAN KLEIN, et al.,

Defendants.

_______________________________

REPORT AND
RECOMMENDATION

03 CV 01570 (BMC)(RML)

___________________

LEVY, United States Magistrate Judge:

On April 1, 2003, plaintiffs Aryeh Gutman ("Gutman"), A to Z Holding Corp., A to Z Capital Corp., Paz Franklin Company, and Washington Greene Associates (collectively, "plaintiffs") commenced this action against defendants Zalman Klein ("Klein"), Dina Klein, Rachel Brach, Rodney Capital Company, Toyv Corporation, Republic Capital Group, LLC, Atlas Furniture Manufacturing Corp., A to Z Holding Corp., A to Z Capital Corp., Paz Franklyn Company, Washington Greene Associates, and others (collectively, "defendants"). (See Complaint, dated Apr. 1, 2003 ("Compl.").) During the course of discovery, plaintiffs uncovered what they believe to have been the spoliation of crucial evidence on Klein's laptop computer ("the Klein laptop"). Plaintiffs now move the court to sanction defendants for destroying this evidence. Specifically, plaintiffs ask the court to (1) enter a default judgment or similar terminating sanction against defendants, (2) assess punitive monetary sanctions against defendants, and (3) reimburse plaintiffs' attorney's fees and costs incurred as a result of the current discovery dispute. (See generally Proposed Findings of Fact and Conclusions of Law in Support of Plaintiffs' Motion for Terminating Sanctions Against Defendants for Spoliation of Evidence and Discovery Abuse, dated Aug. 25, 2008 ("Pls.' Facts & Conclusions"); Plaintiffs'

Motion for Sanctions, dated Apr. 15, 2008.) Defendants oppose plaintiffs' motion. (See generally Defendants' Proposed Findings of Fact and Conclusions of Law on Motion for Spoliation Sanctions, dated Aug. 25, 2008 ("Defs.' Facts & Conclusions").) I held an evidentiary hearing on the matter on July 29 and 30, 2008. For the reasons stated below, I respectfully recommend that plaintiffs' motions for a default judgment and for attorney's fees and costs be granted, and that inquests be conducted to determine the amounts of the default judgment and fee award. I further recommend that plaintiffs' motion for punitive monetary sanctions be denied.

BACKGROUND¹

A. Procedural History

During this case's five years of discovery, I ordered Klein "to advise opposing counsel . . . of the location of all desktop and laptop computers under [his] dominion and/or control" and also ordered him to provide plaintiffs' counsel and their retained expert access to the computers on or before December 8, 2005 so that they could copy the computers' hard drives for examination. (See Order, dated Nov. 30, 2005 (reaffirming & modifying Nov. 7, 2005 order).) According to plaintiffs, when their counsel and expert, Douglas Vitale ("Vitale"), arrived at Klein's residence on December 8, 2005 to copy the hard drives pursuant to my order, "Defendants offered Mr. Klein's desktop computer for imaging, [but] refused to produce Mr. Klein's laptop for nearly two hours." (Letter of Darren Oved, Esq. (Jan. 5, 2008) ("Jan. 5, 2008 Oved Ltr.") at 3; see also Order, dated Nov. 30, 2005.) When Klein eventually produced the

-2-

Klein laptop, plaintiffs found that "it was hot to the touch and a screw was missing from its hard drive enclosure." (Jan. 5, 2008 Oved Ltr. at 3.) Plaintiffs believed that defendants had tampered with the computer. (Jan. 5, 2008 Oved Ltr. at 3; see also Letter of Darren Oved, Esq. (Dec. 20, 2005).)

In response to these events, on May 3, 2007, pursuant to Federal Rule of Evidence 706, I ordered a court-appointed forensic expert, Stroz Friedberg, LLC ("Stroz Friedberg"), to analyze Mr. Klein's hard drives for evidence that Mr. Klein (a) visited the web sites listed in the deletion log (specifically www.ntfs.com), (b) downloaded a program which can delete files so they are not recoverable, (c) changed the name of the program and then deleted it and (d) subsequently deleted files. (Order, dated May 3, 2007.) See Fed. R. Evid. 706(a). I further ordered Stroz Friedberg to "prepare a report detailing the above as well as whether the program was used to delete files which were then rendered completely or partially unrecoverable as a result." (Order, dated May 3, 2007.) Although I directed plaintiffs initially to pay for the expert examination, I held that plaintiffs may seek "additional relief" if Stroz Friedberg "concludes that Mr. Klein engaged in the activities described . . . above." (Id.)

B. The Stroz Friedberg Report

1. Stroz Friedberg's Credentials

Stroz Friedberg, a consulting and technical services firm specializing in digital forensics, computer crime response, electronic discovery, and the preservation, analysis, and production of electronic data, is managed by former federal prosecutors, federal agents, and local law enforcement officers with government and private sector experience in traditional and cyber-

-3-

based investigations, computer forensics, data preservation and analysis, and infrastructure protection. (See Stroz Friedberg, LLC, Forensic Analysis of the Klein Laptop Pursuant to Court Order in Gutman, et al. v. Klein, et al. (Nov. 2, 2007) ("Stroz Report")) ¶ 5.) Jeffrey G. Bolas ("Bolas"), a Digital Forensic Examiner and Investigator at Stroz Friedberg, prepared the Stroz Report under the supervision of John F. Curran ("Curran"), Managing Director of the firm's New York office. (See Stroz Report ¶ 6.) Among his various accomplishments, Bolas, who received a Bachelor of Arts in computer science from Williams College and a Master of Fine Arts from Columbia University, has conducted numerous data acquisitions and digital forensic analyses; led the firm's response in several data breach investigations; and received training in the use of digital forensic investigative tools. (See Stroz Report ¶ 7.) Curran served as Deputy General Counsel for National Security Affairs at the Federal Bureau of Investigation and, for over a dozen years, as an Assistant United States Attorney for the Eastern District of New York. (See Stroz Report ¶ 8.) During his time at Stroz Friedberg, Curran, who oversees digital forensics, cyber-crime, and private investigations and manages electronic discovery projects, has spearheaded several computer intrusion investigations; led numerous digital forensic investigations; and was appointed Special Master by this Court to oversee the review, redaction, and production of sensitive government records in a class action against gun manufacturers. (See Stroz Report ¶ 9.)

2. The Stroz Report

Douglas Vitale ("Vitale"), an examiner with The Intelligence Group, a computer forensics and investigations company working on behalf of Gutman, forensically copied, or

-4-

"imaged," the Klein laptop's hard drive on December 8, 2005.² (See Stroz Report ¶¶ 10-11.) Stroz Friedberg took possession of the forensic image in my chambers on November 14, 2006.

a. User M Visited Websites in the Deletion Log

According to Stroz Friedberg's analysis, the Klein laptop's Internet Explorer cache and Internet History logs reveal that a user named "M" ("M") visited the website "www.ntfs.com" and other websites related to the Windows XP operating system ("Windows XP"), data recovery, and data deletion on December 6, 2005, two days before the forensic imaging. (See Stroz Report ¶¶ 13, 15.) One of the www.ntfs.com-related webpages detailed data-recovery methods, while another page described "a secure hard disk wiping program, 'Active@ KillDisk,' and provide[d] a link to 'Active@ Boot Disk,' . . . free trial software available for download that contains, among other utilities, data recovery tools and the KillDisk secure wiping tool." (Stroz Report ¶ 15; see also Stroz Report Figure 1.)

b. User M Downloaded a File Deletion Program

By examining the browser cache and Windows registry,³ Stroz Friedberg

-5-

discovered that M downloaded the file "boot-cd-iso.zip," which contains the Active@ Boot Disk tool suite, to the desktop from www.ntfs.com on December 6, 2005, the same day M visited the websites discussed above. (See Stroz Report ¶¶ 17, 18.) The Active@ Boot Disk tool suite "purports to 'securely erase data' through the use of one of its tools, the KillDisk program," and "contains a utility to recover lost data." (Stroz Report ¶ 17.) However, Stroz Friedberg found no evidence that a user decompressed boot-cd-iso.zip to access the tool suite. (See Stroz Report ¶ 19.)

c. User M Deleted, But Did Not Rename, the Program

Rather than using the compressed tool suite, M deleted the file by placing it in the Recycle Bin. At that point, Windows XP automatically renamed the file "Dc5.zip"; M did not manually change its name. (See Stroz Report ¶ 20.) M then emptied the Recycle Bin, "rendering the . . . [originally downloaded] copy of the file inaccessible but recoverable." (Stroz Report ¶ 20.) After recovering the deleted file, Stroz Friedberg retrieved a copy of boot-cd-iso.zip from the Klein laptop's Temporary Internet Files folder and verified that the two were identical. (See Stroz Report ¶ 20.)

d. User M Deleted Numerous Files from the Klein Laptop &
Rendered Them Unrecoverable

Subsequent to the downloads, M selectively deleted files from the Klein laptop hard drive, though not with the KillDisk program contained within boot-cd-iso.zip.⁴(See Stroz

-6-

Report ¶ 21.) When Stroz Friedberg examined a system file in the Recycle Bin named "INFO2," which maintains the dates and times when files and folders entered the Recycle Bin, Stroz Friedberg discovered that M deleted "hundreds of user documents" on the Klein laptop "in the days prior to the forensic imaging." (Stroz Report ¶ 40.) Stroz Friedberg also uncovered "substantial evidence of large-scale modifications" to the Klein laptop's operating system in the thirty-six hours prior to the forensic acquisition of the Klein laptop by Vitale, including the reinstallation of Windows XP on December 6, 2005, which overwrote many previously deleted files and rendered them unrecoverable.⁵ (Stroz Report ¶ 22; see also Stroz Report ¶ 40.) M deleted 313 additional files and folders after the operating system reinstallation. (See Stroz Report ¶ 40.) Of the limited number of deleted documents that Stroz Friedberg could recover at least partially, nine had names matching files marked as "Irrelevant," "Privileged," or "Confidential" in Klein's privilege log. (See Stroz Report ¶¶ 41-42, Figure 9.) Five other deleted files shared names matching files present on the Klein laptop in the folder "Gutman Litigation" or "Copy of Gutman Litigation" when Vitale imaged the Klein laptop. (See Stroz Report ¶ 42, Figure 9.) However, because someone had freshly copied these extant file versions onto the Klein laptop on December 8, 2005, see infra, Stroz Friedberg could not verify whether the new copies were identical to their unrecoverable counterparts. (See Stroz Report ¶ 20 n.14.)

-7-

e. Other Conclusions

While Stroz Friedberg examined the Klein laptop's System event log⁶ and Security event log⁷ to determine whether file deletions occurred after the download of the NTFS utilities discussed supra in subsection (b), it discovered that "the Klein laptop user changed the system clock at least seven times on the morning of December 8, 2005, only hours before the forensic imaging by Mr. Vitale," as well as on December 6 and 7, 2005. (Stroz Report ¶ 37; see Stroz Report ¶¶ 32-33, 35-38, 44, Figures 4 (showing Security event log, which lists sequential events as occurring on Nov. 23, 2005 at 11:53 a.m., Dec. 8, 2005 at 9:29 a.m., and then Nov. 23, 2005 at 12:34 p.m.), 6 (showing System event log documentation of three time-synchronization errors, which occur only when a system clock and external Microsoft time server differ by more than fifteen hours), 7.) These alterations led to numerous suspect incidents of incorrect file dating on the Klein laptop.⁸(See, e.g., Stroz Report Figure 4.) For example, certain files on the imaged hard drive bore time stamps of December 9, 2005--the day after Vitale imaged the Klein laptop. (See Stroz Report ¶¶ 29, 31.) Because the hard drive image captured the state of the Klein laptop on December 8, 2005, a file bearing an accurate time stamp from the following day could not exist. Similarly, the hard drive's Security event log shows that the seven system clock

-8-

changes were all supposedly implemented by a user named "ZK" between the dates of May 8, 2004 and November 23, 2005. (See Stroz Report ¶ 34, Figure 5.) However, ZK's profile came into existence only on or after December 6, 2005, when M reinstalled the operating system, so ZK could not have changed the system clock at the recorded times. (See Stroz Report ¶ 34.) From these evidentiary patterns, Stroz Friedberg concluded that "[t]he evidence of system time being backdated calls into question the integrity of the time stamps in the event logs and the time stamps associated with files on the hard drive." (Stroz Report ¶ 34.)

Buttressing this assessment, Stroz Friedberg found that although M performed most of the discussed changes on the Klein laptop, the Klein laptop had no user account for M in the Windows registry when Vitale imaged the hard drive on December 8, 2005. (See Stroz Report ¶ 25.) Sometime between December 6 and December 8, 2005, someone deleted M's user account and created an account for ZK when reinstalling Windows XP, overwriting the prior operating system and user accounts. (See Stroz Report ¶¶ 25-27, Figure 2 (comparing operating system registries from restore point dated Dec. 6 & Dec. 8, 2008).) Notably, the Klein laptop's Windows registry entries state that the reinstallation occurred on July 15, 2003. (See Stroz Report ¶ 28, Figure 3.) "However, since the activity for user 'M' took place on or about December 6, 2005, and since user 'M' was removed from the system by the reinstallation action, the operating system reinstallation must have occurred on or after December 6, 2005, in the two days before the forensic imaging." (Stroz Report ¶ 28.) Consequently, the reinstallation could not have taken place on July 15, 2003. This misdating "suggests that a user of the Klein laptop 'backdated' the purported installation date so that the operating system installation would appear to have occurred in July 2003." (Stroz Report ¶ 28 (footnote omitted).)

-9-

Evidence also demonstrates that a user copied files onto the hard drive soon before the December 8, 2005 imaging. Someone created or copied onto the Klein laptop "[t]housands" of files bearing erroneous, backdated time stamps on December 8, 2005. (See Stroz Report ¶¶ 43-44.) For example,

[e]very one of the 6,639 files and folders within the folder named "Gutman Litigation" . . . bears a create date of November 22, 2005 between 7:10 p.m. and 7:24 p.m., including the folder "Gutman Litigation" itself. Every one of the 6,639 files and folders within the folder named "Copy of Gutman Litigation" bears a create date of November 23, 2005, between 11:28 a.m. and 11:39 a.m., including the folder "Copy of Gutman Litigation" itself. The system clock analysis establishes that the clock was set to these time periods on December 8, 2005 between approximately 2:00 a.m. and 4:00 a.m.

According to Stroz Friedberg, taken together, the sum of this evidence is "indicative of the behavior of a user who was attempting to permanently delete selected files from the machine and then cover up the chronology of system changes occurring in the hours and days just prior to a forensic preservation." (Stroz Report ¶ 47.) In light of the sophistication

-10-

of the Klein laptop user who performed these acts,⁹ Stroz Friendberg concluded that "[t]he fact that documents considered privileged or irrelevant were deleted irretrievably while others not marked as privileged were deleted and . . . copied back, suggests that the wide-scale data deletion and time stamp alteration may have been conducted with a privilege review in anticipation of the production of so-called non-privileged data." (Stroz Report ¶ 42.) It is unlikely that the changes made to the Klein laptop in the days preceeding its imaging occurred accidently.

C. Defendants' Responses to the Factual Allegations of the Stroz Report

Defendants do not proffer a convincing challenge to the Stroz Report's factual account of what happened to the Klein laptop in the approximately three days proceeding the hard drive's imaging. To the contrary, defendants specifically concede many of the findings. For example, defendants admit that

[a]n operating system was installed on the Lap Top [sic] Hard Drive during the period immediately preceding December 8, 2005, by Pinchas [sic] Ungar [("Ungar"),10] who was hired by Klein . . . . [Klein] only found out about the methods once an issue was raised in court regarding the `Kill Disk' program having been utilized prior to imaging.

-11-

[i]n order to locate the [purportedly invisible] data, Unger [sic] searched the internet for programs which would enable him to recover the lost data, namely a program called "Kill Disk" and "Get Data Back." As Unger [sic] was having difficulty retrieving the data, he attempted to mimic the conditions by creating his own data which he would then retrieve. In order to create the conditions, he copied files located [sic] Klein's USB flash drive onto the computer. He copied the documents from the USB drive to ensure that the files were on the laptop to test the deletion process. . . .

. . . During this process, Unger [sic] changed the clock in an attempt to determine whether old files had expired . . . . As the method of backdating the time clock, copying files to the computer, resetting the time clock to the current date and then attempting to delete the data was not producing the desired result, Unger [sic] attempting [sic] to re-install the operating system to test the consequences of such action on recovering old files. . . .

....

Over 12,000 files were copied onto the Klein Lap Top [sic] Hard Drive on December 8, 2005 and remained on that hard drive. . . .

....

At least three flash or jump drives were attached to the Klein Lap Top [sic] Computer on or after December 6, 2005.

-12-

Ungar searched the internet for the Kill Disk and Get Data Back programs; reinstalled the Klein laptop's operating system; copied files onto the Klein laptop from an external source; and altered the Klein laptop's system clock are unmistakable.

***

In light of these events and the findings of Stroz Friedberg, plaintiffs now move for a finding that defendants spoliated the Klein laptop hard drive and to enter a default judgment or similar terminating sanction against defendants; to assess punitive monetary sanctions against defendants; and to reimburse plaintiffs' attorney's fees and costs incurred as a result of the current discovery dispute. Defendants oppose plaintiffs' motion. For the reasons stated below, plaintiffs' motion for sanctions is granted in part and denied in part.

DISCUSSION

A. Spoliation

"Spoliation is the destruction or significant alteration of evidence, or the failure to preserve property for another's use as evidence in pending or reasonably foreseeable litigation." West v. Goodyear Tire & Rubber Co., 167 F.3d 776, 779 (2d Cir. 1999) (citation omitted). A party bringing a spoliation claim must demonstrate

(1) that the party having control over the evidence had an obligation to preserve it at the time it was destroyed; (2) that the [evidence was] destroyed with a culpable state of mind; and (3) that the destroyed evidence was relevant to the party's claim or defense such that a reasonable trier of fact could find that it would support that claim or defense.

As for the first prong, a party becomes obliged to preserve evidence when it "has

-13-

notice that the evidence is relevant to litigation . . . [or] should have known that the evidence may be relevant to future litigation." Kronisch v. United States, 150 F.3d 112, 126 (2d Cir. 1998) (citations omitted); accord Fujitsu Ltd. v. Fed. Express Corp., 247 F.3d 423, 436 (2d Cir. 2001). As for the second prong, the Second Circuit has held that negligence is a sufficiently culpable state of mind for spoliation. See Residential Funding Corp., 306 F.3d at 108; see also NTL, Inc. Sec. Litig., 244 F.R.D. 179, 197-98 (S.D.N.Y. 2007); Phoenix Four, Inc. v. Strategic Res. Corp., No. 05 Civ. 4837, 2006 WL 1409413, at *4 (S.D.N.Y. May 23, 2006). As for the third prong, the burden of proving that evidence would have been relevant to a party's claims or defense is proportional to the mens rea of the party who destroyed the evidence. For example, a court may infer relevance when "a party acted in bad faith because 'bad faith alone is sufficient circumstantial evidence from which a reasonable fact finder could conclude that the missing evidence was unfavorable to that party.'" Phoenix Four, Inc., 2006 WL 1409413, at *4 (citing Residential Funding Corp., 306 F.3d at 109). In contrast, where the party destroyed evidence due to ordinary negligence, "[t]he burden falls on the 'prejudiced party' to produce 'some evidence suggesting that a document or documents relevant to substantiating his claim would have been included among the destroyed files.'" Byrnie v. Town of Cromwell, Bd. of Educ., 243 F.3d 93, 108 (2d Cir. 2001) (quoting Kronisch, 150 F.3d at 128). However, the court should avoid "holding the prejudiced party to too strict a standard of proof regarding the likely contents of the destroyed evidence," as doing so "would subvert the prophylactic and punitive purposes of the [spoliation sanctions]." Kronisch, 150 F.3d at 128.

B. The Klein Laptop

In the case at bar, plaintiffs have demonstrated that Klein spoliated the Klein

-14-

laptop. Litigation between the parties began in New York State court in 1999, and plaintiffs filed this case on April 1, 2003. (See generally Compl.) By April 1, 2003 at the latest, Klein had notice of the subject matter of the present case and "should have known that the evidence [contained on the Klein laptop] may be relevant to [its] future litigation." Kronisch, 150 F.3d at 126. From that date, he had an obligation to preserve the contents of the Klein laptop. Furthermore, plaintiffs clearly noted in their first motion to compel discovery that the information stored on Klein's computers would become an issue in the case. (See Declaration in Support of Cross-Motion to Compel Discovery and in Opposition to Motion to Vacate Stay, dated Oct. 24, 2005, ¶ 14; see also Order, dated Nov. 7, 2005 (requiring discovery of all relevant real estate and financial documents).) Thus, Klein had an obligation to preserve the Klein laptop prior to December 6, 2005, when Ungar and possibly others tampered with its contents.

As explained above, when Klein tampered with the Klein laptop, the evidence strongly suggests he did so with a culpable state of mind. At a minimum, he behaved negligently when he provided Ungar with the Klein laptop and asked him to remove potentially embarrassing files without informing Ungar that the Klein laptop's contents constituted evidence in ongoing litigation. (See Hr'g Tr. 139:9-16, 140:12-14.) In his own words:

I [Klein] told him [Ungar] about a dispute, someone has to get some information from whatever is on the computer . . . . I told him that somebody needs the document for a case that we are fighting about. What his [Ungar's] interpretation of it [sic], I don't know. I didn't tell him exactly why, but I told him it's in the case, a dispute with someone.

-15-

agency, corporate officer, or legal department to shield itself from discovery obligations by keeping its employees ignorant." (quoting Nat'l Ass'n of Radiation Survivors v. Turnage, 115 F.R.D. 543, 557 (N.D. Cal. 1987))).

Finally, I find the destroyed evidence relevant to plaintiffs' claims for three reasons. First, many of the files deleted from the Klein laptop were listed in Klein's privilege log. (See Stroz Report ¶¶ 41-42, Figure 9.) Second, defendants previously stated that the laptop contained relevant information in a letter to the court. (See Letter of Richard A. Finkel, Esq. (Dec. 23, 2005) at 4, attached as Ex. J to Pls.' Facts & Conclusions.) Lastly, the record demonstrates that Klein acted in bad faith when he destroyed evidence on the Klein laptop. See Phoenix Four, Inc., 2006 WL 1409413, at *4 (citing Residential Funding Corp., 306 F.3d at 109); see also Handwerker v. AT&T Corp., 211 F.R.D. 203, 209 (S.D.N.Y. 2002) ("Non-compliance may be deemed willful 'when the court's orders have been clear, when the party has understood them, and when the party's non-compliance is not due to factors beyond the party's control.'" (quoting Bambu Sales, Inc. v. Ozak Trading Inc., 58 F.3d 849, 852-53 (2d Cir. 1995))). For example, evidence presented in the Stroz Report and Ungar's treatment of the Klein laptop suggests that Klein asked Ungar to do more than merely recover hidden data from its hard drive. As previously discussed, Ungar has a greater-than-average level of computer sophistication. (See Hr'g Tr. 125:1-6, 126:1-3, 155:14-156:20; see also Stroz Report ¶ 23.) Nevertheless, when purportedly asked to find hidden files on the Klein laptop, he proceeded to download a program designed to destroy a hard drive's contents; to delete hundreds of files and folders, some with file names identical to those marked "Privileged" or "Confidential" on Klein's privilege log; to reinstall the Klein laptop's operating system; to copy onto the Klein

-16-

laptop's hard drive over ten thousand files and folders into folders named "Gutman Litigation" and "Copy of Gutman Litigation"; and repeatedly to alter the Klein laptop's system clock in a manner that would lead a casual observer to believe the new operating system and recently downloaded files and folders had existed on the Klein laptop long before Vitale imaged its hard drive. (See Stroz Report ¶¶ 17-18, 21-22, 28, 32-33, 35-38, 40-45.) These actions are not consistent with a computer technician's search for hidden, old files.¹²

Ungar's proffered reasons for his behavior further undermine the credibility of his and Klein's motivations for altering the Klein laptop. For example, Ungar testified that he reinstalled Windows XP to enhance the computer's performance. (See Hr'g Tr. 142:17-143:1.) However, he undertook this radical step without--as far as his persistently poor memory recalled--first using an anti-virus program, disk cleanup utility, registry repair tool, defragmentation program, or any other less aggressive procedure. (See Hr'g Tr. 268:15-271:4.) Even a novice computer user would not reinstall a computer's operating system as the first step in troubleshooting something as prosaic as "computer sluggishness."

Similarly, Ungar contended that he altered the Klein laptop's system clock, copied files onto the computer, and then deleted them to aid in his file recovery efforts because he worried that the "old files [had] expired," as if user-created files routinely curdled like fresh milk. (Hr'g Tr. 141:21; see Hr'g Tr. 141:17-142:16, 185:7-13, 190:2-17, 254:24-256:2.) Moreover, he repeated these steps without running any data recovery programs, which casts

-17-

doubt on his professed motive for taking these actions. (See Hr'g Tr. 275:5-11.) When pressed further, even he admitted that these procedures were not ordinary and ultimately did not help him recover any data. (See 138:4-7, 142:12-16.) Rather, as Stroz Friedberg noted and I now find, the changes Ungar made to the laptop in the few days before the court-ordered imaging are "consistent with someone trying to delete information." (Hr'g Tr. 53:9-10.)

More generally, Ungar's and Klein's demeanors and vague and evasive testimony left little doubt that they were not telling the truth. ( See, e.g., Hr'g Tr. 179:8-11 ("THE COURT: And what did he say? THE WITNESS [Ungar]: I don't remember the exact wording. Whatever. I told him whatever. I did whatever I felt right to do, whatever."), 187:13-16 ("Q: Is it fair to say it's one of the first things you did? A [Ungar]: There was not much to be done over there that should be one of the first. Everything was one of the first things I did."), 187:21-188:3 ("Q: So it is, as Stroz says, one of the first things you did on the computer when you took possession of it, correct? . . . . A [Ungar]: Yeah, if you call it that way. Q: Well, I don't call it that way. The Stroz report calls it that way. A [Ungar]: Okay. Whatever. Yeah."), 226:2-23 (Ungar admitting that he does not recall whether he performed tasks Klein asked him to do on Klein laptop, but stating that he performed other, non-requested functions afterward), 258:18-20 ("Q: Why did you choose the couple of dates? A [Ungar]: Just to know--whatever. Just to get--no specific reason. It's the way I would do it."), 343:2-10 ("Q: So if Mr. Unger [sic] said that you told him that when you gave him the laptop, you just purchased this laptop in mid-2005, he would be lying? A [Klein]: Show me that he said that. You want to place judgment on if he's lying or not. Show me what he said, then I'll give you, and maybe he's lying or not. Maybe he doesn't remember. Maybe I don't remember."), 362:4-24 ("Q: Mr. Klein, ultimately the hard

-18-

drive that we sought from you that you identified in 2004 is not the hard drive that was ultimately imaged in December 8th, 2005, correct? A [Klein]: That is possible. Q: Well, it's more than very possible. You testified that that computer was stolen--that a computer was stolen some time in 2004, correct? A [Klein]: Probably, yes. Q: And this computer that was imaged in 2005 was purchased some time in 2005? A [Klein]: Possible. Q: Which is it? A [Klein]: You want to pinpoint me to a date exactly when I got it, I'm not able to tell you exactly the date. I said late '04, early '05, and that's the best I can tell you no matter how you're going to turn this around. Q: Again directing your attention to the Kryptos report,¹³ they have you telling them that you indicated to them that you purchased it in mid-2005. . . . A [Klein]: Question and answered."), 364:7-12 ("Q: So then if Kryptos had written that in their report, that would be incorrect, according to your testimony? A [Klein]: I don't know. Maybe their impression. Q: Well, where would they get that specific date, time, mid-2005? A [Klein]: When is mid? From when to when is mid?"), 368:11-14 ("Q: In any event, you call Unger [sic] in, and what exactly are the instructions that you give Mr. Unger [sic] with regard to the laptop again? A [Klein]: Asked and answered."), 371:1-9 ("Q: About, half-hour? A [Klein]: Maybe less. Q: Between 15 minutes and a half-hour? A [Klein]: You're not going to get any better. Then you're going to say 10, five, 15, 20. If I don't remember exactly, I cannot answer that. I tell you he was there for short while [sic], and I didn't time it. So I cannot tell you, and you're going to nail it to two minutes, I can't."), 374:22-375:12.)

-19-

Moreover, Klein and Ungar contradicted their prior testimony on several occasions. (See, e.g., Hr'g Tr. 131:6-9 ("Q: Did you make use of the kill disk program? A [Ungar]: I don't know. THE COURT: Can you repeat the answer? A [Ungar]: No."). Compare Hr'g Tr. 159:17-160:9 (Ungar testifying that he had worked on only desktop computers for Klein between 2000 and 2004), with Hr'g Tr. 196:1-11 (Ungar testifying that he may have worked on Klein's laptop between 2000 and 2004); compare Hr'g Tr. 346:16-18 ("Q: Prior to that laptop, did you have another laptop? A [Klein]: I might have had. I don't remember. I might have had one, yes."), with Hr'g Tr. 347:8-13 (Klein explaining that he had replaced the laptop he didn't remember having owned because "[i]t was an old one" and he "had problems with it").) Finally, Ungar's clear anxiety during cross-examination and repeated need to look to defendants' counsel for guidance left me with little faith in the veracity of his testimony. (See Hr'g Tr. 240:12-16.)

In light of the myriad alterations to the Klein laptop and Klein's and Ungar's incredible explanations for these acts, I concur with Bolas's finding that it is "impossible" that all of this activity "was inadvertent" and, in fact, "find it very difficult to believe it was wholly innocent." (Hr'g Tr. 49:1-3; see Hr'g Tr. 100:4-7 (Bolas noting that he "can't think of another reason" why someone would alter Klein laptop in said manner apart from attempting "to hide data"), 100:20-101:14 (same); Stroz Report ¶¶ 42, 47.) As Bolas vividly stated, "[w]hat we see is a concerted effort to scramble the egg, to muddle the hard drive . . . just before the court ordered imaging." (Hr'g Tr. 51:14-17.) Klein acted in bad faith when he destroyed evidence on the Klein laptop. I therefore find his behavior sanctionable.

C. A Missing Laptop

-20-

During the course of his testimony at the spoliation hearing, Klein contended that a thief had stolen another, heretofore unmentioned laptop (the "missing laptop") containing evidence relevant to the case. According to Klein, he owned the missing laptop in 2004, prior to purchasing the Klein laptop. (See Hr'g Tr. 345:6-8; 346:11-15; see also Hr'g Tr. 362:4-11; 396:3-401:15.) This was the laptop plaintiffs asked Klein to produce for inspection and imaging at his deposition in 2004 and that was the subject of my November 30, 2005 Order. (See Hr'g Tr. 365:2-5.) As discussed supra, by April 1, 2003, Klein should reasonably have known that the information on this alleged missing laptop would be relevant to the present litigation and that he therefore had a duty to preserve it. See Kronisch, 150 F.3d at 126.

Klein testified at the spoliation hearing that someone stole the missing laptop from his car when he allegedly left a door open. (See Hr'g Tr. 345:11-21.) He presented no witnesses or physical evidence at the hearing to corroborate this account. In light of the general untrustworthiness of Klein's testimony at the hearing, discussed supra, his subsequent failure to report the theft to the police, to inform the court or his adversaries of the theft, or even to file an insurance claim casts doubt on the veracity of his assertion that this purportedly missing laptop in fact was stolen. (See Hr'g Tr. 345:24-346:2; 365:7-23.) Additionally, even if the court were to credit his testimony, Klein concededly did not notify the court or plaintiffs until July 2008 that the laptop he owned in 2004 was stolen or that he produced a different laptop for inspection in December 2005. (See Hr'g Tr. 365:14-25; 366:1-4.) Thus, his conduct was misleading at best.

In sum, Klein has not established by credible evidence that there ever was a missing laptop. Nor has he dispelled plaintiffs' suggestion that he lied about the missing laptop to explain away damaging inconsistencies exposed by the Stroz Report. If he indeed fabricated

-21-

the tale of the missing laptop to cover up other false statements, his misconduct would abundantly merit sanctions. If, alternatively, there really was a missing laptop, sanctions would still be in order, because Klein improperly failed to disclose that the laptop plaintiffs had requested at his deposition was not the laptop he produced for imaging in December 2005.

D. Appropriate Sanctions

A district court has wide discretion in sanctioning a party for discovery abuses, "[w]hether exercising its inherent power, or acting pursuant to Rule 37."¹⁴ Reilly v. Natwest Mkts. Group Inc., 181 F.3d 253, 267 (2d Cir. 1999); accord Zubulake v. UBS Warburg LLC, 229 F.R.D. 422, 430 (S.D.N.Y. 2004); see also Fed. R. Civ. P. 37(b)(2) & (c)(1); West v. Goodyear Tire & Rubber Co., 167 F.3d 776, 779 (2d Cir. 1999); Fleming v. City of New York,

-22-

No. 01 Civ. 8885, 2006 WL 2322981, at *5 (S.D.N.Y. Aug. 9, 2006) (citing Nat'l Hockey League v. Metro. Hockey Club, Inc., 427 U.S. 639, 643 (1976)); Hollingsworth v. City of New York, No. 95 Civ. 3738, 1997 WL 91286, at *2 (S.D.N.Y. Mar. 4, 1997). When deciding how to sanction a party, a court generally must consider, "in light of the full record in the case," Cine Forty-Second St. Theatre Corp. v. Allied Artists Pictures Corp., 602 F.2d 1062, 1068 (2d Cir. 1979), "'(a) willfulness or bad faith on the part of the noncompliant party; (b) the history, if any, of noncompliance; (c) the effectiveness of lesser sanctions; (d) whether the noncompliant party had been warned about the possibility of sanctions; (e) the client's complicity; and (f) prejudice to the moving party.'" Fleming v. City of New York, No. 01 Civ. 8885, 2007 WL 4302501, at *3 (S.D.N.Y. Dec. 7, 2007) (quoting Am. Cash Card Corp. v. AT&T Corp., 184 F.R.D. 521, 524 (S.D.N.Y. 1999) (citing Jodi Golinsky, Note, The Second Circuit's Imposition of Litigation-Ending Sanctions for Failures to Comply with Discovery Orders, 62 Brook. L. Rev. 585, 596-97 (1996))). In the spoliation context, the court also must consider the "prophylactic, punitive, and remedial rationales underlying the spoliation doctrine." West, 167 F.3d at 779. In other words, the sanction should "(1) deter parties from engaging in spoliation; (2) place the risk of an erroneous judgment on the party who wrongfully created the risk; and (3) restore 'the prejudiced party to the same position he would have been in absent the wrongful destruction of evidence by the opposing party.'" Id. (quoting Kronisch, 150 F.3d at 126).

Use of the harshest sanctions is limited to cases involving "willfulness, bad faith, or any fault" of the disobedient party. Salahuddin v. Harris, 782 F.2d 1127, 1132 (2d Cir. 1986) (citing Societe Internationale pour Participations Industrielles et Commerciales, S.A. v. Rogers, 357 U.S. 197, 212 (1958)); accord Hollingsworth, 1997 WL 91286, at *2; Urban Elec. Supply &

-23-

Equip. Corp. v. N.Y. Convention Ctr. Dev. Corp., 105 F.R.D. 92, 98 (E.D.N.Y. 1985); see also Cine Forty-Second St. Theatre Corp., 602 F.2d at 1064, 1066. A court will dismiss a case "only in extreme circumstances, usually after consideration of alternative, less drastic sanctions." West, 167 F.3d at 779 (quotation marks and citation omitted). Similarly, to obtain an adverse inference instruction, the moving "party must establish that the unavailable evidence is relevant to its claims or defenses." Residential Funding Corp., 306 F.3d at 108 (internal quotation marks and citations omitted). "'[R]elevant' in this context means something more than sufficiently probative to satisfy Rule 401 of the Federal Rules of Evidence."¹⁵Id. at 108-09. The party "must adduce sufficient evidence from which a reasonable trier of fact could infer that the destroyed or unavailable evidence would have been of the nature alleged by the party affected by its destruction." Id. at 109 (internal quotation marks, alternation, and citations omitted).

E. Terminating Sanctions

The ultimate sanction of a default judgment is "not to be imposed lightly," particularly when "[a]lternative remedies are sufficient to address the spoliation." Kyoei Fire & Marine Ins. Co. v. M/V Mar. Antalya, 248 F.R.D. 126, 145 (S.D.N.Y. 2007). But lesser sanctions such as adverse inferences are ill-suited to a case like this, where the spoliator has, in bad faith, irretrievably deleted computer files that likely contained important discovery information. See, e.g., Leon v. IDX Sys. Corp., 464 F.3d 951 (9th Cir. 2006); S. New Eng. Tel. Co. v. Global NAPs, Inc., 251 F.R.D. 82 (D. Conn. 2008); Arista Records, L.L.C. v. Tschirhart,

-24-

241 F.R.D. 462 (W.D. Tex. 2006); cf. Miller v. Time-Warner Commc'ns, Inc., No. 97 Civ. 7286, 1999 WL 739528 (S.D.N.Y. Sept. 22, 1999) (imposing sanction of dismissal on plaintiff who had erased her handwritten notes from discovery documents and testified falsely about the erasures, even though the spoliation did not prejudice defendants). But cf. Nucor Corp. v. Bell, 251 F.R.D. 191, 201 (D.S.C. 2008) (finding adverse inference appropriate when defendant's spoliation of laptop did "not ma[k]e it impossible for plaintiff to determine what was on the device--and thus did not make it impossible for plaintiff to prosecute its claims").

This case involves a convoluted set of interconnected claims. (See, e.g., Report and Recommendation and Order, dated Sept. 26, 2007.) The spoliated computer files labeled "Privileged" and "Confidential," and those from the "Gutman Litigation" and "Copy of Gutman Litigation" folders, might have related to any one or more of the claims. Because defendant spoliated the files, "it is impossible to identify which files [were relevant to plaintiff's claims] and how they might have been used." Leon, 464 F.3d at 960. Accordingly, "it is impossible to know what [plaintiffs] would have found if [defendants] and [their] counsel had complied with their discovery obligations." Metro. Opera Ass'n v. Local 100, Hotel Employees & Rest. Employees Int'l Union, 212 F.R.D. 178, 230 (S.D.N.Y. 2003).

Under such exceptional circumstances, the only appropriate non-monetary sanction is a default judgment in plaintiffs' favor, pursuant to Federal Rule of Civil Procedure 37(b)(2)(A)(vi) and the court's inherent powers. First, lesser sanctions would not adequately deter misconduct of this severity. Cf. Arista Records, 241 F.R.D. at 465 ("One who anticipates that compliance with discovery rules and the resulting production of damning evidence will produce an adverse judgment, will not likely be deterred from destroying that decisive evidence

-25-

by any sanction less than the adverse judgment she is tempted to thus evade."). This is especially true where, as here, the court has previously imposed lesser sanctions on the responsible party for other discovery misconduct. (See Order, dated Nov. 30, 2007 (awarding plaintiffs attorney's fees for their "efforts in addressing a serious violation [by defendants] of the discovery schedule").) Second, the most serious forms of spoliation merit the harshest sanctions, and in this case, the destruction of evidence was of the worst sort: intentional, thoroughgoing, and (unsuccessfully) concealed. Finally, the lesser sanction of an adverse inference would not "restor[e] the prejudiced part[ies] to the same position [they] would have been in absent the wrongful destruction of evidence by the opposing party." Kronisch, 150 F.3d at 126. Here, defendants' obliteration of the laptop files may well have deprived plaintiffs of crucial evidence.¹⁶ Cf. S. New Eng. Tel. Co., 251 F.R.D. at 92-93 ("[Plaintiff] is not required to show that the destroyed files were material as long as it can prove that the deletion of the files was in bad faith.").

Accordingly, I respectfully recommend that a default judgment be entered in plaintiffs' favor, with judgment to be entered in an amount to be determined upon a damages inquest.

F. Attorney's Fees & Costs

To remedy the extensive delays and waste of resources that defendants' spoliation

-26-

has caused them, plaintiffs also seek recovery of all reasonable attorney's fees and costs associated with the current discovery dispute. See Fed. R. Civ. P. 37(b)(2)(C) ("Instead of or in addition to the orders above, the court must order the disobedient party, the attorney advising that party, or both to pay the reasonable expenses, including attorney's fees, caused by the failure, unless the failure was substantially justified or other circumstances make an award of expenses unjust."); see also Novak v. Wolpoff & Abramson LLP, 536 F.3d 175, 178 (2d Cir. 2008) (stating that although "[w]e have never held that Rule 37(b)(2) expenses are mandatory and need not do so here, . . . . [t]he use of the word `shall' certainly suggests that an award of expenses is mandatory unless one of the two exceptions . . . applies"); Cine Forty-Second Street Theatre Corp. v. Allied Artists Pictures Corp., 602 F.2d 1062, 1066 (2d Cir. 1979) ("The mildest [sanction under Rule 37] is an order to reimburse the opposing party for expenses caused by the failure to cooperate."). I respectfully recommend awarding plaintiffs attorney's fees encompassing all of their discovery expenses related to the Klein laptop from November 30, 2005 through the date of this Report and Recommendation.¹⁷

"A district court must calculate fees . . . by multiplying the number of hours reasonably expended on the litigation times a reasonable hourly rate." I.B. ex rel. Z.B. v. N.Y. City Dep't of Educ., 336 F.3d 79, 80 (2d Cir. 2003) (internal quotation marks and citations omitted); see also Arbor Hill Concerned Citizens Neighborhood Ass'n v. County of Albany, 522 F.3d 182, 183-84 (2d Cir. 2008) (listing factors relevant to calculating a "presumptively reasonable fee"). Accordingly, I recommend that plaintiffs be ordered to submit detailed

-27-

accounts of the relevant expenses for examination in order for the court to calculate an appropriate fee award.

G. Other Monetary Sanctions

In addition to requesting terminating sanctions and attorney's fees and costs, plaintiffs request punitive monetary sanctions against defendants. Keeping in mind that the "rationales underlying the spoliation doctrine" are "prophylactic, punitive, and remedial," West v. Goodyear Tire & Rubber Co., 167 F.3d 776, 779 (2d Cir. 1999), I recommend that no other sanctions be entered against defendants. In this case, the sanctions of default judgment and attorney's fees and costs are sufficiently severe to satisfy all three rationales of the spoliation doctrine.

-28-

CONCLUSION

For the foregoing reasons, I respectfully recommend that a default judgment be entered against defendants and that plaintiffs be awarded their attorney's fees and costs associated with the discovery dispute at issue. Calculation of the amounts of both awards will require damages inquests. I further recommend that plaintiffs' motion for additional punitive monetary sanctions be denied. Any objections to this Report and Recommendation must be filed with the Clerk of Court, with courtesy copies to Judge Cogan and to my chambers, within ten (10) business days. Failure to file objections within the specified time waives the right to appeal the district court's order. See 28 U.S.C. § 636(b)(1); Fed. R. Civ. P. 72, 6(a), 6(e).

Respectfully submitted,

______/s/______
ROBERT M. LEVY
United States Magistrate Judge

Dated: Brooklyn, New York
October 15, 2008

-29-

¹ Because of the byzantine procedural history of this case, this Report and Recommendation will discuss only those facts essential to the disposition of the current motion.

² Vitale's records indicate that he began imaging the Klein laptop, a Dell Latitude with serial number CN-09C748-4815519E-2036, at approximately 4:32 p.m. on December 8, 2005, using a program called FTK version 2.2, "an accepted tool under industry standards, to perform the imaging and create a forensic duplicate of the hard drive." (Stroz Report ¶ 10.) Due to a likely battery malfunction on Vitale's computer, the forensic image was recorded as having occurred on January 1, 2000. (See Stroz Report ¶ 12.) However, the hash value, or unique "digital fingerprint" of the imaged data, verified as accurate and thereby demonstrated that the image was "accurate and complete." (Stroz Report ¶ 12.) Consequently, defendants' argument that Stroz Friedberg's failure to "establish the usage and ownership history" of the Klein laptop lacks merit. (Defs.' Facts & Conclusions 4.)

³ The Windows registry "stores information 'necessary to configure the system for one or more users, applications, and hardware devices.'" (Stroz Report ¶ 17 n.3 (quoting http://support.microsoft.com/kb/256986).) It contains information relating to, inter alia, user profiles and installed applications. (See Stroz Report ¶ 17 n.3.)

⁴ One can discern that nobody used the KillDisk program on the Klein laptop because (1) no user decompressed boot-cd-iso.zip to access KillDisk and (2) KillDisk "wipe[s] the entire disk" when used and, therefore, could not be used to erase individually selected files or folders. (Stroz Report ¶ 21.)

⁵ The owner, version, and product identifier for the operating systems present on the Klein laptop on December 6, 2005 and two days later all differed, "indicating that the same operating system, Windows XP, was re-installed using a slightly different version." (Stroz Report ¶ 27; see Stroz Report Figure 3.)

⁶ The System event log records, in order of occurrence, error messages, such as failed attempts by Windows XP to synchronize the system clock with an external Microsoft time server via the internet. (See Stroz Report ¶¶ 30, 32.)

⁷ The Security event log records various information, including user logons and system clock changes, in order of occurrence. (See Stroz Report ¶ 32.)

⁸ "A chronology of user actions may be determined by examining the time stamps associated with user files and system configurations. Time stamps are determined by operating system clock settings, and the accuracy of file time stamps depends upon an accurate system clock." (Stroz Report ¶ 29.)

⁹ On December 6, 2005 between 4:13 a.m. and 4:31 a.m., after visiting www.ntfs.com, M conducted searches using the Google search engine with such entries as "new ntfs" and "delete ntfs mft records." (Stroz Report ¶ 23.) According to Stroz Friedberg, "[t]he presence of search queries regarding the deletion of NTFS MFT records strongly suggests that a user with a level of knowledge of the Windows operating system beyond that of the ordinary user was conducting research related to data deletion and recovery." (Stroz Report ¶ 23.)

¹⁰ Ungar's sister is married to Klein's nephew. (See Evidentiary Hearing Transcript, dated July 30, 2008, 158:18.)

¹¹ Stroz Friedberg has proposed a list of corrections to the transcript of this hearing. (Letter of John F. Curran, Esq. (Sept. 5, 2008).) Defendants object to the proposed changes (see Letter of Barry R. Feerst, Esq. (Sept. 11, 2008); Letter of Barry R. Feerst, Esq. (Sept. 15, 2008)), and plaintiffs support them (see Letter of Brian S. Tretter, Esq. (Sept. 11, 2008)). Because this Report and Recommendation does not rely on any of the contested words or phrases, it is not currently necessary to rule on this dispute.

¹² See Hr'g Tr. 86:9-14 ("[Q:] The evidence is consistent with a user attempting to withhold certain files by deleting data and then selectively copying back some of it . . . while . . . chang[ing] the system clock to give the false appearance that the copied files had existed for some time on the Klein laptop, correct? A [Bolas]: Correct. . . . [Q:] [I]s that conclusion based upon your expert opinion? A [Bolas]: Yes, it is.").

¹³ "Kryptos report" refers to an expert report concerning the spoliation dispute that defendant Zalman Klein submitted. (Report of Kryptos Forensics, annexed to Letter of Barry R. Feerst, Esq., dated Apr. 4, 2008.) Based on the testimony at the July 29-30, 2008 hearing and Stroz Friedberg's supplemental report (Stroz Friedberg, LLC, Analysis of Kryptos Report (July 14, 2008)), I find the Kryptos Report unilluminating and unconvincing.

¹⁴ Available sanctions in the Rule 37 context include, in relevant part,

(i) directing that the matters embraced in the order or other designated facts be taken as established for purposes of the action, as the prevailing party claims; (ii) prohibiting the disobedient party from supporting or opposing designated claims or defenses, or from introducing designated matters in evidence; (iii) striking pleadings in whole or in part; . . . (v) dismissing the action or proceeding in whole or in part; (vi) rendering a default judgment against the disobedient party; or (vii) treating as contempt of court the failure to obey any order except an order to submit to a physical or mental examination.

....

(C) Payment of Expenses. Instead of or in addition to the orders above, the court must order the disobedient party, the attorney advising that party, or both to pay the reasonable expenses, including attorney's fees, caused by the failure, unless the failure was substantially justified or other circumstances make an award of expenses unjust.

¹⁵ Rule 401 states that "'[r]elevant evidence' means evidence having any tendency to make the existence of any fact that is of consequence to the determination of the action more probable or less probable than it would be without the evidence." Fed. R. Evid. 401.

¹⁶ In some cases, a lesser alternative remedy would be to instruct the jury to infer that the spoliated evidence was maximally damaging to defendants on the point at issue. But when, as here, the destroyed evidence was potentially relevant to any or all aspects of the case, that remedy would be no less harsh than a default judgment, because it would necessitate finding for plaintiffs on all claims. Cf. Zubulake v. UBS Warburg LLC, 220 F.R.D. 212, 219 (S.D.N.Y. 2003) ("In practice, an adverse inference instruction often ends litigation--it is too difficult a hurdle for the spoliator to overcome.").

¹⁷ The fee award I recommend here would not include any amounts that I directed defendants to pay plaintiffs in my order of September 30, 2008. (See Order, dated Sept. 30, 2008 (ordering defendants to reimburse plaintiffs for payments to Stroz Friedberg).)