Forensic computer examinations can be expensive and therefore may prompt the question during litigation – are they worth it? A recent decision from the Southern District of Ohio illustrates why the answer is “yes” in many trade secret cases. In H&H Industries, Inc. v. Miller, the court relied heavily on the results of the forensic examination of the defendant’s computers to enter a preliminary injunction that prohibited the defendant, the plaintiff’s former employee, not only from divulging or using the plaintiff’s trade secrets but also from working for his new employer.
The plaintiff, H&H Industries, retreads and repairs off-the-road (“OTR”) tires and sells used OTR tires. The defendant, Erik Miller, began working for H&H in 2006, and since 2007 had worked as a salesperson of OTR tires. Miller had access to H&H’s confidential information, including pricing information, and, as such, H&H required him to sign a confidentiality agreement. On July 26, 2013, Miller notified H&H that he was leaving the company to join one of H&H’s direct competitors, Polar Rubber Products.
H&H filed suit alleging that Miller had misappropriated its trade secrets and breached his confidentiality agreement by providing H&H’s trade secrets and confidential information to Polar. H&H sought a temporary restraining order (TRO) and preliminary and permanent injunctive relief. After conducting a conference with the parties, the court issued a TRO that prohibited Miller from using, distributing or misappropriating H&H’s proprietary information.
The court, however, denied H&H’s request to enjoin Miller from working for Polar. The court’s denial was based on Miller’s representations that he had neither taken nor misappropriated H&H’s confidential information.
At the TRO stage, the court also ordered Miller to deliver to the magistrate judge his computers and certain electronic devices so that they could be imaged for preservation and inspection. The court also required Miller to provide the magistrate judge with all log-in information and password information necessary for access to Miller’s e-mail and cloud-storage accounts, and Miller was prohibited from using any of those accounts so as to preserve their current status. This aspect of the TRO likely was based on H&H’s allegations that in the weeks leading up to his departure from H&H, Miller had moved massive amounts of data from H&H’s computers to off-site mass storage devices or the cloud.
Unfortunately for Miller, H&H decided to spend the money to have the imaged copies of his computers forensically examined. The forensic examination disproved Miller’s representations that he had not used or misappropriated H&H’s confidential information. The forensic examination revealed that during his first week of employment at Polar, Miller had caused four H&H pricing files to be transferred to his Polar e-mail account from his personal Gmail account and/or the hard drive of his personal family computer. Miller accessed these H&H files on his Polar laptop, and he even forwarded some of them to his co-workers at Polar.
The forensic examination also revealed that Miller deleted the H&H files subsequent to opening or e-mailing them. Miller also deleted some of the files from his personal Gmail account within a day or two after the lawsuit had been filed. The examination also revealed that Miller had cleaned out the WebCache file on his Polar laptop the same day that the court issued its order requiring Miller to surrender that computer and other electronic devices to the magistrate judge for inspection.
The examiner also discovered that Miller had inserted a flash drive into his H&H computer while an H&H employee. That same flash drive was inserted into Miller’s personal computer a few days after he had stopped working for H&H and also inserted into his Polar laptop the same day. The insertion of the thumb drive into Miller’s Polar laptop occurred a few hours before one of the H&H pricing files had been accessed on that computer. Miller never produced this flash drive during the litigation.
Miller’s story changed when confronted with the forensic examiner’s report. Miller now acknowledged having H&H pricing information on his Polar laptop and divulging some of that information to his Polar colleagues.
The forensic examiner’s report and testimony, which precipitated Miller’s eleventh-hour concessions, lead the court to determine that it could not trust Miller to work for Polar without using, disclosing or otherwise misappropriating H&H’s confidential pricing information. As a result, the court granted H&H’s request for a preliminary injunction that included the provisions of the TRO but also included that branch of the requested injunctive relief that enjoined Miller from working for Polar.
The court was not unsympathetic to the hardship caused by Miller’s inability to work for Polar, but explained “that the special circumstances of this case warrant such a serious measure.” The special circumstances of which the court wrote consisted of Miller’s deceptive conduct that was shown by the forensic computer examination. This case demonstrates that when a plaintiff has good reason to believe its confidential or trade secret information has been taken by a former employee, the plaintiff should preserve the company-owned electronic devices used by the former employee, seek immediate preservation of the former employee’s personal electronic devices, and seriously consider having a forensic examination of those devices conducted. Without such an examination, the plaintiff may never learn, nor be able to demonstrate to the court, the nature and extent of a former employee’s misappropriation.
