Lamb v. Liberty University, Inc.

Opinion

AED A □□ □□□ AT LYNCHBURG, VA FILED UNITED STATES DISTRICT COURT et □□ □□□ WESTERN DISTRICT OF VIRGINIA BY: s/ A Little LYNCHBURG DIVISION DEPUTY CLERK

WALTER SCOTT LAMB, CASE NO. 6:21-cv-00055 Plaintiff, v. MEMORANDUM OPINION AND ORDER LIBERTY UNIVERSITY, Defendant. JUDGE NORMAN K. Moon

Defendant Liberty University seeks sanctions against Plaintiff Walter Scott Lamb for the spoliation of electronically stored information (“ESI”). The particular sanction requested—denial of Lamb’s pending motion for leave to file an amended complaint—is severe in that its practical effect would be the dismissal with prejudice of Lamb’s lawsuit.! The standard for such a sanction is correspondingly rigorous, requiring Liberty to show, among other things, that additional discovery cannot restore or replace the lost ESI. Because Liberty has not yet attempted to restore or replace the lost ESI through additional discovery, the Court will take the motion for sanctions under advisement and give Liberty an opportunity to do so.

' The Court granted dismissal of Lamb’s first amended complaint for failure to state a claim on April 10, 2022. See Dkt. 67.

I. Background A. Initiation of Suit & Preliminary Injunction Lamb sued Liberty in October of 2021, shortly after being fired from his position as the University’s Vice President of Communications and Public Engagement. See Dkt. 17 ¶¶ 16, 22. Lamb alleges that he was fired, in violation of Title IX, because of his opposition to Liberty’s mishandling of sexual assault and harassment complaints, see Dkt. 72-1 ¶¶ 70–76, while Liberty insists that Lamb never expressed such criticism and that his termination resulted from

mismanagement, see Dkt. 85 p. 9. Liberty answered Lamb’s suit with several counterclaims, including claims for conversion and detinue, and simultaneously moved for an order requiring Lamb to return to Liberty any materials in his possession that were produced as part of his work at the University. See Dkts. 10, 11. The Court granted Liberty’s motion in part following an evidentiary hearing in December of 2021, ordering the parties to “confer on a plan to identify, separate, and return Liberty’s information from Lamb’s possession.” See Dkt. 37 p. 3.

B. Forensic Protocol Protracted negotiations resulted in the execution of a document entitled “Computer

Forensics and Document Return Protocol.” See Dkt. 85-2. The first section of the Protocol, under the heading “Imaging Phase,” provides that Lamb will make available to a jointly retained independent expert “[a]ll personal computers, cell phones, and tablets” and “[a]ll cloud-based services, [specifically to include] his Evernote account” that “currently contain documents that Lamb created or obtained by virtue of his employment with Liberty.” Id. pp. 1–2. The Protocol also provides that Lamb will make available “[a]ll external storage media” that he “has ever connected to any device that has ever contained information belonging to Liberty, (including thumb drives, hard drives, CD Roms, etc.)” as well as “[a]ll recording devices that contain recordings made by Lamb of communications with” current or former Liberty employees or third-parties to whom he spoke “in the course of his employment at Liberty.” Id. p. 2. “Once Lamb provides” the foregoing to the independent expert, the independent expert is then authorized to “create forensic images/copies” of the contents. Id. The second section, under the heading “Analysis Phase,” provides that the expert will run

pre-arranged searches on whatever data and files, including deleted files, are reasonably recoverable from the forensic images. See id. p. 3. The Protocol then outlines a process for identifying and separating Lamb’s information from Liberty’s. See id. pp. 3–6. Finally, the third section, under the heading “Destruction Phase,” provides that Liberty will give Lamb’s attorney a list of all data identified as belonging to Liberty to be forensically purged by the independent expert from Lamb’s physical devices and cloud-based services. See id. p. 7. The Protocol also sets out a separate, more limited process for handling Lamb’s phone. It provides that the independent expert will confine his search of the phone to “Liberty texts or emails sent to Lamb’s personal device from Liberty’s Microsoft Outlook servers or Liberty’s

software via Microsoft’s Rules feature.” Id. p. 6. It also provides that if this search should for any reason require imaging of Lamb’s phone, the image is to be used only by the independent expert and solely for the purpose of conducting the aforementioned search. See id. Only the search results, not the forensic image of the phone, would be shared with Liberty. Id. It then provides that Lamb will purge the phone upon its return to him of all materials belonging to Liberty “through factory reset or similar method” or by authorizing the independent expert to do so. Id. pp. 6–7.

C. Motion for Sanctions The following evidence was presented at the hearing on Liberty’s motion for sanctions, which was held July 27–28, 2022. See Dkts. 104, 105. The parties finalized the Protocol on March 22, 2022, having chosen Christopher Racich

to serve as their jointly retained independent expert. See Hr. Tr. 32:15–16.. See Dkt. 85-5 ¶ 3. On April 8, 2022, Lamb’s attorney sent Racich an email stating that Lamb had “packed for delivery” “one laptop, one external hard drive, once cell pone and the credentials for one Evernote account.” Id. ¶ 4. The materials arrived five days later. See id. ¶ 5. This was the evidence concerning those materials.

1. Physical Devices. Other than an iPhone, which is discussed at length below, the independent expert received only two physical devices from Lamb: one laptop and one external hard drive. See Dkt. 85-5 ¶ 5. However, both devices first went into use well after Lamb left his employment with

Liberty—indeed, the first use of both devices occurred over two months after the Court’s December order. See id. ¶ 7(a) (laptop on or about March 12, 2022); ¶ 7(c) (external hard drive on or about April 9, 2022). The contents of the two devices were similarly peculiar. The laptop contained a folder named “Liberty Files,” containing 2,156 files with creation dates between 7:47 a.m. and 7:52 a.m. See id. ¶ 8. Those same 2,156 files were found on the external hard drive. See id. ¶ 9. The creation dates of the files on the hard drive were just a few minutes younger than those found on the laptop: between 7:44 a.m. and 7:50 a.m. on April 9, 2022. See id. When asked to explain Racich’s findings, Lamb, through his attorney, told the Court that “he didn’t have any other Liberty documents on any other devices.” Hr. Tr. 83:21–22. But, desirous of minimizing the costs associated with the independent expert’s time, he wanted to sort through his Evernote data himself. See Dkt. 91 p. 20. Knowing that he could not access his Evernote without subjecting the accessing computer to coverage under the Protocol—

considering that the Protocol applied to any hard drive that had ever accessed a device containing Liberty information, see Dkt. 85-5 p. 2—Lamb found an old computer to use: I had a laptop that I pulled out of my closet of broken laptops, basically, an old laptop that had belonged to one of my children, it was missing the letter F, the screen didn’t work, so on and so forth. I used that laptop to access Evernote knowing that once I accessed Evernote, then that would be a polluted laptop. And then I found Liberty documents and I got them onto that laptop.

. . . .

The only problem was towards the end of this work the laptop was shutting down. It was overheating. The screen was going bonkers. And the memory stick [I planned to use to return the documents to Liberty] was not going to be sufficiently large enough to hold all the documents.

So I went and I purchased a brand new laptop and a brand new hard drive and then having completed my work in Evernote to get all the Liberty documents out, then I transferred them from that broken laptop into a little bitty memory stick and then put them on the brand new laptop that I bought simply to give to Liberty, and then to back it up so it wasn’t just on the laptop, but to back it up I put it on a hard drive that I [purchased] for the purpose. Then, knowing that the broken up—the broken down laptop was tainted and so was the memory stick, I deleted off the contents of the broken down laptop and then factory reset it and then [threw] it away. I deleted the contents. Hr. Tr. 171:25–173:1. Lamb claims to have thought that these actions complied with his obligations under the Court’s December order and the Protocol. See Hr. Tr. 134:17–135:1; 174:20. Other evidence, however, contradicted Lamb’s version of events. First, as already mentioned, Lamb’s attorney reported that his materials had been “packed for delivery” to Racich on April 8, 2022. Yet the files found on the laptop and the external hard drive had not been downloaded onto those devices until the next day. Second, Lamb’s claim that he believed his

actions to conform with the terms of the Court’s December order and the Protocol is difficult to square with the clear language of both. The old laptop originally used to download information from Evernote, as well as the thumb drive used to transfer information from the old laptop to the new laptop are, for example, clearly within the scope of devices Lamb was supposed to make available to Racich. See Dkt. 85-2 p. 2 (defining devices that should be made available to the independent expert to include “all external storage media to which Lamb has access that Lamb, to his knowledge, has ever connected to any device that has ever contained information belonging to Liberty (including thumb drives, hard drives, CD-Roms, etc.)”) (emphasis added). It also strains credulity that Lamb could understand the language of either the Court’s December order or the Protocol to allow him to take unilateral action, action that would require Liberty to

trust solely in his own word and skill to identify, separate, and return the information belonging to it. Third, given his prior testimony, it is difficult to understand how Lamb could not possess any other devices that either currently or at some point held information belonging to Liberty. At the evidentiary hearing preceding the Court’s December order, Lamb placed a great deal of emphasis on his commitment to retaining Liberty information in a place under his, as opposed to Liberty’s, control. This commitment, moreover, is one he claims to have maintained both during and after his employment with Liberty. When he first joined the University, Lamb told the Court, he was instructed by Jerry Falwell, Jr. “to make sure [to keep] records meticulously and thoroughly and off the site of Liberty University, personal records.” Dkt. 52 p. 224:18–19. Lamb surmised that this was “for the protection of both Liberty University, myself, and I think, ultimately, himself.” Id. p. 224:20–21. He was also was adamant that he had adopted the practice: Q. [D]id you continue the same notetakings after President Falwell left and the new acting president, Dr. Prevo, was instituted?

A. Yes, I did.

Q. How did your practices change?

A. It did not change at all.

Q. Did the same thing before as you did after?

A. I did.

Q. You just report to somebody different[], correct?

A. That is correct.

Id. p. 225:2–11. And when the topic was again raised the following day, Lamb testified that he had counseled Liberty’s new president to do the same: And Jerry Prevo called me in the office the first week he was here and asked me if I would counsel him to trust the IT department of Liberty University. . . . And I told him what Jerry Falwell had said to me, which is, “No, don’t trust the IT department. They can look at your things anytime they want to.”

Dkt. 53 p. 29:20–30:16. Lamb has also emphasized the importance to him of keeping thorough records from his time at Liberty even now, stating that he has a “moral obligation” to preserve evidence of Liberty’s “systematic cover-up of sexual assault.” Id. p. 106:8–14. He also testified that he has received instructions from the Department of Education “not to destroy anything.” Dkt. 52 p. 224:1–9. According to Lamb’s version of events, all his Liberty work was stored either on his work laptop or his Evernote account, and he has only ever accessed his Evernote account from his work laptop. It is curious that Lamb would have accessed materials meant to protect him from Liberty exclusively using Liberty equipment. And that he has not accessed those materials—the very evidence central to his Title IX case—since October 2021.

Also curious is Lamb’s failure to make a recording device available to Racich. At the hearing on this motion, Lamb explained that failure by stating that the devices he used to record work-related conversations were “unilaterally—I’d say 90 percent or more” owned by Liberty and that he no longer has access to them. Hr. Tr. 184:15–19. But when asked about recording devices in December, he insisted that he used his own recording devices because he did not trust Liberty. A. I don’t know that I could at [sic] any way say that I put [recordings] on my [Evernote] because of the warnings I had about the IT. So I didn’t always put it on my work [sic].

Q. Where else did you put it?

A. Other places.

Q. Tell me about them.

A. I don’t know.

Q. You don’t know where you put the stuff?

A. Places that weren’t at work.

Q. Okay. You stored them at home?

A. Well, there’s only two places that I am, and one would be work and one would be home, yeah. ….

A. I owned digital voice recorders that I would put down on the table. Those were owned by me prior to me coming to Liberty University. If the audio would be left on the digital voice recorder, it was on the voice recorder.

Dkt. 53 p. 32:17–33:23.

2. Cloud-Based Services. As instructed by the Protocol, Racich used forensic software to create an image of the data from Lamb’s Evernote account.2 Dkt. 85-5 ¶ 13. He found 87 megabytes of data, which was notable given that Racich had found 2.7 gigabytes of deleted Evernote data on the work laptop that Lamb returned following his termination, indicating “that the difference between the data in the Evernote system on April 14, 2022 (when the forensic collection was performed) and what was in Evernote on October 10, 2021, is approximately 2.61 gigabytes.” Id. Lamb explained the discrepancy in his briefing: Lamb ran the agreed search terms himself, and segregated all Liberty materials he could find from the Evernote account on a brand new computer, backed up on a brand new hard drive, in a ‘Liberty Files’ folder. The protocols provided the Liberty materials would be deleted from the Evernote account, and so Lamb deleted the files that he had sequestered and provided.

Dkt. 91 p. 20. Once again Lamb claims that he acted with the purpose of saving money and believing himself to be in compliance with the Protocol. See Hr. Tr. 186:10–187:2.

2 Lamb’s attempt to cast doubt on the efficacy of Racich’s extraction software is not well taken. The expert provided unrebutted evidence that the software is a well-tested “industry standard forensic tool,” Hr. Tr. 118:3–4, and the Court is satisfied that it captured an accurate picture of Lamb’s account. The problem, of course, is that Liberty (and the Court) must take Lamb’s word for the fact that he did not delete any materials, other than the 2,156 files found by Racich, that should have been returned to Liberty. But third-party verification was the centerpiece of the Court’s order and the Protocol, notwithstanding Lamb’s remarkable—indeed, implausible— interpretation of the Court’s order and the Protocol. The Court also notes that Racich’s findings mean that 95% of what was once on Lamb’s Evernote account is now missing. If the entire difference is made up of personal information, presumably Lamb would not have deleted that

information without downloading it onto another device. If he did, that device should have been made available to the expert. See Dkt. 85-2 p. 2 (defining devices that should be made available to the independent expert to include “all external storage media to which Lamb has access that Lamb, to his knowledge, has ever connected to any device that has ever contained information belonging to Liberty (including thumb drives, hard drives, CD-Roms, etc.)”) (emphasis added).

3. iPhone. Racich testified that the iPhone he received from Lamb first went into use on or about March 2, 2022. Dkt. 85-5 ¶ 7(a). Lamb explained that while he had in his possession the phone that he used while working at Liberty through March of 2022, he turned that phone in to a phone carrier in exchange for a credit for a new one. See Hr. Tr. P. 135:10–138:18. But he also

claimed that he did not violate the Protocol in doing so because that particular phone no longer had any data covered by the Protocol. See id. p. 136:21–23. According to Lamb, any emails originating from Liberty’s Microsoft Outlook account were remotely removed from the phone when he was fired. See id. p. 135:25–136:1. And the phone no longer had any texts because his “standard practice was to delete [his] texts constantly all throughout [his] time at Liberty.” Id. 146:15–17. This explanation also raises questions. First, Lamb is well aware that Racich is capable of retrieving deleted information from a device, since the deleted data recovered from his work laptop played a starring role in the December hearing, and the protocol appears to contemplate just such a process. See Dkt. 85-2 p. 3. The claim that Lamb regularly deleted texts also appears inconsistent with his early testimony regarding his commitment to retaining information. It is also unusual for a person to exchange phones without transferring data from the old phone onto the new, and Lamb’s explanation for this decision not to do so was unpersuasive. See Hr. Tr.

151:19–152:14 (explaining that he does not make many personal phone calls and uses a physical rolodex to retrieve work contacts).

II. Legal Standard This is not a typical discovery dispute. In addition to the common law duty to preserve evidence in anticipation of litigation, Liberty’s motion implicates the Court’s inherent power to vindicate the authority of its orders, see Chambers v. NASCO, Inc., 501 U.S. 43, 45 (1991), as well as the “bad faith” prong of the standard governing motions to amend a complaint, see Johnson v. Oroweat Foods Co., 785 F.2d 503, 509 (4th Cir. 1986) (“[L]eave to amend should be denied only when the amendment would be prejudicial to the opposing party, there has been bad

faith on the part of the moving party, or the amendment would have been futile.”). Rule 37(e)(2)3 allows for dismissal of an action (the practical upshot of Liberty’s requested relief) upon a court’s finding that:

3 The Court will be guided at this time by the Federal Rules of Civil Procedure addressing sanctions against a party that intentionally destroys ESI that should have been preserved in anticipation of litigation. That Rule provides the clearest guideposts and was the focus of the parties’ briefing. (1) ESI should have been preserved in anticipation of litigation; (2) That ESI was lost because of a failure to take reasonable steps to preserve; (3) The loss was due to an act by the nonmovant intended to deprive the movant of the use of the ESI during litigation; and (4) The ESI cannot be restored or replaced through additional discovery. Fed. R. Civ. P. 37(e).4 Notably, Liberty need not show that it was prejudiced by the loss of the ESI. “This is

because the finding of intent required by the subdivision can support not only an inference that the lost information was unfavorable to the party that intentionally destroyed it, but also an inference that the opposing party was prejudiced by the loss.” Id., Comm. Notes on Rules–2015 Amendment (hereinafter “Committee Notes”). Finally, this Court will follow “the general approach of courts in the Fourth Circuit . . . to apply the clear and convincing evidence standard, especially where a relatively harsh sanction” like dismissal is sought. See Steve & Sons, Inc. v. JELD-WEN, Inc., 327 F.R.D. 96, 104 (E.D. Va. 2018) (Payne, J.).

4 The relevant portion of the Rule reads: Failure to Preserve Electronically Stored Information. If electronically stored information that should have been preserved in the anticipation or conduct of litigation is lost because a party failed to take reasonable steps to preserve it, and it cannot be restored or replaced through additional discovery, the court: . . . (2) only upon finding that the party acted with the intent to deprive another party of the information’s use in the litigation may: . . . (C) dismiss the action or enter a default judgment. III. Analysis A. Duty to Preserve Rule 37(e) is grounded in the common law “duty to preserve relevant information when litigation is reasonably foreseeable.” Fed. R. Civ. P. 37(e) Committee Notes. There is no serious dispute that Lamb’s iPhone and Evernote account should have been preserved pursuant to this duty. Lamb filed his lawsuit in October of 2021. See Dkt. 1. See also Turner v. United States, 736 F.3d 274, 282 (4th Cir. 2013) (filing of lawsuit triggers duty to preserve). Lamb claimed at

that time, as he does now, that he was wrongfully terminated for his Title IX advocacy. The phone that Lamb used while employed at Liberty, and the cloud-based service on which he stored his notes and work product, are clearly relevant to both the potential defense and prosecution of his claim.

B. Reasonable Steps “The duty to preserve is not meant to impose an unreasonable burden on parties anticipating litigation,” Steve & Sons, 327 F.R.D. at 108, but a party generally “must suspend its routine document retention/destruction policy and put in place a ‘litigation hold’ to ensure the preservation of relevant documents,” Zubulake v. UBS Warburg LLC, 220 F.R.D. 212, 217

(S.D.N.Y. 2003). It is also undisputed that Lamb failed to take reasonable steps to preserve relevant information after his duty to do so arose in October of 2021. To the contrary, Lamb has admitted to taking active steps to destroy information. And on this point it is important to emphasize that the scope of Lamb’s common law duty to preserve information in anticipation of litigation is in no way subrogated by his duties under the Protocol. There is no evidence that preserving Lamb’s Evernote account as it existed in October would have imposed any cost on Lamb. And while keeping his old iPhone would have deprived Lamb of the opportunity to receive credit toward a new one, that cost is a reasonable burden given the potential importance of the information that phone may have contained.

C. Intent “The Fourth Circuit, like most circuits, has yet to interpret the new Rule 37(e)” and the

“standard for proving intent under that rule is not settled.” Jenkins v. Woody, No. 3:15-cv-00355, 2017 WL 362475 *17 (E.D. Va. Jan 17, 2017) (Lauck, J.). What is clear, however, is that “[n]egligent or even grossly negligent behavior does not” suffice because it does not support the inference “that the evidence was unfavorable to the party responsible for loss or destruction of the evidence.” Fed. R. Civ. P. 37 Committee Notes. The Court finds that the inconsistencies and oddities of Lamb’s testimony, not least of which is his implausible insistence that he believed himself to be acting in conformity with the terms of this Court’s December order and the Protocol, demonstrate a lack of credibility and good faith by clear and convincing evidence. The Court finds that Lamb knew he was acting outside the bounds of the law when he spoliated evidence, and that he did so with the purpose of

depriving Liberty of the use of that evidence in this litigation. The record evidence recited above amply demonstrates that. That lack of good faith is crystal-clear in Lamb’s decision to resurrect his children’s old, disused computer to access his Evernote account without doing so from an expressly covered device.

D. Impossibility of Replacement “This factor does not require that [Liberty] pursue every possible avenue for replacing or restoring the ESI, but it must show that it made some good-faith attempt to explore its alternatives before pursuing spoliation sanctions.” Steve & Sons, 327 F.R.D. at 109. Liberty has not yet had an opportunity to pursue such avenues. Maybe the forensic expert and artful use of third-party subpoenas would be capable of producing an image of Lamb’s Evernote account as it existed in October 2021, as well as lost texts, emails, and notes from Lamb’s phone. Because “spoliation sanctions motions often follow only where extensive ESI recovery

efforts have failed, or after forensic review gives the movant a much better idea of the quantity and nature of unproduced, deleted ESI,” Id. at 108 (citing examples), Liberty’s motion will be taken under advisement while Liberty has an opportunity to conduct additional discovery to determine what, if any, information may be recovered.5

IV. Conclusion The evidence shows that Lamb spoliated electronically stored information. Thus, additional discovery is warranted to determine whether that information can be recovered or replaced. Accordingly, Liberty’s motion will be taken under advisement while Liberty is permitted to conduct additional discovery.

It is ORDERED that the Court will take the motion under advisement, Liberty is entitled to conduct further discovery as described herein, and Liberty is to provide a status report within sixty days (60 days) of this Order.

5 Because it was Lamb’s wrongdoing that resulted in the loss of ESI, the Court will also entertain any motion that Lamb should bear the expense involved in recovering it. te OK OK ok The Clerk of the Court is hereby directed to send this Memorandum Opinion and Order to all counsel of record. Entered this 25th day of August 2022.

NO K. MO UNITED STATES DISTRICT JUDGE

_16—