ORBITAL ENGINEERING, INC. v. BUCHKO

Opinion

IN THE UNITED STATES DISTRICT COURT FOR THE WESTERN DISTRICT OF PENNSYLVANIA

ORBITAL ENGINEERING, INC., ) ) Plaintiff, ) ) vs ) Civil Action No. 20-593 ) ) Magistrate Judge Dodge JEFFREY J. BUCHKO, ) ) Defendant. )

MEMORANDUM OPINION AND ORDER Pending before the Court is the motion of Defendant Jeffrey J. Buchko (“Buchko”) to exclude the testimony of Donald Justin Price (“Price”), an expert proffered by Plaintiff Orbital Engineering, Inc. (“Orbital”) on information technology (“IT”) and cybersecurity issues (ECF No. 285). In moving to exclude Price, Orbital relies upon the principles outlined in Daubert v. Merrell Dow Pharmaceuticals, Inc., 509 U.S. 579 (1993). For the reasons that follow, Buchko’s motion will be granted in part and denied in part. I. Standard of Review Rule 702 of the Federal Rules of Evidence sets forth the standards for admissible expert testimony. As explained by the Third Circuit Court of Appeals: “Rule 702 has three major requirements: (1) the proffered witness must be an expert, i.e., must be qualified; (2) the expert must testify about matters requiring scientific, technical or specialized knowledge [, i.e., reliability]; and (3) the expert’s testimony must assist the trier of fact[, i.e., fit].” “Under the Federal Rules of Evidence, a trial judge acts as a gatekeeper to ensure that any and all expert testimony or evidence is not only relevant, but also reliable.” Before the proposed testimony gets presented to the jury, the trial judge evaluates its admissibility based on these three requirements.

United States v. Schiff, 602 F.3d 152, 172 (3d Cir. 2010) (quoting Pineda v. Ford Motor Co., 520 F.3d 237, 243-44 (3d Cir. 2008)). “District courts perform a gatekeeping function to ensure that expert testimony meets the requirements of Federal Rule of Evidence 702.” Karlo v. Pittsburgh Glass Works, LLC, 849 F.3d 61, 80 (3d Cir. 2017). “As gatekeeper, a trial judge has three duties: (1) confirm the witness is a qualified expert; (2) check the proposed testimony is reliable and relates to matters requiring scientific, technical, or specialized knowledge; and (3) ensure the expert’s testimony is

‘sufficiently tied to the facts of the case,’ so that it ‘fits’ the dispute and will assist the trier of fact.” UGI Sunbury LLC v. A Permanent Easement for 1.7575 Acres, 949 F.3d 825, 832 (3d Cir. 2020) (quoting Daubert, 509 U.S. at 591). The Court of Appeals has stated that it has “a generally liberal standard of qualifying experts.” Elcock v. Kmart Corp., 233 F.3d 734, 742 (3d Cir. 2000). “Rule 702 requires the witness to have ‘specialized knowledge’ regarding the area of testimony. The basis of this specialized knowledge can be practical experience as well as academic training and credentials.” Waldorf v. Shuta, 142 F.3d 601, 625 (3d Cir. 1998) (citation omitted). The Third Circuit has derived from the seminal case of Daubert the following non-

exclusive factors for determining reliability: (1) whether a method consists of a testable hypothesis; (2) whether the method has been subject to peer review; (3) the known or potential rate of error; (4) the existence and maintenance of standards controlling the technique’s operation; (5) whether the method is generally accepted; (6) the relationship of the technique to methods which have been established to be reliable; (7) the qualifications of the expert witness testifying based on the methodology; and (8) the non-judicial uses to which the method has been put.

Elcock, 233 F.3d at 745-46 (quoting In re Paoli R.R. Yard PCB Litig., 35 F.3d 717, 742 n.8 (3d Cir. 1994)). This analysis applies to all expert testimony, not just scientific testimony. Kumho Tire Co. v. Carmichael, 526 U.S. 137, 147 (1999). An expert’s testimony must also “fit” the facts of the case. As the Court of Appeals explained in Schiff: It is typically understood in terms of whether there is a sufficient “fit” between the expert’s testimony and the facts that the jury is being asked to consider. Daubert, 509 U.S. at 591. In assessing whether an expert’s proposed testimony “fits,” we are asking “ ‘whether [the] expert testimony proffered ... is sufficiently tied to the facts of the case that it will aid the jury in resolving a factual dispute.’” Id. (quoting United States v. Downing, 753 F.2d 1224, 1242 (3d Cir. 1985)). Put another way, this is a question of relevance, and “Rule 702, which governs the admissibility of expert testimony, has a liberal policy of admissibility” if it has the “potential for assisting the trier of fact.” Kannankeril v. Terminix Int’l, Inc., 128 F.3d 802, 806 (3d Cir. 1997) (citing Holbrook v. Lykes Bros. S.S. Co., 80 F.3d 777, 780 (3d Cir. 1996)); see also In re TMI Litig., 193 F.3d 613, 670 (3d Cir. 1999) (“expert evidence which does not relate to an issue in the case is not helpful”). The “standard is not that high,” but “is higher than bare relevance.” In re Paoli R.R. Yard PCB Litig., 35 F.3d 717, 745 (3d Cir. 1994).

602 F.3d at 172-73. In making these determinations, the court should apply Rule 702’s requirements liberally, Pineda, 520 F.3d at 244, and should uphold the general framework of the Federal Rules of Evidence which favors the admissibility of evidence over non-admissibility. Daubert, 509 U.S. at 588; see also Pineda, 520 F.3d at 243 (“The Rules of Evidence embody a strong preference for admitting any evidence that may assist the trier of fact.”) II. Discussion Buchko asserts that Mr. Price is not qualified to render expert opinions on the topics he discusses. Further, he argues, Mr. Price’s methodologies are unreliable, his opinions lack reliability and “fit,” and his improper conflation of Buchko’s job responsibilities as Chief Operating Officer (“COO”) with those of the head of the IT department could mislead the jury. Buchko first argues that Mr. Price’s background in cybersecurity does not qualify him to opine on the responsibilities of “a C-suite executive that is not tasked exclusively with IT day-to- day functions (compared to, for example, a Chief Information Officer).” He asserts that Mr. Price’s background in cybersecurity alone does not qualify an expert to opine on the obligations of C-suite executives, and therefore, Mr. Price does not have the specialized expertise to be qualified to testify. See Elcock, 233 F.3d at 741. According to Buchko, nothing in Mr. Price’s background suggests any familiarity with corporate organization and/or structure that would quality him “to opine on the role of a COO of a privately-owned engineering firm tasked with oversight of several departments.” (ECF No. 286 at 11.) This is exacerbated, Buchko contends, by Mr. Price’s attempt

to erroneously attribute responsibility for cybersecurity to Buchko with which he was not tasked by Orbital. Orbital responds that Mr. Price is qualified to offer expert testimony and opinions based on his background and expertise. Among other things, he has a master’s degree in Information Systems Management as well as more than 20 years of experience consulting and advising entities concerning their IT systems, conducting cybersecurity assessments, leading cybersecurity incident response teams and directing digital forensic investigations. (Price Report at 5 & App. A; Price Decl. ¶ 3.)1 As he notes in his most recently filed Declaration (ECF No. 314 Ex. 1), he performs assessments and makes recommendations to organizations regarding their IT and cybersecurity

functions. In doing so, he states, he “take[s] into account reporting roles and structures among individuals who are involved with and are responsible for the company’s IT and cybersecurity functions,” and “routinely evaluate[s] descriptions of a company’s IT system, relevant personnel and reporting structures to identify the ultimate decisionmaker, the employee(s) who are or should be my primary point of contact and the employee(s) who will implement any policy changes, practices and procedures that may be approved by the decisionmaker(s).” (Price Decl. ¶¶ 8, 9.) As such, the Court concludes that Mr. Price is qualified to testify and offer opinions on the issue of cybersecurity measures at Orbital. He has both the necessary education and experience to

1 ECF No. 288 Ex. B; ECF No. 314 Ex. 1. do so. Moreover, as Orbital points out, Buchko’s attack on Mr. Price’s qualifications places significant emphasis on Buchko’s actual role and responsibilities regarding IT and cybersecurity at Orbital, a hotly disputed matter in this case. Buchko may cross-examine Mr. Price about these matters, but this goes to the weight of his testimony, not its admissibility. Buchko’s arguments about methodology, reliability and fit have a similar theme. With

respect to his argument that Mr. Price’s methodology is unreliable, Buchko asserts that Mr. Price attempts to impose on him duties and responsibilities that he simply didn’t have. In doing so, Buchko contends, Mr. Price ignores the fact that Orbital knew Buchko’s professional background was in engineering, not in IT or cybersecurity, and Orbital did not require him to have any substantive dealings with IT and cybersecurity. According to Buchko, Mr. Price wholly ignores this evidence in favor of imposing his own standard and duties. Among other evidence cite by Mr. Price, however, is Buchko’s deposition in which he testified that “I had operation responsibility and IT, and operational safety reported to me amongst other things.” (Price Rebuttal Report at 8) (citing Buchko Dep. 101.)2 He also testified that he was

knowledgeable about the various policies, practices, and procedures of the IT department as well as the IT systems and structure utilized by Orbital. (Id.) (citing Buchko Dep. 105.) Price also relies on testimony by Dylan Lewis and Brandon Otis that Buchko was “responsible” for IT. (Price Rebuttal Report at 9) (citing D. Lewis Dep. 20, Otis Dep. 66, 70.)3 Buchko argues that Price never cited the testimony of Robert Lewis, the CEO of Orbital,

2 ECF No. 288 Ex. C. 3 Buchko objects to this testimony on the ground that he did not report to these individuals, only to Robert Lewis. But as Orbital notes, they did not testify that they personally instructed him to perform certain matters, only that they understood he was responsible for IT. Orbital also cites to the deposition of Robert Lewis and a declaration by Otis, but as these matters were not reviewed by Price in preparing his reports, they will not be considered here. and that Orbital therefore cannot point to evidence that he was given any “directives” to take certain actions with respect to IT or cybersecurity. But as Orbital notes, Buchko offers no support for the premise that he had to receive “directives” given that oversight of IT was part of his job. Moreover, Buchko has not explained the apparent contradiction he has created: he maintains that he was not aware of the details of IT and cybersecurity and instead relied on the head of IT, but at

the same time expected the CEO of Orbital to direct him in these matters. Thus, the Court cannot conclude that Mr. Price’s methodology is unsound because he does, in fact, support his conclusions about Buchko’s obligations and his failure to comply with these obligations on evidence, not conjecture. “An expert is. . . permitted to base his opinion on a particular version of disputed facts and the weight to be accorded to that opinion is for the jury.” Walker v. Gordon, 46 F. App’x 691, 695-96 (3d Cir. 2002). In turn, Buchko may cross examine Mr. Price regarding the facts on which his opinions are based. Similarly, with respect to relevance and fit, Buchko contends that as to Mr. Price’s opinions regarding cybersecurity policies, there is no evidence that Buchko was required to have any

background in IT to assume the role of COO or that Buchko was personally directed to obtain training or certifications in the areas of IT and cybersecurity. Further, for Mr. Price’s opinions to “fit” the facts of this case, he would need to establish a foundation that Buchko was responsible for preparing and implementing the IT and cybersecurity policies. Because he failed to provide any such foundation, his testimony does not “fit.” Buchko also contends that Mr. Price opined that Orbital lacked a meaningful cybersecurity program, as a result of which it was vulnerable to the November 2019 ransomware incident. Buchko contends that this opinion does not “fit” the facts of this case because a third-party consultant found that no sensitive information was attempted to be accessed or exfiltrated during the attack, there was no evidence that data was copied or exfiltrated by the threat actors, the system was able to be shut down within an hour of the attack and, because Buchko had put in place cybersecurity insurance coverage, there was no loss of significance to Orbital. Buchko notes Mr. Price’s admission that no company can assure that its network is secure against all threats. (Price Report at 13-14) (ECF No. 288 Ex. B.)

The Court concludes that Mr. Price’s proposed testimony meets the standards of reliability and fit. His report is sufficiently tied to the facts of the case such that it will aid the jury in resolving the parties’ disputes. Buchko can certainly cross-examine Mr. Price as to these issues, but they go to the weight of his testimony, not its admissibility. See Tuman v. Genesis Assocs., 935 F. Supp. 1375, 1385 (E.D. Pa. 1996) (“questions relating to the bases and sources of an expert’s opinion affect the weight to be assigned that opinion rather than its admissibility and should be left for the jury’s consideration.”) Finally, Buchko argues that because Mr. Price’s testimony improperly conflates Buchko’s role with that of Scott Winkler, head of the IT department, it should be excluded because it will

unfairly confuse the jury. Mr. Price states: “I found that neither the IT department nor the COO responsible for the department conducted or had conducted for them an adequate risk assessment on which to base the development and implementation of an effective cybersecurity program.” (Price Report at 14) (ECF No. 288 Ex. B.) See id. at 40-41 (“Mr. Buchko demonstrated a failure to educate himself, or to ensure that others he appointed in the IT department were knowledgeable or even aware of basic industry standards relating to information technology or cybersecurity.”) As these statements indicate, Mr. Price did not conflate Buchko’s responsibilities with those of the head of the IT department. Indeed, Mr. Price relies on facts, albeit disputed, that Buchko had more than mere “administrative oversight” of IT functions. Rule 403 supports excluding evidence that is “unfairly prejudicial, not just prejudicial.” Goodman v. Pennsylvania Tpk. Comm’n, 293 F.3d 655, 670 (3d Cir. 2002). While this evidence may be prejudicial to Buchko, he has not demonstrated that the probative value of Mr. Price’s testimony is substantially outweighed by the danger of unfair prejudice. To the extent that Mr. Price’s conclusions are based on evidence that Buchko had certain responsibilities for IT that he failed to fulfill, Buchko may

dispute these conclusions by presenting evidence that he did not have the level of responsibility that Orbital has suggested. Thus, the jury may properly evaluate this conflicting evidence. Having concluded that Mr. Price’s testimony is generally admissible, the Court nonetheless finds that Mr. Price’s testimony must be based on the specific facts of this case as they relate to Buchko’s role and responsibilities and his critique of Buchko’s performance. Orbital asserts both that Price was “not opining in the abstract about the responsibilities a chief operating officer may have with respect to IT or cybersecurity” (ECF No. 314 at 12), and that Price “also provides a detailed background discussion with respect to a COO’s role in a company’s cybersecurity [which] provides a further foundation and rationale for [his] opinions and conclusions.” (Id. at 13 n.3.)

Orbital cannot have it both ways. Mr. Price’s report discusses Orbital’s lack of compliance with industry standards relating to its IT function and cybersecurity policies and procedures. He places the blame for Orbital’s noncompliance on Buchko. Thus, the fundamental inquiry on this issue is what Orbital tasked Buchko to do and whether he fulfilled these obligations. As such, while Mr. Price may provide relevant background regarding his familiarity with corporate organization and/or structure that may support his qualifications and may also testify as to his opinions about industry standards regarding cybersecurity and IT functions, he will be precluded from expressing any testimony or opinions, to the extent that his report does so, regarding the abstract responsibilities that a hypothetical chief operating officer may have with respect to IT or cybersecurity. Therefore, this 5th day of January, 2022, it is ORDERED that the motion of Jeffrey J. Buchko to exclude the testimony of Donald Justin Price is GRANTED to the extent that Orbital intends to offer Mr. Price’s testimony regarding the responsibilities of chief operating officers in general with respect to IT or cybersecurity. Orbital is precluded from offering any such testimony

or opinions. The motion is otherwise DENIED.

BY THE COURT: s/Patricia L. Dodge PATRICIA L. DODGE United States Magistrate Judge