Proofpoint, Inc. v. Vade Secure, Incorporated

Opinion

1 2 3 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA 6 EUREKA DIVISION 7 8 PROOFPOINT, INC., et al., Case No. 19-cv-04238-MMC (RMI)

9 Plaintiffs, ORDER RE: PLAINTIFFS’ MOTION 10 v. TO ENFORCE PRIOR ORDERS AND DEFENDANTS’ MOTION TO 11 VADE SECURE, INCORPORATED, et al., COMPEL 12 Defendants. Re: Dkt. Nos. 287, 292

13 14 Now pending before the court are two motions related to discovery disputes in this case. 15 The first is Plaintiffs’ renewed motion for enforcement and sanctions (dkt. 287) through which 16 they seek enforcement of two prior court orders that had granted Plaintiffs’ motion to compel the 17 production of certain discovery. The second (dkt. 292) is a motion filed by Vade Secure, Inc. and 18 Vade SASU (collectively, “Vade”) seeking the compelled production of Plaintiffs’ source code for 19 inspection by an expert based in the United Kingdom. The underlying problem attending 20 Plaintiffs’ need to file their motion for enforcement and sanctions has been Vade’s mistaken 21 contention that they can keep a bevy of discovery objections in their pocket, raising them in a 22 piecemeal fashion whenever they chose to do so, such as to draw out the course of discovery in 23 this case over a large period of time while requiring this court to entertain and adjudicate multiple 24 motions to compel the same discovery requests. 25 In short, (through RFP Nos. 1, 2, and 7-10) Plaintiffs sought to inspect all of Vade’s source 26 code for its O365 and MTA products, Vade refused, Plaintiffs moved to compel, Vade asserted 27 only an objection that French law prohibited it from tendering the source code in discovery except 1 reconsideration and added a new argument to the effect that Plaintiffs had failed to sufficiently 2 identify their trade secret under California law; then, several months after the undersigned rejected 3 those arguments, and well after Vade’s motion for a stay and for relief from that order were both 4 denied by Judge Chesney, Vade again refused to produce portions of the source code that was 5 encompassed by RFP Nos. 1, 2, and 7-10, claiming for the first time that they were irrelevant to 6 Plaintiffs’ claims. Plaintiffs then moved to enforce the prior orders granting its motion to compel, 7 but before that motion could be adjudicated, Vade entered into a stipulation wherein it agreed to 8 produce all the source code for its O365 and MTA products. The undersigned approved the 9 stipulation, rendering it into yet another order of the court. Shortly thereafter, Vade had another 10 change of heart and once again withheld certain portions of its source code for those products, 11 while again claiming those portions of code were not relevant. Plaintiffs then renewed their 12 motion to enforce the courts prior orders with coercive sanctions, while also requesting attorneys’ 13 fees and costs. The undersigned then informed the parties that Plaintiffs’ motion (dkt. 278) will be 14 bifurcated such that the court will first rule on the enforcement portion of the relief requested, 15 while deferring ruling on the attorneys’ fees and costs portion of the relief sought by Plaintiffs 16 until after the resolution of the enforcement issues. For the reasons stated below, the undersigned 17 will grant Plaintiffs’ motion for enforcement of the court’s prior discovery orders and for the 18 imposition of coercive sanctions; and, Vade’s motion for the compelled production of Plaintiffs’ 19 source code for inspection by a foreign-based expert is denied. 20 FACTUAL AND PROCEDURAL BACKGROUND 21 In October of 2019, the parties commenced fact discovery and Plaintiffs propounded a 22 series of discovery requests, including Plaintiffs’ first set of Requests for Production (“RFP”) Nos. 23 1 through 30 addressed to Vade; and, because Vade objected to the entirety of Plaintiffs’ discovery 24 requests, Plaintiffs quickly filed a motion to compel (dkt. 78).1 Specifically, counsel for Vade 25 26 1 Among the requested materials that were the subject of Plaintiffs’ motion to compel were RFP Nos. 1 and 2 as well as 7-10. In RFP Nos. 1 and 2, Plaintiffs sought complete copies of the source code (including 27 associated comment and revision histories sufficient to show individual authors and contributors) for any and all versions or releases for Vade O365 and Vade MTA. In RFP Nos. 7-10, Plaintiffs sought all 1 addressed a letter to Plaintiffs’ counsel on October 18, 2019, stating in pertinent part that, “[w]hile 2 Defendants intend to assert objections to those requests as otherwise permitted under the Federal 3 Rules of Civil Procedure and other applicable authorities, there is a more fundamental issue 4 concerning these requests that Defendants wanted to raise with Plaintiffs at the outset.” See Defs.’ 5 Ltr. Of October 18, 2019 (dkt. 78-5) at 1. Thus, while making a generalized reference to an 6 intention to assert other objections later, Vade’s letter focused on only two objections to providing 7 discovery in this case – namely, the applicability of a French blocking statute, and a provision of 8 European Union privacy law, as barriers that prohibited Vade from producing any discovery at all 9 in this case unless Plaintiffs agreed to seek discovery pursuant to Hague Convention procedures 10 under the supervision of a French magistrate. Id. at 1-2. Three days after the filing of Plaintiffs’ 11 motion to compel discovery (dkt. 78), the motion, as well as all further discovery matters, were 12 referred (dkt. 79) to the undersigned by Judge Chesney. In the order of referral, the parties were 13 instructed to meet and confer in advance of preparing and filing a joint letter brief explaining their 14 discovery dispute. Id. at 1. 15 About two months later, on January 6, 2020, the parties jointly filed three discovery 16 dispute letter briefs (dkts. 91, 92, 93). In the first letter brief (dkt. 91), Plaintiffs submitted that 17 three months had passed since they had served their discovery requests and that Vade had refused 18 to tender any discovery because complying with their discovery obligations in this case was 19 precluded by French law. Id. at 3-5. In opposition, Vade devoted the entirety of their response to 20 arguing that French law precluded them from participating in discovery in this case under the 21 Federal Rules of Civil Procedure, and that discovery should proceed pursuant to Hague 22 Convention procedures under the supervision of a French judge. Id. at 5-7. At this juncture it 23 should be noted that Vade clearly acknowledged that they understood the fact that they were 24 opposing a motion to compel discovery. See id. at 6 (Vade’s portion of the letter brief was littered 25 with acknowledgements that Plaintiffs had moved to compel production of materials responsive to 26 their discovery requests: “Plaintiffs, however, have refused [Hague Convention procedures] and 27 1 insist, through a motion to compel, that Defendants be required to produce discovery . . . 2 Plaintiffs’ motion should be denied . . . Plaintiffs now seek to compel discovery, claiming that 3 French law does not apply.”). At no point in its portion of this discovery dispute letter brief in 4 opposition to Plaintiffs’ motion to compel did Vade even mention any objections concerning the 5 relevance of any of Plaintiffs’ RFPs, or venture to lodge any objection at all other than contending 6 that French law precluded discovery because Vade contended – vaguely – that “with limited 7 exceptions, Defendants’ documents and information originate from France, and in most instances 8 are being stored on servers and equipment located in France.” Id. at 5 (emphases supplied). 9 Likewise, nowhere in the second or third letter briefs did Vade present any objection as to 10 relevance. The second letter brief (dkt. 92) addressed disputes as to the contents of a proposed ESI 11 order relating to preliminary depositions in light of Vade’s views about EU privacy laws and, 12 again, a French statute that was designed and intended to frustrate discovery procedures in 13 American courts (see dkt. 149 at 8-13). The third letter brief (dkt. 93) once again addressed the 14 applicability of French law, as well as disputing the location of source code review, the tools with 15 which source code would be reviewed, and the timing of source code printouts. 16 Shortly thereafter, the undersigned overruled Vade’s objections and granted Plaintiffs’ 17 motion to compel. See Order of January 31, 2020 (dkt. 112) at 4 (“Plaintiffs’ Motion to Compel 18 (dkts. 78, 91) is GRANTED.”). Fourteen days later, without having complied with the Order of 19 January 31, 2020, Defendants simultaneously sought leave to file a reconsideration motion before 20 the undersigned (dkt. 121), as well as appealing that order and requesting a stay from Judge 21 Chesney (dkts. 122, 123). Because Vade had chosen to seek reconsideration and an appeal, Judge 22 Chesney denied the appeal without prejudice (see dkt. 125) until after the resolution of the motion 23 for leave to file a reconsideration motion. The gist of Vade’s reconsideration motion was that a 24 General Standing Order of the undersigned pertaining to discovery disputes had prevented them 25 from submitting certain declarations relating to French law which had been (in the view of the 26 undersigned) more than adequately described in Defendants’ portion of the letter brief (dkt. 91) 27 through which they had chosen to oppose Plaintiffs’ motion to compel based only on their view 1 procedures. See generally Vade’s Recon. Mot. (dkt. 121). While Vade’s reconsideration motion 2 was still pending before the undersigned, the parties jointly filed a new discovery dispute letter 3 brief (dkt. 128) through which Vade added a new argument in opposition to Plaintiffs’ motion to 4 compel discovery – namely, that the motion to compel should also be denied because Plaintiffs 5 had reportedly failed to sufficiently identify (as required by California law) the particulars of the 6 trade secret that they alleged to have been stolen. Thereafter, the undersigned denied Vade’s 7 motion for reconsideration by rejecting both arguments (i.e., the applicability of French law, and 8 the argument about the insufficiency of Plaintiffs’ identification of its trade secret). See generally 9 Order of April 20, 2020 (dkt. 149). Defendants then sought relief (dkt. 152) from that order by 10 appealing to Judge Chesney, as well as requesting a stay (dkt. 154). On May 12, 2020, Judge 11 Chesney entered an Order (dkt. 159) denying Vade’s motions. 12 Several months later, because Vade had refused to provide certain portions of the source 13 code for Vade O365 and Vade MTA based on newly-concocted objections that the withheld 14 portions of source code were not relevant to Plaintiffs’ claims, Plaintiffs moved to compel the 15 production of source code printouts, and for enforcement of the court’s prior orders granting 16 Plaintiffs’ original motion to compel, as well as moving for sanctions and attorneys’ fees. See Pls.’ 17 Mots. (dkts. 237, 239). Following a hearing before the undersigned (dkt. 255), Vade induced 18 Plaintiffs to withdraw their motion by entering into a stipulation through which Vade agreed to 19 provide “all of the code” that would be responsive to RFP Nos. 1, 2, and 7-10 to the extent not 20 previously provided. See Stipulation (dkt. 266) at 4-6. The undersigned then approved that 21 stipulation, and by signing and filing the parties’ proposed order, the court terminated Plaintiffs’ 22 motions to compel and for sanctions. See Order of October 5, 2020 (dkt. 273). However, shortly 23 thereafter, Plaintiffs’ renewed their motions for sanctions and enforcement because Vade had once 24 again had a change of heart and had withheld portions thereof based on more newly-concocted 25 relevance objections. See Pls.’ Renewed Mots. (dkts. 287, 292). 26 Putting aside Vade’s tangential and irrelevant statements and arguments (such as when 27 Vade boasts about the sheer volume of materials they have elected not to withhold in discovery), 1 responsive to RFP Nos. 1, 2, and 7-10, is Vade’s argument that the withheld portions of the source 2 code are not relevant to Plaintiffs’ claims. See Defs.’ Opp. (dkt 313) at 21-24. As for Vade’s 3 explanation for why they have not violated the court’s previous order compelling the production 4 of all of this material, Vade argues that the two above-discussed orders granting Plaintiffs’ motion 5 to compel “were limited in scope” and that those orders only addressed the applicability of French 6 law and therefore did not “narrow Vade’s rights to lodge [other] objections [later] to discovery 7 requests under the Federal Rules of Civil Procedure, [and that the court] did not make a ruling on 8 any specific relevancy objections, or include any language about specific document production.” 9 Id. at 10. However, because Vade had not presented any such relevancy objections in any of their 10 papers opposing Plaintiffs’ motions to compel discovery, the thrust of Vade’s contention that the 11 court’s prior orders granting Plaintiffs’ motions to compel did not limit their rights to later present 12 such objections rings hollow and essentially boils down to the untenable contention that Vade can 13 make a tactical decision to withhold some discovery objections and to present them in a piecemeal 14 fashion such as to force Plaintiffs’ to file multiple motions to compel the same discovery 15 materials, and such as to force this court to repeatedly adjudicate multiple motions to compel the 16 same material, all of which would be entirely dependent on Vade’s decisions as to when to present 17 which objection. 18 Also pending before the court is Vade’s motion to compel Plaintiffs to provide their source 19 code for review by an expert based in the United Kingdom. See Vade’s Mot. (dkt. 292). Plaintiffs’ 20 arguments in opposition express serious concerns about the practicality attending enforcement and 21 policing of the court’s protective order regarding what would be an extraterritorial inspection of 22 their highly confidential source code. See Pls.’ Opp. (dkt. 311) at 2-3. Because Plaintiffs’ source 23 code relates to cybersecurity tools – in addition to being confidential and proprietary business 24 information – Plaintiffs suggest that a multitude of severe consequences would flow from the code 25 falling into the wrong hands, and that it is far from certain that the protective order in this case can 26 be effectively policed and enforced extraterritorially. Id. at 9-10. In short, Plaintiffs submit that 27 Vade cannot establish any particular need for a foreign-based source code review, let alone the 1 Plaintiffs such as to justify sending Plaintiffs source code to the United Kingdom for Vade’s 2 expert to conduct the review in question there rather than here in the United States. Id. 3 DISCUSSION 4 Generally speaking, “[t]he Federal Rules of Civil Procedure strongly favor full discovery 5 whenever possible.” Farnsworth v. Procter & Gamble Co., 758 F.2d 1545, 1547 (11th Cir. 1985). 6 Further, “[t]he party who resists discovery has the burden to show that discovery should not be 7 allowed, and has the burden of clarifying, explaining, and supporting its objections.” DIRECTV, 8 Inc. v. Trone, 209 F.R.D. 455, 458 (C.D. Cal. 2002). In order to avoid discovery, the resisting 9 party must assert their specific objections in response to the request, and then argue them in 10 response to a motion to compel because “[i]t is well established that a failure to object to 11 discovery requests within the time required constitutes a waiver of any objection.” Richmark 12 Corp. v. Timber Falling Consultants, 959 F.2d 1468, 1473 (9th Cir. 1992). 13 Therefore, in evaluating a motion to compel, the court does not simply look to and rely on 14 objections raised only in the response to the original discovery request. See Olmos v. Ryan, No. 15 CV-17-3665-PHX-GMS (JFM), 2020 U.S. Dist. LEXIS 67701, at *4-5 (D. Ariz. Apr. 17, 2020). 16 Instead, “[w]hen ruling upon a motion to compel, the court generally considers those objections 17 which have been timely asserted and relied upon in response to the motion . . . [and] generally 18 deems objections initially raised but not relied upon in response to the motion as abandoned. It 19 deems objections not initially raised as waived.” Cotracom Commodity Trading Co. v. Seaboard 20 Corp., 189 F.R.D. 655, 662 (D. Kan. 1999) (emphasis supplied); Hupp v. San Diego Cnty., 2014 21 U.S. Dist. LEXIS 52741, 2014 WL 1404510, at *7 (S.D. Cal. Apr. 10, 2014) (same); Bryant v. 22 Armstrong, 285 F.R.D. 596, 604 (S.D. Cal. 2012) (addressing only the objections raised in a 23 party’s opposition to a motion to compel where the party raised multiple boilerplate objections in 24 its initial responses to discovery requests, but did not support or explain those objections in its 25 opposition to a motion to compel); Dolquist v. Heartland Presbytery, 221 F.R.D. 564, 568 n.16 26 (D. Kan. 2004) (“objections initially raised but not relied upon in response to a motion to compel 27 are deemed abandoned”); In re Toys “R” Us-Del., Inc. Fair & Accurate Credit Transactions Act 1 2010) (same). 2 Accordingly, because Vade chose to only respond to Plaintiffs’ motion to compel with 3 arguments relying on the applicability of French law, while later adding the sufficiency of 4 Plaintiffs’ trade secret designation under California law, the court finds that Vade abandoned any 5 other objections that it may have asserted in response to the discovery requests themselves but that 6 were not mentioned, supported, or explained in its opposition to the motion to compel; and, as for 7 any objections that were not even raised in response to the discovery requests in the first place, the 8 court finds that those objections were waived. Thus, because Vade’s objections relating to, inter 9 alia, RFP Nos. 1, 2, and 7-10, were either waived or abandoned, or expressly rejected by the 10 court’s prior orders on the motion to compel, Vade was required to produce all information that 11 was responsive to all of Plaintiffs’ discovery requests without any further objections, or without 12 occasioning any further delays based on the piecemeal presentation of objections. Having failed to 13 do so, Vade has been in violation of the court’s prior orders since May 12, 2020, when Judge 14 Chesney entered an Order (dkt. 159) denying Vade’s motions for relief from the aforementioned 15 orders entered by the undersigned. The remaining question at this point is what should be the 16 consequence of Vade’s intransigence. 17 Plaintiffs have requested the gamut of consequences including a request that Vade be 18 found in civil contempt, the imposition of $2,500 in daily coercive sanctions until such time that 19 Vade complies with its obligation to produce, without objection, all of the materials that are 20 responsive to RFP Nos. 1, 2, and 7-10, and if Vade persists in refusing to comply as of November 21 20, 2020, Plaintiffs have requested that the undersigned recommend the issuance of an adverse 22 inference instruction at trial relating to the missing evidence. Following oral argument on these 23 motions, Vade filed a Notice (dkt. 329) explaining that (while it disagrees with the notion that it 24 has violated any order of this court or that it has failed to comply with any of its discovery 25 obligations at all) that coercive sanctions, or a certification to Judge Chesney for a contempt 26 finding, or the recommendation of an adverse inference instruction are unnecessary, because if 27 compelled to do so, Vade can make all of the source code in question available for inspection by 1 2 A magistrate judge’s authority to impose discovery sanctions turns first on whether the 3 order is construed as non-dispositive or dispositive. See Grimes v. City & Cnty. of S.F., 951 F.2d 4 236, 240-41 (9th Cir. 1991). If the matter is not dispositive of a claim or defense of a party, a 5 magistrate judge may enter a written order setting forth the decision, and such decisions are given 6 a degree of deference under Fed. R. Civ. P. 72(a), so long as they are not clearly erroneous or 7 contrary to law. Grimes, 951 F.2d at 240-41. On the other hand, if the matter is dispositive, a 8 magistrate judge must enter “a recommendation for the disposition of the matter.” Fed. R. Civ. P. 9 72(b). Proscriptive sanctions which are designed to compel compliance with a discovery order are 10 deemed not to be dispositive matters. See Grimes, 951 F.2d at 241 (“We hold that magistrates may 11 impose prospective sanctions pursuant to Rule 37 where such sanctions are necessary to enforce 12 compliance with a valid discovery order.”). Nor is a finding of contempt a necessary prerequisite 13 for imposing such coercive sanctions. See id.; see also United States v. Westinghouse Elec. Corp., 14 648 F.2d 642 (9th Cir. 1981). 15 In light of those standards, the court will note that due to the sophistication and reputation 16 of Vade’s counsel, it appears likely to the undersigned that Vade’s purpose for presenting its 17 objections in the piecemeal fashion described above has been to delay and frustrate the discovery 18 process in this case, however, the undersigned cannot completely discount the possibility that 19 Vade’s counsel simply did not know the law and that there may remain some chance of 20 misapprehending Vade’s mistakes for misdeeds. Accordingly, to fairly account for that possibility, 21 while at the same time leaving no room for doubt that the well of patience has run dry, the court 22 will fashion the following remedy in an effort to avoid unduly punishing Vade where it may be 23 undeserved while at the same time ensuring that that the court’s prior orders granting Plaintiffs’ 24 motion to compel will be duly respected and enforced without any further delay. It is therefore 25 ORDERED that for each weekday starting with Thursday, November 12, 2020, until Friday, 26 November 20, 2020, Vade shall be sanctioned in the sum of $2,500.00 per day until such time that 27 Vade’s CEO and its counsel in this court have certified to the court in writing that all materials 1 Plaintiffs. However, Vade’s obligation to actually pay these sums is STAYED until 12:00 p.m. on 2 November, 20, 2020; if by then, the written certification of compliance has been filed on the 3 docket of this case by Vade’s CEO and counsel, then Vade’s obligation to actually pay the accrued 4 sum will be VACATED and Vade will be excused from any obligation to pay any of those 5 accrued sanctions. If, on the other hand, Vade fails to produce the discovery in question and to file 6 the signed certification in question by 12:00 p.m. on November 20, 2020, then Vade is herewith 7 ORDERED to pay the accrued sum of $17,500.00 to the Clerk of Court no later than 3:00 p.m. on 8 Monday, November 23, 2020. Thereafter, until it complies with this order, Vade shall continue to 9 be assessed a daily sanction in the amount of $2,500.00 until Monday, November 30, 2020 (which 10 sums Vade shall remit to the Clerk of Court no later than 3:00 p.m. on Monday, November 30, 11 2020), at which point the undersigned will certify the issue of civil contempt for determination by 12 Judge Chesney, as well as issuing findings and a recommendation for the issuance of an adverse 13 inference instruction relating to the missing evidence against Vade at trial. 14 The undersigned will now turn to Vade’s motion to compel the transmission of Plaintiffs’ 15 source code to the United Kingdom for review by the foreign-based expert that Vade has retained. 16 While Vade contends that if this court refuses to force Plaintiffs to transmit their source code for 17 review abroad, this would amount to “disqualifying” Vade’s chosen expert. The court disagrees 18 because Vade’s argument discounts the possibility of bringing its (foreign-based but US citizen) 19 expert to the United States for reviewing the source code in question. Further, other than 20 suggesting that their expert has “agreed” to be subject to this court’s jurisdiction for the purposes 21 of enforcement and policing of the protective order in this case, those assurances ring hollow to 22 Plaintiffs because they are dependent in large part on voluntary compliance by Vade’s foreign- 23 based expert. 24 Because Vade has failed to cite a single case wherein a court has compelled a party to 25 transmit sensitive information of the nature involved here, and that is subject to a protective order, 26 abroad for review by a foreign-based expert, and because Vade can give no concrete assurance 27 that this court can effectively enforce or police the protective order in the event of unauthorized 1 compel (dkt. 292) is DENIED. Vade can either transport their chosen expert to the United States 2 || where he can review Plaintiffs’ source code pursuant to the terms of the protective order, or Vade 3 || can select some other expert that might be able to review Plaintiffs’ source code in the United 4 |} States. 5 IT IS SO ORDERED. 6 Dated: November 11, 2020 7 8 RQBERT M. ILLMAN 9 United States Magistrate Judge 10 11 a 12 15 16

= 17

Z 18 19 20 21 22 23 24 25 26 27 28