SiteLock LLC v. GoDaddy.com LLC

Opinion

1 WO 2 3 4 5 6 IN THE UNITED STATES DISTRICT COURT 7 FOR THE DISTRICT OF ARIZONA

9 SiteLock LLC, No. CV-19-02746-PHX-DWL

10 Plaintiff, ORDER

11 v.

12 GoDaddy.com LLC,

13 Defendant. 14 15 In 2013, Plaintiff SiteLock LLC (“SiteLock”) and Defendant GoDaddy.com LLC 16 (“GoDaddy”) executed a contract (the “Reseller Agreement”) under which GoDaddy 17 agreed to promote and sell SiteLock’s website security services to GoDaddy’s customers. 18 In this action, SiteLock accuses GoDaddy of various contractual breaches, as well as 19 Lanham Act and related state-law violations. 20 Earlier this year, the Court issued a lengthy order resolving the parties’ cross- 21 motions for summary judgment, a motion for sanctions, and a motion to exclude expert 22 testimony. (Doc. 435.) Now pending before the Court are two more requests for sanctions: 23 (1) GoDaddy’s motion to preclude SiteLock from pursuing a particular damages theory 24 due to late disclosure (Doc. 457); and (2) GoDaddy’s motion for spoliation sanctions based 25 on SiteLock’s destruction of application programming interface (“API”) data and certain 26 customer communications (Doc. 467). For the following reasons, both motions are denied. 27 … 28 … 1 RELEVANT BACKGROUND 2 The background of this case has been summarized in detail in earlier orders. When 3 certain facts become important, they will be addressed in the Discussion section below. 4 On February 26, 2021, the deadline for completing fact discovery expired. (Doc. 5 250.) 6 On May 17, 2022, GoDaddy filed a motion for sanctions pursuant to Rule 37(b)(2) 7 and Rule 37(c)(1) based on late disclosure (“the motion for disclosure sanctions”). (Doc. 8 457 [motion]; Doc. 458 [memorandum].) The motion thereafter became fully briefed. 9 (Doc. 465 [response]; Doc. 466 [refiled version of response]; Doc. 478 [reply].) 10 On June 1, 2022, GoDaddy filed a motion for sanctions for spoliation of evidence 11 (“the motion for spoliation sanctions”). (Doc. 467 [motion]; Doc. 468 [memorandum].) 12 The motion thereafter became fully briefed. (Doc. 480 [response]; Doc. 486 [reply].)1 13 DISCUSSION 14 I. The Motion For Disclosure Sanctions 15 A. Legal Standard 16 As discussed in the Court’s March 2, 2022 order, violations of the disclosure 17 obligations created by the District of Arizona’s Mandatory Initial Discovery Pilot Project 18 (“MIDP”) are sanctionable under Rule 37(b)(2). (Doc. 435 at 41-42.) 19 Because this case was filed in April 2019, it was (and remains) subject to the MIDP, 20 which applies to most civil cases filed between May 1, 2017 and May 1, 2020. See D. 21 Ariz. G.O. 17-08. Under the MIDP, the parties “are ordered to provide mandatory initial 22 discovery responses before initiating any further discovery in this case. The responses are 23 called for by the Court, not by discovery requests actually served by an opposing party.” 24 Id. ¶ A.2. “Each party’s response must be based on the information then reasonably 25 available to it,” and a “party is not excused from providing its response because it has not 26 fully investigated the case.” Id. ¶ A.3. Additionally, “[t]he duty to provide mandatory 27 initial discovery responses . . . is a continuing duty, and each party must serve supplemental

28 1 SiteLock’s request for oral argument on both motions is denied because the issues are fully briefed and argument would not aid the decisional process. See LRCiv 7.2(f). 1 responses when new or additional information is discovered or revealed.” Id. ¶ A.8. As 2 relevant here, the information that is subject to mandatory disclosure under the MIDP 3 includes, “[f]or each of your claims or defenses, . . . the facts relevant to it and the legal 4 theories upon which it is based.” Id. ¶ B.4. Also subject to mandatory disclosure is “a 5 computation of each category of damages claimed by you, and a description of the 6 documents or other evidentiary material on which it is based.” Id. ¶ B.5. 7 Because the disclosures required by the MIDP “supersede the disclosures required 8 by Rule 26(a)(1) and are framed as court-ordered mandatory initial discovery pursuant to 9 the Court’s inherent authority to manage cases,” id. at 1, a violation of the MIDP’s 10 disclosure obligations is sanctionable under Rule 37(b)(2). Sali v. Corona Reg'l Med. Ctr., 11 884 F.3d 1218, 1222 (9th Cir. 2018) (“In the context of Rule 37(b) sanctions, we ‘read 12 broadly’ the term ‘order’. . . [to] ‘include any order relating to discovery.’”) (citations 13 omitted); Nyerges v. Hillstone Rest. Grp. Inc., 2021 WL 3299625, *8-9 (D. Ariz. 2021) 14 (violation of MIDP disclosure obligations sanctionable under Rule 37(b)(2)). Rule 15 37(b)(2), in turn, provides that if a party “fails to obey an order to provide or permit 16 discovery . . . the court . . . may issue further just orders,” including “prohibiting the 17 disobedient party from supporting . . . designated claims or defenses, or from introducing 18 designated matters in evidence.” “The scope of sanctions for failure to comply with a 19 discovery order is committed to the sound discretion of the district court.” Payne v. Exxon 20 Corp., 121 F.3d 503, 510 (9th Cir. 1997). 21 B. Discussion 22 1. Terminology 23 Before diving into the merits of GoDaddy’s request for disclosure sanctions, it is 24 important to discuss the terminology used in the motion. GoDaddy seeks to exclude 25 SiteLock’s “theory of damages based on unactivated SiteLock products that GoDaddy’s 26 customers obtained for free,” which GoDaddy characterizes as the “Free Giveaway 27 Theory.” (Doc. 458 at 1.) According to GoDaddy, this theory is that “GoDaddy breached 28 the parties’ agreement by offering free giveaways” of SiteLock products, which is distinct 1 from SiteLock’s theory based on “generalized allegations of damages based on sales of 2 SiteLock made by GoDaddy to GoDaddy’s customers.” (Id. at 3.) According to GoDaddy, 3 SiteLock disclosed the “Free Giveaway Theory” for the first time on March 19, 2021, when 4 it was mentioned in the report of SiteLock’s damages expert, Dr. Kursh. (Doc. 478 at 3.) 5 In that report, Kursh states: “GoDaddy also sold SiteLock as part of bundles of other 6 products. I understand that, as with standalone sales of SiteLock subscriptions, GoDaddy 7 paid SiteLock for these subscriptions only ‘if activated.’” (Doc. 308-9 ¶ 167.) 8 The Court will set forth its understanding of the theory in a simpler context. A 9 customer at McDonald’s purchases a Happy Meal, which comes with a toy that 10 McDonald’s advertises as being “free.” Because the cost of the toy does not display on the 11 register when the cashier rings up the order, the customer may view the toy as a giveaway. 12 However, the wholesale manufacturer of those toys does not view them as “free” or “given 13 away,” but as a valuable component of the overall Happy Meal that drives customer traffic. 14 Here, GoDaddy suggests that when it provided a customer with a bundle of products 15 that included a SiteLock subscription, the SiteLock component of the bundle was “a free 16 giveaway” because the customer did not pay for the SiteLock product itself. (Doc. 458 at 17 3 n. 2 [“[C]ustomers who have GoDaddy’s Managed Wordpress Ultimate plan get the free 18 SiteLock Professional plan.”].) But SiteLock disputes that the SiteLock product is “free” 19 in this scenario, arguing that “[w]hen a customer pays GoDaddy for a product bundle that 20 includes SiteLock, by definition that customer is ordering and paying for all of the products 21 in that bundle, including SiteLock.” (Doc. 466 at 1.) 22 2. The Parties’ Arguments 23 In its motion to exclude, GoDaddy argues that (1) the logic underlying the Court’s 24 earlier order excluding GoDaddy’s “bundling” recoupment theories also mandates 25 exclusion of SiteLock’s Free Giveaway Theory (Doc. 458 at 10-12); (2) exclusion is 26 necessary under Ninth Circuit precedent (id. at 12-13); (3) the disclosure violation was not 27 substantially justified, because SiteLock could have developed the theory before the case 28 began, and was not harmless, because it interfered with GoDaddy’s ability to pursue 1 relevant discovery (id. at 13-16); (4) at a minimum, the Court should reopen fact and expert 2 discovery (id. at 16-17); and (5) the motion is timely (id. at 17). 3 SiteLock responds that (1) it properly disclosed the disputed theory in the complaint 4 and in its MIDP disclosures, both of which made clear that it was seeking damages based 5 on GoDaddy’s failure to pay SiteLock for “all” “orders” of a SiteLock subscription (Doc. 6 465 at 10-13); (2) the Court already held that bundled SiteLock subscriptions are part of 7 SiteLock’s claims (id. at 13-14); (3) GoDaddy’s motion is untimely because it was filed 8 more than 18 months after GoDaddy became aware of SiteLock’s position that “all” 9 “orders” includes bundled subscriptions (id. at 14-15); and (4) any technical violation was 10 substantially justified, because SiteLock reasonably believed its MIDP disclosures put 11 GoDaddy on notice of the theory, and harmless, because GoDaddy already has the relevant 12 information it claims to need (id. at 15-17). 13 In reply, GoDaddy argues that (1) SiteLock failed to properly disclose the theory 14 (Doc. 478 at 2-3); (2) SiteLock had no valid reason to delay disclosure (id. at 3-5); (3) 15 SiteLock’s witnesses confirmed that GoDaddy gave away free products (id. at 5-7); (4) 16 SiteLock failed to address previous judicial admissions (id. at 7); (5) the Court has already 17 ruled that SiteLock’s disclosed theory did not include “free giveaways” (id. at 7-8); (6) the 18 Court has not already ruled that SiteLock’s disclosed theory included bundled products (id. 19 at 8-10); (7) more discovery is required on “free giveaways” (id. at 10-11); and (8) the 20 motion is timely (id. at 11). 21 3. Analysis 22 On August 9, 2019, SiteLock served its initial MIDP disclosures, which explained 23 that “GoDaddy breached the Agreement by refusing to pay SiteLock for each customer 24 ‘order’ of a SiteLock ‘subscription.’” (Doc. 466-2 at 10.) On August 28, 2020, SiteLock 25 served amended MIDP disclosures, which stated that GoDaddy was obligated to pay 26 SiteLock for “each ‘order’ of any ‘subscription’ to a SiteLock service” and that GoDaddy 27 breached the Reseller Agreement “[b]y failing to pay SiteLock for all ‘orders’ of SiteLock 28 ‘subscriptions.’” (Doc. 466-3 at 16-17.) 1 SiteLock argues these disclosures were, alone, sufficient to provide adequate notice 2 of the so-called Free Giveaway Theory because they made clear that it was seeking 3 damages arising from “each” and “all” orders of SiteLock subscriptions, which are 4 unqualified formulations that necessarily include orders in which a SiteLock subscription 5 was included as part of a larger product bundle. In response, GoDaddy contends this 6 argument is inconsistent with how GoDaddy defined the term “order” for purposes of its 7 initial interrogatories, requests for production, and deposition notices, which was that an 8 order constituted “a Customer’s agreement to pay for a SiteLock subscription.” (Doc. 458 9 at 6, citing Doc. 253-1 at 57, 73, 83.) 10 As an initial matter, the Court is not persuaded that SiteLock’s current position is 11 inconsistent with its previous definition of “orders.” Although GoDaddy may have 12 construed the phrase “agreement to pay for a SiteLock subscription” to refer only to 13 standalone purchases outside of bundles, it also would have been reasonable for SiteLock 14 to construe that phrase to include bundles in which there was no separate charge for the 15 SiteLock component. This harkens back to the Happy Meal analogy described above— 16 although the customer might perceive the toy to be a free giveaway, the manufacturer 17 would not. At most, then, the definition of “order” that SiteLock provided during the early 18 stages of the case was ambiguous as to whether it encompassed bundled subscriptions. 19 Critically, any lingering ambiguity was eliminated by no later than November 20, 20 2020, when SiteLock filed a motion to compel in which it made clear that “SiteLock 21 subscriptions that GoDaddy sold with other services are just as relevant as SiteLock 22 subscriptions that GoDaddy sold on their own. The parties’ contracts required GoDaddy 23 to pay SiteLock when it sold SiteLock subscriptions whether separately or as part of a 24 package.” (Doc. 215 at 4.) This was more than three months before the close of fact 25 discovery. Following this clarification, GoDaddy took various steps to defend against 26 SiteLock’s claim for damages based on bundled subscriptions, including retaining an 27 expert to “defend against SiteLock’s late-disclosed position.” (Doc. 367 at 6.) 28 Given this backdrop, GoDaddy has not established that SiteLock violated its 1 disclosure obligations under the MIDP with respect to the so-called Free Giveaway Theory. 2 SiteLock’s MIDP disclosures, although perhaps ambiguous, could be reasonably construed 3 as encompassing the damages theory it now seeks to pursue. 4 Alternatively, even assuming the disclosures could be deemed inadequate, any 5 disclosure violation was substantially justified and harmless. Although the text of Rule 6 37(b)(2) does not specifically enumerate a “substantially justified or harmless” escape 7 hatch for liability, the Court has determined that a district court may consider concepts of 8 substantial justification and harmlessness when deciding whether to impose sanctions 9 under Rule 37(b)(2), in pursuit of the requirement that sanctions be “just.” (Doc. 435 at 48 10 n. 18.) 11 SiteLock’s position that it believed it did not need to amend its MIDP disclosures, 12 because it had already disclosed a theory of damages covering both standalone and bundled 13 subscriptions (“all” or “each” order), was substantially justified. As discussed above, a 14 reasonable person could have interpreted SiteLock’s disclosure of its intention to pursue 15 damages based on “each” and “all” orders to include orders involving bundled 16 subscriptions, even in light of how SiteLock defined the term “orders” for purposes of its 17 discovery requests. 18 Any disclosure violation was also harmless. GoDaddy became aware of SiteLock’s 19 theory no later than November 2020, nearly two years ago and several months before the 20 close of discovery. GoDaddy was not “in the dark regarding the theory or nature of 21 Plaintiffs’ damages claims,” Allstate Ins. Co. v. Nassiri, 2010 WL 5248111, *5 (D. Nev. 22 2020), but was given “fair notice of the factual basis for [SiteLock’s claims] so as to allow 23 [GoDaddy] an opportunity to conduct relevant discovery.” Ocean Garden Prods. Inc. v. 24 Blessings Inc., 2018 WL 6133773, *1 (D. Ariz. 2018). In fact, GoDaddy does not explicitly 25 state that it was unaware of the full scope of GoDaddy’s theory, but simply contends that 26 the theory was never properly and formally disclosed. GoDaddy also retained an expert to 27 “defend against SiteLock’s late-disclosed position.” (Doc. 367 at 6.) Finally, GoDaddy’s 28 1 attempt to bring a fully conceived counterclaim2 based on the same factual premise, without 2 a motion to exclude SiteLock’s theory, and then only bring a motion to exclude after the 3 counterclaim was excluded, makes clear that GoDaddy was not genuinely prejudiced by 4 what was—at most—a nominal violation of SiteLock’s disclosure obligations under the 5 MIDP. 6 II. The Motion For Spoliation Sanctions 7 A. Legal Standard 8 GoDaddy seeks the imposition of spoliation sanctions under Rule 37(e) of the 9 Federal Rules of Civil Procedure. Rule 37(e) was “completely rewritten” in 2015 to 10 “provide[] a nationally uniform standard for when courts can give an adverse inference 11 instruction, or impose equally or more severe sanctions, to remedy the loss of ESI.” 1 12 Gensler, Federal Rules of Civil Procedure, Rules and Commentary, Rule 37, at 1194 13 (2021). The text of Rule 37(e)(2) now provides:

14 If electronically stored information that should have been preserved in the 15 anticipation or conduct of litigation is lost because a party failed to take reasonable steps to preserve it, and it cannot be restored or replaced through 16 additional discovery, the court: 17 . . . 18 (2) only upon finding that the party acted with the intent to deprive 19 another party of the information’s use in the litigation may: 20 (A) presume that the lost information was unfavorable to the 21 party; 22 (B) instruct the jury that it may or must presume the 23

24 2 GoDaddy argues that the Court’s earlier exclusion of its recoupment theory “mandates” exclusion of SiteLock’s similar theory. Not so. The Court found that 25 GoDaddy never disclosed its theories to SiteLock until after the close of fact discovery and that GoDaddy’s vague MIDP disclosures did not provide fair notice or even “logically 26 implicate[] the existence of a peripheral undisclosed theory.” (Doc. 435 at 47-48.) By contrast, SiteLock provided initial and supplemental MIDP disclosures that were, alone, 27 arguably sufficient to disclose the challenged theory, then explicitly informed GoDaddy of the two components of its theory shortly after supplementing its MIDP disclosures (and 28 well before the close of discovery). Although both SiteLock’s and GoDaddy’s theories relied on a similar universe of facts, their disclosure efforts varied drastically. 1 information was unfavorable to the party; or

2 (C) dismiss the action or enter a default judgment. 3 4 A party seeking sanctions under Rule 37(e) has a threshold duty to show that the 5 ESI at issue was, in fact, lost or destroyed. Fed. R. Civ. P. 37(e) advisory committee’s note 6 to 2015 amendment (“The new rule applies only . . . when [ESI] is lost.”). If such a showing 7 has been made, Rule 37(e) “establishes three prerequisites to sanctions: the ESI should 8 have been preserved in the anticipation or conduct of litigation, it is lost through a failure 9 to take reasonable steps to preserve it, and it cannot be restored or replaced through 10 additional discovery.” Fast v. GoDaddy.com LLC, 340 F.R.D. 326, 335 (D. Ariz. 2022). 11 See also Fed. R. Civ. P. 37(e) advisory committee’s note to 2015 amendment (“The new 12 rule applies only if the lost information should have been preserved in the anticipation or 13 conduct of litigation and the party failed to take reasonable steps to preserve it.”). 14 If each of these questions is answered in the affirmative, the next inquiry under Rule 15 37(e)(2) is whether the nonmovant “acted with the intent to deprive another party of the 16 information’s use in the litigation.” Unlike Rule 37(e)(1), Rule 37(e)(2) “does not include 17 a requirement that the court find prejudice to the party deprived of the information. This 18 is because the finding of intent required by the subdivision can support not only an 19 inference that the lost information was unfavorable to the party that intentionally destroyed 20 it, but also an inference that the opposing party was prejudiced by the loss of information 21 that would have favored its position. Subdivision (e)(2) does not require any further 22 finding of prejudice.” Fed. R. Civ. P. 37(e) advisory committee’s note to 2015 amendment. 23 If such intent is found, the Court has discretion to impose any of the sanctions 24 authorized in subsections (e)(2)(A)-(C) (i.e., an adverse inference, an adverse-inference 25 jury instruction, or a terminating sanction). However, “[f]inding an intent to deprive 26 another party of the lost information’s use in the litigation does not require a court to adopt 27 any of the measures listed in subdivision (e)(2). The remedy should fit the wrong, and the 28 severe measures authorized by this subdivision should not be used when the information 1 lost was relatively unimportant or lesser measures such as those specified in subdivision 2 (e)(1) would be sufficient to redress the loss.” Id. 3 “[T]he relevant standard of proof for spoliation sanctions is a preponderance of the 4 evidence.” Fast, 340 F.R.D. at 335. See also Compass Bank v. Morris Cerullo World 5 Evangelism, 104 F. Supp. 3d 1040, 1052-53 (S.D. Cal. 2015). The Court is the appropriate 6 finder of fact on a Rule 37(e) motion. Mannion v. Ameri-Can Freight Sys. Inc., 2020 WL 7 417492, *4 (D. Ariz. 2020). See also Adriana Int’l Corp. v. Thoeren, 913 F.2d 1406, 1408 8 (9th Cir. 1990) (“The imposition of discovery sanctions pursuant to [Rule 37] is reviewed 9 for abuse of discretion. Absent a definite and firm conviction that the district court made 10 a clear error in judgment, this court will not overturn a Rule 37 sanction. Findings of fact 11 related to a motion for discovery sanctions are reviewed under the clearly erroneous 12 standard. If the district court fails to make factual findings, the decision on a motion for 13 sanctions is reviewed de novo.”) (citations omitted). 14 B. The Parties’ Arguments 15 1. Duty To Preserve Evidence 16 GoDaddy argues that “SiteLock identified its core claims in 2014” and “identified 17 its disparagement claim by June of 2017.” (Doc. 468 at 10.) Thus, GoDaddy contends that 18 “SiteLock’s duty to preserve evidence began in 2014” and that “SiteLock destroyed 19 Customer Communication Evidence and the API Data well after it identified its claims, 20 and as it prepared to file this lawsuit.” (Doc. 468 at 10.) 21 SiteLock responds that “[f]or years, GoDaddy had assured SiteLock that [it] would 22 . . . uphold its contractual promise to pay for all SiteLock orders.” (Doc. 480 at 7.) 23 According to SiteLock, it was not until October 2018, when “GoDaddy sent a formal email 24 to SiteLock asserting that GoDaddy had no obligation to pay SiteLock for unactivated 25 SiteLock subscriptions,” that SiteLock began anticipating litigation. (Id. at 7.) SiteLock 26 asserts that GoDaddy is wrong to argue that SiteLock was “planning” to sue GoDaddy 27 since March 2014 because “[t]his was before GoDaddy even began offering SiteLock to 28 its customers and more than four years before the parties’ contract terminated. . . . 1 GoDaddy repeated [its] assurances for the next four years until reversing itself in October 2 2018. Because of GoDaddy’s repeated assurances, SiteLock saw no need to pursue any 3 legal options against GoDaddy until 2018.” (Id. at 8.) 4 GoDaddy replies that, based on certain documents relating to Abry Partners, LLC’s 5 acquisition of SiteLock, “SiteLock’s duty to preserve evidence indisputably arose in 2014, 6 when it began planning to sue GoDaddy.” (Doc. 486 at 1.) GoDaddy specifically argues 7 that a duty to preserve can arise long before a party formally retains counsel. (Id. at 4-5.) 8 2. Customer Communication Evidence 9 GoDaddy argues that SiteLock willfully destroyed customer communication 10 evidence, which SiteLock itself has confirmed is directly relevant to SiteLock’s claims. 11 (Doc. 468 at 10-11.) GoDaddy also argues that the evidence cannot be obtained from an 12 alternative source. (Id. at 11-12.) Although GoDaddy states that it “need not prove 13 prejudice because SiteLock’s destruction of evidence was willful,” GoDaddy argues that it 14 was prejudiced by the destruction here because the missing evidence “would show that 15 there was no disparagement.” (Id. at 12-13.) As a result, GoDaddy asks the Court to 16 preclude SiteLock from arguing that GoDaddy disparaged SiteLock in communications 17 between GoDaddy and GoDaddy’s customers, and in the alternative, GoDaddy asks for an 18 adverse inference instruction “for the jury to assume that if SiteLock had not destroyed the 19 Customer Communication Evidence, such evidence would show GoDaddy did not 20 disparage SiteLock.” (Id. at 15.) 21 In response, SiteLock argues that GoDaddy cannot show that favorable evidence 22 was lost or that GoDaddy was prejudiced by the loss of the calls—more evidence of 23 disparagement could logically only benefit SiteLock while calls lacking disparagement 24 would not be probative. (Id. at 14-15, 17.) At any rate, SiteLock argues that it was 25 reasonable not to retain all customer calls, as SiteLock applied a standard retention policy 26 in which calls and chats were retained for 90 days. (Id. at 15-16.) SiteLock also asserts 27 that GoDaddy “cites zero evidence” in support of the contention that SiteLock intentionally 28 destroyed the communications to frustrate GoDaddy’s litigation objectives. (Id. at 16-17.) 1 17.) Finally, SiteLock requests an award of the costs incurred when opposing GoDaddy’s 2 motion, lest GoDaddy “be emboldened to continue filing frivolous and untimely discovery 3 motions.” (Id. at 17.) 4 GoDaddy replies that “temporal proximity between SiteLock’s decision to preserve, 5 review, and then destroy Customer Communication Evidence . . . demonstrates intent.” 6 (Doc. 486 at 4.) GoDaddy also reasserts that it is requesting SiteLock’s claims be barred 7 or “an instruction stating that it has been deemed admitted, and must be accepted as true, 8 that the deleted recordings show GoDaddy did not disparage SiteLock.” (Id. at 11.) 9 3. API Calls 10 GoDaddy argues that because the API data “goes to the heart of SiteLock’s core 11 claims” and “SiteLock insisted the GoDaddy produce the same data,” “there is no question 12 that it should have been preserved. SiteLock cannot credibly argue that the API Data can 13 be obtained from an alternative source given its demand that GoDaddy reengineer the 14 automated API calls from GoDaddy’s backup tapes.” (Doc. 468 at 11-12.) GoDaddy 15 asserts that it was prejudiced by SiteLock’s destruction of API data in two ways: (1) “the 16 parties spent months litigating discovery battles that could have been avoided had SiteLock 17 preserved this key evidence”; and (2) without the API data SiteLock cannot show that it 18 “accurately invoiced GoDaddy for all activations.” (Id. at 14-15.) GoDaddy asks the Court 19 to preclude SiteLock from arguing that the “destroyed” API data supports its calculation 20 of damages, or in the alternative, to order SiteLock to pay GoDaddy’s attorneys’ fees in 21 connection with all litigation that could have been avoided had SiteLock simply preserved 22 the API data. (Id. at 15-16.) 23 SiteLock responds that it has preserved records showing all subscriptions reported 24 by GoDaddy, but those records do not include information that SiteLock never received— 25 i.e., subscriptions that GoDaddy did not report. (Doc. 480 at 8.) SiteLock asserts that the 26 API data is irrelevant because the transaction records associated with the raw API calls has 27 been produced and the API calls themselves would be duplicative of those records. (Id. at 28 9.) SiteLock further contends that those calls would be irrelevant to SiteLock’s damages 1 because they only represent the disclosed transactions, not the transactions GoDaddy failed 2 to report. (Id. at 9.) SiteLock also argues that the API calls themselves are “raw computer 3 code that is largely indecipherable to humans. GoDaddy does not explain how it would be 4 feasible to use this computer code to calculate damages.” (Id. at 9.) SiteLock asserts that 5 its policy of not retaining API calls was reasonable, as it retained the transactions and the 6 API calls were duplicative of those records, and thus SiteLock could not have foreseen that 7 API calls would be relevant to future litigation with GoDaddy. (Id. at 11-12.) SiteLock 8 also asserts that GoDaddy has not established SiteLock’s intent to deprive and that 9 GoDaddy is not prejudiced by the absence of “GoDaddy’s own data” or the presence of 10 discovery battles caused by GoDaddy’s unwillingness to produce that data to SiteLock. 11 (Id. at 12.) 12 GoDaddy replies that SiteLock “now argues that it preserved all API evidence, but 13 that claim is contradicted . . . . Mr. Lovell testified that SiteLock kept only the data that 14 made it on to its invoices. So if SiteLock failed to include the agreed-upon discount for 15 bundled products in its invoices, SiteLock did not preserve that data.” (Doc. 486 at 8.) 16 GoDaddy further contends that “[w]hile SiteLock argues the API Data is irrelevant, it used 17 the absence of that data to oppose GoDaddy’s pending Rule 37 motion, and to support its 18 motion for partial summary judgment.” (Id.) Finally, GoDaddy reasserts that it need not 19 prove prejudice, but “prejudice is clear,” and points to a negotiation between SiteLock and 20 GoDaddy that supports this conclusion. (Id. at 8-9.) 21 4. Timeliness 22 In addition to opposing GoDaddy’s request for spoliation sanctions on the merits, 23 SiteLock contends the motion should be denied on untimeliness grounds because it 24 essentially raises a discovery dispute and thus should have been filed before the close of 25 fact discovery. (Doc. 480 at 4-5.) 26 GoDaddy replies that its request is timely because it sought relief five months before 27 trial, unlike in Mannion, and because the case management order does not include a 28 specific deadline for this sort of motion. (Doc. 486 at 9-11.) 1 C. Analysis 2 1. Customer Communication Evidence 3 On the one hand, the Court understands and, to some extent, shares GoDaddy’s 4 frustration with SiteLock’s decision to destroy Customer Communication Evidence. One 5 of SiteLock’s contentions in this case is that GoDaddy improperly disparaged SiteLock. 6 There is evidence that SiteLock became aware of the possibility that it would be pursuing 7 such a claim against GoDaddy no later than June 2017, which is long before this case was 8 filed. (Doc. 371-1 ¶ 103.) From that point forward, SiteLock has a duty to preserve 9 information that was potentially relevant to its anticipated disparagement claim. Fast, 340 10 F.R.D. at 337 (“[A] duty to preserve ESI can arise far in advance of the formal retention of 11 a lawyer or the filing of a lawsuit. . . . [T]he duty arises when litigation is reasonably 12 foreseeable and the party knows or should know the ESI may be relevant to pending or 13 future litigation.”); Waymo LLC v. Uber Techs., Inc., 2018 WL 646701, *14 (N.D. Cal. 14 2018) (“Many court decisions hold that potential litigants have a duty to preserve relevant 15 information when litigation is reasonably foreseeable. Rule 37(e) is based on this common- 16 law duty. . . . This is an objective standard, asking not whether the party in fact reasonably 17 foresaw litigation, but whether a reasonable party in the same factual circumstances would 18 have reasonably foreseen litigation. The reasonable foreseeability of litigation is a flexible 19 fact-specific standard that allows a district court to exercise the discretion necessary to 20 confront the myriad factual situations inherent in the spoliation. This standard does not 21 trigger the duty to preserve documents from the mere existence of a potential claim or the 22 distant possibility of litigation. However, it is not so inflexible as to require that litigation 23 be imminent, or probable without significant contingencies.”) (cleaned up). It is no excuse 24 that the information was otherwise subject to destruction pursuant to SiteLock’s document 25 retention policy—once SiteLock became aware of the information’s potential relevance to 26 anticipated litigation, a preservation duty arose. See generally Apple Inc. v. Samsung 27 Electronics Co., 881 F. Supp. 2d 1132, 1137 (N.D. Cal. 2012) (“[I]t generally is recognized 28 that when a company or organization has a document retention policy, it is obligated to 1 suspend that policy and implement a litigation hold to ensure the preservation of relevant 2 documents after the preservation duty has been triggered.”) (citation and internal quotation 3 marks omitted). 4 The Court also agrees with GoDaddy’s contention that SiteLock should have 5 recognized that the specific category of information at issue here—Customer 6 Communication Evidence—was potentially relevant to the anticipated litigation. See Fed. 7 R. Civ. P. 37(e), advisory committee note to 2015 amendment (“Courts should consider 8 the extent to which a party was on notice that litigation was likely and that the information 9 would be relevant. . . . [T]he scope of information that should be preserved may remain 10 uncertain. It is important not to be blinded to this reality by hindsight arising from 11 familiarity with an action as it is actually filed.”) (emphasis added). SiteLock has now 12 produced two pieces of evidence that arguably support its disparagement theory—a 13 customer support call and a voicemail. (Doc. 475 [notice of non-electronic filing of 14 exhibits].) Both callers refer in broad terms to conversations with GoDaddy in which 15 customers were encouraged to view SiteLock as an inferior or unsuitable product. Given 16 that the evidence of the alleged disparagement was contained within recordings of 17 customer calls and voicemails (i.e., Customer Communication Evidence), it should have 18 been apparent to SiteLock that such information needed to be preserved in anticipation of 19 litigation. 20 On the other hand, the two remedies that GoDaddy seeks based on SiteLock’s 21 spoliation of Customer Communication Evidence—“an order precluding SiteLock from 22 arguing GoDaddy disparaged or defamed SiteLock based on any alleged communications 23 with customers,” or in the alternative “an adverse inference instruction that the missing 24 evidence would have benefitted GoDaddy had it been preserved” (Doc. 468 at 2)—are 25 untethered to the actual violation and would produce a windfall. If any of the destroyed 26 communications contained evidence of GoDaddy disparaging SiteLock, their destruction 27 was beneficial to GoDaddy and detrimental to SiteLock (because the evidence would have 28 otherwise been useful in supporting SiteLock’s disparagement claim). In contrast, if any 1 of the destroyed communications lacked evidence of disparagement, they were unhelpful 2 to either party—as SiteLock persuasively puts in, “SiteLock does not claim that every 3 customer who called SiteLock in June 2017 reported GoDaddy’s disparagement. It is no 4 defense for GoDaddy to argue that GoDaddy didn’t always disparage SiteLock.” (Doc. 5 480 at 15.) 6 Under these circumstances, it would be improper to sanction SiteLock for 7 the destruction of evidence that was either potentially helpful to SiteLock or, at worst, 8 irrelevant by categorically precluding SiteLock from presenting any evidence of 9 disparagement at trial or crafting an adverse-inference instruction. The first requested 10 sanction would, for example, preclude SiteLock from presenting the two pieces of 11 disparagement evidence (the customer support call and voicemail) that it did preserve. The 12 Court is not required to, and declines in its discretion to, impose such disproportionate, 13 windfall-producing sanctions. See Fed. R. Civ. P. 37(e) advisory committee’s note to 2015 14 amendment (“The remedy should fit the wrong, and the severe measures authorized by 15 [subdivision (e)(2)] should not be used when the information lost was relatively 16 unimportant or lesser measures such as those specified in subdivision (e)(1) would be 17 sufficient to redress the loss.”); Fast, 340 F.R.D at 353 (“The fact that Rules 37(c)(1) and 18 (e) authorize sanctions does not mean that sanctions must be imposed. The Court retains 19 discretion to determine what sanctions, if any, are warranted.”).3 20 Given this determination, it is unnecessary to resolve SiteLock’s alternative 21 argument that the Customer Communication Evidence-based sanctions request be denied 22 on untimeliness grounds. 23 … 24 …

25 3 The Court notes that, if SiteLock were to attempt to argue at trial that it has additional evidence of disparagement beyond the pieces of Customer Communication 26 Evidence it has preserved and produced, this approach might be improper (because SiteLock’s failure to preserve the remaining Customer Communication Evidence has 27 undermined GoDaddy’s ability to rebut claims about the content of other customer communications). But because it is unclear whether SiteLock intends to pursue such a 28 claim at trial, and GoDaddy has not moved for a tailored sanction that would preclude such a claim, the Court simply flags the issue for now. 1 2. API Calls 2 During the course of the SiteLock/GoDaddy contractual relationship, “GoDaddy 3 reported orders for (activated) SiteLock subscriptions to SiteLock through an API. An API 4 is a piece of software that allows two businesses’ computerized systems to talk to one 5 another. The API worked as follows: each time a customer ordered a SiteLock subscription 6 from GoDaddy (and ‘activated’ the subscription), GoDaddy’s computer system 7 automatically transmitted an ‘API call’ to SiteLock’s computer system. An API call is 8 computer code that tells the recipient computer to take some action. In this case, each API 9 call instructed SiteLock’s system to create a record reflecting the details of the customer’s 10 order. When SiteLock’s computer system received the API call, SiteLock’s internal 11 database automatically created a transaction record reflecting all of the information about 12 the subscription contained in that API call.” (Doc. 480 at 7.) API “calls” between 13 computers are “raw computer code” that is “largely indecipherable to humans” and 14 “unusable until translated into . . . transaction records.” (Id. at 2, 9.) 15 In a nutshell, GoDaddy argues that SiteLock “spoliated API Data by deleting the 16 API calls that it received, keeping only ‘some’ transaction data, and altering the retained 17 data along the way to fit its invoices.” (Doc. 468 at 6 [emphasis added].) SiteLock, in 18 turn, acknowledges that it did not “retain[] the raw API calls themselves” but argues that 19 it “preserved and produced all relevant API data,” in that it “preserved all of the[] 20 transaction records [and] produced these records . . . at GoDaddy’s request.” (Doc. 480 at 21 6-7 [emphasis added].) 22 Resolving GoDaddy’s motion is complicated by the parties’ ambiguous use of the 23 terms API “data” and “call.” For example, when SiteLock states that it “preserved and 24 produced all relevant API data,” it is referring to the automatically created transaction 25 record that translates the code, not the API call itself. (Doc. 480 at 7-8.) The Court will 26 respect GoDaddy’s own description of its spoliation claim—that SiteLock spoliated data 27 by deleting the API calls, i.e., computer code. (Doc. 468 at 6.) GoDaddy also asserts that 28 SiteLock kept only some of the transaction “data” and altered that “data” along the way to 1 fit its invoices. (Id. at 6.) However, the evidence that GoDaddy produces in support of 2 that claim makes clear that “data” refers to the API “calls” themselves, not the transaction 3 records that SiteLock has produced. (Doc. 468 at 6 [citing Doc. 367-18, deposition of Scott 4 Lovell].)4 Accordingly, the narrow question before the Court is whether the imposition of 5 spoliation sanctions under Rule 37(e) is warranted based on the destruction of the API 6 “calls” when SiteLock has preserved the corresponding transaction records. 7 A party seeking sanctions under Rule 37(e) has a threshold duty to show that the 8 ESI at issue was, in fact, lost or destroyed. Fed. R. Civ. P. 37(e) advisory committee’s note 9 to 2015 amendment (“The new rule applies only . . . when [ESI] is lost.”). GoDaddy argues 10 that SiteLock destroyed many of the API calls and SiteLock does not dispute it. 11 The next inquiry is whether the ESI was foreseeably relevant to the pending or 12 foreseeable litigation. It is hard to understand why the API calls would be relevant here. 13 GoDaddy does not deny that the API calls themselves are functionally useless to a 14 layperson, does not explain how an expert would make use of them, and SiteLock alleges 15 (without effective contradiction) that it has produced all of the transaction records 16 associated with those calls. Instead, GoDaddy makes three points: first, that GoDaddy was 17 prejudiced by litigating discovery battles that would have been avoided if SiteLock had 18 preserved the API calls (Doc. 468 at 14), second, the related point that SiteLock “used the 19 absence of [the API Data] to oppose GoDaddy’s pending Rule 37 Motion, and to support 20 its motion for partial summary judgment” (id. at 8), and third, that SiteLock cannot meet 21 its burden of establishing damages without the information in the API calls (id. at 14). 22 GoDaddy first argues that “SiteLock’s failure to preserve the API [calls] caused 23 discovery disputes that wasted the Court’s resources on a series of motions that lasted more 24 than a year.” (Id. at 6.) To the extent this argument has any bearing on the relevance of 25 API calls, it is factually unsupported. GoDaddy points to SiteLock’s RFP No. 10, which 26 GoDaddy characterizes as “demand[ing]” API calls. (Doc. 468 at 6.) In fact, RFP No. 10 27 4 Doc. 367-18 at 7 (stating that SiteLock maintains “some” records of API calls that 28 it receives from resellers, but it would be too expensive to retain them all); id. at 21 (explaining that API calls impact how invoicing is “set up”). 1 requested that GoDaddy produce “[d]ocuments sufficient to show all invoicing information 2 provided by GoDaddy to SiteLock through the [API].” (Doc. 154-1 at 77.) In its response 3 brief, SiteLock explains that it was not requesting the API “call,” but “documents showing 4 the actual subscription information that GoDaddy reported through the API,” which tracks 5 the Court’s own understanding of the RFP. (Doc. 480 at 9.) GoDaddy does not reply. 6 Similarly, GoDaddy points to SiteLock’s RFP No. 7, which requested “documents 7 sufficient to show the number of SiteLock products purchased through GoDaddy between 8 November 4, 2013 and March 2, 2018, and the number of such products that were activated 9 between November 4, 2013 and December 31, 2018.” (Doc. 152-1 at 48.) But SiteLock 10 explained in a cover letter that these documents were “necessary to calculate SiteLock’s 11 contract damages, which are based on SiteLock subscriptions sold through GoDaddy but 12 never reported to SiteLock through GoDaddy’s API.” (Id.) Again, this is apparently a 13 request for documents that reflect the full scope of transactions between the two parties, 14 not a request for raw API calls. GoDaddy does not offer an alternative understanding in 15 its reply. 16 In the same vein, GoDaddy asserts that “SiteLock argued that the parties’ 17 differences over alleged ‘missing data’ could be put to rest if GoDaddy produced the API 18 Data.” (Doc. 468 at 6 [citing Doc. 181-3 at 253].) But the actual testimony suggests that 19 “this data” referred to “invoices that GoDaddy provided to SiteLock,” not API calls. (Doc. 20 181-3 at 253.) Finally, GoDaddy’s assertion that “SiteLock also requested that GoDaddy 21 reengineer—and reproduce—logs of the API calls from GoDaddy’s servers” is based on 22 GoDaddy’s own characterization of SiteLock’s request. (Doc. 468 at 7 [citing Docs. 367- 23 2 ¶ 32, 367-26 at 2].) GoDaddy’s reply is limited to recursively citing its own briefing in 24 support of the argument that “SiteLock repeatedly demanded GoDaddy produce the API 25 Data in this action.” (Doc. 486 at 9.) 26 Second, GoDaddy argues that SiteLock “used the absence of [the API Data] to 27 oppose GoDaddy’s pending Rule 37 Motion, and to support its motion for partial summary 28 judgment.” (Doc. 486 at 8.) When responding to GoDaddy’s Rule 37 motion, SiteLock 1 alleged that “[d]uring the parties’ relationship, SiteLock submitted invoices to GoDaddy 2 based on the orders for SiteLock subscriptions that GoDaddy reported to SiteLock. The 3 subscriptions GoDaddy reported, and for which SiteLock billed GoDaddy, included orders 4 of both standalone and bundled subscriptions. SiteLock itself did not (and could not) 5 distinguish between standalone and bundled subscriptions, because GoDaddy never 6 reported that information to SiteLock.” (Doc. 466 at 4.) In SiteLock’s motion for partial 7 summary judgment, SiteLock argued that “GoDaddy used an Application Programming 8 Interface (or ‘API’) to report its sales to SiteLock. Based on the data that GoDaddy 9 reported through the API, SiteLock generated invoices that it sent to GoDaddy on a 10 monthly basis, which GoDaddy paid after ‘reconciling’ them. It is undisputed that 11 GoDaddy never provided information to SiteLock through the API (or through any other 12 avenue) identifying any of its sales of SiteLock subscriptions as part of a ‘bundled’ package 13 entitled to the discount. Accordingly, SiteLock did not know what subscriptions GoDaddy 14 had sold as part of bundles, and could not reflect such bundles in its invoices.” (Doc. 341 15 at 12.) Contrary to GoDaddy’s position, neither of these assertions relied on the absence 16 of API calls. Instead, they relied on GoDaddy’s failure to report a subset of transactions 17 (bundles) in the first place. 18 Third, GoDaddy argues that SiteLock cannot prove damages with “reasonable 19 certainty” without the API calls. (Doc. 468 at 14-15.) SiteLock responds that it has 20 “already calculated damages using GoDaddy’s transaction records, which are the only 21 source of information showing the subscriptions that GoDaddy failed to report and pay for. 22 SiteLock’s own transaction records do not reflect the subscriptions that GoDaddy failed to 23 report through the API, and therefore do not permit this calculation.” (Doc. 480 at 9.) 24 GoDaddy does not reply directly but argues that “SiteLock’s argument on damages violates 25 due process.” (Doc. 486 at 9.) However, arguments raised for the first time in reply are 26 forfeited. CSR Technology, Inc. v. Bandspeed, Inc., 2012 WL 1150863, *5 (D. Ariz. 2012) 27 (finding that a constitutional due process claim raised for the first time in reply was 28 waived). 1 For these reasons, GoDaddy has not established that the destroyed API calls would 2 be relevant to anticipated litigation. This determination, alone, means that GoDaddy’s 3 request for spoliation sanctions based on the destruction of the API calls must be denied. 4 Finally, and alternatively, GoDaddy’s request for sanctions also fails because it has 5 not established that the missing ESI “cannot be restored or replaced through additional 6 discovery.” Fast, 340 F.R.D. at 339. For the reasons discussed above, GoDaddy has failed 7 to establish that the missing API calls differ, in any material way, from the resulting 8 transaction records that were preserved and produced. The transaction records can thus be 9 viewed as “replacing” the API calls. 10 Given these determinations, it is unnecessary to resolve SiteLock’s alternative 11 argument that the API-related sanctions request be denied on untimeliness grounds. 12 3. Attorneys’ Fees 13 GoDaddy asks the Court to grant “attorneys’ fees incurred while litigating issues 14 related to the API Data that would have been averted had SiteLock preserved that 15 evidence.” (Doc. 468 at 2.) Although GoDaddy does not specify the basis for this request, 16 the Court assumes that the request for spoliation sanctions in the form of attorneys’ fees 17 would be governed by Rule 37(e)(1) of the Federal Rules of Civil Procedure, which 18 provides that “upon finding prejudice to another party from loss of information, [the Court] 19 may order measures no greater than necessary to cure the injustice.” 20 As stated above, the Court has found that SiteLock’s destruction of API “calls” 21 caused no prejudice to GoDaddy because the calls were duplicative of information 22 GoDaddy did produce. Further, even if GoDaddy’s fee request were based on the Court’s 23 inherent authority, the Court has found no evidence of SiteLock’s intent to frustrate 24 GoDaddy’s litigation aims, which would be necessary to establish that SiteLock acted “in 25 bad faith, vexatiously, wantonly, or for oppressive reasons.” Leon v. IDX Sys. Corp., 464 26 F.3d 951, 961 (9th Cir. 2006). 27 SiteLock requests that “given the frivolousness of GoDaddy’s motion, . . . the Court 28 award SiteLock fees pursuant to 28 U.S.C. § 1927 or the Court’s inherent authority. (Doc. 465 at 17.) Because SiteLock offers a bare request for sanctions, without formally setting out allegations of bad faith (as required under both § 1927 and the Court’s inherent □□ authority, Cunningham v. County of Los Angeles, 879 F.2d 481, 490 (9th Cir. 1988)), the 4|| Court declines in its discretion to grant fees. 5 Accordingly, 6 IT IS ORDERED that: 7 1. GoDaddy’s motion for disclosure sanctions (Doc. 457) is denied. 8 2. GoDaddy’s motion for spoliation sanctions (Doc. 467) is denied. 9 Dated this 29th day of August, 2022. 10 11 Lom ee” 12 f □ _o—— Dominic W. Lanza 13 United States District Judge 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

-22-