Xerox Corporation v. Conduit Global, Inc.

CourtDistrict Court, W.D. New York
DecidedJuly 26, 2024
Docket6:21-cv-06467
StatusUnknown

This text of Xerox Corporation v. Conduit Global, Inc. (Xerox Corporation v. Conduit Global, Inc.) is published on Counsel Stack Legal Research, covering District Court, W.D. New York primary law. Counsel Stack provides free access to over 12 million legal documents including statutes, case law, regulations, and constitutions.

Bluebook
Xerox Corporation v. Conduit Global, Inc., (W.D.N.Y. 2024).

Opinion

UNITED STATES DISTRICT COURT WESTERN DISTRICT OF NEW YORK

Xerox Corporation,

Plaintiff and Counterclaim- Defendant. DECISION and ORDER v. 21-cv-6467-EAW-MJP Conduit Global, Inc.,

Defendant and Counter- claim-Plaintiff APPEARANCES For Plaintiff and Counterclaim-Defendant: Carolyn G. Nussbaum, Esq. Eric M. Ferrante, Esq. Sarah L. Tufano, Esq. Nixon Peabody LLP 1300 Clinton Sq, Ste 1244 Rochester, NY 14604

For Defendant and Counterclaim-Plaintiff: Peter J. Behmke, Esq. Maxwell D. Herman, Esq. Scott S. Balber, Esq. Herbert Smith Freehills New York LLP 450 Lexington Ave, 14th Flr New York, NY 10017

[Remainder of this page intentionally blank.] INTRODUCTION Pedersen, M.J. The Federal Rules of Civil Procedure make los- ing a motion to compel costly. They likewise reward successful protective

order motions. Here, Plaintiff Xerox brought a successful motion for a protective order. Xerox likewise prevailed on the bulk of its opposition to Defendant Conduit Gobal’s motion to compel. On the other side of the coin, how- ever, Conduit succeeded on some of its motion to compel. The question for the Court is whether to award attorneys’ fees and costs and to whom. BACKGROUND This case involves a contract dispute between Xerox and its for-

mer service provider, Conduit. Under an Outsourcing Agreement, Xerox asked Conduit to provide telephone services for Xerox customer support. The Agreement required Conduit to provide “customer service call cen- ter support and other extensive IT-related services” and to do so in a secure manner. (Compl. ¶¶ 13–14, ECF No. 1, July 2, 2021.) Conduit provided a platform to support Xerox’s customer relationships in the

United States, including customer service, orders, and sales. (Id. ¶ 1.) Recognizing the critical role that these functions played in Xerox’s operations, the Agreement required Conduit to “maintain levels of phys- ical and data security protection in accordance with industry standards, current legal obligations and Xerox policies as outlined in Schedule 15 (Xerox Policies) of this Agreement.” (Herman Decl. Ex. 1 (the “Agree- ment”) § 20.1, ECF No. 60-2, Feb. 28, 2023.) These security protections could include, for example, multi-factor authentication, which Xerox al-

leges Conduit failed to implement. (Compl. ¶ 22, ECF No. 1 (alleging that the cause of the breach to Conduit’s networks included “Conduit’s failure to use multi-factor authentication and its use of insufficient end- point security and intrusion detection”).) Conduit suffers a ransomware attack that allegedly harms Xerox, so Xerox sues. Roughly three-and-a-half years into the Agreement, Conduit suf- fered a ransomware attack.1 The attack appears to have been wide- spread: Xerox indicates that the attackers “cripple[d] all of Conduit’s data centers globally.” (Id. ¶ 23.) Xerox notes that “Xerox agents could not log into Conduit’s system to take customer calls and Xerox customers

and partners could not contact Xerox by telephone, including those in need of repairs[.]” (Id.) In sum, the attack “crippled” Xerox’s ability to communicate with its partners and customers for “weeks.” (¶¶ 1, 12, 20, ECF No. 1.) Xerox terminated the Agreement for cause based on Conduit’s “material breaches” of the Agreement, citing Conduit’s “failure to meet

1 For background, see Federal Bureau of Investigation, Ransomware, https://www.fbi.gov/how-we-can-help-you/scams-and-safety/common-scams- and-crimes/ransomware (last visited July 25, 2024). contractually prescribed service levels.” (Id. ¶¶ 1, 3, 32.) Conduit re- jected the notice, demanding the termination fee required under the Agreement for termination without cause. (Id. ¶¶ 34, 42.) So, Xerox

sued, seeking a declaratory judgment that terminating Conduit was valid, that Xerox was not obligated to pay the termination fee, and that Xerox should be awarded damages for Conduit’s breach. (Id. ¶¶ 53 & 59.) After a saga of discovery disputes, the parties bring dueling dis- covery motions. After the parties completed their pleadings, the Hon. Elizabeth A. Wolford, Chief Judge, referred this case to the undersigned. (Text Or- der, ECF No. 10, July 29, 2021.) With this case came a string of discovery disputes. While the Court managed to informally resolve some of the parties’ disputes, Conduit eventually moved to compel. (ECF No. 60,

Feb. 28, 2023.) Xerox opposed and cross-moved for a protective order. (ECF No. 62, Mar. 21, 2023.) Conduit’s motion to compel comprised two categories. Conduit first demanded Xerox policy documents, including “all” documents related to Xerox’s data security “policies” and “any analysis or assessment” of the same. (Herman Decl. in Supp. of Mot. to Compel

Ex. 4 at 9 ¶¶ 1 & 2 (Conduit’s Second Set of Document Requests, Request Nos. 1 and 2), ECF No. 60-5, Feb. 28, 2023.) The parties refer to these as the “Policy Requests.” The Policy Requests ask Xerox to produce doc- uments explicitly referenced in the Agreement and any “analysis or as- sessment” of those policies:

1. All Documents Concerning [Xerox’s] policies rules, re- quirements and procedures relating to data security, in- cluding but not limited to [Xerox’s] policies, rules, require- ments and procedures referenced in Section 20.1 of the Outsourcing Agreement. 2. All Documents Concerning any analysis or assessment of [Xerox’s] policies, rules, requirements, and procedures relating to data security, including but not limited to [Xerox’s] policies, rules, requirements and procedures ref- erenced in Section 20.1 of the Outsourcing Agreement. (Id.) Conduit additionally maintained that, under these requests, it should have access to assessments and policies regarding two other Xerox vendors: Bell Canada and Genesys.2 Ultimately, the Court disa- greed.

2 About this, Conduit stated in its motion to compel:

Based on discovery to date, Conduit understands there are at least two Xerox business partners that provided the same or sim- ilar information and technology services to Xerox during the rel- evant period: Bell Canada (which provided telephony services to Xerox in Canada) and Genesys (to which Xerox outsourced te- lephony services after terminating the Agreement with Con- duit). There are presumably other business partners that pro- vided information services to Xerox, or that had similar Xerox data on its systems, that were required to comply with the same policies as Conduit. Because Xerox was required under its own policies to review, assess, and audit all security controls applica- ble to those services, processes, and information, Conduit ex- pects there is a trove of relevant information concerning Xerox’s The second category of Conduit’s motion to compel deals with a separate ransomware attack Xerox suffered (the “Xerox Incident Re- quest”). Conduit’s Xerox Incident Request demanded documents and in-

formation about a cyber-attack Xerox had suffered: “All Documents and Communications Concerning any malware or cyberattacks on [Xerox], including but not limited to the cyberattack suffered by [Xerox] in or about June 2020[.]” (Id. Ex. 2 at 13 ¶ 21 (Conduit’s First Set of Document Requests, Request No. 21), ECF No. 60-3, Feb. 28, 2024.) The Court de- nied Conduit’s motion to compel concerning this Request, granting in-

stead Xerox’s cross-motion for a protective order concerning the Xerox Incident. In cross-moving for a protective order, Xerox argued that the Xerox Incident was irrelevant to Conduit’s claims and defenses. (Mem. of Law in Opp’n to Mot. to Compel and in Supp. of Cross-Mot. at 19–22, ECF No. 62-6, Mar. 21, 2023.) Besides contending that the Xerox Inci- dent was “beyond the proper scope of discovery,” Xerox argued that Con-

Free access — add to your briefcase to read the full text and ask questions with AI

Related

United States v. Rodriguez
602 F.3d 346 (Fifth Circuit, 2010)
Hensley v. Eckerhart
461 U.S. 424 (Supreme Court, 1983)
Pierce v. Underwood
487 U.S. 552 (Supreme Court, 1988)
Farrar v. Hobby
506 U.S. 103 (Supreme Court, 1992)
Gomez-Beleno v. Holder
644 F.3d 139 (Second Circuit, 2011)
Millea v. Metro-North Railroad
658 F.3d 154 (Second Circuit, 2011)
Louis Vuitton Malletier S.A. v. LY USA, Inc.
676 F.3d 83 (Second Circuit, 2012)
Townsend v. BENJAMIN ENTERPRISES, INC.
679 F.3d 41 (Second Circuit, 2012)
Simmons v. New York City Transit Authority
575 F.3d 170 (Second Circuit, 2009)
Novak v. Wolpoff & Abramson, LLP
536 F.3d 175 (Second Circuit, 2008)
Barfield v. New York City Health & Hospitals Corp.
537 F.3d 132 (Second Circuit, 2008)
Eskimo Pie Corporation v. Whitelawn Dairies, Inc.
284 F. Supp. 987 (S.D. New York, 1968)
Cush-Crawford v. Adchem Corp.
94 F. Supp. 2d 294 (E.D. New York, 2000)

Cite This Page — Counsel Stack

Bluebook (online)
Xerox Corporation v. Conduit Global, Inc., Counsel Stack Legal Research, https://law.counselstack.com/opinion/xerox-corporation-v-conduit-global-inc-nywd-2024.