The opinion of the court was delivered by: John M. Facciola United States Magistrate Judge
In this suit, Equity Analytics, LLC ("Equity") claims that its former employee, Timothy Lundin ("Lundin"), gained illegal access to electronically stored information after he was fired.
Equity employee, Melissa Kirk ("Kirk"), is assistant vice president of operations and, in that capacity, assists in the oversight of the security of Equity's computer system. Plaintiff Equity Analytics, LLC's Motion for Order Authorizing Examination of Defendant's Computer [#25], Exhibit 8 ("Doc. 25-8") at ¶ 1. She explains that Lundin was fired in December, 2006. Id. at ¶ 6. On October 30, 2007, the senior system administrator told Kirk that one of the members of the Equity staff had reported an unauthorized user accessing Equity's Salesforce.com, account. Kirk then ascertained that two Equity employees had logged into this account using a Macintosh operating system and a Firefox browser on several days between May 28, 2007, and October 28, 2007, although Equity employees were only issued PC's with a Windows 2003 Professional operating system and Internet Explorer and were not permitted to change either the operating system or web browsing software. Id. at ¶¶ 11, 12.
For his part, Lundin explains that Eric Aguirre, another employee at Equity, granted Lundin permission to use Aguirre's username and password to access Equity's Salesforce.com account. Defendant Timothy D. Lundin's Memorandum in Support of its Response and Opposition, in part, to Plaintiff Equity Analytics, LLC's "Motion for Order Authorizing Examination of Defendant's Computer [#26], Exhibit 2 ("Doc. 26-2") at ¶ 44. Lundin then states: "Over the next 90 days between June 21, 2007 and September 18, 2007, I used the access that Aguirre provided me with his username and password to [access] Salesforce.com some eighteen times." Id. at ¶ 45. Lundin indicates that he used his Macintosh computer to access Salesforce.com. Doc. # 26-2, passim.
I. The Contents of Lundin's Computer
On November 8, 2007, Judge Lamberth issued a temporary restraining order against Lundin that, inter alia, prohibited him from "accessing or attempting to access Equity Analytics, LLC's data on Salesforce.com for any purpose." Order of November 8, 2007 [#4] ("Doc. 4") at ¶ 2(b).
Initially, Judge Lamberth struck from the order that Equity had proposed a requirement that Lundin permit Equity to have a computer forensic expert examine Lundin's computer to ascertain: (1) whether Lundin accessed Equity's confidential customer data and/or trade secrets; (2) whether the data has been forwarded to Lundin's new employer an Equity competitor; and (3) whether the data was purged or overwritten. Doc. 4 at ¶ 4.
Although Judge Lamberth struck this provision, the parties are now agreed that a computer forensic specialist should be permitted to examine Lundin's Macintosh computer. Unfortunately, even though they have been trying diligently with my encouragement to arrive at a protocol for the search, they have reached an impasse that I must now resolve.
II. The Use of Keywords to Search
Lundin now works out of his home and uses the Macintosh computer and portable hard drives to store data and for many other purposes. As a result, the computer and the hard drives contain: (1) attorney-client communications; (2) business records; (3) medical records; (4) tax and banking records; and (5) data (including images) created for his professional photography business. Doc. 26-2 at ¶¶ 74-75. Since there is data on the computer and the hard drives that is personal, private, and privileged, plaintiff's counsel has proposed that the forensic computer examiner (hereafter "the examiner") use search terms to restrict the search to data that is relevant to this case. Doc. 26 at 2.
Equity argues that search terms are inadequate because Lundin indicates that he loaded a new operating system ("Leopard") onto the Macintosh on October 31, 2007 (Doc. 26-2 at ¶¶ 67-69), and doing so could have compromised the integrity of the files that were previously on the computer. Doc. 25 at 4.
Lundin also proposes that the search first be limited to certain file types, i.e., MS Word (.doc, .txt, .rtf),*fn1 MS Excel (.csv, .xml), MS Powerpoint (.ppt), MS Entourage*fn2 and Adobe Acrobat (.pdf). Doc. 25-6 at 1. Once those files are found, the search ...