NO. 05-11-00952-CV - 5th Court of Appeals

Transcription

NO. 05-11-00952-CV
ACCEPTED
225EFJ016533669
FIFTH COURT OF APPEALS
DALLAS, TEXAS
11 October 7 P1:57
Lisa Matz
CLERK

In The Court Of Appeals
For the Fifth District Of Texas
Dallas, Texas

RELIANT HOSPITAL PARTNERS, LLC, et al.,
Appellants
vs.
CORNERSTONE HEALTHCARE GROUP HOLDINGS, INC.,
Appellee

On Appeal From The
68th Judicial District Court of Dallas County, Texas
Trial Court Cause No. 11-04339

APPELLEE’S RESPONSE BRIEF

Scott A. Brister
State Bar No. 00000024
David P. Whittlesey
ANDREWS KURTH LLP
111 Congress Ave., Suite 1700
Austin, Texas 78701
Phone: 512.320.9200
Fax: 512.320.9292
scottbrister@andrewskurth.com
davidwhittlesey@andrewskurth.com
Marc D. Katz
Cristina I. Torres
ANDREWS KURTH LLP
1717 Main Street, Suite 3700
Dallas, Texas 75201
Phone: 214.659.4400
Fax: 214.659.4401
marckatz@andrewskurth.com
cristinatorres@andrewskurth.com
ATTORNEYS FOR APPELLEE CORNERSTONE
HEALTHCARE GROUP HOLDINGS, INC.
AUS:646830.2
TABLE OF CONTENTS Index of Authorities ................................................................................................. ii Introduction .............................................................................................................1 Statement of Facts ...................................................................................................2 1. Cornerstone’s managers use Cornerstone’s assets to set up a competing business ..................................................................... 2 2. They copy Cornerstone’s reports and data ......................................... 5 3. They cover their tracks by deleting data at Cornerstone .................... 7 4. When suit is filed, they delete data at Reliant too .............................. 9 Summary of Argument...........................................................................................12 I. The Consequences of Spoliation..................................................................14 II. No‐Evidence Issues ......................................................................................17 III. A. Probable Right: Misuse of Confidential Information ........................ 19 B. Probable Right: Usurpation of Corporate Opportunities.................. 23 C. Probable Irreparable Injury: Possession + Position.......................... 26 D. Balance of Equities/Public Interest: Those Who Breach Confidences and Delete Evidence Have No Claim ............................. 30 Objections to the Form of the Order ...........................................................32 A. For Obvious Reasons, the Order Did Not Detail Trade Secrets ............................................................................................... 32 B. The Order is not Overbroad; it Covers Targets Identified Using Cornerstone’s Confidential Information .................................. 36 C. Effective Relief Must Include Those Acting in Concert ...................... 40
i
AUS:646830.2
INDEX OF AUTHORITIES Cases Alex Sheshunoff Mgmt. Servs., L.P. v. Johnson,
209 S.W.3d 644 (Tex. 2006) ................................................................................. 42
Bennett v. Reynolds,
315 S.W.3d 867 (Tex. 2010) ................................................................................. 41
Birnbaum v. Alliance of Am. Insurers,
994 S.W.2d 766 (Tex. App.—Austin 1999, pet. denied) ................................. 19
Buckeye Retirement Co., LLC, Ltd. v. Bank of Am., N.A.,
239 S.W.3d 394 (Tex. App.—Dallas 2007, no pet.) .......................................... 14
Butnaru v. Ford Motor Co.,
84 S.W.3d 198 (Tex. 2002) ................................................................................... 29
Chrysler Ins. Co. v. Greenspoint Dodge of Houston, Inc.,
297 S.W.3d 248 (Tex. 2009) ................................................................................. 41
Cire v.Cummings,
134 S.W.3d 835 (Tex. 2004) ................................................................................. 17
Computek Computer & Office Supplies, Inc. v. Walton,
Computer Assocs. Int'l, Inc. v. Altai, Inc.,
918 S.W.2d 453 (Tex. 1996) ................................................................................. 21
Conley v. DSC Comm'ns Corp.,
No. 05-98-01051-CV, 1999 WL 89955 (Tex. App.—Dallas
Feb. 24, 1999, no pet.) .............................................................................. 27, 39, 42
Dallas/Fort Worth Int'l Airport Bd. v. Ass'n of Taxicab Operators, USA,
335 S.W.3d 361 (Tex. App.—Dallas 2010, no pet.) ................................ 2, 17, 18
Electronic Data Systems Corp. v. Powell,
524 S.W.2d 393 (Tex. Civ. App.—Dallas 1974, writ ref'd n.r.e.).................... 38
ii
AUS:646830.2
ERI Consulting Eng’rs, Inc. v. Swinnea,
318 S.W.3d 867 (Tex. 2010) ................................................................................. 29
Estancias Dallas Corp. v. Schultz,
500 S.W.2d 217 (Tex. Civ. App.—Beaumont 1973, writ ref'd n.r.e.)............. 30
Franke v. Wiltschek,
209 F.2d 493 (2 Cir. 1953) .................................................................................... 23
GTE Sw., Inc. v. Bruce,
998 S.W.2d 605 (Tex. 1999) ................................................................................. 41
Garth v. Staktek Corp.,
876 S.W.2d 545 (Tex. App.—Austin 1994, writ dism'd w.o.j.) ...........25-26, 29
Global Water Group, Inc. v. Atchley,
Graham Mortg. Corp. v. Hall,
Ex parte Hudson,
917 S.W.2d 24 (Tex. 1996) ................................................................................... 34
Hyde Corp. v. Huffines,
314 S.W.2d 763 (Tex. 1958) ..................................................................... 23, 26, 31
IAC, Ltd. v. Bell Helicopter Textron, Inc.,
160 S.W.3d 191 (Tex. App.—Fort Worth 2005, no pet)................. 23, 27, 28, 33
Julius Hyman & Co. v. Velsicol Corp.,
233 P.2d 977 (Colo. 1951) .................................................................................... 31
K & G Oil Tool & Serv. Co. v. G & G Fishing Tool Serv.,
314 S.W.2d 782 (Tex. 1958) ........................................................................... 30, 31
Liberty Mut. Ins. Co. v. Mustang Tractor & Equip. Co.,
812 S.W.2d 663 (Tex. App.—Houston [14th Dist.] 1991, no writ) ................ 35
iii
AUS:646830.2
Ligon v. E. F. Hutton & Co.,
428 S.W.2d 434 (Tex. Civ. App.—Dallas 1968, writ ref'd n.r.e.)..............31-32
MRT, Inc. v. Vounckx,
Matlock v. Data Processing Sec., Inc.,
618 S.W.2d 327 (Tex. 1981) ................................................................................. 33
Methodist Hosps. of Dallas v. Tex. Indus. Acc. Bd.,
798 S.W.2d 651 (Tex. App.—Austin 1990, ) ..................................................... 30
Protestant Episcopal Church Council of Diocese of Tex. v. McKinney,
339 S.W.2d 400 (Tex. Civ. App.—Eastland 1960, writ ref'd) ......................... 35
Putnam v. City of Irving,
331 S.W.3d 869 (Tex. App.—Dallas 2011, pet. denied) ............................ 18, 22
Ramos v. Frito-Lay, Inc.,
784 S.W.2d 667, 669 (Tex. 1990) ......................................................................... 42
Rugen v. Interactive Bus. Sys., Inc.,
864 S.W.2d 548 (Tex. App.—Dallas 1993, no writ) .................................passim
Safeguard Business Systems, Inc. v. Schaffer,
822 S.W.2d 640 (Tex. App.—Dallas 1991, no writ) ................................... 33, 34
Shannon v. Texas General Indem. Co.,
889 S.W.2d 662 (Tex. App.Houston [14th Dist.] 1994, no writ) .................... 25
Sharma v. Vinmar Int'l Ltd.,
231 S.W.3d 405 (Tex. App.—Houston [14th Dist.] 2007, no pet.) ................. 19
Southwest Research Inst. v. Keraplast Techs., Ltd.,
103 S.W.3d 478 (Tex. App.—San Antonio 2003, no pet.) ............................... 37
Southwest Weather Research, Inc. v. Jones,
327 S.W.2d 417 (1959).......................................................................................... 18
iv
AUS:646830.2
T-N-T Motorsports, Inc. v. Hennessey Motorsports,
965 S.W.2d 18 (Tex. App.—Houston [1st Dist.] 1998, no pet.)................ 27, 37
Tom James of Dallas, Inc. v. Cobb,
Trilogy Software, Inc. v. Callidus Software, Inc.,
143 S.W.3d 452 (Tex. App.—Austin 1994, no pet.) ......................................... 28
Truly v. Austin,
744 S.W.3d 934 (Tex. 1988) ................................................................................. 31
Vaughn v. Intrepid Directional Drilling Specialists, Ltd.,
288 S.W.3d 931 (Tex. App.–Eastland 2009, no pet.)........................................ 42
Wal-Mart Stores, Inc. v. Johnson,
106 S.W.3d 718 (Tex. 2003) ....................................................................... 2, 14, 15
STATUTES, REGULATIONS, AND RULES
Tex. R. Civ. Proc. 683.................................................................................... 14, 30, 34, 40
v
AUS:646830.2
STATEMENT REGARDING ORAL ARGUMENT Appellee Cornerstone believes this case can be decided on the briefs and
oral argument is unnecessary. The interlocutory appeal challenges a temporary
injunction on grounds this Court has rejected several times before. Moreover,
the extensive spoliation of evidence by the Defendants raises a presumption that
the destroyed evidence, along with all the other evidence and inferences, support
the trial court’s order. That said, Cornerstone would be pleased to present oral
argument if it would aid the Court in the disposition of this appeal
ISSUES PRESENTED In addition to responding to the 15 or more issues in the Defendants’ four
briefs, Appellee presents the following issue for review:
1.
When former employees deliberately delete evidence of what
they downloaded from a former employer’s computers, may
the trial court presume the evidence was confidential and
proprietary and enjoin them from using or disclosing it?
vi
AUS:646830.2
INTRODUCTION The Defendants have nothing if not nerve. They claim there is no
evidence they took any confidential information after wiping their computers clean of whatever information they took. They lay claim to equity and the
public interest, although their briefs never challenge the trial court’s finding
that they “intentionally deleted e-mail and documents to cover up their
actions.” 2 CR 707. They raise three objections this Court has expressly
rejected in one of its most frequently cited opinions on temporary
injunctions —which is completely absent from their 134 pages in four briefs.
See Rugen v. Interactive Bus. Sys., Inc., 864 S.W.2d 548 (Tex. App.—Dallas
1993, no writ).1 They have removed large parts of this dispute to this Court
by filing two appeals.2
And they demand the right to keep using
confidential information on the ground that they didn’t know it was
confidential when they initially got it.
For two main reasons, the Court need not engage in a detailed
analysis of the Defendants’ many complaints in this interlocutory appeal:
Westlaw lists 75 citations to Rugen to date. See Westlaw.com, citing references to Rugen,
854 S.W.2d 548 (available at www.westlaw.com) (accessed October 5, 2011).
1
In addition to this interlocutory appeal, Reliant has filed a separate mandamus action. See
In re Reliant Hospital Partners, LLC, No. 05-11-01218-CV.
2
1
AUS:646830.2
1.
Under Texas law, “a party who has deliberately destroyed
evidence is presumed to have done so because the evidence was
unfavorable to its case.” Wal-Mart Stores, Inc. v. Johnson, 106 S.W.3d 718, 721
(Tex. 2003). Regardless of the other evidence, the trial court had discretion
to presume the destroyed evidence established the grounds for temporary
relief, and this Court should affirm that exercise of discretion.
2.
The Defendants are not entitled to a preview ruling on the
merits from this Court. See Dallas/Fort Worth Int’l Airport Bd. v. Ass'n of
Taxicab Operators, USA, 335 S.W.3d 361, 364 (Tex. App.—Dallas 2010, no
pet.). That is precisely what their no-evidence complaints seek.
The Court should affirm the trial court’s order and send this case back
for trial.
STATEMENT OF FACTS 1. Cornerstone’s managers use Cornerstone’s assets to set up a competing business Five of the individual Defendants are former officers and managers of
Appellee Cornerstone Healthcare Group Holdings, Inc.— Michael Brohm,
Patrick Ryan, Kenneth McGee, Jerry Huggler, and Chad Deardorff (“the
former managers”). They resigned en masse and immediately went to work
at Reliant Hospital Partners, LLC on the day it was created, March 23, 2011.
2
AUS:646830.2
Each took virtually the same position at Reliant that he had held at
Cornerstone.3 Reliant is now a competitor of Cornerstone in the business of
buying and running post-acute care hospitals. 3 RR 87-88; 6 RR 90, 153.4
The former managers readily admit that while still on Cornerstone’s
payroll they had been negotiating for months with Nautic Partners LLC (an
investment banking group in Rhode Island) to hire them to run the chain of
healthcare facilities they convinced Reliant to buy. 1 CR 329-30; 10 RR 6775, 89-95.
To facilitate this new venture, the former managers used
Cornerstone’s confidential information.
Michael Brohm, CEO first of
Cornerstone and later of Reliant, sent a “business plan” to Nautic that
disclosed Cornerstone’s “complete playbook” of business opportunities, 4
RR 12-13, 40-43; 10 RR 212-271, including companies with which it was
currently “in discussions” potentially leading to acquisition. 4 RR 27-28; 11
RR 544. He also sent Nautic the financials, market details, and business
The executives’ positions at Cornerstone were: (1) Michael Brohm - President, CEO,
Director; (2) Kenneth McGee - V.P. of Hospital Operations; Patrick Ryan - V.P. of Business
Development; (4) Jerry Huggler - V.P. of Finance; (5) Chad Deardorff - Group C.F.O.). 1 CR 45.
Upon joining Reliant, Brohm became the CEO and a Board member (19 RR 61), McGee the Chief
Operating Officer (19 RR 476), Ryan the Senior V.P. of Marketing and Provider Relations (19 RR
629), Huggler the Chief Financial Officer (19 RR 429), and Deardorff the Senior V.P. of Financial
Operations (19 RR 343).
3
4
See 4 RR 20 & compare map at 15 RR 431 with map at 15 RR 431; see also infra at 20 n.15.
3
AUS:646830.2
strategy for Cornerstone and its individual hospitals. 4 RR 21-24; 12 RR 3562. After giving a “Strategic Assessment” regarding opportunities in the
post-acute care market to Cornerstone’s Board on February 15, 2011, a week
later the former managers presented the same information to Nautic using
some of the same PowerPoint slides5 — and charged Cornerstone for their
travel to Rhode Island to make the presentation. 4 RR 21-24; 12 RR 35-62.
The data shared with Nautic was not general knowledge; it was
confidential information gathered using Cornerstone’s network of hospital
managers around the country.
In the fall of 2010, Brohm asked these
managers to gather data about potential opportunities in their local markets.
5 RR 83-86; 12 RR 63-80; 19 RR 73-74. Their reports included detailed
information about existing local healthcare facilities, including:
5
•
how they got referrals;6
•
how they were trying to increase those referrals;7
Compare 10 RR 261, 263-64 with 10 RR 941, 934-35.
See, e.g., 12 RR 64 (noting that “most of [facility’s] patients come from” two named
sources); id. at 66 (noting which local facility “Appear[s] to have good physician contacts for
referral sources”); id. at 79 (noting that facility has “a variety of medical staff to achieve admission
and consultation goal”).
6
See, e.g., 12 RR 63 (noting method used by facility “to ensure that patients they want to
keep stay within their system”); id. at 65 (noting that facility was “[s]upposedly working on some
agreement with [named institution’s] neurologists”); id at 68 (noting closure of competing facility
and “Our liaison team is focused on this market to turn some of the patients our direction”).
7
4
AUS:646830.2
•
how they marketed their services;8
•
the problems they faced;9
•
the opportunities and limits for individual facilities or
particular markets;10 and
•
why some local facilities had failed.11
This confidential information from Cornerstone’s network of managers was
never shared with Cornerstone’s Board; instead, the former managers
provided that information to Nautic. 5 RR 139-41; 12 RR 63-80.
2. They copy Cornerstone’s reports and data The former managers did not leave Cornerstone empty-handed. In
an e-mail dated January 28, 2011, Brohm instructed Chad Deardorff to begin
preparations to copy or replicate Cornerstone’s information systems for use
See, e.g., 12 RR 63 (noting method facility uses “to ‘rehab’ patients that don't meet acute
rehab criteria-- they sell it as ‘rehab’ to patients & families”).
8
See, e.g., 12 RR 66 (noting that facility lacked “processes and systems in place” and
“appropriate supplies/equipment”); id. at 67 (noting circumstances in which “it is very difficult to
admit a patient to the unit”); id. at 73 (noting that facility was “known for taking patients that
aren’t ‘Rehab appropriate’”).
9
See, e.g., 12 RR 69 (noting difficulty of increasing occupancy because of medical director’s
strict criteria); id. at 71 (Ex. 266 p. 9) (noting reasons “I would not recommend competing in this
market”); id. at 76 (noting “very strong political clout” of local medical center in legislature, which
“will result in a decline in referrals” if new competition is introduced); id. at 77 (noting regulatory
restrictions that suggested the only avenue for expansion “is to purchase an existing entity or to
manage a unit”); id. at 78 (suggesting that with addition of 20 beds at a hospital, “Economies of
10
scale can be maintained”).
11
See, e.g., 12 RR 65 (noting why two other local facilities had failed).
5
AUS:646830.2
at Reliant:
Need to identify where the software or programming for CHG
[Cornerstone Healthcare Group] lies today and how can we
copy it or eventually redo it at Reliant; and who can redo it if
necessary.
Chad, prepare a list of all such reports we have today, where
does it pull data from, how does it pull the data, what is the
name of the report and where is the report kept; and any other
pertinent data. 10 RR 1030.
Similarly,
Brohm’s
assistant
testified
that
she
downloaded
Cornerstone documents at Brohm’s request and took them with her to her
new job in the same position at Reliant:
Q.
So that thumb drive, Mike Brohm asked you to put documents
on the thumb drive a month before you left Cornerstone, and
then you took that thumb drive with you to Reliant when you
went there?
A.
I did.
Q.
And what was on the thumb drive?
A.
I can't tell you specific documents. It was a folder for Mike
Brohm. 19 RR 461 (depo at 45:12-19).
*
*
*
Q.
And then you -- so you copied the information from the thumb
drive that you took from Cornerstone, you put it on your
Reliant laptop, and then you put that thumb drive in your
desk?
A.
Yes. 19 RR 461 (depo at 48:9-13).
6
AUS:646830.2
3. They cover their tracks by deleting data at Cornerstone It is hard to say precisely what Cornerstone information the former
managers took and disclosed to Reliant, because they deleted everything
from their Cornerstone computers before they left.
Defendant Brohm deletes data
Q.
So before you left Cornerstone, did Mr. Brohm also ask you to
delete e-mails or documents on your computer at Cornerstone?
A.
Yes.
Q.
What did he ask you to delete?
A.
E-mails and documents. I can’t give you specifics. 19 RR 456
(depo at 26:10-18).
...
Q.
And had you been working on a number of documents for
him?
A.
That’s all I did.
Q.
Including PowerPoint presentations?
A.
PowerPoints, Words, Excel. I mean, anything Mike needed, I
did. 19 RR 456 (depo at 28:7-12).
...
Q.
All the documents you had worked on in the last couple of
months before you left Cornerstone you deleted?
A.
Yes.
Q.
And that was at Mr. Brohm’s direction?
7
AUS:646830.2
A.
Yes. 19 RR 456-57 (depo at 28:24-29:3).
Defendant Ryan deletes data
Q.
Okay. So when Mike Brohm came to you in February or March,
you not only did it on your Yahoo account, you did on your
Cornerstone account, you went back and deleted any of the emails about Reliant?
A.
Yes. 19 RR 659 (depo at 38:3-7).
...
Q.
And tell me about that conversation. He comes to you and he
says?
A.
I'm going to guess -- I mean, I don't recall the exact details -Pat, if you have any e-mails that -- that need to be deleted, start
looking at them and start deleting them, something to that
extent.
Q.
What did you do?
A.
Probably deleted them.
Q.
What do you mean "probably deleted them"?
A.
Well, probably deleted them. I mean, I -- he was my boss and, I
mean, I probably went -- I don't recall. I probably went through
and deleted some, kept some based on what I thought I needed
to keep or -- or delete. I'm being honest.
Q.
Okay. And why -- why would you be in there deleting e-mails?
A.
I don't know. It's -- it's obviously conversations that -- or
information such as this that he did not want them to show up
at a later date…. 19 RR 652-53 (depo at 12:10-13:4).
8
AUS:646830.2
Defendant Crouch deletes data
Q.
Which e-mails do you recall deleting?
A.
Those were e-mails and transactions related to any
communication I had with Mike [Brohm] and Ken [McGee]. 19
RR 318 (Crouch Depo 87:20-22).
...
Q.
Why did you do that?
A.
I was requested to do so.
Q.
Who asked you to do that?
A.
I believe Ken McGee asked me to do that.
Q.
Do you know why he asked you to do that?
A.
I have no idea. 19 RR 318 (depo at 88:8-13).
Defendant Deardorff deletes data
Q.
Okay. Tell me more about that. You just sat down and you are
leaving Cornerstone and you feel --
A.
I made a decision to delete the e-mails.
Q.
Okay. And for what purpose? You had not deleted them the
day before or the week before; you decided to delete them right
before you left Cornerstone. Why did you make that decision?
...
A.
I -- I don't know if I had a reason, other than I just made the
decision -- 19 RR 359 (depo at 15:9-16, 15:25-16:6, 16:10-11).
4. When suit is filed, they delete data at Reliant too Again, it is hard to say precisely what the former managers delivered
9
AUS:646830.2
to Reliant, as there too they deleted everything after this suit was filed. As
Brohm’s secretary testified:
Q.
You came to be employed at Reliant in the same position that
you had at Cornerstone, that is, Mr. Brohm' s assistant, right?
A.
Yes.
Q.
As Mr. Brohm' s assistant at Reliant, did Mr. Brohm ask you to
delete e-mails or documents?
A.
Yes. 19 RR 454 (depo at 18:6-12).
...
Q.
How is it that you determined which emails and documents to
delete?
A.
I deleted all of it. 19 RR 454 (depo at 19:11-13).
...
Q.
… The documents that Mr. Brohm asked you to delete at
Reliant, on your Reliant computer, were all documents that you
edited while you were at Reliant?
A.
Yes. 19 RR 456 (depo at 25:15-18).
...
Q.
And essentially it was his communication to you, Delete all of
the documents that you’ve worked on for me since we’ve been
here?
A.
The conversation, how I remember it, was, Delete your e-mails
and delete the documents that you’ve done for me.
Q.
Did you believe that was wrong to do that?
10
AUS:646830.2
A.
I’m not going to question my boss. 19 RR 456 (depo at 25:2226:4).
On October 5, 2011, the court-appointed forensic expert in this case,
Noel Kersh of Pathway Forensics LLC, issued a report stating his findings
after an extensive investigation of the parties’ electronic data (copy attached
hereto as Tab A).12 The report speaks for itself:
1.
“Pathway found evidence of the presence of Cornerstone
proprietary information on the Defendants’ computers
and devices used by the Defendants. One specific device
of particular interest is a Kingston brand thumb drive
which was connected to multiple Defendants’ computers
at both Cornerstone and Reliant that was not produced
by any party for analysis.” Tab A, p. 3 of 44.
2.
“Brohm’s counsel stated that Mike Brohm was not aware
that Ryan Brohm, his son, was remotely logged into his
machine and running CCleaner the night of April 10,
2011. We found evidence that indicates Brohm may not
have been telling the truth about April 10. Brohm also
was in the possession of all four “community” USB
devices that were passed around between the
Defendants, but only one of those four devices was
produced for examination.” Tab A, p. 3 of 44.
3.
“Defendant Brohm provided a download of his Bellsouth
email account which was incomplete as our forensic
analysis uncovered a number of Reliant and Icon related
emails that were not in his production. The other
Defendants didn’t produce much if any webmail.
Cornerstone has requested the trial court clerk to prepare a supplemental record for filing
with this Court to include the forensic report.
12
11
AUS:646830.2
Pathway analyzed for webmail on each machine and
much webmail was found that was not produced by the
Defendants.” Tab A, p. 3 of 44.
4.
“Deardorff attached an external hard drive to his
Cornerstone computer the night before his last day of
employment. We found this same drive attached to his
Reliant computer and a folder named “Chad” which
contained a high volume of Cornerstone data. The drive
containing this Cornerstone data was not produced for
examination.” Tab A, p. 4 of 44.
5.
“Pathway became aware of a potential conflict of interest
with SamTech [employer of Defendant Brohm’s son,
Ryan Brohm] which provided IT services to both parties
in this matter at the same time. SamTech did not notify
either the Plaintiffs or the Defendants that the company
was providing IT services to both parties in this litigation
at the same time. In fact, SamTech instructed its
employees to lie in the event this conflict of interest was
discovered.” Tab A, p. 4 of 44.
SUMMARY OF ARGUMENT Under Texas law, evidence is presumed to be unfavorable to a party
that deliberately destroys it. Regardless of the other evidence, the trial court
had discretion to presume the destroyed evidence here would have
indicated a probable right to relief and probable injury, thus supporting a
temporary injunction.
There was evidence here that the former managers gathered detailed
information about potential business opportunities using Cornerstone’s
12
AUS:646830.2
personnel and assets, information that was only available to someone who
owned and operated post-acute care facilities in those communities. By
taking that information to Reliant for use, the former mangers both
breached their duty of confidences with Cornerstone and usurped its
business opportunities.
The trial court did not abuse its discretion in
protecting that information and those opportunities pending trial.
In Rugen v. Interactive Business Systems, Inc., 864 S.W.2d 548 (Tex.
App.—Dallas 1993, no writ), this Court expressly rejected three of the
arguments raised by the Defendants:
1.
A temporary injunction need not specify the precise
information that is confidential; it is perfectly proper to
enjoin use of “trade secrets” generally or by reference to
other documents. Id. at 552-53.
2.
Irreparable injury is shown by evidence that former
employees possess confidential information and are in a
position to use it; no showing of commercial use is
required. Id. at 552.
3.
An order barring former employees from contacting
particular businesses is not a bar to competition when
they learned about those contacts only through the use of
confidential information. Id. at 551.
There is no good reason this Court should have to explain these rules again.
The balance of equities and the public interest generally favors
protecting applicants like Cornerstone with a probable right and probable
13
AUS:646830.2
injury. Neither favors the Defendants, who either took trade secrets or plan
to use them, and whose deletions of relevant evidence prevent them from
coming to court with clean hands.
Rule 683 provides that a temporary injunction is binding on the
parties to the action and “those persons in active concert or participation
with them.”
Regardless of what the Defendants other than the former
managers knew, they were properly ordered not to perpetuate the misuse of
Cornerstone’s confidences and opportunities by exploiting it pending trial.
I. THE CONSEQUENCES OF SPOLIATION Cornerstone’s former officers and employees deliberately deleted
evidence — both at Cornerstone before they left and at Reliant after this suit
was filed. They admit this. See Statement of Facts, parts (3)-(4) supra. Under
Texas law, “a party who has deliberately destroyed evidence is presumed to
have done so because the evidence was unfavorable to its case.” Wal-Mart
Stores, Inc. v. Johnson, 106 S.W.3d 718, 721 (Tex. 2003). Thus, the trial court
had discretion to presume that the deleted evidence supported what
Cornerstone alleges. See Buckeye Retirement Co., LLC, Ltd. v. Bank of Am.,
N.A., 239 S.W.3d 394, 402 (Tex. App.—Dallas 2007, no pet.) (reviewing trial
judge’s decision whether to apply spoliation presumption for abuse of
14
AUS:646830.2
discretion).
The duty to preserve relevant evidence arises when parties should
know there is a substantial chance of litigation. Wal-Mart, 106 S.W.3d at
722-23. The Defendants clearly violated that duty by deleting data after suit
was filed. MRT, Inc. v. Vounckx, 299 S.W.3d 500, 510 (Tex. App.—Dallas
2009, no pet.). But they anticipated suit long before then, as they requested
indemnification from Nautic in the event Cornerstone filed this suit, and
selectively deleted relevant documents at Cornerstone before they left. See,
e.g., 12 RR 128-130; 19 RR 129-130 (depo at 330:4-5, 330:14-331:11, 331:16332:1); 19 RR 381 (depo at 57:10-58:13); 19 RR 456-457.
Naturally, the Defendants barely mention spoliation in their briefs. In
a footnote, Reliant argues it is irrelevant as the trial court refused to apply a
spoliation presumption.
But that is incorrect; while the trial judge
postponed the decision on a spoliation instruction for the jury trial, see 2 RR
53, he expressly found the Defendants’ evidence “not credible” because of
spoliation. 2 CR 710. As he explained to counsel:
THE COURT:
I just want to make it clear that there were a number of
references made, and you've said it here, that you can't use
the destruction of e-mails as a basis to punish the
defendants through an injunction. I agree with you, but
that's not the reason I think this pattern of destroying
evidence and e-mails and deleting e-mails is relevant….
15
AUS:646830.2
COUNSEL FOR RELIANT: I'm sure, and I will talk about this more, that
you will hear more about e-mails, et cetera. My point for
now is that with respect to November, December, January,
February, even March, there is actually nothing wrong
with deleting an e-mail associated with this because it has
nothing to do with their work at Cornerstone, and they're
entitled to keep that information from Cornerstone. It's not
destroying evidence unless -THE COURT:
How do I know that? I don't know what's in the e-mails.
They have certain duties. . . . I mean, they had certain
duties when they were employees at Cornerstone. Since I
don't have all that evidence, and I don't have certainty that
there isn't evidence that's still missing, it's very hard to
judge the credibility of your witnesses.
Reliant hired a forensic expert to testify that everything deleted from
its computers has been recovered. But it has prevented that claim from
being tested, obtaining an emergency stay from this Court on September 9,
2011 to stop production of the expert’s notes and reports so all his findings
could be examined. More importantly, evidence was deleted from many
places where he did not look, as the court-appointed forensic expert’s report
shows in detail. See Tab A.
It is frustrating, to say the least, to read the Defendants’ briefs
demanding that Cornerstone produce more evidence of what they
themselves took — and deliberately deleted. What they deleted could show
precisely what they took and what they disclosed or used.
16
AUS:646830.2
Having
destroyed the evidence themselves, the trial court was entitled to presume it
would have been favorable to Cornerstone and unfavorable to the
Defendants. See Cire v.Cummings, 134 S.W.3d 835, 841 (Tex. 2004).13 A trial
court does not abuse its discretion by issuing a temporary injunction when
spoliation by several Defendants supplies a presumption of prima facie
evidence against them.
II. NOEVIDENCE ISSUES In their no-evidence points, the Defendants ask this Court to reverse
the temporary injunction because (1) the information they took was not
confidential, (2) they usurped no corporate opportunities, (3) they haven’t
used any confidential information yet, and (4) the equities are all in their
favor. But as this Court has often stated, an advisory opinion on the merits
is not what an interlocutory appeal is for. “[A] party may not use an appeal
of a temporary injunction ruling to get an advance ruling on the merits.”
Dallas/Fort Worth Int’l Airport Bd. v. Ass'n of Taxicab Operators, USA, 335
S.W.3d 361, 364 (Tex. App.—Dallas 2010, no pet.). As this Court said in
(“Because the audiotapes sought by Cire would have either proved or disproved
Cummings's claims, her destruction of them justifies a presumption they would have done the
latter. On this record, it was within the trial court's discretion to determine that Cummings
deliberately destroyed dispositive evidence; thus, death penalty sanctions are warranted in this
exceptional case.”).
13
17
AUS:646830.2
1959 and again last year:
[O]ur system of procedure is such that legal rights cannot be
finally determined upon a hearing relating to the wisdom or
expediency of issuing a status quo order. Deliberate action is
essential for the accurate determination of legal rights and
upon occasion this can be secured only by issuing a temporary
decree protecting a status quo.
Id. at 366 (quoting Southwest Weather Research, Inc. v. Jones, 327 S.W.2d 417,
421 (1959). The Defendants’ requests are inappropriate before trial.
The Reporter’s Record here contains 12 volumes of testimony and
deposition excerpts, and 9 volumes of exhibits. Marshaling all the evidence
would be wasteful for the litigants and tedious for the Court. Accordingly,
this brief will present only enough examples from the record to show that
the trial court did not abuse its discretion. See Putnam v. City of Irving, 331
S.W.3d 869, 873 (Tex. App.—Dallas 2011, pet. denied) (“When the trial court
bases its decision on conflicting evidence, there is no abuse of discretion.”).
Finally, Cornerstone need not show a probable right to relief and
probable injury relating to every one of its claims; a showing as to any one
of them is sufficient to justify preserving the status quo. See Graham Mortg.
Corp. v. Hall, 307 S.W.3d 472, 481 (Tex. App.—Dallas 2010, no pet.) (holding
movant did not have to show probable right relating to every loan to justify
temporary injunction, as preserving status quo required relief as to all);
18
AUS:646830.2
Birnbaum v. Alliance of Am. Insurers, 994 S.W.2d 766, 776 (Tex. App.—Austin
1999, pet. denied) (“Our reversal of the permanent-injunction order moots
one ground for the temporary injunction, but the other ground--that the
Quarterly Market Reports are trade secrets--survives.”).
A. Probable Right: Misuse of Confidential Information The law forbids employees from disclosing confidential information
of a former employer. See Rugen v. Interactive Bus. Sys., Inc., 864 S.W.2d 548,
551 (Tex.App.-Dallas 1993, no writ). The common law imposes this duty
whether or not there is a nondisclosure or noncompetition contract. See Tom
James of Dallas, Inc. v. Cobb, 109 S.W.3d 877, 888 (Tex. App.—Dallas 2003, no
pet.). The duty survives termination of employment. See Sharma v. Vinmar
Int’l Ltd., 231 S.W.3d 405, 424 (Tex. App.—Houston [14th Dist.] 2007, no
pet.).
Both Reliant and Cornerstone are in the business of buying healthcare
facilities, not just operating them. In the investment banking community
(which includes the owners of both Cornerstone and Reliant), the strengths
and weaknesses of potential target companies are considered highly
19
AUS:646830.2
confidential.14 That is exactly what the former managers took.
While Cornerstone previously owned only long-term acute care
hospitals, changes in federal regulations in 2009 encouraged Cornerstone
and its competitors to begin bundling various types of post-acute care
facilities. See 3 RR 121-128.15 The former managers asked Cornerstone’s
hospital managers throughout the country to identify and recommend local
facilities that would make for profitable acquisitions. This information was
not general knowledge in the industry — that explains why the former
managers had to gather it from local sources. The former CEO of Reliant’s
chain of facilities admitted that such information (e.g., bed-need analysis,
sources of referrals, and marketing strategies) is considered confidential
information. 19 RR 554 (depo at 129:19-131:20). Brohm took a copy of that
report with him to Reliant, where a hardcopy survived his spoliation efforts
See 19 RR 262-63 (depo at 48:19-49:20) (testimony of Vice President and now Principal with
Nautic: “Q. Does Reliant consider its target acquisition list to be confidential? A. Yes, sure.”).
14
Reliant argues that it and Cornerstone were in two entirely different markets. But the
record shows Cornerstone was pursuing the same inpatient rehabilitation facilities (IRFs) targeted
by Cornerstone. See, e.g., 10 RR 794-95 (Cornerstone Board Meeting August 12, 2010 identifying
IRFs for acquisition); 10 RR 942 (Cornerstone Board Meeting February 15, 2011 discussing pursuit
of IRF acquisitions); 10 RR 1010 (email from Cornerstone board member in January 2011 regarding
expansion into IRFs in local markets). Conversely, the record also shows that Reliant was pursuing
long-term acute care hospitals (LTACHs) like those held by Cornerstone, including Cornerstone
itself. See 11 RR 544 (business plan Brohm sent to Nautic in November 2010); 10 RR 262 (business
plan Brohm presented to Nautic iFebruary 22, 2011).
15
20
AUS:646830.2
and was produced by Reliant. 5 RR 21-22, 140.
“A trade secret is any formula, pattern, device or compilation of information which is used in one's business and presents an opportunity to
obtain an advantage over competitors who do not know or use it.”
Computer Assocs. Int’l, Inc. v. Altai, Inc., 918 S.W.2d 453, 455 (Tex. 1996).
Cornerstone produced testimony regarding the confidential nature of this
compilation, the measures taken to protect it, its value, the time and effort
spent gathering it, and the difficulty others would have duplicating it. See
Statement of Facts, part (1); 3 RR 102-106, 109.
In their briefs, the Defendants dismiss this data as “a few trivial
snippets of readily available information.”
But candid opinions from
knowledgeable professionals about local conditions and competitors in a
specialized market is not trivial. Only people in the business would know
these kinds of details. The Defendants disparage the value of knowing
which facilities have a “good reputation” as common knowledge. But the
“buyers” of rehab services are generally doctors who refer patients to
them,16 and their personal professional opinions are what counts rather than
See 3 RR 124 (“You want to be horizontally integrated because if you have that doctor, he's
the referring source. He's the one that has the patients. That's the guy you want to say, look, I can
16
21
AUS:646830.2
public hearsay.
It would be difficult for anyone else to replicate this same level of
inside information.
Reliable information about which facilities are
profitable, respected, or well-run cannot be obtained from the Internet.
Cornerstone could gather that kind of information because, at substantial expense, it owned and operated a network of healthcare facilities with
knowledgeable personnel around the country. Those who do not own such
a network would have difficulty gathering the same information even with
a large investment time and money; simply interviewing strangers is
unlikely to produce the same quality of information that Cornerstone’s
managers shared within their own company.
Reliant asks this Court to draw an inference that individual pieces of
this information were not trade secrets either because they are commonly
known or inconsequential. That is the wrong standard of review in at least
three respects. First, in reviewing a temporary injunction, the Court must
draw all legitimate inferences in favor of the trial court’s Order. See Putnam
v. City of Irving, 331 S.W.3d 869, 873 (Tex. App.—Dallas 2011, pet. denied).
take your patient, your ventilator patient. . . . From a business perspective now, I've captured -my client is really that doctor, even though we take care of the patient.”).
22
AUS:646830.2
Second, in reviewing a temporary injunction the question is not whether
information is in law and fact a trade secret, but whether it is entitled to
protection pending trial. See IAC, Ltd. v. Bell Helicopter Textron, Inc., 160
SW3d 191, 197 (Tex. App.—Fort Worth 2005, no pet).
And third, the
relevant question is not whether the Defendants might have developed this
list of targets independently, because that is not what they did — they took
it. As the Texas Supreme Court stated 53 years ago:
It matters not that defendants could have gained their
knowledge from a study of the expired patent and plaintiffs'
publicly marketed product. The fact is that they did not.
Instead they gained it from plaintiffs via their confidential
relationship, and in so doing incurred a duty not to use it to
plaintiffs' detriment. This duty they have breached.
Hyde Corp. v. Huffines, 314 S.W.2d 763, 774-75 (Tex. 1958) (quoting Franke v.
Wiltschek, 209 F.2d 493, 495 (2 Cir. 1953). Viewed by the proper standards,
the trial court did not abuse its discretion in determining there was
confidential information at stake that deserved protection pending trial.
B. Probable Right: Usurpation of Corporate Opportunities The Court need not address this issue if the temporary injunction is
supported by either ground above. See pp. 19-20 supra.
At the temporary injunction hearing, there was evidence that the
former
managers
(1)
identified
potential
23
AUS:646830.2
target
companies
using
Cornerstone’s assets, networks, and personnel, see e.g. 3 RR 99-105; 4 RR 1114, 19, 47-48; 10 RR 940; 14 RR 129-157; 15 RR 515; (2) took that information
to Reliant and recommended acquiring some of them, see 12 RR 63-80; 10 RR
258-259; 12 RR 63-80;
and (3) unless restrained, that is precisely what
Reliant intends to do, see, e.g., id.; 19 RR 134-136 (depo at 350:17-18, 351:1352:14, 352:19-355:12, 355:22-356:9, 356:14-25); 19 RR 310-312 (depo at 56:1018, 56:24-57:1, 57:5-58:6, 58:11-22, 59:21-60:15, 60:21-61:5). The trial court had
discretion to keep that from happening pending trial.
The Defendants complain that the Order does not contain a “factintensive analysis of multiple factors” required by Delaware law to prove
the merits of this claim. But a temporary injunction under Texas law does
not require a fact-intensive analysis of the merits; it requires only a showing
of probable right and probable injury.
The evidence already cited
establishes that.
The Defendants’ briefs speculate that the corporate-opportunity
doctrine played no part in the Order. There was necessarily some overlap
in Cornerstone’s breach of confidences and usurpation of opportunities
claims because the target companies were identified as potential targets
using Cornerstone’s confidential information and analysis. In any event,
24
AUS:646830.2
the Order expressly states that the facilities listed on Exhibit A attached to
the Order were corporate opportunities identified using Cornerstone’s
assets, see 2 CR 749, that the Defendants “have actively usurped” those
corporate opportunities, see 2 CR 749-750, and that they should be enjoined
from pursuing these “business opportunities” pending trial on the merits,
see 2 CR 757-759. This Order must be reviewed based on what it says, not
on stray remarks by judge or anyone else before or after it. See, e.g., Shannon
v. Texas General Indem. Co., 889 S.W.2d 662, 664 (Tex. App.―Houston [14th
Dist.] 1994, no writ) (holding grounds for summary judgment were those
stated in order, not in judge’s letter to parties).
The Defendants also argue that future targets cannot constitute
usurpation because they had no duty to their former employer. But as
already noted, an employee’s duty not to use confidential information
survives termination, and the information on potential targets was taken
before the former managers left.
See pp. 5-6, 19 supra.
Nor can the
Defendants be excused on the ground that Cornerstone can still compete for
these targets. In new markets, the highest returns are generally earned in
early months before other competitors have a chance to jump in. See Garth
v. Staktek Corp., 876 S.W.2d 545, 549 (Tex. App.—Austin 1994, writ dism’d
25
AUS:646830.2
w.o.j.).17
Allowing any of the Defendants to pursue targets based on
confidential information gained from Cornerstone’s local managers would
give them a “head start” not shared with other companies who have not
been privy to inside information. See Hyde Corp. v. Huffines, 314 S.W.2d 763,
778 (Tex. 1958) (noting that one who obtains confidential information has a
“head start” in subsequent competition).
C. Probable Irreparable Injury: Possession + Position The Defendants assert there was no evidence of probable irreparable
injury absent proof of actual or imminent use of Cornerstone’s confidential
information. This precise argument has been considered and rejected by
this Court before.
In Rugen v. Interactive Business Systems, Inc., 864 S.W.2d 548
(Tex.App.-Dallas 1993, no writ), a former employee challenged a temporary
injunction “because the record does not show that she had wrongfully used
and would continue to use any confidential information.” Id. at 552. But
(“Moreover, in technological industries, the design stage and the start-up phase provide
the creator of a new device a period in which to market the new product before potential
competitors are able to copy the technology. By appropriating Staktek's confidential information
before its publication, RTB was able to prepare to enter the market at the same time as Staktek, and
thus could deprive Staktek of the competitive advantage offered by the normal developmental
period.”).
17
26
AUS:646830.2
this Court held that probable injury and a probable right to relief could be
inferred if a former employee is in possession of confidential information
and in a position to use it:
From our review of the record, we find evidence indicating that
Rugen possesses confidential information of IBS and operates a
firm in direct competition with IBS. Rugen is in possession of
IBS's confidential information and is in a position to use it.
Under these circumstances, it is probable that Rugen will use
the information for her benefit and to the detriment of IBS.
Id. Other courts have applied this same standard. See, e.g., IAC, Ltd. v. Bell
Helicopter Textron, Inc., 160 SW3d 191, 200 (Tex. App.—Fort Worth 2005, no
pet.); T-N-T Motorsports, Inc. v. Hennessey Motorsports, 965 S.W.2d 18, 24
(Tex. App.—Houston [1st Dist.] 1998, no pet.); Conley v. DSC Comm’ns Corp.,
No. 05-98-01051-CV, 1999 WL 89955, at *4 (Tex. App.—Dallas Feb. 24, 1999,
no pet.) (not designated for publication).
In this case, the former managers shared Cornerstone’s confidential
information with their fellow Defendants, and in their briefs the assert the
right to continue using that information pending trial. The information on
these markets may have been deleted from their computers, but it cannot be
deleted from their heads. See, e.g., 7 RR 143 (testimony by Brohm: “I did not
use [Exhibit] 266 specifically because I know the markets in my head. I don't
need to look at a document to know markets.”). As the Defendants are in
27
AUS:646830.2
possession of confidential information and in a position to use it, the trial
court could conclude that Cornerstone had shown a probable injury.
The Defendants’ cite two cases for their claim that evidence of actual
use is required. See Global Water Group, Inc. v. Atchley, 244 S.W.3d 924, 930
(Tex. App.—Dallas 2008, no pet.); Trilogy Software, Inc. v. Callidus Software,
Inc., 143 S.W.3d 452, 463 (Tex. App.—Austin 1994, no pet.). But those were
judgments on the merits in damages actions, not temporary injunctions. In
a damages action, there are no damages without use. But the primary
purpose of a temporary injunction is to prevent use in the first place — and
thus irreparable damages.
It is true that a temporary injunction must state more than that the
movant is “suffering irreparable harm.” See Global Water, 244 S.W.3d at 930;
Trilogy Software, 143 S.W.3d at 463. But that of course is not this case. The
17-page Order here details the Defendants’ use of confidential information
and their efforts to cover it up. “The threatened disclosure of trade secrets
constitutes irreparable injury as a matter of law.” IAC, Ltd., 160 S.W.3d at
200.
Moreover, the trial court noted that use of Cornerstone’s confidential
information could be “impossible to measure with monetary damages.” 2
28
AUS:646830.2
CR 754. As the Defendants concede in their briefs, “there is no way to
measure the damage caused by lost opportunities to expand.” See Reliant
Brief at 49; Brohm Brief at 44. “An injury is irreparable if the injured party
cannot be adequately compensated in damages or if the damages cannot be
measured by any certain pecuniary standard.” Butnaru v. Ford Motor Co., 84
S.W.3d 198, 204 (Tex. 2002).
In the business of turning around less-
profitable healthcare facilities, lost profits may be hard to show with
“reasonable certainty.”
See ERI Consulting Eng’rs, Inc. v. Swinnea, 318
S.W.3d 867, 876 (Tex. 2010) (holding lost profits must be proven “by
competent evidence with reasonable certainty”); Garth v. Staktek Corp., 876
S.W.2d 545, 549 (Tex. App.—Austin 1994, writ dism’d w.o.j.) (“Lost
opportunity to create or gain control of a new market may result in
unquantifiable losses for which there is no adequate remedy at law.”)
Finally, the trial court also noted that the Defendants’ attempts to
“hide their activities” made it “difficult to determine” how Cornerstone’s
confidential information might be used pending trial. 2 CR 753. If the
Defendants wanted more specifics about how Cornerstone’s confidential
information had been used, they should not have deleted it to make that
hard to determine. This Court should not demand more specificity in the
29
AUS:646830.2
Order than the Defendants prevented by concealing what they took.
In this case, the Order specifies that the Defendants had taken and
used confidential information and ordered them to desist. Texas law does
not require any more than that, as the Texas Supreme Court stated more
than fifty years ago:
Future problems of enforcement applicable to most every type
or form of injunction may be imagined. The decree is,
however, to be interpreted in the light of its recitals and
findings. It was found that respondents were wrongfully
making a tool substantially the same as that of petitioners.
They were ordered to desist. The decree is sufficiently definite
to be enforced.
K & G Oil Tool & Serv. Co. v. G & G Fishing Tool Serv., 314 S.W.2d 782, 791
(Tex. 1958).
D. Balance of Equities and the Public Interest: Those Who Breach Confidences and Delete Evidence Have No Claim The Defendants complain that the Order “does not even address …
the balance of harms and the public interest.” There is no such requirement
in Rule 683, or anywhere else.18 In any event, the balance of equities and the
See, e.g., Methodist Hosps. of Dallas v. Tex. Indus. Acc. Bd., 798 S.W.2d 651, 661 (Tex. App.—
Austin 1990, ) (affirming temporary injunction by indulging reasonable presumptions in favor of
judgment that did not explicitly address balance of equities and public interest); Estancias Dallas
Corp. v. Schultz, 500 S.W.2d 217, 221 (Tex. Civ. App.—Beaumont 1973, writ ref'd n.r.e.) ("[T]here is
an implied finding that the trial court balanced the equities in favor of plaintiffs by entering the
judgment granting the injunction.").
18
30
AUS:646830.2
public interest generally favor protecting applicants with a probable right to
relief from irreparable injury — like Cornerstone.
“The protection of a trade secret is a well-recognized objective of
equity.” K & G Oil, 314 S.W.2d at 790. The Defendants all either took trade
secrets or plan to use them. Their claim that the balance of equities favors
such conduct is, as the Texas Supreme Court has said, “abhorrent to our
conception of ordinary honesty:
[T]his knowledge of plaintiff's trade secrets was acquired by
them in confidence and while they were occupying a fiduciary
relationship. They now seek to appropriate these trade secrets
to their own use and profit by a violation of their contractual
agreements and a betrayal of the confidence reposed in them by
plaintiff. This they may not do; such conduct is abhorrent to
our conception of ordinary honesty.
Hyde Corp. v. Huffines, 314 S.W.2d 763, 775 (Tex. 1958) (quoting Julius Hyman
& Co. v. Velsicol Corp., 233 P.2d 977, 999 (Colo. 1951)).
Additionally, one who seeks equity must come to court with clean
hands. Truly v. Austin, 744 S.W.3d 934, 938 (Tex. 1988). “The doctrine is
applied to one whose own conduct in connection with the same matter or
transaction has been unconscientious or unjust, or marked by a want of
good faith, or has violated principles of equity and righteous dealing.”
Ligon v. E. F. Hutton & Co., 428 S.W.2d 434, 437 (Tex. Civ. App.—Dallas
31
AUS:646830.2
1968, writ ref’d n.r.e.).
Given the undisputed fact that the Defendants
deleted relevant material before leaving their former employer and after
being sued at their new one, the Defendants can hardly claim clean hands.
There is absolutely no evidence that the public health or welfare turns
on which set of investment bankers are able to buy the target companies
involved here. Reliant’s plan is to buy existing facilities, not create new
ones. As the facilities listed in Exhibit A to the Order are all already in
operation, temporarily prohibiting Reliant from buying them does not
reduce the level of healthcare available anywhere.
Reliant complains that the temporary injunction “strikes at the heart
of Nautic's business plan.” But the heart of that business plan was to make
use of confidential information gathered from Cornerstone’s network of
healthcare professionals. Neither the law nor the public interest favors
protecting business plans that are unlawful.
III. OBJECTIONS TO THE FORM OF THE ORDER A. For Obvious Reasons, the Order Did Not Detail Trade Secrets The “first and foremost” complaint raised by the Defendants is that
the Order fails to specify “the precise information” that qualified as a trade
secret or confidential information. There is no such requirement.
32
AUS:646830.2
Numerous Texas courts have held that an order prohibiting use of
trade secrets in general terms is not improper:
•
the Texas Supreme Court upheld an order barring
employees from using “any of the trade secrets and/or
confidential business information” of their former
employer in Matlock v. Data Processing Security, Inc., 618
S.W.2d 327, 328-29 & n.2 (Tex. 1981);
•
the Fort Worth court of appeals upheld an order barring
disclosure of “Bell trade secrets and information” in IAC,
Ltd. v. Bell Helicopter Textron, Inc., 160 S.W.3d 191, 201-02
(Tex. App.—Fort Worth 2005, no pet.); and
•
this Court in 1991 upheld an injunction requiring a
former employee to “return … all documents of any type
or description, whatsoever” in Safeguard Business Systems,
Inc. v. Schaffer 822 S.W.2d 640, 642 (Tex. App.—Dallas
1991, no writ).
In the Safegaurd case, this Court noted two reasons why an order in general
terms is sufficient.
First, a temporary injunction is no place to detail confidential
information:
“Where secret customer information was one of the main
assets sought to be protected, the trial court would defeat that purpose by
requiring the public disclosure of such information.” Id. at 644. This Court
expressly approved of temporary injunction orders that incorporate
documents under seal in Rugen:
When confidential information and trade secrets are sought to
be protected, courts should word the injunction order to avoid
33
AUS:646830.2
disclosure of the information. An injunction referring to sealed
exhibits is in compliance with Rule 683 provided the activity
sought to be enjoined is described in reasonable detail.
864 S.W.2d 548, 553 (Tex. App.—Dallas 1993, no writ). A former employee
who has “seen the exhibits and has personal knowledge of the exhibits’
contents” cannot claim a temporary injunction referring to those exhibits is
vague. Id.
Second, former employees usually know precisely what information
is confidential; in most cases, that is why they took it (why take the phone
books or letterhead?). As this Court stated in Safeguard, “we do not think it
unreasonable to assume that he who is sought to be enjoined is sufficiently
familiar with the employer's business and its customers to avoid violating
the injunction.” 822 S.W.2d at 644.
Rule 683’s requirement that an injunction must be “specific in terms”
and describe the acts restrained “in reasonable detail” is not applied in the
abstract. The question is whether this defendant had reasonable notice. See
Ex parte Hudson, 917 S.W.2d 24, 26 (Tex. 1996). Thus,
•
an order to “maintain the land in a sightly condition”
gave adequate notice to a junkyard owner of what was
required, see id.;
•
an order to use property “for residence purposes only”
gave adequate notice to priests using a home as a center
34
AUS:646830.2
for campus ministry, see Protestant Episcopal Church
Council of Diocese of Tex. v. McKinney, 339 S.W.2d 400, 403
(Tex. Civ. App.—Eastland 1960, writ ref’d); and
•
an order prohibiting an insurer from “withdrawing its
defense” gave adequate notice of what it could not do, see
Liberty Mut. Ins. Co. v. Mustang Tractor & Equip. Co., 812
S.W.2d 663, 667 (Tex. App.—Houston [14th Dist.] 1991,
no writ).
In this case, the injunction prohibited the Defendants from retaining
documents they “obtained … during their employment with Cornerstone”
and from using information that was “developed . . . during their respective
periods of employment with Cornerstone.” 2 CR 754-761. No one knows
better than the Defendants precisely what that covers.
In any event, pages 6 and 7 of the injunction specifically list the types
of confidential information the Defendants took from Cornerstone:
financial data from 2007 until 2010, detailed analyses of its markets, strategy
summaries for each market, and a list of potential targets for acquisition
(including data about their personnel, management, capacity, referral
sources, marketing strategies, and competition). 2 CR 749-750. If the Order
were truly vague, the Defendants could not have spent so many pages in
their briefing arguing that these documents weren’t confidential.
35
AUS:646830.2
The Defendants rest their entire argument on one case: Computek
Computer & Office Supplies, Inc. v. Walton, 156 S.W.3d 217 (Tex. App.—Dallas
2005, no pet.). But Computek was a noncompete case, not a confidential
information case. No one claimed the customer list was confidential, and
the former employee needed a list because these were not his customers and
he had no way of knowing whom he could not contact. Id. at 222. In this
case, the Defendants know exactly what data they took from Cornerstone;
indeed, due to spoliation they may be the only ones who know.
The Defendants may disagree that what they took from Cornerstone
was confidential information. But they know perfectly well what it was.
The temporary injunction Order requiring them to stop using it and return
it is sufficiently clear under the circumstances.
B. The Order is not Overbroad; it Covers Targets Identified Using Cornerstone’s Confidential Information The Defendants claim the temporary injunction is overbroad because
it bars competition rather than merely use of confidential information. But
the Order does not bar the Defendants from buying any healthcare facilities
except those they targeted with the help of Cornerstone’s confidential
information. That is what a temporary injunction should do, as this Court
36
AUS:646830.2
said in Rugen:
The temporary injunction does not prevent Rugen from
competing with IBS. Instead, the injunction prohibits her from
soliciting or transacting business with IBS's consultants and
customers, whose identities she was able to obtain through
confidential information.
864 S.W.2d at 551. “Injunctive relief is proper to prevent a party, which has
appropriated another's trade secrets, from gaining an unfair market
advantage.”
T-N-T Motorsports, Inc. v. Hennessey Motorsports, Inc., 965
S.W.2d 18, 24 (Tex. App.—Houston [1st Dist.] 1998, pet. dism’d).
A temporary injunction must fit the circumstances. In cases where it
is easy to separate actions that use confidential information from actions
that don’t, a temporary injunction should be limited to the former. Thus,
for example, in T-N-T Motorsports the secrets for modifying a Dodge Viper’s
engine were separable from other tools of the mechanics trade, so an order
barring the defendants from changing a Viper’s tires or oil was overbroad.
See 965 S.W.2d at 25-26. Similarly, if business can be carried on using public
rather than confidential information, a temporary injunction that bars the
business completely is overbroad. See Southwest Research Inst. v. Keraplast
Techs., Ltd., 103 S.W.3d 478, 482 (Tex. App.—San Antonio 2003, no pet.).
37
AUS:646830.2
But a different rule applies when activities cannot be so neatly
divided.
In Electronic Data Systems Corp. v. Powell, this Court held an
injunction that merely barred a computer programmer from using
confidential information was too narrow; instead, it should have barred him
from doing any programming in the same field. 524 S.W.2d 393, 399 (Tex.
Civ. App.—Dallas 1974, writ ref’d n.r.e.). As the Court noted, a “don’t-useany-secrets
injunction”
is
“intrinsically
unenforceable”
in
these
circumstances because (1) a programmer could not help but use the same
information when doing the same work in the same field, id.; and (2) it
would be hard to tell whether the order was being violated until it was too
late. Id. at 398. As this Court concluded, “the mere rendition of service in
the same area would almost necessarily impart such knowledge” to his new
employer. Id.
Similarly, the former employee in Rugen objected that an order
barring her from doing business with former customers was “equivalent to
enjoining competition” and effectively imposed an invalid noncompete. See
864 S.W.2d at 551. This Court upheld the injunction, noting that it was
impossible for her to contact those clients without using “identities she was
able to obtain through confidential information.” Id. As a practical matter,
38
AUS:646830.2
when the confidential information is a list of customers, the only way to
prohibit use of the information is to prohibit contact with those customers.
And in Conley v. DSC Communications Corp., this Court upheld a
temporary injunction prohibiting a former employee from contacting a
particular customer where disclosure was likely. See No. 05-98-01051-CV,
1999 WL 89955, at *9 (Tex. App.—Dallas Feb. 24, 1999, no pet.) (not
designated for publication).
As the Court stated, a complete bar was
justified because it “is the only effective way to insure that [the former
employee] will not use, intentionally or unintentionally, his knowledge of
[the
former
employer’s
confidential
information
in
the
ongoing
competition.” Id.
In this case, the evidence showed that the former managers gathered
information about potential acquisition targets using Cornerstone’s network
of hospital managers throughout the country, and then shopped some of
those market opportunities to Reliant. The Defendants concede in their
briefs that the trial judge spent a day “parsing through the key documents”
to make sure the list on Exhibit A included only those facilities as to which
Cornerstone’s confidential information was involved. See Reliant Brief at 15;
Brohm Brief at 17. The current Reliant might not even exist, much less want
39
AUS:646830.2
to pursue these targets, but for the breaches by Cornerstone’s former
managers. That Reliant might now develop independent information about
those targets is irrelevant because that is not what it did — its interest in
them arose through a breach of confidences. Pending trial, the only way to
preserve the status quo and keep Reliant from using the information is to
keep it from pursuing those targets — which is what the trial court did.
C. Effective Relief Must Include Those Acting in Concert Finally, several of the Defendants argue that they cannot be bound by
the Order because neither conspiracy nor any other tort has been
independently established against them. For several reasons, that argument
should be rejected.
First, Rule 683 provides that a temporary injunction is binding not
only on wrongdoers but also on “those persons in active concert or
participation with them.” Ignorance of the initial theft does not allow a
recipient of stolen property to keep it. Had the former managers stolen
money from Cornerstone, Reliant and the remaining Defendants could be
enjoined from spending it — not because they were tortfeasors but because
it was not their money.
40
AUS:646830.2
Second, when the former managers acted on behalf of their new
enterprise with Nautic and Reliant, they were acting as vice principals of
those entities. These entities could act only through human agents, and the
agents they chose were the former managers — Brohm as CEO,19 and the
others as mangers of departments or divisions. See Bennett v. Reynolds, 315
S.W.3d 867, 884 (Tex. 2010).20 “When actions are taken by a vice-principal of
a corporation, those acts may be deemed to be the acts of the corporation
itself.”
GTE Sw., Inc. v. Bruce, 998 S.W.2d 605, 618 (Tex. 1999); accord,
Bennett, 315 S.W.3d at 884.
It does not matter whether Nautic or Reliant authorized the former
managers to take Cornerstone’s data or later to delete. If that were the rule,
businesses could simply disavow what their managers did after the fact,
even though businesses only act through those managers. As the Texas
Supreme Court has said: “To permit an employer to escape liability for the
outrageous acts of its management-level employee because the employee
19
See 11 RR 1168 (Nautic report dated Feb. 17, 2001: “Our new CEO, Mike Brohm”).
(“[A] vice-principal includes four classes of human agents: (a) Corporate officers; (b)
those who have authority to employ, direct, and discharge servants of the master; (c) those
engaged in the performance of nondelegable or absolute duties of the master; and (d) those to
whom a master has confided the management of the whole or a department or division of his
business.” (quoting Chrysler Ins. Co. v. Greenspoint Dodge of Houston, Inc., 297 S.W.3d 248, 254 (Tex.
2009)).
20
41
AUS:646830.2
was performing a non-managerial task would severely undercut this
purpose.” Ramos v. Frito-Lay, Inc., 784 S.W.2d 667, 669 (Tex. 1990).
Disclosure and noncompetition cases in Texas often include the new
employer of former employees, as including them is the only way to make
injunctive relief effective.
See, e.g., Alex Sheshunoff Mgmt. Servs., L.P. v.
Johnson, 209 S.W.3d 644, 647 (Tex. 2006) (noting intervention by employee’s
new employer); Vaughn v. Intrepid Directional Drilling Specialists, Ltd., 288
S.W.3d 931, 937 (Tex. App.–Eastland 2009, no pet.) (affirming TI against
former employees and new venture they formed to compete). In this case,
excluding Defendants Nautic, Reliant, or their current officers from the
temporary injunction would allow them to gather the fruit of the tree the
former managers planted using Cornerstone’s confidential information.
Writing for this Court in 1999, Justice Lagarde colorfully explained
why the Order here must extend to such parties:
At best, relying on the new employer to protect the trade
secrets of the former employer when those trade secrets could
work to the new employer's advantage is little better than
asking the fox to guard the henhouse. The richer the henhouse,
the less wise it is to trust even the most responsible and reliable
of foxes.
Conley, 1999 WL 89955, at *6. The trial court properly enjoined Reliant and
the other defendants from using Cornerstone’s confidential information
42
AUS:646830.2
even if they were not the ones who originally took it.
CONCLUSION A party does not have to delay seeking a temporary injunction until
its target companies are bought by a competitor, or its confidential
information is posted on the Internet. The pursuit of this interlocutory
appeal itself shows that the Defendants would use this confidential
information immediately if they had the chance. To preserve the status quo
pending trial, this Court should affirm the trial court’s Order.
Respectfully submitted,
ANDREWS KURTH LLP
By:
/s/ Scott A. Brister
Scott A. Brister
David P. Whittlesey
ANDREWS KURTH LLP
111 Congress Ave., Suite 1700
Austin, Texas 78701
Phone: 512.320.9200
Fax: 512.320.9292
scottbrister@andrewskurth.com
dwhittlesey@andrewskurth.com
Marc D. Katz
Cristina I. Torres
ANDREWS KURTH LLP
Dallas, Texas 75201
Phone: 214.659.4400
Fax: 214.659.4401
marckatz@andrewskurth.com
cristinatorres@andrewskurth.com
ATTORNEYS FOR APPELLEE CORNERSTONE
HEALTHCARE GROUP HOLDING, INC.
43
AUS:646830.2
Certificate Of Service I hereby certify that a true and correct copy f the foregoing document
was served on all counsel of record via electronic transmission on this 7th
day of October, 2011.
Mark R. Steiner
W. Gary Fowler
JACKSON WALKER L.L.P.
Dallas, Texas 75202
(214) 953-5822 (Fax)
msteiner@jw.com
Patrick F. Philbin
KIRKLAND & ELLIS LLP
655 15th Street, NW
Washington, DC 20005
(202) 879-5200 (Fax)
patrick.philbin@kirkland.com
John F. Hartmann
Garbor Balassa
KIRKLAND & ELLIS LLP
300 North La Salle Street
Chicago, Illinois 60654
(312) 862-2200 (Fax)
john.hartmann@kirkland.com
David Watkins
JENKINS & WATKINS, PC
2626 Cole Ave, Suite 200
Dallas, Texas 75204
(214) 378-6680 (Fax)
dwatkins@jenkinswatkins.com
Keith A. Clouse
Alyson C. Brown
Gregory M. Clift
CLOUSE DUNN LLP
1201 Elm Street, Suite 5200
Dallas, Texas 75270
(214) 220-3833 (Fax)
kclouse@cdklawyers.com
Jonathan LaMendola
COBB MARTINEZ WOODWARD PLLC
1700 Pacific Ave., Suite 3100
Dallas, Texas 75201
(214) 220-5299 (Fax)
jlamendola@cobbmartinez.com
Mark Bayer
GARDERE WYNNE SEWELL LLP
1601 Elm St., Suite 3000
Dallas, Texas 75201
(214) 999-4667 (Fax)
mbayer@gardere.com
The Honorable Martin Hoffman
68th District Court of Dallas County
600 Commerce Street
Dallas, Texas 75202
(214) 653-7569 (Fax)
/s/ Scott A. Brister
Scott A. Brister
44
AUS:646830.2
ACCEPTED
225EFJ016533669
FIFTH COURT OF APPEALS
DALLAS, TEXAS
11 October 7 P1:57
Lisa Matz
CLERK
Tab A
Independent Forensic Examiner Report
Case: 10259 — Cornerstone v Reliant
Cause Number: 11-04339
Examiner: Noel Kersh, ACE, EnCE
Pathway Forensics LLC
14405 Walters Road, Suite 630
Houston, Texas 77014
Ph: (713) 401-3380
www.pathwayforensics.com
Licensed Private Investigators, State of Texas (A-15251)
Table of Contents
Table of Contents .......................................................................................................................................... 2
Executive Summary....................................................................................................................................... 3
Approach and Sequencing of Independent Examination ............................................................................. 5
Counsel Interviews .................................................................................................................................... 6
Materials Received.................................................................................................................................... 7
Findings from Discovery Audit ...................................................................................................................... 8
Forensic Analysis Findings........................................................................................................................... 17
Defendant Forensic Analysis ................................................................................................................... 17
USB Analysis ............................................................................................................................................ 17
Recent Items (Windows Link Files) ......................................................................................................... 17
Recycle Bin Records ................................................................................................................................ 18
Webmail .................................................................................................................................................. 18
Internet History ....................................................................................................................................... 18
Shared USB Devices ................................................................................................................................ 19
Mike Brohm ................................................................................................................................................ 20
Brohm CCleaner and Dameware Activity on April 10 ............................................................................. 21
Chad Deardorff............................................................................................................................................ 25
Kenneth McGee .......................................................................................................................................... 27
Jerry Huggler ............................................................................................................................................... 28
Patrick Ryan ................................................................................................................................................ 29
Additional Discovery ................................................................................................................................... 30
Conclusion ................................................................................................................................................... 32
Exhibit 1 ...................................................................................................................................................... 35
Timeline of Key Discovery Dates ............................................................................................................. 35
Exhibit 2 ...................................................................................................................................................... 40
Evidence List............................................................................................................................................ 40
CV – Noel Kersh, ACE, EnCE ........................................................................................................................ 44
10259 – Cornerstone v Reliant
Page 2 of 44
Executive Summary
In September 2011, I was named as the Independent Forensic Examiner (“IFE”) in the Cornerstone v
Reliant matter. An Agreed Order outlined the scope of the engagement. I assembled a team of
forensics and eDiscovery professionals from the Pathway Forensics LLC staff (“Pathway”). The team’s
activities undertaken to fulfill the Agreed Order are outlined in this report.
This assignment had a long list of requests and a very short timeline. We interviewed the parties,
vendors and performed analysis on the evidence. Since time was very limited, we were unable to
address each and every request in the Order. Requests we were unable to address were added to the
Additional Discovery section of this report.
Pathway’s audit determined both sides had committed errors in their discovery efforts. Both sides did
not produce some evidence items. From artifacts examined on the evidence produced, Pathway found
evidence of the presence of Cornerstone proprietary information on the Defendants’ computers and
devices used by the Defendants. One specific device of particular interest is a Kingston brand thumb
drive which was connected to multiple Defendants’ computers at both Cornerstone and Reliant that was
not produced by any party for analysis. Both sides had some evidence that was not preserved in either a
timely manner or in a forensically sound manner.
A statement by Defendant Brohm’s counsel on his behalf is not supported by the forensic analysis we
conducted. Brohm’s counsel stated that Mike Brohm was not aware that Ryan Brohm, his son, was
remotely logged into his machine and running CCleaner the night of April 10, 2011. We found evidence
that indicates Brohm may not have been telling the truth about April 10. Brohm also was in the
possession of all four “community” USB devices that were passed around between the Defendants, but
only one of those four devices was produced for examination.
Defendant Brohm provided a download of his Bellsouth email account which was incomplete as our
forensic analysis uncovered a number of Reliant and Icon related emails that were not in his production.
The other Defendants didn’t produce much if any webmail. Pathway analyzed for webmail on each
machine and much webmail was found that was not produced by the Defendants.
Defendant Deardorff testified he removed all Reliant related email prior to his departure from
Cornerstone. Our forensic analysis found Reliant emails that were still in Deardorff’s Yahoo account
Page 3 of 44
after he left Cornerstone. Deardorff viewed these Reliant related Yahoo emails while on his Reliant
computer which contradicts his testimony. Deardorff attached an external hard drive to his Cornerstone
computer the night before his last day of employment. We found this same drive attached to his Reliant
computer and a folder named “Chad” which contained a high volume of Cornerstone data. The drive
containing this Cornerstone data was not produced for examination.
The Plaintiffs did not preserve cell phones used by the executives at Cornerstone. Instead, Cornerstone
IT wiped and reissued the cell phones to employees. Plaintiffs also reissued two computers used by the
Defendants to new employees. The data on these devices is still useful for a forensic examination but
many of the dates and times on the evidence have been altered. In the case of Patrick Ryan’s computer,
only the files in Ryan’s user profile were collected from the machine instead of collecting the entire
computer. This collection left out critical files that, for example, would allow an examiner to determine
if any USB devices were attached.
Email backups for both Plaintiff and Defendants were not preserved. Given the importance placed on
deleted email in this matter, this is a serious gap in the evidence preservation for this litigation.
Through interviews, Pathway became aware of a potential conflict of interest with SamTech which
provided IT services to both parties in this matter at the same time. SamTech did not notify either the
Plaintiffs or the Defendants that the company was providing IT services to both parties in this litigation
at the same time. In fact, SamTech instructed its employees to lie in the event this conflict of interest
was discovered. SamTech’s involvement with the evidence collection in this matter is a cause of
concern as to the reliability of the evidence they collected on behalf of the Plaintiffs.
Pathway discovered several discovery best practices that were not followed by both sides. The details
of our discoveries in this area will be detailed in this report. Pathway’s action recommendations, list of
additional discovery items and results of our forensic analysis are detailed in the report.
Page 4 of 44
Approach and Sequencing of Independent Examination
Shortly after the appointment as Independent Forensic Examiner on September 15, the following major
steps were laid out as our approach to gathering the types of information covered in the Agreed Order,
to be examined by Pathway:
•
Obtain all media images and other specific Initial Request items from all parties, as well as
written, signed statements from counsel responding to sets of tailored inquiries focusing on
awareness of the parties’ duty to preserve discoverable material, consultations with counsel and
actions taken to preserve and collect relevant material, digital media within clients’ possession,
and knowledge or participation in any attempts to delete or destroy evidence.
•
Conduct interviews with each party’s legal counsel as specified in Paragraphs 3 and 9 of the
Agreed Order, using the responses from the Initial Requests and the written statements of
counsel, as the framework for exploration of the completeness of discovery issues raised in the
Agreed Order.
•
Conduct interviews of Defendants’ and Plaintiff’s IT representatives, e-discovery vendors,
forensic consultants or experts, and any other technical personnel who participated in dealing
with the data and document discovery issues in this case.
•
Review key pleadings, motions, affidavits, depositions and related exhibits for comprehension of
issues and context of the discovery process and the events described in the Agreed Order.
•
Apply an extensive set of forensic processing, analysis and cross comparison steps against the
items of digital evidence provided by the parties, including USB, LNK, Recycle Bin records,
Webmail, Comprehensive Internet, Pre-fetch and Web Parser.
•
Prepare a report to the Court and parties summarizing our expert findings and conclusions.
Page 5 of 44
Following this outline as our game plan, the following steps have been completed to bring this report to
the Court:
Counsel Interviews
Plaintiff
Telephone interview with James Stanton of Andrews Kurth, LLP, counsel for Cornerstone Healthcare
Group Holdings.
Defendants
In-person interview with Florence Crisp of Edwards Wildman Palmer LLP, and Kevin Van Wart of Kirkland
& Ellis, counsel for Nautic Partners and Reliant Hospital Partners, LLC.
Telephone interview with Diane Sumoski of Carrington Coleman, counsel for Chad Deardorff.
Telephone interview with Jason Winford of Jenkins & Watkins, counsel for Michael Brohm.
Telephone interviews with Gregory Clift and Alyson Brown of Clouse Dunn LLP, counsel for Ken McGee,
Jerry Huggler and Patrick Ryan.
IT, E-discovery or Forensic Resources
Telephone interview with Adam Davis, IT Director for Cornerstone
Telephone interview with Phillip Jaubert, IT Director for Reliant Hospital Partners, LLC (with counsel on
the line)
Telephone interview with Plaintiff’s forensic consulting expert.
Telephone interview with Aaron Magley, former employee of Document Technologies, Inc. (DTI), and
now Integreon, forensic consultant and expert for Reliant /Nautic.
(In addition, received a written report from Florence Crisp on her interview with a representative of The
Message Center on their backup restoration time limits and ability to recapture deleted emails.)
Page 6 of 44
Forensic Processing and Analysis
Received, processed, analyzed and cross referenced over 50 items of digital evidence containing more
than 7.025 TB (7,025 GB) of data.
Materials Received
Initial Request responses and Written Statements from all counsel listed above.
DVD of organized selected pleadings from Andrews Kurth, counsel for Cornerstone.
FTP site access to full set of docket item pleadings from Greg Fowler of Jackson & Walker, local counsel
for Reliant / Nautic.
Deposition transcripts for Adam Davis, from Andrews Kurth, counsel for Cornerstone.
Deposition transcripts, exhibits and Affidavits of Aaron Magley from Jackson & Walker, local counsel for
Reliant / Nautic.
Deposition transcripts and exhibits of Ryan Patrick Brohm and Cliff Aycock of Samtech, from Florence
Crisp, counsel for Reliant / Nautic and James Stanton, counsel for Cornerstone.
Deposition transcripts and exhibits of Timothy Nalley and Anthony Merlino of DTI, from Florence Crisp,
counsel for Reliant / Nautic.
Page 7 of 44
Findings from Discovery Audit
A thorough examination of the discovery process was conducted on both sides of the case. Multiple
issues were discovered on both sides. Several issues occurring during the early phases of the discovery
process had a domino effect throughout the rest of the matter.
1. Evidence Preservation
Through interviews as well as our analysis, several pieces of evidence were identified as missing. These
are items that were not collected by the parties in this case but in our opinion should have been
collected.
•
Cornerstone failed to have the Defendants’ Cornerstone cell phones preserved. No forensic
examination of these devices was conducted. Instead, the devices were wiped by Cornerstone
IT and redeployed within the organization.
•
The Cornerstone computer used by Patrick Ryan was not forensically imaged. Ryan Patrick’s
user profile was the only folder collected. Data that was needed to determine USB device
connections; web history and webmail (to name a few) was not collected and therefore cannot
be analyzed.
•
Pathway conducted a thorough USB analysis on available evidence, which revealed that over 20
devices were not produced for examination and are unaccounted for at this time. Cornerstone
and Reliant IT departments indicated they do not have any policies restricting the use of these
devices internally and at the time the Defendants were employed with Cornerstone and Reliant.
2. Lack of training in proper preservation
Adam Davis with Cornerstone IT was the “first responder” when the executive team left Cornerstone for
Reliant. He was tasked with setting the executives laptops aside so that they could be imaged. Dan
Perkins of Cornerstone instructed Davis to disable the Defendants accounts, which he did. He was also
instructed to search the share drives in order to locate relevant documents. Cornerstone hired a
forensic expert to forensically image the devices but two of the laptops were reissued to new employees
before that happened. Davis has not been trained in how to handle digital evidence involved in
litigation. Best practices dictate collecting the machines and devices involved then placing them in a
secure location until they can be forensically imaged.
Page 8 of 44
Davis redeployed two Defendants’ computers almost immediately after their departure and before the
laptops could be forensically imaged. Once reassigned and put back in service, multiple types of files
were compromised on the evidence. Additionally the remaining four computers were not stored in a
secure location.
The Defendants also utilized untrained IT personnel to assist with early discovery. We interviewed Philip
Jaubert with Reliant IT to understand the steps he took to preserve the evidence in this case.
Jaubert terminated the accounts for the Defendants which locked them out of the Reliant network.
However, he did not disconnect the Defendants’ computers from the network which meant they could
be accessed remotely which could have resulted in evidence being manipulated or destroyed. While it
was impossible for the individual Defendants to access the machines, it was possible for anyone else
with access to the Reliant network having admin rights to access those machines. On April 14 when the
Defendants were put on leave, SamTech was doing work for Reliant and had access to the Reliant
network. This situation escalated the importance of the machines being disconnected from the network
as soon as possible.
Jaubert also did not place the physical machines into a restricted access area or container. These left
the machines unsecure which could have resulted in the physical devices being tampered with, stolen or
damaged. The machines should have been secured by being placed in a locked container such as locking
file cabinet or a secure area with limited access.
Pathway conducted analysis to determine if evidence for both the Defendant and Plaintiff may have
been accessed after the Defendants’ departure from Cornerstone and Reliant. Aside from the two
machines that were reissued, no other machines appeared to be accessed.
3. Missing Email Backups
In interviews with Reliant’s counsel, Phillip Jaubert (Reliant’s IT director) and from a report obtained
from the Message Center by Reliant’s counsel, it has been determined that no effort was made by
Reliant or its counsel to collect available email backups of custodians’ double deleted emails from the
Message Center.
The Message Center (now known as SAAS Host) is a vendor hired by Reliant, providing Microsoft
Exchange email server hosting services to corporate clients. The services include very tight – almost real
Page 9 of 44
time – synchronization between the Message Center’s servers and the Offline Storage files (OST) of
users’ computers. This synchronization occurs when a laptop or desktop computer is connected to the
customer’s network and Outlook is open on the individual computer.
Unless longer email archiving is contracted for (not included in Reliant’s contract), backup recoveries are
limited to approximately 14 days prior to when a recovery request is made. (From emails with the
Message Center provided by Reliant’s counsel, it is noted that there is a possibility of utilizing what
Message Center calls a 30-day round-robin backup, which may provide limited ability to recover items
deleted more than 14 but less than 30 days prior.)
When Reliant issued its litigation hold and began collection of custodians’ devices including emails, the
decision was made that, due to the tight synchronization feature between the Message Center servers
and the individual custodians’ OST files, that it was not necessary to obtain backups of the custodial PST
files on the Message Center servers because it was felt they would contain essentially identical material
to what was available on the OST files of the individuals’ machines. In the interview with Phillip Jaubert,
Reliant IT Director, it was confirmed that it was his advice to counsel not to order the Message Center
backups for this reason. One statement made by Jaubert would seem to indicate, though, that he also
made the decision not to order more PST material from the Message Center based in part on avoidance
of a very small additional charge which would have been made.
For forensic preservations, it is preferable to collect both the email stored on the custodian’s
workstation (OST file) as well as what resides (including deleted material) on the email server – in this
case, the email server of an external service provider. Even with tight synchronization, there are
scenarios that can occur which cause deleted material to be missed on one source but caught on the
other source. In retrospect, with allegations of deleted email in this litigation, it would have been more
prudent for Reliant to take quick action to capture every bit of custodial email material (deleted
included) which was still residing on the Message Center servers. After the passage of 14 and then 30
days following when the email deletion became an issue, the opportunity to recover anything that might
have been available in the Message Center’s backups was lost.
4. Litigation Hold Letter Issues
Typically in these types of cases we see Counsel issue litigation hold letters. Typically these letters
contain instructions to all relevant personnel to preserve data and email on the network, and locate and
Page 10 of 44
save paper documents. SamTech (Cornerstone) and the Message Center (Reliant) might also receive
letters in this scenario instructing them on the necessary steps to preserve email backups.
Pathway evaluated the litigation hold letters sent to their organizations and subcontractors.
The litigation hold letter sent by Reliant seemed to contain the necessary elements of a litigation hold
letter. However, no letter was sent to the Message Center asking them to set aside and preserve the
backup rotation of their email.
The litigation hold memo sent by the Interim CEO of Cornerstone lacked the following:
-
Not timely: The letter was sent almost 60 days after the litigation began.
-
The letter did not ask for any confirmation or feedback from the recipients, either that they
received it, or that they do or do not still have any potentially relevant material in their
possession.
-
Does not ask for the recipients to report what potentially relevant material they are aware of
that may have been destroyed or altered.
-
No follow up reminders sent after this memo.
-
There is no suspension of routine document deletion policies, and in fact, in the last paragraph,
the Interim CEO approves the deletion of emails more than one day old, because of the
company’s daily backups of email.
-
No hold letter was sent to SamTech, which managed their exchange server.
5. Failure to Preserve Cell Phones
Upon leaving Cornerstone, each Executive turned in a cell phone to Cornerstone IT. Instead of setting
the phones aside to be forensically imaged, the cell phones were wiped by Cornerstone IT and reissued.
The evidence on the phones could have contained relevant text messages, emails, call logs and contacts.
It is unclear whether Cornerstone knew at the time they reissued the cell phones that there was
anticipated litigation; if not then there may have been no requirement to preserve the cell phones.
Page 11 of 44
6. SamTech Conflict of Interest
During this review we became aware that Ryan Brohm, Mike Brohm, Cliff Aycock and Adam Davis
worked at Regency Hospital together. Ryan Brohm, Cliff Aycock and Adam Davis worked in the same
department. Cliff Aycock left Regency and started SamTech. Mike Brohm and Adam Davis went to
Cornerstone. Not long after hiring Ryan Brohm, SamTech started a contract with Cornerstone to provide
IT services. The relationships between these four individuals go back several years.
We explored a potential conflict of interest at SamTech. At the same time SamTech was assisting
Cornerstone with their response to the discovery requests in this matter, they were also providing IT
services to Reliant. During Ryan Brohm’s deposition on 9/27/2011, he said he was instructed by Cliff
Aycock (SamTech CEO) to lie to Cornerstone if asked about SamTech’s engagement with Reliant. It
seems to be an apparent conflict of interest for the Defendant’s son to be participating in the gathering
of evidence for the Plaintiffs and raises questions about the integrity of that collected evidence.
While providing services for Cornerstone, Adam Davis suggested that Ryan Patrick Brohm use an
alternate name so as to ease “political” pressures if a Cornerstone employee was to be uncomfortable
working with the CEO’s son. Ryan Brohm used the name Ryan Patrick. While working for Reliant, Ryan
Brohm continued to use the alternate name of Ryan Patrick. When asked about why he continued to
use an alternate name outside of Cornerstone, Brohm responded nobody told him to do anything
different.
Cornerstone’s new executive team was not aware that Mike Brohm’s son, Ryan, worked for SamTech.
The alternate name of Ryan Patrick made connecting Ryan Brohm to his father Mike Brohm difficult.
However, Adam Davis was aware of Ryan Brohm’s true identity and his relationship to one of the
Defendants.
Adam Davis, Cornerstone’s IT Director was aware of Ryan Brohm’s conflict and he
suspected SamTech was doing work for Reliant. Cornerstone’s counsel stated to us that he was not
aware of Ryan Brohm’s conflict until Aaron Magley’s deposition in August 2011. In addition, Ryan
Brohm testified in his deposition that his father didn’t know he was running CCleaner on April 10 1.
Despite Davis’ awareness of the issues related to having the son of one of the Defendants performing
work for Cornerstone during this litigation, he said nothing to management.
1
Ryan Brohm Deposition 183:15 – 184:7
Page 12 of 44
SamTech had total access to Cornerstone computers, servers, network and email. There are limited
tools available to track SamTech’s activity on the Cornerstone network. (It has been discovered, for
example, that Cornerstone never activated the logging feature for their Virtual Private Network (VPN)
network system, which would have reflected SamTech’s remote activity from its offices in Atlanta.)
SamTech assisted Cornerstone with its discovery requests including pulling email from the servers for
the Defendants. While we acknowledge there may well be no wrongdoing here, it raises concern about
SamTech’s role in discovery. SamTech’s intentional actions to hide its relationship with Reliant are
troublesome.
7. Forensic Experts
Interviews were conducted with the forensic examiners for both sides to understand the work they
performed, their findings as well as the instructions they were given. The interviews with the forensic
examiners provided clarity as to the issues experienced in this case.
The Plaintiff hired a Texas e-discovery company to do its forensic collections of the six Defendants’
laptops and server data. However, two of the devices to be preserved were reissued to new users. This
meant the evidence being analyzed on that evidence was missing accurate date information. This also
made it difficult to attribute actions on the computer to a Defendant or to the person who was
reassigned the computer.
The Plaintiff’s forensic expert did not perform a thorough investigation on the evidence largely due to
time constraints. Had a full investigation been conducted, the expert would have discovered a number
of unaccounted for USB devices which could have been requested and collected early in the
investigation. Webmail analysis would have revealed a number emails of the Defendants’ regarding
their intended departure from Cornerstone. The expert could have suggested an imaging of the email
backups on the SamTech servers which was time sensitive
The Plaintiffs also did not instruct their experts to image the Defendant’s mobile phones. Artifacts from
the phones could include call logs, text messages and in the case of some smart phone devices, email.
Instead, Cornerstone IT reissued the phones to new employees before imaging could be done.
The Defendants’ expert was provided with too narrow a scope from which to work. He was asked to
look for deleted files and email. His investigation revealed several files that were missing. Overlooked
Page 13 of 44
by this limited investigation, however, was webmail activity, USB devices that were attached containing
Cornerstone data and the presence of Cornerstone data on Reliant servers.
The Defendant’s expert did not produce a list of USB devices connected to the Defendants’ machines.
Had this list been generated and provided to counsel, a complete response to the discovery request to
produce all USB devices could have been made.
The Defendants’ expert could have suggested the email backups be collected. The failure to make this
timely request resulted in missing critical email backups which would have included deleted messages.
Finally, all webmail was not collected. Only Brohm’s webmail email account was downloaded. Our
analysis found it to be incomplete. The other defendants did not produce their webmail.
8. Cornerstone Internal Investigation Recommendation
During our investigation, we became very concerned about the relationship between SamTech and
Adam Davis. This is due in part to Davis’ failure to raise the issue of SamTech’s conflict of interest
regarding their work with Reliant while working for Cornerstone. It was not clear if Davis knew for sure
SamTech was working with Reliant, but it was clear that he suspected they were. In any event, this issue
should have been raised to the new executive team at Cornerstone. From Ryan Brohm’s deposition on
September 27, we learned that Davis was interested in leaving Cornerstone to work for Reliant 2. Also, it
was Davis who requested Ryan Brohm use a different name.
We recommend an internal investigation into the communications between SamTech employees and
Adam Davis regarding the data collection done for the litigation specifically as well as their
communication about SamTech’s contract to perform work for Reliant. We recommend this due to
several concerns including:
2
-
SamTech’s efforts to mislead Cornerstone about their work with Reliant.
-
Fact that Ryan Brohm’s father is a Defendant.
-
Mike Brohm, Ryan Brohm, Cliff Aycock and Adam Davis relationship.
-
Davis’ desire to leave Cornerstone for Reliant.
-
Davis’ failure to report his suspicions of SamTech’s work with Reliant.
Ryan Brohm Deposition 83:18 – 84:4
Page 14 of 44
We also believe part of this investigation should include an analysis of SamTech’s activity on
Cornerstone’s network. However as previously described this will not be possible since the logging was
not activated.
SamTech was involved with Cornerstone’s data collection as part of this litigation. SamTech had access
to Cornerstone machines, servers and their entire network. This investigation will seek to ensure that
data collected for this litigation was not undermined by SamTech.
9. Plaintiff’s Request for Personal Email Subpoena
In depositions, the Plaintiff asked some of the Defendants if they would allow a subpoena to be sent to
their personal email provider in order to collect all webmail. The Defendants gave their approval to
send the subpoena. However, the Plaintiff has chosen not to pursue issuance of such subpoenas for
personal email accounts, since the retention period for such material by personal email vendors had
expired.
10. PI License Issues
Once it became evident that allegations of intellectual property theft, as well as possible spoliation of
evidence, would become central issues in this litigation, it is notable that neither Reliant nor
Cornerstone launched any significant forensic analysis in search of additional relevant material within
their respective possession, custody or control.
Reliant did instruct its vendor, DTI, to perform forensic collections of custodial devices.
DTI
subcontracted the work to Protegga who performed the actual collections in Texas. The images
harvested by Protegga have been the forensic focus of much of Pathway’s examination under the
Agreed Order. However, with the limited exceptions of expanding the e-discovery processing and review
hosting of custodial material by DTI to include a partial forensic analysis by Aaron Magley of the specific
McQuistion and Crouch deletion incidents, and examination of the CCleaner issue, Reliant did little more
to obtain the type of in-depth forensic evaluation and analysis of their collected device images which
Pathway has performed since appointment by the Court.
Texas Occupations Code Chapter 1702 requires computer forensics companies in Texas to be licensed
Private Investigation companies and the individuals to be licensed private investigators.
Page 15 of 44
The Defendants’ expert who is located in Atlanta is not a licensed Texas private investigation company;
however they did contract one to perform the collection of the evidence in an attempt to comply with
the law. However, most interpretations of the law require that the presentation of computer evidence
in court requires a license. I cannot opine as whether DTI’s testimony in this case is a violation of this
statute but it warrants examination.
The Plaintiff’s expert was a licensed investigation company and the individual is licensed as well.
However, the company’s license expired in July 2011 and has not been re-instated as of the date of this
report.
11. Recovery of Cornerstone Data
Analysis has established that external USB devices containing Cornerstone data have been connected to
Reliant owned machines. Additionally Cornerstone data has been found on the Reliant computers as
well as the Reliant share drives. In order to come into compliance with the order to return Cornerstone
data, Reliant should take steps to ensure that all Cornerstone data is appropriately and permanently
removed from their systems including email. Reliant should provide Cornerstone with proof that their
data has been removed from their systems.
Page 16 of 44
Forensic Analysis Findings
Defendant Forensic Analysis
Analysis was conducted on each Defendant’s evidence to answer the questions asked of Pathway.
Analysis was conducted on the web artifacts, webmail, USB drive activity, CCleaner activity, remote
connection activity and work to recover deleted files and emails.
For brevity, some of the technical concepts will be introduced, the details of which will be addressed for
each defendant.
USB Analysis
USB devices attached to a computer leave a number of artifacts that can be detected. Some of these
artifacts analyzed for this report include the following:
•
Windows Plug and Play log (setupapi.log) records the date a device is first detected and installed
by Windows.
•
Windows Registry (HKLM\CurrentControlSet\Enum\USBSTOR) enumerates USB devices that
have been installed and includes make, model, and serial number. Information persists even
after devices are no longer connected.
It is important to note that not all USB devices have a serial number. When Windows encounters a
device without a serial number, it will generate a number in its place.
Recent Items (Windows Link Files)
Windows link files, sometimes called shortcuts, are files that point to a file, such as a program or
document, in another location. Windows automatically creates link files for many types of recently
accessed items to make these items conveniently accessible from the Start Menu. These files are not
deleted when the target item is deleted, and it is often possible to recover link files that have been
deleted or purged. Link files contain information such as the Volume Name of the drive the file is
stored, the date stamps of the target file at the time the link file was created, along with several other
details.
Page 17 of 44
Recycle Bin Records
When a file is deleted on a Windows operating system, Windows will place that item into the Recycle
Bin by default (although it is possible to change this default or otherwise bypass the Recycle Bin). When
a file is placed in the Recycle Bin, a record is created that records the date of deletion and the original
path of the file. These records can sometimes be recovered even if the Recycle Bin has been emptied.
Webmail
Internet browsers typically store local copies of web pages viewed, including webmail. These local
copies can often be recovered after the item has been purged from the internet browser cache. By
recovering these files, we are able to retrieve the contents of the Webmail.
Internet History
Internet browsers generally keep some record of websites visited. These records generally include the
website visited and the date. These records can often be recovered after they have been purged from
the history file. The URL (Universal Resource Locator, such as http://www.pathwayforensics.com), may
often yield useful information, such as search queries, usernames, or file names.
Page 18 of 44
Shared USB Devices
We discovered that several USB devices were being shared by the Defendants. In some cases, we see a
USB device being passed between two or more defendants while working at Cornerstone then the
device is attached to one of the Defendant’s Reliant machine. Only one of the four shared USB devices
being passed between the Defendants have been produced.
In addition, we discovered one device that was attached to Huggler’s Cornerstone machine and then
attached to his Reliant machine. This device also has not been produced.
The following table shows the Shared Devices as well as the Huggler device:
Page 19 of 44
Mike Brohm
The forensic image of Michael Brohm’s Cornerstone computer was processed for web activity. Starting
from mid December 2010 we see a dramatic increase of downloaded Reliant documents from his Yahoo
account to his Cornerstone machine. In addition, the Plaintiff has raised the issue about projects,
specifically ICON Hospitals, which Brohm was working on while at Cornerstone but not on behalf of
Cornerstone. Reviewing Michael Brohm’s web history has shown two separate occasions in which an
“Icon Hospital Acquisition Model.xlsx” spreadsheet was downloaded from his personal Yahoo account to
his Cornerstone machine.
The table below shows the dates the ICON files were downloaded to Brohm’s computer.
Several files appear to have been opened from Michael Brohm’s private share drive at Reliant. These
files appear in the LNK file report generated from the first imaging of his Reliant computer. A folder
named “Scans” has files that reside inside it and were opened on 4/6/2011. When the share drive was
forensically imaged on 4/11/2011, the “Scans” folder was empty. A spreadsheet labeled “Icon Hospital
Acquisition Model.xlsx” was also opened on 4/4/2011, this file is also no longer present when Michael
Brohm’s private network share is imaged.
The table below shows a file listing of the files previously accessed on Michael Brohm’s private share
drive that were not present at time his share drive was collected.
A Hitachi external hard drive device was connected to both Brohm’s Cornerstone and Reliant
computers. Link file artifacts found on his Reliant computer indicated that he accessed files on the
Page 20 of 44
Hitachi drive. Many of the files accessed on the Hitachi appear to be work product data from
Cornerstone Healthcare Group.
The table below shows the files that were accessed on Brohm’s Reliant laptop on the Hitachi external
hard drive.
Brohm CCleaner and Dameware Activity on April 10
On April 10, 2011 at approximately 22:00, Mike Brohm signed a visitor log to enter the Reliant building
after hours on a Sunday night.
Page 21 of 44
On Brohm’s Reliant computer, a user remote connected using Dameware on April 10 at 22:10. The User
ID remote connecting was “Ryan Brohm”.
At 22:14, a person sitting at Brohm’s computer attached a Kingston USB thumb drive (S/N:
5B741D00293F) to the machine. This is the same device that was attached to McQuistion and Brohm’s
computers at Cornerstone. On this Kingston drive is a folder named “Cornerstone files”.
At 22:16, CCleaner is downloaded from FileHippo.com.
At 22:17, CCleaner is setup then run on Brohm’s computer.
At 22:22, the Windows event logs are deleted.
At 22:22, “Ryan Brohm” remote session ends.
Approximately 22:30, Mike Brohm signs out on the Reliant building visitor log.
This series of events concerned us so analysis was conducted to determine if the Kingston drive may
have been wiped during this remote session. During Ryan Brohm’s September 27 3 deposition, he
testified that the only situation he would use CCleaner to wipe data, is if he was running CCleaner on a
computer with multiple hard drives.
3
Ryan Brohm Deposition 63:8 - 12
Page 22 of 44
We were able to confirm that the Kingston device was not completely wiped during this remote session
by Ryan Brohm. The day after this session, (April 11), the same Kingston device was connected to
Patrick Ryan’s computer. If the device was wiped on April 10, the volume name on the drive would have
been different than the volume name seen on Patrick Ryan’s machine on 4/11. The volume names
matched which means it was not wiped during the remote session on 4/10.
There is still some question as to what CCleaner was used to do during the remote session on 4/10. An
inspection of the Kingston thumb drive is necessary to determine what happened.
At 22:22, we see the Windows Event logs on the machine were deleted right before the Ryan Brohm
remote session ended.
Brohm had his Yahoo email forensically collected and produced. We analyzed the Yahoo production
against the webmail artifacts discovered during our webmail analysis. We discovered several emails
were missing from the collection that appears to be responsive email.
Page 23 of 44
The missing Yahoo emails are in the exhibit below:
Page 24 of 44
Chad Deardorff
Pathway’s examination of Deardorff’s evidence revealed he attached a Western Digital Passport drive
(S/N: 575843593037353834373338) to his Cornerstone computer on 3/24/2011 at 7:47 PM, the night
before he resigned from Cornerstone. We then see the same device attached to his Reliant computer
on his second date of employment with Reliant on 3/29/2011. Analysis of the LNK files on Deardorff’s
Reliant computer shows a folder named “Chad” was on the external drive. This folder contained a high
number of what appear to be Cornerstone data files. The files in this “Chad” directory were accessed on
his Reliant computer.
This drive appears to have been used on his Reliant computer until April 14,
2011.
Pathway did not receive this external hard drive or an image of this external hard drive. We strongly
recommend that this drive be produced for examination.
It was stated in the interview with Deardorff’s counsel that before he left Cornerstone, he removed all
Reliant related email from his personal email. This was also stated in his deposition 4. The forensic
evidence would suggest otherwise. Using Deardorff’s Reliant computer, Yahoo webmail was viewed on
the machine including one email with the subject “FW:Reliant – YTD results” sent 3/22/11 from Michael
Brohm. Deardorff’s last day at Cornerstone was 3/25 and his first day at Reliant was 3/28. This means
not all Reliant emails were removed from his Yahoo email.
Deardorff’s counsel told Pathway during our interview that Deardorff responded to the discovery
request in this litigation by doing a self collection of Reliant related emails. The search terms he
indicated he used to search his email for responsive email included: Reliant, Cornerstone, Brohm,
McGee, Ryan and Huggler. Despite using “Reliant” as a keyword to search his personal email, the email
sent on 3/22 with the subject “FW:Reliant – YTD results” was not produced.
An email with the subject “Letter” includes Brohm, Deardorff and Huggler as recipients. This email was
first sent to Deardorff on 4/2/11. This too should have been produced using the search terms Deardorff
claimed he used, but the email was not produced.
An email with the subject “FW: Icon Hospital Proforma”, sent 3/27 from Michael Brohm. This is another
example of an email that should have been produced but was not.
4
Deardoff Deposition 8:13 - 25
Page 25 of 44
In addition to these examples, the following webmail was found on Deardorff’s Yahoo webmail. No
emails were produced by Deardorff in response to the discovery request sent by the Plaintiffs.
Page 26 of 44
Kenneth McGee
Ken McGee’s last day at Cornerstone was March 23rd. Cornerstone reassigned his laptop to be used by
Jay Quintana on March 24th.
Analysis was conducted on McGee’s web history. We discovered several Reliant related files were
downloaded from his personal Yahoo account to his Cornerstone computer. The earliest Reliant
download occurred on 1/11/2011.
The table below contains the files downloaded to McGee’s Cornerstone computer.
Analysis of USB evidence on McGee’s Reliant computer showed a file named “CORNERSTONE STUDY.xls”
accessed on 4/6. This device was not produced for examination.
We found Dameware activity similar to the evidence we saw on Brohm’s Reliant machine. Ryan Brohm
remotely connected to McGee’s computer on 4/8 at 17:41. He setup and ran CCleaner on the machine.
After it was complete, he uninstalled CCleaner. We also see the Windows event logs were deleted just
before disconnecting. We saw the same process he followed on Brohm’s computer on McGee’s .
Page 27 of 44
Jerry Huggler
Link files analyzed on Huggler’s Reliant machine showed Cornerstone files were accessed. The files were
found to be accessed from two different types of media. The first was a USB device which has not been
produced for examination. It was accessed on 4/6/2011.
The table below shows the USB device activity on Huggler’s Reliant computer where Cornerstone data
was accessed.
Analysis also showed Cornerstone files were accessed on Huggler’s private share at Reliant. Also
revealed was a folder on Huggler’s share drive labeled “Scans”. This folder contained at least 4 PDF files.
The table below shows the Cornerstone files on Huggler’s private network share.
When the share drive was imaged on 4/11/2011, these files are not present. Sometime between
4/7/2011 8:59 and 4/11/2011, the files are removed from Huggler’s Private network share.
Link files found on the second imaging of Huggler’s Computer show that on 4/13/2011 13:24 the
spreadsheet “Cornerstone Reimbursement.xlsx” was accessed from Huggler’s Reliant computer once
more.
Page 28 of 44
Patrick Ryan
Patrick Ryan’s computer was repurposed for another Cornerstone employee before it could be
forensically imaged. Cornerstone did create a logical Image of Patrick Ryan’s user profile. However this
did not include any system files which is where most analysis is performed. Therefore, most processing
could not be completed for Patrick Ryan’s computer.
Patrick Ryan began employment with Reliant on 3/24/11. On 3/25/11, a SanDisk Cruzer is attached to a
laptop that has been used by both Michael Brohm and Patrick Ryan. Unfortunately due to the
incomplete collection on Patrick Ryan’s Cornerstone PC we are unable to verify if this device had been
previously attached to his Cornerstone PC.
Two devices that have shown up on previous Cornerstone and Reliant Defendant computers are
attached to Ryan’s Reliant computer on the evening of 4/11/11. The computers were imaged for the
first time on 4/11/11.
The table below shows when the devices in question were connected to the Reliant machine.
Page 29 of 44
Additional Discovery
Pathway believes additional discovery is required be able to answer some of the lingering questions in
this matter. The following additional discovery items are recommended.
1. Produce and analyze missing USB devices
Forensic analysis conducted by the IFE showed a number of USB devices that were not produced for
inspection. Also revealed were a large number of files accessed on USB devices, including Cornerstone
data. Each device attached to a Defendant’s computer should be produced and examined. The
examination of the device should include the following analysis:
a. Forensically image the drive
b. Carve the drive for deleted files
c. Run recovered folders (EnCase)
d. Examine Unallocated Clusters for evidence of wiping
e. Examine file metadata
f.
Conduct keyword search for Cornerstone data
g. Create a file listing of all the files on the drive
h. Create a file listing of all deleted, not overwritten files
2. Analyze shadow copies and restore points for USB activity
It is possible to determine multiple connections of a USB drive to a piece of evidence by analyzing the
Windows shadow copies and restore points on the device. Conduct analysis on each Defendant
machine to determine when each device was first plugged in, last plugged in and each time between the
first and last by analyzing the System registry hives and the setupapi.log files in the shadow copies and
restore points.
3. Forensically Image Patrick Ryan Cornerstone Laptop
Create a full forensic image of the entire hard drive, instead of the imaged Windows profile for Patrick
Ryan. Verify that the Patrick Ryan user profile is still present on the computer. Conduct USB analysis on
the machine. Generate a list of USB devices attached to the machine and compare to the list of USB
devices attached to Patrick Ryan’s Reliant computer. Analyze LNK files on the machine for files accessed
on external hard drives. Conduct detailed Webmail analysis. Run Recycle Bin analysis to look for
deleted files. Carve the computer for deleted documents.
Page 30 of 44
4. Perform Yahoo Email Collections
Forensically gather personal email accounts for each Defendant. Once downloaded, search email for
responsive emails and produce.
5. Perform very low level forensic analysis across all images
Due to the time constraints imposed through the Order, low level forensic analysis could not be
conducted on all images. Doing this could lead to additional relevant findings.
6. Run additional analysis on cell phone images
Run deep level analysis tools including file recovery tools on the cell phone images. Look for deleted
text messages on the images.
7. Carve for Deleted Files
Files and emails deleted on the Defendants machines may be recoverable through the use of file
carving.
8. Recover Deleted Email from the Exchange Database
Attempting to recover email not already produced from the Exchange database.
Page 31 of 44
Conclusion
While we were not able to address all requests in the time allotted, we have drawn the following
conclusions based on the work we have performed to date:
-
The Defendants removed Cornerstone data upon their departure from Cornerstone and took it
with them to Reliant.
-
The Cornerstone data was copied to the Reliant network.
-
Cornerstone data was copied using several thumb drives and external hard drives.
-
The Defendants failed to produce several thumb drives shown to contain Cornerstone data.
-
The New Reliant business opportunity was discussed as early as November 2010.
-
The Defendants sent many emails to each other regarding Reliant using their personal email.
-
The Defendants used their Cornerstone issued computers to work on the Reliant opportunity.
-
The Defendants did not produce all of their personal email regarding Reliant.
-
The Defendants uploaded Cornerstone data to their personal email accounts.
-
The Defendants downloaded Reliant related files to their Cornerstone assigned computers.
-
Potentially responsive data was being deleted after the commencement of the litigation.
-
Forensic analysis identified evidence that seemed to conflict with previous testimony by several
parties.
-
Plaintiff did not preserve all sources of evidence related to the matter.
-
SamTech’s employment and utilization of a person with conflicted interests in this matter may
have undermined the integrity of the preservation efforts of both parties.
We have made recommendations including:
-
Cornerstone internal investigation into Adam Davis and SamTech activities.
-
Reliant take steps to remove Cornerstone data from their network including servers and
computers attached to their network.
-
Reliant provide to Cornerstone proof that their data has been removed from their network.
-
Recommend additional discovery outlined in the Additional Discovery section of this report.
Page 32 of 44
Examiner:
Noel Kersh
Signature:
__________________________________
Page 33 of 44
Exhibits
Page 34 of 44
Exhibit 1
Timeline of Key Discovery Dates
Page 35 of 44
Timeline of Key Discovery Dates
Date
November 3, 2010
November 21,
2010
March 17, 2011
March 20, 2011
March 23, 2011
March 28, 2011
April 2, 2011
April 6, 2011
April 7, 2011
April 8, 2011
April 10, 2011
April 11, 2011
April 11, 2011
Case Event
Brohm first contacts Nautic about rehabilitation hospital company opportunity
(Old Reliant)
Brohm has conference call with Nautic and Nautic’s counsel to discuss
Nautic/Reliant Deal; potential legal risks of mass exodus of Executives is discussed.
Following this conference, Brohm generally stops using his Cornerstone e-mail
account, and mostly uses his personal Bellsouth email account to communicate
about the deal. Brohm also obtains personal email addresses for other Executives
to communicate about the deal.
Execs and Nautic anticipate closing of Reliant asset purchase next day, March 18,
and finalizing related employment and personal investment documents.
Executives sending and moving multiple documents in anticipation, including
Cornerstone docs.
Brohm sends himself email titled “Cornerstone Mission, Vision, Values”
Reliant transaction closes; Brohm, McGee, and Ryan leave Cornerstone and begin
working for New Reliant
New Reliant purchased Old Reliant n/k/a Addison Resolution on March 23, 2011.
New Reliant was created and funded by Nautic Partners, LLC.
Jerry Huggler and Chad Deardorff hired by New Reliant (hereafter, Brohm, McGee,
Ryan, Huggler and Deardorff referred to as the “Executives”)
Cornerstone first becomes aware that Executives have gone to work for New
Reliant, which it considers to be a competitor, and learns that customers of
Cornerstone are being contacted by Executives.
First demand letter from Cornerstone (Andrews & Kurth, counsel) received
(demand letters sent to Executives)
Cornerstone files petition in Texas State District Court in Dallas, naming Executives,
New Reliant and Nautic as Defendants
First TRO prohibiting use or disclosure of Cornerstone information entered; Court
orders expedited discovery; Cornerstone serves requests for production on New
Reliant at approximately 11 p.m.; Nautic hold notice sent.
New Reliant hold notice sent; DTI engaged; Crisp has teleconference with Jaubert
(IT) of New Reliant regarding preservation and collection; C-cleaner installed and
run on McGee’s computer, apparently by Ryan Patrick Brohm of SAMTech via
remote access.
C-cleaner installed and run on Mike Brohm’s computer, apparently by Ryan Patrick
Brohm of SAMTech via remote access.
Forensic harvesting begins at New Reliant. Protegga conducts forensic harvest of
computers, Blackberries/Smartphones, and network shares of Executives, plus
Crouch and Moore (former Old Reliant managers.) Collection takes place over
April 11-13, 2011. Oliver Group harvests Nautic’s files in Providence
Deposition of Brohm
Page 36 of 44
Date
Case Event
April 11, 2011
Deposition of Deardorff
April 11, 2011
Deposition of Huggler
April 11, 2011
Deposition of Ryan
April 12, 2011
Deposition of Price
April 12, 2011
Deposition of Smith
April 14, 2011
Executives, plus Marie McCuistion placed on administrative leave with pay; their
access to Reliant computers and premises is blocked
Sometime between April 15 and 18, Crouch has a telephone call with Cliff Aycock
of SAMTech and directs him to hold off doing any additional evaluations of New
Reliant IT for the time being
Crouch informs New Reliant counsel he deleted emails on April 8. New Reliant
counsel takes steps to have deleted emails restored.
New Reliant counsel informed by DTI that all of Crouch’s deleted emails were
recovered
Crouch emailed SAMTech CEO, Cliff Aycock, to inform him that New Reliant no
longer needed any of SAMTech’s services
New Reliant counsel asks DTI to recover any deleted files or emails from Reliant
computers of Executives
Marie McCuistion’s computer is imaged by Protegga.
Aaron Magley (then with DTI) detects presence of C-cleaner on Brohm and McGee
images, and includes entries in his examiner’s notes. New Reliant’s counsel is not
informed of this.
New Reliant informs counsel for Cornerstone that it located calendar entries and
associated attachments that appeared to be created at Cornerstone in Chad
Deardorff’s Reliant files
Second TRO entered; requires (among other things) return of Cornerstone
information by May 2, 2011; Court directed parties to meet to work out protocol
for return of electronic information.
Forensic image of Ellen Lytle’s computer taken.
New Reliant returns hard copy documents that appeared to be from Cornerstone
and asks counsel for Plaintiff to confer regarding return of electronic information.
McCuistion’s counsel informs New Reliant’s counsel regarding her thumb drive;
thumb drive is located and imaged.
DTI recovered deleted files from McCuistion’s thumb drive.
Additional thumb drive located at New Reliant (in McGee’s office); thumb drive is
imaged.
New Reliant informs Cornerstone’s counsel that Marie McCuistion copied a “Mike
Brohm” folder from Cornerstone to a thumb drive, transferred the folder to her
New Reliant computer and then deleted the folder, all at Mike Brohm’s direction
April 15, 2011
(circa)
April 20, 2011
April 21, 2011
April 21, 2011
April 23, 2011
April 26, 2011
April 26, 2011
April 27, 2011
April 28, 2011
April 29, 2011
May 2, 2011
May 12, 2011
May 14, 2011
May 16, 2011
May 17, 2011
Page 37 of 44
Date
Case Event
May 17, 2011
Deposition of Daugherty (Nautic)
May 18, 2011
Deposition of McCuistion
May 18, 2011
Deposition of McGee
May 19, 2011
Deposition of Campbell
May 19, 2011
13 attempted VPN log-ins into Reliant network from SAMTech IP address
May 19, 2011
New Reliant counsel requests information regarding contents of “Mike Brohm”
folder on Cornerstone computers to aid in determining whether files by
McCuistion have been recovered
May 20, 2011
Deposition of Callan
May 20, 2011
Deposition of Crouch
May 20, 2011
Deposition of Deardorff
May 20, 2011
Deposition of Huggler
May 20, 2011
Deposition of Noe
May 20, 2011
Deposition of Ryan
May 23, 2011
Deposition of Beakey
May 23, 2011
Deposition of Moore
May 24, 2011
Deposition of Boguslawski
May 24, 2011
Deposition of Davis
May 24, 2011
Cornerstone files emergency spoliation motion; only conduct of New Reliant
employees at issue in spoliation motion is deletions by McCuistion and Crouch.
May 25, 2011
Deposition of Corey
May 26, 2011
Deposition of Hilinski
May 27, 2011
Deposition of Smith
Page 38 of 44
Date
May 31, 2011
June, 2011
Case Event
Defendants file responses to emergency spoliation motion. New Reliant submits
affidavit of Aaron Magley describing his efforts to recover deleted files of Marie
McCuistion and Chester Crouch.
On several non-consecutive days between June 7 and July 1, the Court held an
evidentiary hearing on Cornerstone’s Motion for a Temporary Injunction
June 2, 2011
Deposition of Brohm
June 3, 2011
Hearing on Spoliation Motion (ruling deferred)
June 10, 2011
Hard drives of Brohm, McGee, Ryan, Huggler, and Deardorff reimaged to capture
any data since date of original image.
Temporary Injunction entered by the Court.
Hard drives removed from computers used by Brohm, McGee, Ryan, Huggler, and
Deardorff and maintained by Protegga.
Aaron Magley informs Crisp that C-cleaner was used on McGee and Brohm’s
computers
Deposition of Magley. Magley testified regarding use of C-cleaner on McGee and
Brohm computers.
Deposition of Nixon (corporate rep for New reliant); Magley’s notes reflecting that
he detected C-cleaner on the computers of Brohm and McGee in April produced to
Plaintiff.
July 1, 2011
July 12, 2011
August 15, 2011
August 25, 2011
August 26, 2011
August 31, 2011
Deposition of Magley
September 2, 2011
Hearing in which Court directs parties to finalize agreed order for appointment of
independent forensic examiner; sets date for show cause hearing; and issues other
rulings.
September 13,
2011
Highland Capital Management is a private equity management firm whose funds
own a majority of Cornerstone. Highland was only recently added to this lawsuit as
a third-party defendant
September 15,
2011
Noel Kersh of Pathway Forensics LLC appointed by Court as Independent Forensic
Examiner, to evaluate compliance by Executives and New Reliant, with discovery
requests propounded by Cornerstone
Page 39 of 44
Exhibit 2
Evidence List
Page 40 of 44
Evidence
Pathway
Evidence #
E001
E002
E003
Custodian
Description
N/A
Sharon Noe
Ken Mcgee
DVD of Docket Material
laptop files
laptop
Cornerstone Exchange
PSTs
laptop
laptop
laptop
File Shares
laptop files/logical file
backup
Acquisition
Date
Company
Other Evidence #
4/28/2011
3/28/2011
Cornerstone
Cornerstone
Cornerstone
048804-020010
048804-020004
3/29/2011
Cornerstone
048804-020008
3/28/2011
3/28/2011
3/28/2011
3/28/2011
Cornerstone
Cornerstone
Cornerstone
Cornerstone
048804-020001
048804-020002
048804-020005
048804-020006
3/28/2011
Cornerstone
048804-020007
048804-020003
E004
Multiple
E005
E006
E007
E008
Michael Brohm
Jerry Huggler
Marie McCuistion
Multiple
E009
Patrick Ryan
E010
Chad Deardorff
laptop
3/28/2011
Cornerstone
E011
Michael Brohm
computer
4/11/2011
Reliant
E012
Chad Deardorff
computer
4/11/2011
Reliant
E013
Jerry Huggler
computer
4/11/2011
Reliant
E014
Chester Crouch
computer
4/11/2011
Reliant
E015
Kenneth McGee
computer
4/11/2011
Reliant
E016
Patrick Ryan &
Michael Brohm
computer
4/11/2011
Reliant
E017
Patrick Ryan
computer
4/11/2011
Reliant
E019
Michael Brohm
Cell Phone
4/11/2011
Reliant
E020
Michael Brohm
Computer
6/10/2011
Reliant
E021
Chad Deardorff
Laptop
6/10/2011
Reliant
E022
Jerry Huggler
Laptop
6/10/2011
Reliant
E023
Ken Mcgee
Laptop
6/10/2011
Reliant
E024
Patrick Ryan
Laptop
6/10/2011
Reliant
RHP-MBrohmPCL-04
RHP-CDeardorffPCL-02
RHP-JHugglerPCL-01
RHP-CCrouchPCL-09
RHP-KMcGeePCL-03
RHP-PRyan-PCL19
RHP-JD3YRH1PCL-20
RHP-MBrohmSPH-23
RHP-MBrohmPCL-41
RHP-CDeardorffPCL-39
RHP-JHugglerPCL-40
RHP-KMcGeePCL-38
RHP-PRyan-PCL42
Page 41 of 44
RHP-KMcGeeSPH-22
RHP-MBrohmOTH-11
RHP-KMcGeeOTH-13
RHP-JHugglerOTH-14
RHP-CDeardorffSPH-10
RHP-CDeardorffOTH-15
RHP-PRyan-SPH21
RHP-PRyan-OTH12
RHP-CcrouchOTH-16
RHP-CcrouchSPH-07
RHP-EmooreOTH-17
RHP-Emoore-PCL08
RHP-EmooreSPH-05
E025
Kenneth Mcgee
Cell Phone
4/11/2011
Reliant
E026
Michael Brohm
Reliant Network Share
4/11/2011
Reliant
E027
Kenneth Mcgee
Network Share
4/11/2011
Reliant
E028
Jerry Huggler
Network
4/11/2011
Reliant
E029
Chad Deardorff
Cell Phone
4/11/2011
Reliant
E030
Chad Deardorff
Network Share
4/11/2011
Reliant
E031
Patrick Ryan
Cell Phone
4/11/2011
Reliant
E032
Patrick Ryan
Network Share
4/11/2011
Reliant
E033
Chester Crouch
Network
4/11/2011
Reliant
E034
Chester Crouch
Cell Phone
4/11/2011
Reliant
E035
Emmett Moore
Network
4/11/2011
Reliant
E036
Emmett Moore
Computer
4/11/2011
Reliant
E037
Emmett Moore
Cell Phone
4/11/2011
Reliant
E038
Ellen Lytle
PST
4/26/2011
Reliant
RHP-Elytle-OTH27
E039
Ellen Lytle
Computer
4/29/2011
Reliant
RHP-Elytle-PCL29
E041
Marie McCuistion
Computer
4/26/2011
Reliant
RHP-McCuistionPCL-28
E040
Mutiple Custodian
Computer
Computer
4/11/2011
Reliant
E042
Marie McCuistion
Thumb drive
5/12/2011
Reliant
E043
Kennth McGee
Thumb drive
5/16/2011
Reliant
RHP-JD3YRH1PCL-20
RHP-Reliant-TBD30
RHP-MCGee-TBD31
Page 42 of 44
E044
Jerry Huggler
Computer
Personal
RHP32A
E045
E046
E047
Ken Mcgee
Ken Mcgee
Ken Mcgee
MAC Computer
Powerbook G4
Thumb drive
Personal
Personal
Personal
E048
Patrick Ryan
Computer
Personal
E049
Patrick Ryan
Computer
Personal
RHP-Mcgee-33
RHP34
RHP 35
OR-002557-0051
RHP37A
OR-002557-0051
RHP36A
048804-Knowles
RHP-MBROHMCTH-24
RHP-MBROHMSPH-23
RHP-MBROHMTBD-18
RHP-MBROHMXHD-26
0159-001
E911
EnCase case files
6/1/2011
9/23/2011
E050
Michael Brohm
Mike Brohms Yahoo
Personal
E051
Michael Brohm
SD Card
Personal
E052
Michael Brohm
Axiom USB Thumb Drive
Personal
E053
Michael Brohm
Hitachi USB Drive
Personal
E054
Chad Deardorff
Personal Computer
Personal
Page 43 of 44
CV – Noel Kersh, ACE, EnCE
Page 44 of 44
14405 Walters Road, Suite 630
Houston, Texas 77014
Ph: (713) 401-3380
www.pathwayforensics.com
Noel E. Kersh
Senior Manager, Forensics
Noel has extensive experience in conducting digital forensics acquisitions and analysis on a
variety of cases involving business and employment disputes, compliance with discovery
requests, family law, harassment, in-house investigations for large corporations, copyright
infringement and criminal cases. He also has handled large-scale eDiscovery matters.
Prior to joining Pathway, Noel helped lead two initiatives to receive a distinguished laboratory
accreditation given by the American Society of Crime Laboratory Directors/Laboratory
Accreditation Board (ASCLD/LAB). This accreditation demonstrates that a computer forensics
laboratory’s operating standards meet quality standards set by ASCLD/LAB. Accreditation
criteria include personnel, technical procedures, equipment and physical facilities. Noel has also
provided audit services to labs seeking ASCLD/LAB accreditation.
Noel has provided expert testimony by deposition, affidavit and at trial on matters involving
computer forensics. Noel is an EnCase Certified Examiner (EnCE), AccessData Certified
Examiner (ACE) and member of the High Technology Investigation Association (HTCIA). Noel is
a licensed Private Investigator by the State of Texas. (Reg #871273)
Professional History:
Senior Manager, Pathway Forensics, LLC
2009 to Present
Conduct computer forensics investigations. Assist in large-scale in-house corporate
investigations.
Lab Director, CyberEvidence, Inc.
2008 to 2009
Oversaw lab operations in the CyberEvidence Digital Forensics Laboratory including overseeing
all investigations performed in the lab, managing lab personnel and client communications.
Conducted computer forensics investigations. Provided expert reports and testimony. Led
CyberEvidence lab to receiving ASCLD/LAB accreditation.
Forensic Practice Leader, ILS Technologies
2007 to 2008
Added to organization to create a computer forensics practice.
PATHWAY FORENSICS, LLC
Noel Kersh
Curriculum Vitae
Page 1 of 3
Lab Manager, HSSK LLC
2006 to 2007
Managed the day to day operations of the lab. Conducted computer forensics investigations.
Provided expert reports and testimony. Noel helped lead the initiative to be the first private
computer forensics laboratory accredited by the American Society of Crime Laboratory
Directors/Laboratory Accreditation Board (ASCLD/LAB).
Senior IT Project Manager, Hewlett Packard Corporation
1997 to 2006
Held several positions during almost 10 years at HP including managing application
development team for HP.com IT, developer, database administrator and system implementer.
Certifications:
EnCase Certified Examiner (EnCE), 2007 to Present
AccessData Certified Examiner (ACE), 2009 to Present
Education:
BBA in Management Information Systems, Texas Tech University, 1997
Professional Affiliations:
High Technology Crime Investigation Association (HTCIA)
Expert Witness Testimony:
Cooper v. Cooper; Cause No. 2010-61285
Catalyst Services, Inc. v. Cat-Spec, Ltd. et. al.; Cause No. 2008-53942
State of Texas v. Matt Dee Baker; Cause No. 2009-456C1 (Trial Testimony)
State of Texas v. Matt Dee Baker; Cause No. 2009-456C1 (Sentence Hearing Testimony)
Talascend, Inc. v. David Lee; Cause No. 2008-21433
Hernandez v Hernandez; Cause No. 2006-52751
Wausau Underwriters v. United Plastics Group; Cause No. 1:04-cv-06543
Catalyst Services Inc v. Cat-Spec LTD; Cause No. 2008-53942
Noel Kersh
Curriculum Vitae
Page 2 of 3
Speaking Engagements:
“Computer Forensics in Litigation”
Wright & Close, LLP, 2011
“Computer Forensics in Litigation”
Andrews Kurth, LLP, 2011
“True Crime with Aphrodite Jones” Show
Featured Interview on Discovery Network’s Investigate Discovery Channel, 2011
“Issues with Jane Velez-Mitchell” Show
Expert Panelist on CNN’s Headline News, 2010
“InSession” Show
Expert Panelist on CourtTV, 2010
“What Every Expert Should Know about Computer Forensics and E-Discovery”
Tennessee Society of Certified Public Accountants, 2009
“Digital Evidence: What You Need to Know”
Northwest Houston Bar Association, 2008
“Computer Forensics and E-Discovery”
Tarrant County Bar Association, 2007
“CEIC Tips and Tricks”
Texas Gulf Coast Chapter of the HTCIA, 2007
Robertson & Railsback, 2006
Houston Metropolitan Paralegal Association, 2006
Noel Kersh
Curriculum Vitae
Page 3 of 3

NO. 05-11-00952-CV - 5th Court of Appeals

Transcription

Similar documents

Sara Wang

IT`S NOT TO LATE TO JOIN!

CCU40372 AnnualReport2012_VMECH.indd

January, 2015 - Cornerstone Baptist Church

NEWSLETTER - Cornerstone Family Violence Prevention Centre

Cornerstone Center for Early Learning

Spring Newsletter – Annual Report

Cornerstone Connect - Cornerstone Credit Union

Newsletter 2015 – Edition 10