In-Depth
Avoiding the RAMifications of Storage Retention
To stay in compliance, IT has had to focus on ensuring the right data is saved for the right length of time. A new court case may extend what data must be saved in the future. Regardless of the outcome of that case, we explore three steps IT must take to be prepared when lawsuits arise.
by Doug Rogers
In a copyright infringement case in late May, a magistrate judge in the Central District of California ordered the defendants in Columbia Pictures Industries v. Bunnell to preserve and produce information received in the future on the RAM of Web servers defendants controlled. The defendants have appealed the decision to the district judge. However the judge decides, the magistrate’s decision raises important issues that enterprises should anticipate may arise in the future in one form or another.
The plaintiffs filed a complaint against the defendants for encouraging, inducing and profiting from the online piracy of plaintiff’s copyrighted works through the operation of their Web site (a form of copyright infringement referred to as contributory infringement). The Web site, TorrentSpy, offered users files for downloading that contained code enabling a user’s computer to access and copy copyrighted content without the permission of the copyright holder.
The plaintiffs sought "the preservation and production of the following data: (a) the IP addresses of users of defendants’ Web site who request ‘dot-torrent’ files; (b) the requests for ‘dot-torrent’ files; and (c) the dates and times of such requests" (defined in the opinion as Server Log Data)." The magistrate noted that the Web server used by defendants had the capacity to retain server log data on its hard drive. That function had never been turned on, so the only place the information resided (and only temporarily) was in RAM.
In this article we’ll explore three key issues for IT to protect an organization in the case of a lawsuit.
Issue #1: IT must review retention policies and practices of electronically stored information
The magistrate noted that some courts have held that what constitutes a copy of a work for purposes of determining copyright infringement can include content on RAM. However, the purpose of copyright law is to give authors the financial incentive to create literary and other works by preventing others from making many uses of the works (such as copying) without permission of the creator.
In contrast, the purpose of the Federal Rules of Civil Procedure (FRCP) is not to prevent reproductions or other uses, but to secure just, speedy, and inexpensive determination of actions. Although the magistrate concluded that the information on RAM was electronically stored information within the meaning of the FRCP, neither Rule 34 of the FRCP nor the Committee Notes on Rule 34 defines "electronically stored information." Rule 34(a) simply gives examples of electronically stored information, including "data compilations stored in any medium from which information can be obtained." The Committee Notes state that "Rule 34 applies … to information that is stored in a medium from which it can be retrieved AND examined" (emphasis added). Computers use RAM to format content for display on a computer monitor, but "retrieve" means "to get and bring back," such as information from hard drives, CD ROMs and other non-volatile memory sources. (There has been no retrieval from any source of the requested information in the case.)
RAM is distinct from data on traditional storage media, of course, but the distinction goes beyond this simple difference. When data is on RAM, there may been no affirmative act by any user that the information reflected on RAM is, in fact, what the user intended to enter. After all, RAM can include mistakes and typos not reflecting the statements or thoughts of the person inputting the data. However, when users save content to a hard drive, they have at least taken an affirmative step, in effect marking the sentence as their sentence.
In addition, the common meaning of "fix," the word in the copyright statute to designate when a copy has been made, is "to make firm or stable." In contrast, the common understanding of "store" (as in electronically stored information) is "to stock or furnish against future time." In other words, "fix" refers to the present, whereas "store" refers to preparing for the future.
The logical conclusion is that even if content on RAM may constitute "copies" for purposes of copyright infringement in certain situations, such content should not be deemed electronically stored information for purposes of production under Rule 34. On the other hand, case law provides that when litigation has commenced or is reasonably likely, prospective parties have an obligation to preserve electronically stored information relevant to the claims and defenses, including relevant server log data being recorded on a hard drive. Thus, if the defendants had had the server log turned on at the time the litigation commenced, so the server log data had been recorded on a hard drive, defendants would have had an obligation to preserve that information.
IT personnel should consult with their inhouse or outside counsel, preferably before litigation arises, to advise counsel on the architecture of their information systems, for what periods information is retained on different systems (including voice mail, chat rooms, etc.) and to get advice from counsel on whether any current retention practices should change and, if litigation seems likely, what information may be considered relevant electronically stored information that needs to be preserved.
Issue #2: Understand what electronically stored information your enterprise controls
An issue in the case was that at some point, possibly subsequent to the lawsuit, defendants contracted with a third party to serve as a middleman to receive the server log data (and that only temporarily). The magistrate was suspicious of this change in business practice from defendants receiving and caching the files. The magistrate said that "defendants have the ability to manipulate at will how the Server Log Data is routed," and the magistrate concluded defendants had the obligation to obtain and produce the information.
Whether or not this decision is correct, it highlights the need for companies to consult with counsel before changing business practices in the face of litigation, in order to try to avoid giving the court the impression that the change was made to avoid responsibilities in litigation rather than for business purposes. This also highlights that companies should consult with counsel about what their legal and practical relationships are with third parties with which the party does business, even before litigation arises, to determine what the company’s preservation/production responsibilities may be after litigation arises with respect to the third parties.
Issue #3: Establish/maintain credibility to avoid "the sky is falling" claims
The magistrate in concluded that the testimony of defendants on the burden of producing the information was not credible. The magistrate the defendant "either did not know that the logs could be selectively enabled to collect the Server Log Data only or that he intentionally misrepresented the volume of data in issue." This highlights that before responding to discovery requests, IT must:
- Understand the capabilities and practices of the company’s information systems, so the company does not make representations to the court on capabilities or practices, only to find out that its actual capabilities or practices are different.
- Have counsel cross-examine the applicable IT personnel of the company to make sure that counsel can evaluate the truth of the prospective responses and whether those responses will appear credible (even if true, a response that does not appear credible will harm the company).
- Investigate whether there are compromise positions that would show the company is trying to reasonably resolve the discovery dispute (e.g., offering to turn on the "button" for the server log data for some period of time to sample the volume of information actually recorded for that period of time—in the field of electronic discovery, the courts have now recognized sampling as a valid technique to determine burdensomeness).
If counsel and IT personnel do not consult in advance of discovery requests (preferably before litigation), it can be much more expensive to have that consultation occur after litigation and the exchange of discovery requests.
- - -
Doug Rogers is a lawyer with Vorys, Sater, Seymour and Pease LLP. You can reach the author by writing to dlrogers@vssp.com