MetadataEmployees continue to believe that they can outsmart their electronic storage devices and the metadata of the files on those devices – and they continue to be wrong.

In Engility Corporation v. Daniels, the trial court entered a preliminary injunction against two former employee-defendants, largely because the court did not believe their assertions that they no longer possessed trade secrets belonging to their former employer, the plaintiff. Click here for the Order Granting Preliminary Injunction in Part.

Daniels’ attempted explanation is a bit convoluted and hard to summarize quickly. To get the full flavor, you should read the judge’s summary of it. But there are two components to that attempted explanation that bear directly on points I raised in my previous blogs on the use of metadata and electronic storage devices in proving or defending against claims of theft of trade secrets.

Daniels’ undoing began with metadata. Specifically, Daniels said that on August 29, 2016 he returned to Engility a flash drive full of company information. But most of the files on that flash drive bore a “Date Modified” metadata date of August 30. Obviously Daniels couldn’t have modified those files after he returned the flash drive. One of those dates had to be wrong. Engility explained the discrepancy by saying that Daniels actually returned the flash drive on August 31. Daniels continued to insist he returned the flash drive on August 29. How did he explain the August 30 “Date Modified”? He couldn’t. He speculated that the files had been in a zip file that someone at Engility somehow extracted on August 30, which would generate a “Date Created” date of August 30. The court wasn’t buying it. (For a discussion of how metadata dates can bolster or defeat an argument, see my blog, “Part III: What Employers Must Know About Metadata and Why: Metadata as a ($20-million-plus) Sword.”)

It gets worse. Engility showed that the hard drive partition on the computer that Daniels returned to the company upon his departure had been “wiped,” i.e., overwritten with zeros. This is critical. Wiping the hard drive partition in a litigation or pre-litigation context is destroying evidence. (On this, see my blog, “Part IV: What Employers Must Know About Metadata, and Why: Destroying Metadata, Destroying Evidence and Paving the Road to Sanctions.”) Wiping the hard drive means not only destroying evidence of the existence of files and their contents, but also destroying evidence of the fact that they were deleted. But the fact that the hard drive (or the device) has been wiped is evident, which is why those who do this kind of wiping frequently wind up in trouble.

According to the judge, when Daniels was asked why the partition was wiped, Daniels explained that he had used the laptop to assemble the files needed for the flash drive project, then copied all of those files onto an external hard drive (not a flash drive), then wiped his user profile from the laptop (for unexplained reasons) and then copied the files on the external hard drive back onto the laptop. Finally, he copied those same files from the laptop onto the flash drive, and ultimately turned in both the laptop and the flash drive to Engility.

Here’s a pop quiz: What are the three most important words in the judge’s comments? The answer: “for unexplained reasons.” That’s another way of saying that Daniels could not have had any legitimate reason for wiping his user profile. In addition, the entire sequence of events that Daniels described defies any legitimate rationale.

Employers should remain alert to the benefits of obtaining and properly interpreting metadata and the burdens triggered by mishandling electronic storage devices and the files (and metadata) stored on them.