As many readers are aware, Commonwealth v. Fowler, No. 1888CR000598 (Mass. Dist. Ct. Nantucket filed Dec. 20, 2018), a criminal prosecution, and a related civil action, Little v. Fowler, No. 1975CV00022 (Mass. Sup. Ct. Nantucket filed June 26, 2019), are matters in which, respectively, the commonwealth of Massachusetts and a plaintiff brought criminal charges and a civil complaint against actor Kevin Spacey (whose legal name is Kevin Spacey Fowler), claiming that in summer 2016 Spacey sexually assaulted an 18-year-old employee of a Nantucket restaurant by first plying him with alcohol and then groping him at the restaurant. The allegations led to Spacey being removed from a starring role in a hit TV series and a film studio withdrawing its request that he star in an upcoming film. In July, however, the Massachusetts civil action was dismissed with prejudice and prosecutors dropped the criminal charges because of the alleged spoliation of digital evidence—specifically, the complainant's cellphone—and relatedly, as shall be explained, the plaintiff/complainant's invocation of his Fifth Amendment protections against self-incrimination. In this month's article I will review the matters and discuss whether there was spoliation and the implications of the reasoning leading to the conclusion that there was.

The Civil and Criminal Matters

Spacey was on the island of Nantucket, Massachusetts, in summer 2016. Per the allegations of the complainant, an 18-year-old employee of a Nantucket restaurant, Spacey bought him alcohol and then, without the complainant's consent, groped him at the restaurant. In response, Spacey, through counsel, asserted that the complainant had told Spacey that he was 23, and the encounter was a "mutual and consensual flirtation."

Spacey's counsel demanded discovery of the complainant's mobile phone, seeking text, video and Snapchat data from the date of the incident to the date of the discovery request.

A July 2019 court hearing regarding the whereabouts and contents of the phone produced an interesting response by the complainant.

Some of the phone's data had been introduced in court. Text messages between the complainant and his girlfriend, which included the complainant's description of the purported groping and his girlfriend's text responses, some with multiple emojis, and which purportedly were sent at the time of the groping, had been entered into evidence via screenshots. Spacey's counsel, asserted that some of the text messages had been edited.

The way to determine whether the evidence was pristine or edited was to examine it on the mobile phone. Issues, however, arose regarding the preservation of the phone's data. The complainant's mother conceded that she had deleted some data from the phone before turning it over to law enforcement but asserted that said data was unrelated to the alleged incident. A police officer involved in the investigation told the court that the mother had stated that the deleted data pertained to "frat boy activities," not the alleged groping. The complainant's mother sought to bolster her honesty with regard to what she had deleted both by admitting in court that she had deleted the data before providing the phone to law enforcement and underscoring that she was "very honest with the police about that."

Defense counsel challenged the mother, stating to her, "You were not the gatekeeper. The police were the gatekeeper, and God forbid, we might be the gatekeeper or the judge may be the gatekeeper," and asking her, rhetorically, "You understand that, right?" The mother's response was, "I'm beginning to understand that now." The court was skeptical of such a response, noting that the complainant's mother was a former Boston television news reporter, i.e., someone who should have known better regarding the destruction of potential evidence in a criminal matter.

The issue of the deleted data may have been overcome had a forensic examination of the phone discovered the data still residing on the phone, since while "deleted" materials may disappear from the user's view, on many devices they are not upon deletion "wiped" from the device. Deletion simply removes the command on the device to save the data and, unless and until such space is needed for active data, the data remains, and so could still have resided on the phone.

Such forensic examination, however, never took place because the phone disappeared. While law enforcement materials indicated that the phone had been returned to the employee's family, the family's attorney told the court, "My clients do not recall ever receiving the phone." The family represented that the phone had been "backed up," but it was unclear whether the "backup" was forensically made, i.e., whether it saved all data on the phone, and when it was made, i.e., was it made close before, or enough in time to, the deletion of the "frat boy" data to preserve such deleted materials.

Following these revelations, the court asked the complainant whether he knew altering evidence was a crime. The complainant invoked the Fifth Amendment, leading his counsel to drop the civil matter on July 5. The prosecutors filed a nolle prosequi, dropping all charges, on July 17.

Discussion

The 2015 amendment to Federal Rule of Civil Procedure 37(e) provides that sanctions are available when evidence "cannot be restored or replaced through additional discovery." State rules or practices either already had, or have since followed, embraced that principle. What the 2015 amendment does not address, however, is the even more fundamental concept that why evidence may need to be restored or replaced will dictate whether any party should be sanctioned.

In the instant matter, the data was controlled by the complainant, not the defendant. Typically in civil cases, data is more likely to be sought by plaintiffs from defendants who control it, and typically in criminal matters, law enforcement seeks data through search and seizure of suspects or subpoena of third parties. Plaintiffs in civil matters and complainants in criminal ones usually are so concerned about not letting their adversaries off on technicalities that they preserve potential evidence without giving it much thought.

Notwithstanding those general principles, there will be circumstances when parties do not preserve data. The most common circumstance is when litigation is not contemplated. Personnel of the plaintiff or defendant in any civil matter, for example, may routinely delete emails, e-docs and other data, while doing their jobs, and such data might not be captured even if the user's data is backed up every day; it would only be after the party understands that it is engaged in the civil matter that instructions not to delete anything would be communicated to personnel. Under those circumstances, data deleted prior to instruction could easily be lost. In criminal matters, if the matter is an assault of any kind, a theft or robbery, or any other crime committed by a person or a group of people targeting victims, destruction of incriminating evidence would likely be an important part of the commission of the crime, but if the matter is one in which criminal charges are brought against a large organization, i.e., one in which backups of devices are made daily, it is possible that destruction of evidence would not take place early on in the conspiracy and evolve as those members of the organization involved in the criminality grow more committed to such criminality. Thus, it is important to understand what the matter is and when and how the data was not preserved to determine whether the loss of data was intentional.

It should be remembered that "backups" typically are "logical," not forensic. A forensic copy is a copy of every bit of data on the location being copied, and it is shown to be accurate when the "hash value" generated by the location matches that of the backup. A "hash value" is created by an application taking different bits of data from the source being "hashed" and placing that data as factors in a complex algorithm. If there is even the slightest difference between the source and the forensic copy, the hash values of the two will be completely different; when they match, that demonstrates that the forensic copy is a full copy.

A "logical" copy is the type of copy that we users routinely make, such as when we copy emails, Word docs and so on. If at a certain time at the end of each day a logical copy of the devices at a business, for example, are made and saved to a Cloud location, a backup server, etc., what will be on the logical copy is data the way it looks to the user. No deleted files still residing on the device, as described above, will be on the logical copy, just as such is not visible to the user. As well, no hash values will have been generated to demonstrate the accuracy of the copy.

Turning back to the matter at hand, even if the phone had been "backed up," it is far, far more likely that the backup would have been a logical, and not a forensic, copy. This means that the data deleted by the complainant's mother (if the mother was telling the truth when she claimed that she and not her son deleted the data) would not have resided on the copy. The only way that such data could have resided on the copy is if it were a forensic copy, in which case it is possible, but by no means certain, that such data could have been recovered, or if the logical copy was made prior to the deletion of the data, a highly unlikely scenario given the description of who did the deletions, how they were done, that the copy was never produced, and so on. From the description of how the deletions were made, complainant's failure to produce a copy and the complainant's invocation of the Fifth Amendment, it is all but certain that no copy was made and even more certain that if a copy had been made it would not have been made to capture the deleted data.

Conclusion

The results in Commonwealth v. Fowler and Little v. Fowler may or may not reflect what actually happened. What is important to remember is that the matters are by no means typical. Criminal matters are usually investigated far more than was done here, with all issues pertaining to evidence and apparent to the prosecution resolved before the arrest is made or, if the arrest is made on the spot, before the case moves forward to indictment or preliminary hearing, as the rules of jurisdiction dictate. Civil matters are also investigated, and all evidence secured, before moving forward, if only because plaintiffs firms typically profit only by prevailing in some manner (settlement, verdict), and so they do not want to take on the case and have their attorneys' hours eaten up unless they are convinced they have a good chance to prevail, which chance is lessened considerably if discovery is not locked down prior to commencement of the action and becomes a reason for the defendant to prevail. One can guess that the reason the cases were moved forward despite their discovery problems may have something to do with the defendant being a big movie and TV star, but that explanation, if true, is certainly no justification. What civil and criminal litigators should take away from these cases is that they exceptions, and not the rule.    

Leonard Deutchman is a legal consultant retired from one of the nation's largest e-discovery providers, KLDiscovery, where he was vice president, Legal. Before joining KLDiscovery, he was a chief assistant district attorney at the Philadelphia District Attorney's Office, where he founded the Cyber Crime Unit and conducted and oversaw hundreds of long-term investigations involving cybercrime, fraud, drug trafficking and other offenses.