Disclosure: Deleting Deleted Data

August 31, 2010

Cases have previously come before the English courts in which one party has alleged that the other party has deleted e-mails and other documents. But in Rybak v Langbar International Ltd [2010] EWHC 2015 (Ch) it was alleged that the claimant had gone further and had deliberately deleted retrievable data using specialist security deletion software which overwrote all traces of retrievable data.

The action arose out of an agreement to settle earlier proceedings between the same parties.  The Rybaks claimed a declaration that they had complied with the terms of the settlement agreement, as amended by a supplemental agreement.  In response, Langbar contended that it had been induced to enter into the supplemental agreement by misrepresentations.

There had been serious deficiencies in the disclosure given by the Rybaks.  They had given a number of explanations, including difficulties with computers.  It was said that computers had crashed, that they had failed, that they had been infected with viruses and that data had been lost.  Langbar obtained an order that the Rybaks deliver up, to a jointly appointed IT expert, computers, other electronic storage devices, documents stored on the computers and storage devices, and passwords.  The IT expert was to make forensic image copies.  The order made provision for filtering out privileged and irrelevant material.  The order was an ‘unless’ order.

The Rybaks did not cooperate in the appointment of the IT expert, and the court made an order appointing a named expert.

After these orders had been made, there was twice carried out a procedure on an Apple Mac computer known as ‘Secure Erasing of Free Space’.  This procedure made no changes to active files stored on the computer, but it did overwite all the data in space occupied by deleted files.  As a result, any data retrievable from deleted files could no longer be retrieved. 

Mr Rybak did not dispute that he had carried out these procedures.  He did however contend that at the date when he carried out the procedure there were no deleted files on the computer, and that he regularly used this function in order to maintain the efficient running of his computer.  

The evidence was that, before the user of the software clicked the button marked ‘Erase Free Space’, a message appeared on the screen reading ‘To help prevent recovery of deleted files click the Erase Free Space Button’.  The judge had no difficulty in rejecting the assertion that there were no deleted files on the computer, and found that Mr Rybak must have known that the purpose of running the Erase Free Space program was to ensure that data became irretrievable, and that it was not for the purpose of maintaining the efficient running of the computer.  The judge also found as a fact that Mr Rybak had mistakenly believed that he had successfully deleted the log file showing when the Erase Free Space function had been used.

The Rybaks further contended that the order applied to hardware and to the data stored on the hardware on the date of delivery up, and not to the data previously stored on the hardware.  The judge rejected this interpretation of the order.

In the circumstances the judge held that the Rybaks had failed to comply with the unless order.  This meant that the current position was that the claim and defence to counterclaim were already struck out. 

The Rybaks applied for relief against the sanction of striking out.  Having held that Mr Rybak had deliberately failed to comply with an unless order, the judge refused to grant relief against that sanction.  The Rybaks’ claim accordingly remained struck out.  The judge did not find it necessary to deal with the submission that the Rybaks’ claim should be struck out on the alternative ground that there had been an abuse of the process of the court which made a fair trial no longer possible.

Clive Freedman is a Barrister at 3 Verulam Buildings and an SCL Trustee