Searching over 5,500,000 cases.


searching
Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.

Williams v. American College of Education, Inc.

United States District Court, N.D. Illinois, Eastern Division

September 16, 2019

TRIANO WILLIAMS, Plaintiff/Counter-Defendant,
v.
AMERICAN COLLEGE OF EDUCATION, INC., Defendant/Counter-Plaintiff.

          MEMORANDUM OPINION AND ORDER

          Gary Feinerman, Judge.

         Triano Williams brought this suit against his former employer, American College of Education, Inc. (“ACE”), under 42 U.S.C. § 1981, Titles VI and VII of the Civil Rights Act of 1964, 42 U.S.C. §§ 2000d et seq., 2000e et seq., and state law, alleging that he was discriminated against and ultimately terminated due to his race and in retaliation for complaining about discrimination. Doc. 8. ACE counterclaimed, alleging theft under Indiana law. Doc. 29. Williams then filed an amended complaint, adding allegations that ACE defamed him by publishing false allegations that he locked ACE out of its Google email account after his termination. Doc. 59.

         ACE moves under Civil Rule 37(e) and the court's inherent authority for sanctions against Williams for spoliation of evidence, charging that he intentionally destroyed electronically stored information by installing a new operating system on his ACE-issued laptop, rendering unrecoverable potentially relevant files. Docs. 90, 189. Williams denies ACE's charge, contending that he kept a second ACE-issued laptop at ACE's Indianapolis office, and theorizing that ACE used that laptop-or a combination of his two laptops-to fabricate evidence of the alleged spoliation. Doc. 215 at 12-15. The court held an evidentiary hearing and entertained oral argument. Docs. 208, 210-215. Having heard, reviewed, and carefully considered the evidence, the court finds that Williams destroyed files on his laptop by installing a new operating system and committed perjury in denying that he had done so, and therefore grants ACE's sanctions motion, dismisses Williams's claims, and relinquishes its jurisdiction over ACE's counterclaim.

         Background

         Williams worked in ACE's Information Technology (“IT”) department from 2007 through February 2016. Doc. 124-2 at ¶ 6. He was a systems administrator from 2013 through 2016. Id. at ¶ 8. From 2011 until his termination, Williams worked remotely from his home in Riverdale, Illinois. Id. at ¶¶ 10-11; Doc. 214 at 4.

         On February 12, 2016, ACE told Williams that it was relocating all IT employees to its Indianapolis headquarters and that he would no longer be permitted to work remotely from home. Doc. 124-2 at ¶ 12; Doc. 212 at 68-69, 169; Doc. 124-4. Williams alleges that he was subjected to discriminatory treatment due to his race over the course of his employment and that ACE forced him to choose between relocating and leaving his job due to his race and in retaliation for his prior complaints about discrimination. Doc. 59 at ¶¶ 43-52. The most salient of those complaints were set forth in a letter (the parties call it the “ACE Culture Letter”) that Williams sent to supervisors expressing his concerns that “[t]he culture of [ACE] has become very toxic … and seems to affect only the African American demographic of our college.” Doc. 124-3; Doc. 59 at ¶ 14. The letter is dated February 11, 2016-the day before ACE announced on February 12 that all IT employees had to relocate to Indianapolis-but the parties dispute whether Williams in fact prepared and sent it before February 12.

         A. Williams's Knowledge of His Preservation Obligations

         On February 29, 2016, ACE told Williams that it was placing him on a leave of absence and that he should no longer report to work. Doc. 124-2 at ¶ 21. Williams's attorney sent ACE a letter that day, informing it of Williams's intent to bring this suit. Doc. 89 at 10-11. ACE's counsel responded on March 10, 2016, stating:

The College asks that you remind Mr. Williams that he has affirmative obligations to preserve any and all electronic and paper documents that are relevant to his claims, his separation and his employment with the College. This not only includes preserving his company property without destruction, but also any personal email, text messages or other forms of communication that he has had with other current or former College employees. We trust Mr. Williams has and will continue to comply with [h]is preservation obligations.

Id. at 13-14.

         B. Williams's Home Laptop

         On February 29, 2016, the day Williams was placed on a leave of absence, ACE cut off his access to its network by changing his password and disabling his account. Doc. 212 at 54, 69, 175; Doc. 214 at 4; Doc. 124-2 at ¶¶ 21, 42. Although Williams's network access was disabled, he still could have logged into the ACE-issued laptop he kept at home by using either his previous password-because the computer was no longer on ACE's network, it would not have received the update invalidating that password-or the local administrator credentials. Doc. 212 at 70-71; Doc. 214 at 4-5. According to James Aldridge, ACE's vice president of technology, ACE could not have remotely accessed Williams's laptop after it was removed from the network. Doc. 212 at 57, 70.

         On April 21, 2016, KK Byland, ACE's vice president of human resources, sent Williams a FedEx box so that he could return his ACE-issued laptop to ACE. Doc. 89 at p. 2, ¶ 5. Aldridge testified that on May 10, 2016, a receptionist delivered to his office a sealed FedEx box from Williams containing the laptop. Doc. 212 at 80-81. IT managers Steven Carey and Rick Gehring were in Aldridge's office at the time. Ibid. Aldridge testified that he laid out the contents of the box-the laptop and a few pieces of bubble wrap-and photographed them. Id. at 81; Doc. 178-3 at 16. (Williams testified that he also sent back his power cord and keycard, neither of which appears in the photograph. Doc. 214 at 23-24; Doc. 178-3 at 16.) Aldridge did not photograph the bottom of the laptop, where the service tag (Dell's version of a serial number) was located. Doc. 212 at 118-119; Doc. 214 at 60. Aldridge then opened the laptop and turned it on, at which point he realized that it “was no longer on [ACE's] domain and that the screen was cracked.” Doc. 212 at 81.

         After Aldridge told Byland that he had received the laptop, she gave him a chain of custody form. Id. at 82. Aldridge filled out the form and then locked both the form and the laptop in his desk, using a key on his keychain. Id. at 82-84. The chain of custody form identifies the laptop as a “DELL Latitude E7450 wrapped in bubble wrap in a large Fedex box” with a “[v]isibly damaged screen, ” but does not note its service tag. Doc. 178-3 at 11. Williams testified that ACE's IT department, including Aldridge, typically identified devices by their service and asset tags. Doc. 214 at 181.

         According to Aldridge, ACE's “standard procedure” when receiving a former employee's laptop was to gather the files from the laptop and provide them to the employee's supervisor, who then reviewed the files to determine whether any should be kept. Doc. 212 at 84. IT then “wipe[d] [the] computer and put a fresh image on it … for the next user.” Ibid. IT was unable to perform this procedure on Williams's laptop because a new operating system had been installed. Id. at 84-85.

         Aldridge gave the laptop to Jacob Carey on May 12, 2016-a transfer he recorded on the chain of custody form, Def. Ex. 9 at 1; Doc. 178-3 at 11; Doc. 124-14 at 6-who used a bootable operating system to access the computer in search of “any additional files on the laptop that [ACE] could preserve.” Doc. 212 at 84-85. Jacob Carey accessed the laptop, changed the local administrator password, and logged in. Id. at 85. Upon doing so, he discovered that the laptop had been loaded with a new copy of the Windows 7 operating system and that “no files from … Williams were present on the laptop.” Ibid. Jacob Carey then returned the laptop to Aldridge, who kept it locked in his desk drawer until, upon leaving ACE in January 2017, he gave it to Steven Carey. Id. at 87; Doc. 178-3 at 11.

         In his responses to ACE's requests for production, Williams repeatedly stated that the requested documents could be found on the laptop that he returned to ACE. Doc. 89 at 22, 36-37. For example, Williams responded to ACE's request to produce “[a]ll documents that refer or relate in any way to your employment with [ACE], including but not limited to, time records, policies, procedures, and personnel documents” by stating: “These documents were maintained electronically and were accessed via my laptop which was returned.” Id. at p. 22, ¶ 1. Williams gave a similar response-“Documents that may have been contained on my laptop are now unavailable.”-to ACE's requests for “[d]ocuments relating to any communications, including but not limited to e-mails and text messages, ” between Williams and Rommel Haynes, Dr. Linetta Durand, Amber Ying, or “any person not employed by [ACE] regarding the allegations in the Complaint.” Id. at pp. 36-37, ¶¶ 60-63. And Williams gave that same response to ACE's request for documents “reflecting [his] job duties and responsibilities while he was employed by [ACE]” and documents related to his attempts to obtain employment after he left ACE. Id. at p. 37, ¶¶ 65-66.

         C. D4/Evans's Forensic Analysis

         ACE sent Williams's laptop to John Evans, a computer forensics expert with the firm D4, LLC, to perform a forensic analysis. Doc. 214 at 29-31; Doc. 89 at 94. D4 received the laptop and ACE's chain of custody form in July 2017. Doc. 214 at 31. Evans testified that the laptop received by D4 matched the description on the chain of custody form. Ibid. The shipping label identified the sender as Steven Carey, as did the form. Doc. 178-2 at 7, 13. Evans testified that D4 never received any other computers from ACE, and that D4 examined only one laptop: a Dell Latitude E7450 with service tag CXF4M32 received from ACE. Doc. 214 at 31-32, 41. Byland testified that the laptop Williams returned to ACE was the one that ACE sent to Evans and that she had no reason to believe that anyone had altered or tampered with it. Doc. 212 at 177.

         Evans performed a forensic examination on the laptop and found that the operating system had been reinstalled on March 28, 2016. Doc. 214 at 32. Evans added that the previous operating system had been installed on June 1, 2015. Id. at 42. Evans testified that reinstallation requires human intervention in the form of “affirmative actions to click through screens to set up the new operating system.” Id. at 37. In Evans's experience, reinstalling an operating system is a common method of deleting information from a computer. Ibid. He explained that when an operating system is reinstalled, files that were deleted before the reinstallation can be overwritten, making them unrecoverable. Id. at 32.

         Evans found evidence that the reinstallation of the operating system on Williams's laptop had that effect. Id. at 33. Specifically, he found “evidence of at least 20 files that were opened prior to the reinstallation”-and thus “were present on the hard drive at that time”-but that “no longer exist[ed] on the device” when he examined it. Ibid. Evans testified that he was unable to recover any autosaved Google login information or any email communications other than those saved in Outlook (and therefore available independently through Outlook). Id. at 32-33, 46. When Evans received the laptop, it did not appear to be associated with any domain or physical network. Id. at 35.

         According to Evans, reinstalling the operating system moves the previous operating system and user profiles-which Evans described as “a collection of documents related to logins on that computer”-to a “windows.old” folder. Id. at 34. Evans found six user profiles that pre-dated the reinstallation: “Administrator, ” which accessed the device from June 2015 through March 2016; “Jose.Rubio, ” which accessed the device in July 2015; “Triano.Williams, ” which accessed the device from August 2015 through January 2016; “Triano.Williams.ACE, ” which accessed the device from January through February 2016; and two profiles with no activity (“Default” and “Public”). Id. at 34-36, 48; Doc. 89 at 95. From August 2015 through February 2016, the only profiles with any activity were “Triano.Williams” and “Triano.Williams.ACE.” Doc. 214 at 36. The only profiles present after the operating system reinstallation were “ACE, ” “Default, ” “Public, ” and an “Administrator” profile deleted shortly after the reinstallation. Id. at 37; Doc. 89 at 95.

         Evans found evidence of activity on the previous operating system on March 4, March 9, and March 28, 2016. Doc. 214 at 34. That activity included opening about twenty files on March 28, 2016, the date of the reinstallation. Id. Because none of those files were present on the laptop after the reinstallation, Evans concluded that they had been deleted before the reinstallation. Id. at 34-35. Evans was able to determine the names of the deleted files but not their contents, id. at 66-67, and observed that the names of files do not necessarily match their contents, id. at 82-83. Evans also found that USB devices were connected to the laptop on February 29 and March 3, 2016. Id. at 36. Evans did not find any documents or activity from after the reinstallation. Id. at 37. Evans found the TeamViewer application (a mechanism for obtaining remote access to a computer) and the logs it generated when used, but he did not find any evidence of TeamViewer activity after February 1, 2016, nor did he find any other evidence of remote access in connection with the March 28, 2016 reinstallation. Id. at 36, 44; Doc. 178-2 at 4. Evans testified that as far as he knows, it is not possible to reinstall an operating system remotely. Doc. 214 at 76. If it were possible to do so, Evans would expect the process to leave behind evidence, but he did not find any. Id. at 79.

         Evans recovered more than 10, 000 deleted items, which he opined were recoverable only through forensic means. Id. at 41. Evans opined that all the items were deleted from the laptop he examined. Ibid. He added that “it is impossible to tell what information was overwritten, and therefore no longer recoverable, as a result of the” reinstallation. Doc. 178-2 at 3.

         Evans looked for evidence of tampering beginning on May 10, 2016-when ACE received the laptop from Williams-but found none. Doc. 214 at 38. Evans found nothing on the laptop that was altered after May 12, 2016, when Jacob Carey used a boot disk to start the computer and reset the password. Id. at 37, 47; Doc. 178-3 at 18-19. Evans found two files consistent with the activity that Jacob Carey described, both dated May 12, 2016. Doc. 178-2 at 5, 19-21. Evans testified that he would expect to find evidence of doctoring if someone had tried to make a laptop look like someone else was using it. Doc. 214 at 38.

         D. Protek/Glud's Forensic Analysis

         Williams hired Protek International, Inc. to analyze a copy of the forensic image that D4 had made of his laptop. Doc. 169-2 at 1. Like Evans, Protek found that the “active operating system” was installed March 28, 2016, likely by way of reinstalling Windows, as evidenced by the presence of the “Windows.old” folder. Id. at 2. Protek found a few dozen emails to or from Williams's personal accounts. Ibid.; Doc. 169-1 at ¶ 9. (Evans testified that Protek's finding those emails is not inconsistent with his conclusion that there were no recoverable emails because Evans searched for locally saved emails, not for emails available in Outlook. Doc. 214 at 46; Doc. 178-2 at 5.) Protek did not find the two files that Jacob Carey said he renamed- “Utilman.exe” to “Utilman.exe.old, ” and “cmd.exe” to “Utilman.exe”-while attempting to access the laptop with a boot disk, but Protek did find evidence that a program file named “Utilman.exe” was last run on May 10, 2016. Doc. 169-2 at 3.

         Protek found “[s]everal versions of spreadsheets tracking ACE computer assets.” Ibid. Protek also examined “ShellBag” and “UserAssist” artifacts, which can provide information about user activity. Ibid. Protek determined that the ShellBag data, which “help[] track the views, sizes and positions of a folder when displayed on a monitor screen” and thus offer “insight into the folder/browsing history of a user, ” provided “evidence of network access to resources attributable to Higher Education Holdings”-ACE's holding company-from June 3, 2015 through January 6, 2016. Ibid. Protek also determined that the UserAssist artifacts, which record “programs executed by a user account, ” showed activity on the same profiles and in the same time periods as Evans had found. Compare ibid., with Doc. 214 at 34-36, 48, and Doc. 89 at 95.

         At the evidentiary hearing, Williams asked Evans whether a spreadsheet Protek prepared of the UserAssist data, Pl. Exs. 12, 22; Doc. 169-2, contained evidence of remote access to Williams's laptop on March 28, 2016. Doc. 214 at 84-87. Evans opined that even assuming that the UserAssist spreadsheet was accurate, it showed only that a program named “Remote Desktop Connection” was run on the laptop after the reinstallation, not that the laptop was in fact accessed remotely from another device. Doc. 214 at 87-89. (Although Plaintiff's Exhibit 22 was not separately admitted at the evidentiary hearing, it is a reproduction of Exhibit D to Protek's report, Doc. 169-2; Pl. Ex. 12, which Williams filed in its native (Excel) format on a USB drive.)

         Todd Glud, Protek's director and senior consultant for electronic discovery and computer forensics, opined that ACE's chain of custody form was deficient because it did not “record any unique identifying information, ” such as a service tag, that would distinguish Williams's laptop “from other laptops of the same make and model.” Doc. 169-1 at ¶¶ 1, 6. (ACE's motion to strike Glud's opinions about the chain of custody form, Doc. 163, is denied as moot because those opinions do not affect the outcome of ACE's spoliation motion.) Glud also opined that one of the inventory spreadsheets on the forensic image of Williams's laptop indicated that “two Dell Latitude E6430 laptop computers” were at some point assigned to Williams, both with service tags different from the tag on the E7450 laptop that D4 analyzed. Doc. 169-1 at ¶ 8. Williams averred in a declaration that the laptop he returned to ACE from his home and the laptop he used at the Indianapolis office (of which more in a moment) were E7450s. Doc. 180-15 at ¶¶ 8, 31-32.

         Evans prepared a supplemental report in response to Protek's findings and Williams's declaration. Doc. 178-2 at 2. Evans opined that Protek's findings were largely consistent with his own. Id. at 4-5. Evans agreed with Glud that the inventory documents referred to two E6430 laptops, but found that none of the documents referred to the service tag of the laptop that D4 imaged. Id. at 5. Ultimately, Evans opined that Protek's findings were “consistent with D4's conclusion that the reinstallation of the operating system may have caused the permanent deletion of … potentially relevant information.” Id. at 6. Given the lack of evidence of remote access and the affirmative steps required to accomplish reinstallation, Evans ...


Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.