Robin Duane Littau v Astrata (Asia Pacific) Pte Ltd

Yeong Zee Kin SAR:

[1] This is an application under Part IVA of the Supreme Court Practice Directions for the discovery and inspection of electronically stored documents (“Part IVA”) for the court to determine the keywords which are to be used to conduct a reasonable search for discoverable documents following the execution of an Anton Piller Order. A summary of the personalities, issues and procedural history leading up to this application is set out in Littau Robin Duane v Astrata (Asia Pacific) Pte Ltd [2010] SGHC 361, [1]–[4] & [6], which I adopt for these grounds:

[1] The plaintiff was a former group regional director of the defendant. Between March 2005 and December 2009, he was employed in various senior executive and managerial positions in the Asia-Pacific region. During his employment, he signed a Confidentiality, Restrictions & Intellectual Property Agreement (“the non-compete agreement”) with the defendant. On 11 September 2009, the plaintiff gave three months’ notice of his resignation. His last day of employment would therefore have been 10 December 2009. However, on 9 December 2009, the defendant purported to dismiss him summarily with immediate effect.

[2] The defendant was incorporated in Singapore in October 2003. It is in the business of designing and developing location-based information technology services and solutions (telematics). These solutions enable businesses and government organizations to monitor, trace and control the movement and status of machinery, vehicles, personnel and other assets. The defendant’s business dealings are often confidential as they pertain to matters of security and defence. It is part of the Astrata Group of companies which comprises Astrata (Singapore) Pte Ltd (“ASP”) and Astrata Group Inc (“AGI”), a USA company. AGI is the parent company of the defendant which is in turn the parent company of ASP.

[4] On 21 June 2010, the defendant applied for and obtained an interim injunction and search orders against the plaintiff. These orders were extracted as order no. 2968 of 2010 (“the injunction”), order no. 2969 of 2010 and order no. 2986 of 2010 (“the search orders”). Among other things, the defendant alleged that the plaintiff had approached its customers and business partners (namely COSEM, the Tridex Companies and TNT). The injunction enjoined the plaintiff from giving confidential information to third parties and from breaching the non-compete agreement. The search orders were directed at evidence that the plaintiff had given information to the US parties as well as his breach of the non-compete agreement. The search orders were extended by the court on 25 June 2010, extracted as order no. 3082 of 2010, as the physical imaging of the plaintiff’s gmail [sic] account could not be completed in time. A moratorium of two weeks was ordered against perusal of any materials obtained as a result of these orders and if the plaintiff should apply within two weeks to set aside or to vary the orders, the prohibition against perusal would continue until further notice.

…

[6] After hearing the parties … I [] lifted the moratorium against perusal … I directed the parties’ solicitors to review the disputed documents obtained and try to come to an agreement whether they fall within the ambit of the search orders, failing which the plaintiff may apply to court to resolve the matter.

[2] In addition to the above, the following facts need also be borne in mind. This action, although commenced in the Subordinate Courts, was transferred to the High Court in March 2010. General discovery was given when the defendant and plaintiff filed their lists of documents on 22 April 2010 and 26 April 2010 respectively. Hence, the search orders were obtained in June 2010 after general discovery had been given.

[3] Pursuant to the search orders, the defendant had seized, inter alia, the contents of the hard disk of the plaintiff’s Apple iMac 24” desktop computer and his PowerBook G4 notebook computer; as well as the contents of the plaintiff’s e-mail accounts — Gmail account with e-mail address rlittau@gmail.com, LinkedIn account for rlittau@gmail.com and AOL account with e-mail address rlittau@AOL.com (“the seized items”).

[4] Forensic images of the seized items had also been made in accordance with the procedures set forth in the search orders. The volume of data in the seized items is sizeable as shown in the following table, which provides the size of the forensic image for each of the seized items:

[5] Following Tay J’s decision, parties engaged in attempts to agree on the manner of reviewing the forensic images of the seized items. Parties were able to reach agreement that keyword searches ought to be conducted to identify relevant documents, but they were not able to agree on either the list of keywords or the procedure to be adopted after keyword searches have yielded a set of documents that are responsive to the keywords used (“the search results”). On the other hand, parties were able to agree on the use of keyword searches to identify documents which were subject to litigation privilege for exclusion from the review.

[6] Parties appeared before me on two occasions to settle the approach which ought to be adopted in the review. At the hearing on 15 November 2010, I made directions that the following 3-stage process be adopted for conducting the review. First, parties are to come to an agreement on a list of keywords to be used to conduct the reasonable search. Thereafter, the reasonable search is to be conducted on the forensic images of the seized items. The search results would then, in the third stage, be reviewed by counsel to identify confidential information and information subject to privilege. The search results, less privileged documents and documents which are otherwise unnecessary for disclosure, will form part of general or further discovery. The application was adjourned for parties to reach an agreement on the list of keywords to be used in the first stage.

[7] On 13 December 2010, parties returned before me and appeared to have reached an impasse on the keywords. I ordered that a preliminary search be performed using the list of 251 keywords proposed by the defendants solely for the purpose of identifying the number of hits against each keyword, but with no right to review the underlying documents.

[8] Parties came back before me on 12 January 2011 for submissions on the disputed keywords; and on 19 January 2011, I heard parties on the limits which ought to be applied on the reasonable search. I set forth hereunder my reasons and the considerations for each stage of the framework for conducting the review.

Whether the test for determining relevance of keywords in the review of search orders is different from that which is applicable for discovery in the pending suit

[10] On behalf of the plaintiff, it was argued that the keywords to be used in the keyword search had to be relevant to issues in dispute. Further, after the keyword search is conducted, a review of the documents which form the search results should be conducted in order to identify documents which are to be finally disclosed. On the other hand, the defendant sought to draw a distinction between its ability to conduct keyword searches on the seized items under the powers given pursuant to the search orders – which it thought should not be fettered by a list of keywords – and the use of keyword searches for the purpose of identifying relevant documents for discovery. The defendant sought to persuade me that its powers under the search orders were somewhat broader and less fettered.

[11] I did not agree with the defendant’s submission as I do not see any distinction between the test applicable to determine relevance for compliance with the search orders and relevance for the purposes of discovery in the pending suit. Search orders (previously known as Anton Piller orders) are draconian in nature and, by reason of the very drastic effect and far-reaching consequences such orders may have when executed, they are granted only in exceptional cases: Computerland Corp v Yew Seng Computers Pte Ltd [1991] 2 SLR(R) 379; [1991] SGCA 28, at [17]. The primary purpose of a search order is to preserve evidence relevant to the case from destruction or concealment where there is solid evidence of a real risk that such destruction or concealment might take place: Petromar Energy Resources Pte Ltd v Glencore International AG [1999] 1 SLR(R) 1152; [1999] SGCA 28, at [6].

[12] Documents which are within the scope of a search order has to be, in the first place, relevant to the pending suit in with the search order is made: see for example Asian Corporate Services (SEA) Pte Ltd v Eastwest Management Ltd (Singapore Branch) [2006] 1 SLR(R) 901; [2006] SGCA 1, at [14] where it was noted that one of the four requisites which had to be satisfied before an Anton Piller order is issued is a real possibility that relevant documents will be destroyed. In the execution of search orders, only documents within the scope of the Anton Piller order may be seized. The obligation lies on the party executing the order to ensure full compliance with its scope. It has been observed that 95% accuracy in compliance is not good enough – the draconian nature of Anton Piller orders meant that, “if they are not to become instruments of oppression, their limits must be meticulously obeyed and enforced”: per Yong Pung How J (as he then was) in Peters Edition Ltd and another v Renner Piano Co and another suit [1989] 2 SLR(R) 505; [1989] SGHC 98, at [9].

[13] If documents falling beyond the scope of a search order are seized, these have to be returned. This is exemplified in the case of Peters Edition Ltd v Renner Piano Co, where the Anton Piller order in question permitted the removal of infringing copies of music books. The defendant had in its stock both genuine copies which it had purchased and unauthorised reproductions. During execution of the Anton Piller order, some genuine copies were also removed. Upon the defendant’s application, the court held the plaintiff to strict compliance with the scope of the Anton Piller order and ordered the return of the genuine copies as these fell beyond the scope of the Anton Piller order.

[14] From the above analysis, it is clear to me that only evidence relevant to the pending suit in which the search order is obtained may be seized. Further, the draconian nature of search orders require that the courts maintain a vigilant watch over the execution of search orders in order to ensure that there is no abuse.

[15] The search orders in this case were obtained for documents which fell within the scope set out in Schedule 2 (“the Listed Items”):

Further, the search order permitted the imaging of “the entire hard disk or other digital or media storage devices” if any of the Listed Items are found.

[16] It is clear upon a perusal of the definition of the Listed Items that the definition of the Listed Items confines itself to the types of documents, regardless of medium, which may be seized. However, it does not mean that all documents falling within these descriptions are subject to the search orders. The case law surveyed above has made it clear that before a document may be seized, it has also got to be relevant to the pending suit. In traditional executions of Anton Piller orders, a printed document which falls within any one of the categories above can and has to be examined before it is seized. In the modern context where keyword searches are performed on “the entire hard disk or other digital or media storage devices” which have been seized and imaged, the keywords assist to identify electronic documents for subsequent review. If the purpose of the review is to ensure that only relevant documents are seized, then the keywords which are used during the performance of the keyword search must also be relevant to the issues in the pending suit.

[17] To my mind, the vigilance which the courts have traditionally kept over executions of Anton Piller orders is all the more necessary in the context of modern day search orders, where electronic recording devices (eg hard disks and USB flash-based removable devices) and storage media (eg optical discs) are often seized and forensic images made. These recording devices and storage media are best regarded as the proverbial filing cabinet, which may contain a surfeit of electronic documents, only part of which are relevant to the pending suit. On this analysis, the party who has seized the recording device or storage medium ought not to be permitted untrammeled access to its entire contents. To do so would, in my view, offend the trite discovery principles which prevent trawling or the emptying of the opponent’s filing cabinets under the guise of discovery: see for example Thyssen Hunnebeck Singapore Pte Ltd v TTJ Civil Engineering Pte Ltd [2003] 1 SLR(R) 75; [2002] SGHC 247. Indeed, the court in Alliance Management SA v Pendleton Lane P and another and another suit [2007] 4 SLR(R) 343; [2007] SGHC 133, which had to consider an application for inspection of a hard disk, required that a protocol be put in place to ensure that the inspecting party is not allowed to trawl through the entire database under the guise of the inspection order.

[18] For the reasons set out above, I did not agree with the submission that there may be keywords which may be relevant for compliance with the search orders but which may not be relevant for the pending suit. I had, on 15 November 2010, directed that parties discuss and attempt to agree on a list of keywords which are to be used to perform the keyword search. I had also directed that the relevance of any particular keyword may be demonstrated by reference either to the search orders or the pleadings. Additionally, if parties were able to agree on a list of issues, then relevance may be demonstrated by reference to such list. For the purposes of disclosure, I had emphasised that the underlying test ought to be the same as that adopted for discovery under O 24, r 1 or r 5. If parties were not able to agree on any particular keywords, then the court will determine its relevance.

[19] On 13 December 2010, as parties had reached an impasse on the list of keywords, I fixed the application for a special hearing date in order to determine relevance of the disputed keywords. To facilitate parties’ submissions and assist the court in determining whether any particular keyword was relevant, the defendant was permitted to run a preliminary search against the forensic images of the seized items using the list of keywords that it had proposed. However, this preliminary search was intended solely for the purpose of identifying the number of hits – ie instances of documents which corresponded to the keyword – and the defendant was not permitted to view any of the documents forming the search results.

[21] The complete list of keywords which were considered and my reasons for allowing them (with or without modifications or restrictions) or disallowing them, are set out in the tables annexed to these grounds. As the relevance of keywords is specific to the issues of each suit, they will have to be determined on a case by case basis. However, the following observations may be noted. First, keywords have to be carefully chosen to avoid words which are commonly used. The reason is obvious: this is to avoid a situation where an inordinately large number of documents are returned as part of the search results. This would defeat the purpose of making use of keyword searches. Similarly, keywords which commonly form part of a word should be avoided or should only be used where the search engine is capable of identifying their occurrence as a discrete word and not as part of the word: see below, paragraph 25. Second, the availability of the preliminary search (see above, paragraph 19) proved to be very helpful in determining whether a particular keyword should be permitted or how it should be modified or constrained. I must emphasise that the number of hits returned in the preliminary search results does not have any bearing on relevance. However, they were helpful in determining whether a particular keyword was unsuitable as too many hits had been returned thereby highlighting those keywords which needed to be refined or restricted, after relevance had been determined.

[22] In the second stage, the list of keywords settled in the first stage would be used to conduct a reasonable search of the forensic images of the seized items. The term “reasonable search” as it is used in Part IVA should not be confused with a similarly named concept under the UK Civil Procedure Rules, which is used to denote a search for documents, electronic or pulp, for the purpose of disclosure. Under Part IVA, the term “reasonable search” means that the keyword search for electronic documents has to be reasonably constrained by, at least, limits on the time period and the number of repositories of electronic documents. In other words, there must be reasonable limits to the keyword search in order to prevent, on the one hand, the trawling or emptying out of your opponent’s filing cabinets which is eschewed by trite discovery principles, and on the other, returning a surfeit of documents responding to the keywords but which is well neigh impossible to review properly.

[23] In the present case, the number of electronic repositories is limited to the seized items. The plaintiff tendered his notice of resignation on 11 September 2009 and his alleged breaches of the terms of his employment and his duties of confidentiality to the defendant date back to July 2009. Parties therefore agreed that it was reasonable in the circumstances to limit keyword searches for documents, to those created, modified or deleted on or after 1 January 2009 and for emails, to those which were received or sent on or after the same date. These limits applied to all keywords which were to be used when conducting the keyword search.

[24] Additionally, it was necessary to specify additional limits for some keywords in order to ensure that the number of documents which were returned as part of the search result was not inordinately high by reason of overly broad keywords resulting in potentially irrelevant hits in the search results: see above paragraphs 20 and 21. Some examples of the additional limits specified are that certain pairs of keywords have to appear in the document – in other words, using the ‘AND’ Boolean operator – or for certain keywords to be used as a discrete word and not as part of a word (eg “TC”, “TP”, “AGI” and “BB”, see Table 1 below).

[25] During the course of arguments, one of the considerations which arose was whether the search engine which the defendant’s experts were using to conduct the keyword search was capable of certain functions, for example, whether the search engine was capable of distinguishing certain keywords as discrete words from occurrences when the keyword was part of a word. For example, “AGI” (which was an abbreviation of the defendant) was permissible as a keyword only if it occurred in a document as a discrete word, but not when it was part of a word like “magic”. During arguments, the defendant was not able to state definitively the capabilities of the search engine that was to be used. Hence, certain of the orders which were made were made on the assumption that the search engine probably had the capabilities, and if eventually it turned out that the search engine did not, then the keyword would not be allowed.

[26] This provides useful guidance for parties in future cases. In discussing the use of keyword searches, parties should also agree on the search engine which is to be used and ascertain its capabilities. If, for example, I was informed that the search engine which was to be used was able to conduct proximity searches (ie a search that returns a positive result only if the pair of keywords are within a certain number of words from each other), then the option for limits to the keywords will be increased for the discovery orders sought. The capabilities of the search engine are therefore relevant and should ideally be placed before the court.

[27] Another point which arose during arguments was whether keyword searches should be conducted on both allocated and unallocated space. Allocated space refers to the parts of the recording device or storage media which is allocated to files and directories (or folders). Unallocated space includes file slack and refers to portions of the recording device or storage media which, although previously allocated to files or folders, is now no longer allocated and is therefore available as free space. Until the unallocated space is completely written over by a new file, the contents of the pervious file may still exist (in full or partially) and may be retrieved by the use of the correct forensic techniques. File slack refers to parts of allocated space that are not occupied by the newly written file such that the contents of the previous file which occupied the unused space are still accessible using forensic tools and techniques.

[28] Part IVA and Appendix E Part I thereto establishes a de facto standard that for the purposes of general discovery, unallocated space or file slack are not ordinarily within the scope of general discovery. Paragraph 1(c) of Appendix E states as follows:

For the avoidance of doubt, electronically stored documents residing in folders or directories in storage locations, media or devices, including folders or directories where temporarily deleted files are located (for example the Recycle Bin folder or Trash folder) are within the scope of general discovery; deleted files or file fragments containing information which are recoverable through the use of computer forensic tools or techniques during a forensic inspection of the unallocated file space or file slack are not within the scope of general discovery,

[30] However, it was argued on behalf of the defendant that the search orders in this case had specifically included unallocated space within its scope as one of the Listed Items:

The defendant submitted that this formulation permitted the performance of a keyword search on unallocated space: an interpretation which was not contested and which I accepted. By reason of the scope of the search orders, the keyword search was permitted to be performed on the unallocated space of the seized items.

[31] In the third stage, the search results are reviewed to ensure compliance with the search order and to identify confidential documents or documents subject to privilege. Compliance with the search order, as discussed above, involves determining whether a document is firstly, within the range of documents described in the search order, and secondly, whether the document is relevant. The categories of documents which fall within the scope of a search order are usually described in broad terms and consequently, review for this aspect of compliance is frequently unnecessary. The definition of Listed Items in this case is a typical example:

[34] I wish to emphasise that the approach adopted here is applicable only where relevance of keywords have been agreed or determined by the court. This approach may also be taken if parties adopt an agreed electronic discovery protocol for the conduct of general discovery which includes a list of agreed keywords. The protocol can provide by agreement that all documents responding to the list of agreed keywords are to be given in general discovery without the need for a further review for relevance. My reasons for saying so is that a list of keywords which is agreed by parties or determined by the courts will usually have been closely scrutinised and the relevance of each keyword determined prudently. It follows that the risk of irrelevant documents turning up in the search results will be small. This may be contrasted with the use of keyword searches by a party on his own documents in order to facilitate his review to identify relevant documents to be given during discovery. The keywords are decided by the party on his own view of what is relevant to the issues in the pending suit, without the benefit of his adversary’s counter-check. I would think that the keywords may either be too broad or too exclusive. A review will have to be carried out in order to ensure that his discovery obligations are properly discharged.

[35] However, it is still necessary to safeguard any privileged documents and confidential information which are irrelevant to the pending suit. For the purpose of identifying documents which privileged from disclosure, it was possible to call on the aid of keyword searches. For documents which are subject to litigation privilege, parties were able to agree on using keyword searches to identify all e-mail communications passing between the plaintiff and its solicitors and documents which contain the name of the plaintiff’s solicitors’ firm. Parties were also able to establish that the plaintiff had sought legal advice from another set of solicitors after 1 January 2009 and hence were able to identify documents which are thus subject to legal advice privilege in a similar fashion.

[36] With regards to confidential information, parties were reminded of the Riddick principle which does not prevent the disclosure of relevant confidential information. However, there was a possibility that a document may contain confidential information which are irrelevant for the proceedings and which may properly be redacted in order to safeguard its confidentiality and to prevent prejudice to the plaintiff. If such documents are identified, parties could come to an agreement on the redaction of such documents, or apply to court for directions in the event of disputes.

[37] I had initially ordered that the plaintiff’s confidentiality and privilege review be completed within 3 weeks. Concurrently, the defendant could commence his substantive review of the documents provided that this was a solicitors-only review. The documents should only be released to clients upon the completion of the confidentiality and privilege review, and after parties have put in place appropriate measures to safeguard confidentiality and privilege. Having in mind the possibility of disputes, I also gave liberty to apply for further directions. Parties came back before me on 7 March 2011 as there was disagreement on the manner in with the confidentiality and privilege review should proceed. By this time, parties had completed the reasonable search which yielded 34,000 documents in the search results. Additionally, parties had also managed to identify privileged documents using keyword searches. However, parties were unable to agree on how to complete the confidentiality and privilege review.

[39] Having heard parties, I was persuaded by the fact that the majority of privileged documents had already been identified using keyword searches. Hence, the probability of additional privileged documents existing in the search results would be lowered significantly. The remainder of the privilege and confidentiality review will be primarily for the purpose of identifying confidential information. Confidentiality per se is no bar to discovery although “the court should order a controlled measure of discovery … upon terms ensuring that there should be neither use nor further disclosure of the confidential information to the prejudice of the party concerned”: see Singapore Civil Procedure 2007, paragraphs 24/3/37–38; and the Riddick principle prevents the use of documents (confidential or otherwise) disclosed in court proceedings for any purpose other than the proceedings in which it was disclosed: see Hong Lam Marine Pte Ltd and another v Koh Chye Heng [1998] 3 SLR(R) 526; [1998] SGCA 60. In the event that confidential information is identified, the prejudice to the plaintiff is low since this was still a solicitors-only review for the defendant and the documents concerned would not have been shown to the defendant. The plaintiff may still claw back the confidential document or redact the irrelevant portions. It was therefore crucial that the plaintiff complete his privilege and confidentiality review within the allotted time. However, I was also mindful of the perception which the defendant held that it had been deprived of access to documents which had been seized under the search orders by reason of the time that the plaintiff is taking to complete his privilege and confidentiality review.

[40] In order to expedite the pending suit, which had been stalled for some time by reason of the dispute over the how the confidentiality and privilege review should be completed, I granted an extension of time for the plaintiff to complete his confidentiality review within 4 weeks and permitted defendant’s solicitors to commence substantive review of the search results (less excluded material). During these 4 weeks, only the defendant’s solicitors may review the search results (less excluded material). After the expiry of 4 weeks, the defendant would then be permitted access to the documents. For the plaintiff, since these are his documents, he was permitted access so that he can properly instruct his solicitors. I further granted liberty to apply in the event that parties are unable to agree on the claw back or redaction of any confidential document which is not relevant to these proceedings.

[41] I turn now to the mode and manner of giving discovery of the search results (less excluded material). As these were documents in the possession, power and custody of the plaintiff’s, I directed that discovery of the documents forming the search results (less excluded material) be given by the plaintiff. I further directed that in addition to the usual requirement of an affidavit verifying list of documents filed by the plaintiff, the computer experts who were involved in the performance of the reasonable search should also depose to the methodology and process of performing the keyword searches in a joint affidavit. This is because the plaintiff, who is giving these documents in discovery, is relying on their expertise to conduct the keyword searches using the list of relevant keywords, which in turn identify the documents that are given in discovery. Hence, it was appropriate that the computer experts who conducted the keyword searches should file a joint affidavit (if possible) on how the searches were conducted. In the event that they are unable to agree on the text of a joint affidavit, then each should file an affidavit to the same effect.