Court Says Deleting Browser History To 'Avoid Embarrassment' Isn't Destruction Of Evidence
from the those-that-delete-the-past-are-doomed-to-repeat-it dept
A court order demanding the retention of digital evidence morphed into the worst-case scenario for a defendant in a Canadian “breach of confidence” lawsuit. Even though the defendant’s actions were ultimately deemed lawful, the intended effect of the questioned action was undone by the judicial discussion of them.
Melissa Caldwell of CyberLex has more details on the events leading up to this unfortunate conclusion:
The underlying action arose after Moyse, who had been employed by Catalyst, left the company to take a position with a competing investment management firm. Catalyst brought an action for breach of confidence for the alleged misuse of confidential information regarding a target company in which Catalyst had unsuccessfully attempted to acquire an interest. Subsequently, the target company was successfully acquire by Catalyst’s competitor, and Catalyst claimed Moyse had delivered Catalyst’s confidential information to its competitor and its competitor had used it in the successful acquisition.
After Moyse had joined the competitor company and before this action was commenced, Catalyst obtained a consent order requiring Moyse and the competitor company to preserve and maintain all records in their possession, power or control “relating to Catalyst and/or related to their activities since March 27, 2014 and/or related to or was relevant to any of the matters raised in the Catalyst action.” The order required specifically that Moyse turn over his computer to counsel for forensic imaging of the data stored on it.
However, before turning his personal computer over to his lawyer, Moyse deleted his personal browsing history and purchased software entitled “RegCleanPro” to further delete registry information.
Catalyst claimed Moyse had destroyed evidence by deleting his browser history. Moyse countered that the preservation order did not specify his computer needed to be kept in “as is” condition — free from any alterations until it could be imaged. He also pointed out that Catalyst was interested in company documents, rather than his personal internet use. And he had a very good reason for deleting his browser history, seeing as the contents of his computer were about to be made public — a reason the court sympathized with [PDF] when considering the implications of the preservation order.
I accept Mr. Moyse’s evidence as to why he deleted his internet browsing history. There is no evidence to contradict his statements as to why he deleted his internet browsing history. He was a young man at the time who had a very close relationship with his girlfriend who is now his fiancée. He did not want his internet searching to become part of the public record.
The court found that the documents central to the lawsuit were not affected by Moyse’s actions. They were available through Dropbox accounts and forensic examiners found no evidence Moyse had ever transferred the documents to his personal Dropbox account. In addition, they found the last time he accessed his account predated his work on the disputed documents.
As for Moyse, his attempt to keep his access of porn sites under wraps backfired. He may have been cleared of evidence spoliation accusations, but his personal web browsing habits still made it into the public record — albeit without the excruciating level of detail that would have been present if he hadn’t thought to scrub his browsing history before turning over the computer.
Filed Under: browser history, evidence, evidence destruction
Comments on “Court Says Deleting Browser History To 'Avoid Embarrassment' Isn't Destruction Of Evidence”
A Lesson for Us All
And that, children, is why you set your browser to clear out everything when you close it down. Something done automatically and on a daily basis cannot then be claimed to be destruction of evidence.
Re: A Lesson for Us All
Or be prepared to have your lawyer forward some unusual instructions to investigators.
“My client’s browser history is like the necronomicon. Under no circumstances should you open it, and if you do open it, you absolutely should not read from it.”
Re: Re: A Lesson for Us All
Klaatu… verata… n… Necktie. Nectar. Nickel. Noodle.
I never get it right!
Re: A Lesson for Us All
Or, even better, just set your browser to never keep the history to begin with. An i mean all the history.
Re: A Lesson for Us All
No, use private browsing instead.
Private tabs?
Who doesn’t use a private window/tab when browsing … uh … techdirt?
Re: Private tabs?
Private tabs?… nah go full tor on a baseline imaged computer that auto restores after use with the 31 gutman pass between imaging.
Re: Re: Private tabs?
Or just use a live CD on a system with no hard disks.
Re: Re: Re: Private tabs?
Ya beat me to it. 😉
Re: Re: Private tabs?
As the other AC pointed out, it’d be a lot easier to just use TAILS https://tails.boum.org/
Take your privacy seriously, because no one else will.
the unanswered question.
Did his fiance stay his fiance now that she is sure to have heard about it?
Embarking facts are great leverage
“…but his personal web browsing habits still made it into the public record…”
Of course they did. Lawsuits today aren’t about the legal issues at hand. They’re about which party can make it so expensive for the other party, that will force the latter party has to surrender.
That can be either a matter of who has deeper pockets, or who has the most embarrassing facts to hide. And, if the latter, who cares if those facts are relevant to the legal issues at hand? Usually, NOT the judge.
If Mr. Moyse wanted those facts kept private, he should have surrendered to Catalyst demands.
That’s exactly wrong, but a win by any means is a win.
Re: Embarking facts are great leverage
You do realize that this guy wasn’t the defendant, right? I know all the stuff you said sounds good, but it doesn’t really apply to this case.
Re: Re: Embarking facts are great leverage
It doesn’t matter. He’s tied to the defendant, and their defense depends upon his cooperation.
They sue you; then they involve your wife, son, daughter, employer, church…anyone they can find a tenuous theory to tie to your case and increase the leverage on you to surrender.
So ask yourself, since they weren’t suing him, why were they tearing his house apart? Right, looking for leverage on him, so he would surrender and quit his new job. (Or get fired.) Which would be what they really wanted, wouldn’t it?
This lawsuit was BS from the start. He quit, went to work for a competitor…and he must be punished. That’s what the lawsuit was about. Think they’ll give up now that they have a pound of his flesh? Somehow I doubt it.
Popper preventative maintenance
Popper preventative maintenance.
And here I thought that, clearing the browser cache and history was popper preventative maintenance. that should be done routinely.
Along with Registry error correction and compaction. FAT integrity checks, HDD de-fragmentation, slack space wipe.
I guess that doing the right thing can get one labeled a criminal.
Re: Popper preventative maintenance
Malibu Media tried to argue that having maintenance programs like CCleaner on your computer is a sign of guilt, since you must have tried to erase evidence that you downloaded one of their files.
Whatever has also argued that if you don’t look suspicious, it means you took steps to appear so and therefore are inherently suspicious.
Dumbfuck logic, but these are the idiots running the world right now.
Re: Re: Popper [sic] preventative maintenance
Cleaning your browse history and wiping your hard drive is normally a good thing, just like shredding all your personal documents. But once you get a subpeona, you aren’t supposed to do either one.
This guy got let off the hook because the judge decided that what he destroyed wasn’t relevant to the case. I can’t say for sure whether that’s right, but I think the judge did the public a disservice. Sucks to get subpoenaed, but once it happens people have to take it seriously. When weighing the options the decision has to be that destroying the evidence is going to be worse than turning it over and letting the chips fall where they may. If burning the evidence is less risky than turning it over, why not just give the middle finger to the system?
Of course the other side of that is that system is going to work a lot better if people have some confidence that what get subpoenaed is going to stay private. Courthouse leakers need to end up worse off than the armed robbers, but that will probably never happen.
Re: Re: Re: Popper [sic] preventative maintenance
When issued a subpoena one is not allowed to put out the trash … what to do when the HOA starts harping on your pile of evidence.
Has this guy never heard about FF add-ons:
BetterPrivacy
That does all for you automatically, once you close the browser down.
And yes, there are similar tools for Chrome, etc….
Re: Re:
You don’t need an add-on, just check the box “clear history when Firefox closes”.
Maybe a dumb question but why did the internet history become public? When it has nothing to do with a case then why should it ever turn up after the investigators have searched for evidence and turned it down as not important?
Yes it’s embarrassing to have strangers look through all your stuff. But everything that has nothing to do with illegal activities should stay between you and the investigators who have certainly a requirement to not talk about private stuff of the persons they investigate.
Just run your browser in a sandbox like sandboxie delete it when done.