Yoder & Frey Auctioneers, Inc. v. EquipmentFacts, LLC

OPINION

Defendant, EquipmentFacts, LLC (“Efacts”), appeals from the judgment entered by the United States District Court for the Northern District of Ohio imposing liability and damages in a civil suit brought by Plaintiffs, Yoder & Frey Auctioneers, Inc. Yoder & Frey) and RealtimeBid.com, LLC (“RTB”). Specifically, Efacts appeals from the district court’s denial of spoliation sanctions; denial of hearsay objections to various documents produced by internet service providers; denial of summary judgment and judgment as a matter of law on Plaintiffs’ Computer Fraud and Abuse Act (“CFAA”) claim; and imposition of sanctions under Federal Rule of Civil Procedure 37. For the reasons set forth below, we AFFIRM the district court’s decisions.

I. BACKGROUND

Yoder & Frey is an Ohio company that hosts auctions for used construction equipment. Its largest and most profitable'auction is held annually in Florida. Efacts is a New Jersey company owned by Lawrence Garafola that provides auctioneers with online bidding platforms. In 2003, Yoder & Frey began offering the opportunity for buyers to submit live bids over the Internet during the Florida auction, and it contracted with Efacts to provide online bidding services for that purpose. As part of this relationship, Efacts received, stored, and maintained confidential customer information relating to Yoder & Frey’s auctions. In early 2008, however, the companies had an acrimonious falling out and Yoder & Frey terminated the contract.

At this point, Yoder & Frey hired RTB, another online bidding services company. RTB created a custom online auction plat *1069 form and used that software during Yoder & Frey’s Florida auction in 2010, which took place from February 8 through February 16, 2010. As part of its services, RTB accepted online bidder applications and, in conjunction with Yoder & Frey, reviewed and approved prospective bidders who wished to participate in the auction.

At trial, Plaintiffs presented evidence that on February 7, 8, and 9, 2010, Efacts accessed the RTB bidding platform without authorization by utilizing an RTB administrative username (“test”) and password (“test”). The platform recognized this administrative login as bidder number 100051. Specifically, it was Efacts’ owner Garafola who improperly accessed the auction. He was aware of the username and password combination from Efacts’ prior relationship with Yoder & Frey. Bidder number 100051 submitted two winning bids with a combined price of $41,000 for which it did not pay.

Plaintiffs also put forth evidence that on February 10 and 11, 2010, an Efacts employee gained unauthorized access to the RTB auction platform by posing as one of Yoder & Frey’s customers, Allied Erecting. 1 During the auction, “Allied Erecting” was assigned bidder number 102703. In that two-day span, the employee placed eighteen winning online bids with a combined purchase price of $1,212,074 for which neither she nor Efacts paid.

Plaintiffs only learned of Efacts’ unauthorized access after contacting Allied Erecting for payment of the eighteen items. Allied Erecting informed Yoder & Frey that it had not registered for the 2010 auction and had not placed any bids. After an exhaustive probe by Plaintiffs, it was confirmed that Allied Erecting had not registered and did not bid on the items, but that someone using Allied Erecting’s information had gained access to and participated in the auction.

Knowing only that bidder numbers 102703 and 100051 had placed winning bids, Plaintiffs first had to determine the IP addresses from which the bids had been placed. To obtain this information, Justin Clark, who worked for both Yoder & Frey and RTB, contacted Rich Mavro-geanes, the owner of the server hosting the auction. Clark requested, and Mavro-geanes supplied, all the data from the server regarding the auction from February 6 through February 13, 2010, a total of over 35 million lines of information. The parties refer to this information as the IIS log or the digital log. It contained a record of all activity that took place on the online bidding system during the relevant time period.

Clark searched the digital log using various key words, including the two bidder numbers, the usernames and passwords for the two bidder numbers, and “Allied ER.” During this investigation, Clark identified ten IP addresses that were associated with winning bids and other auction activity. Having identified ten suspicious IP addresses, subpoenas were issued to internet service providers (“ISPs”) Covad, Century Link, and two Verizon companies, based on the dates and times that each bidding session started for each IP address. All ten IP addresses, including those utilized during the sessions when winning bids were placed, were traced to Efacts.

Upon learning this information, Yoder & Frey and RTB filed suit against Efacts. Following a jury trial of this -cause, a ver- *1070 diet was rendered in Plaintiffs’ favor. This timely appeal followed.

II. DISCUSSION

A. Spoliation Sanction

We review a district court’s decision whether to impose a spoliation sanction for an abuse of discretion. Adkins v. Wolever, 692 F.3d 499, 503 (6th Cir.2012) (hereinafter, Adkins II). “A court abuses its discretion when it commits a clear error of judgment, such as applying the incorrect legal standard, misapplying the correct legal standard, or relying upon clearly erroneous findings of fact.” Jones v. Ill. Cent. R. Co., 617 F.3d 843, 850 (6th Cir.2010) (internal quotation marks omitted).

“[A] federal court’s inherent powers include broad discretion to craft proper sanctions for spoliated evidence.” Adkins v. Wolever, 554 F.3d 650, 651 (6th Cir.2009) (en banc). A party seeking a spoliation sanction because evidence was destroyed must establish “(1) that the party having control over the evidence had an obligation to preserve it at the time it was destroyed; (2) that the records were destroyed with a culpable state of mind; and (3) that the destroyed evidence was relevant to the party’s claim or defense such that a reasonable trier of fact could find that it would support that claim or defense.” Beaven v. U.S. Dep’t of Justice, 622 F.3d 540, 553 (6th Cir.2010) (internal quotation marks omitted). 2 A district court “may impose many different kinds of sanctions for spoliated evidence, including dismissing a case, granting summary judgment, or instructing a jury that it may infer a fact based on lost or destroyed evidence.” Automated Solutions Corp. v. Paragon Data Sys., Inc., 756 F.3d 504, 513 (6th Cir.2014) (internal quotation marks omitted). The severity of sanction issued is determined on a case-by-case basis, depending in part on the spoliating party’s level of culpability. Flagg v. City of Detroit, 715 F.3d 165, 178 (6th Cir.2013).

In its motion in limine, its motion for reconsideration, and again in its post-trial Rule 50 motion for judgment as a matter of law, Efacts argued that the software and hardware RTB used during the Florida auction, and the original logs those systems produced, were essential pieces of evidence. Efacts denied placing the false bids, contested the accuracy and reliability of the RTB system and its logs, and raised the possibility that the system was infected by a virus or otherwise corrupted. Efacts contends that the destruction of the software, hardware, and logs severely hampered its ability to defend itself.

The district court, after recounting the elements of the Beaven test, denied the motion on the basis that Efacts had not made a sufficient showing of relevance. Specifically, the court held that Efacts “needed to show that what it would discover was actually relevant, not just that it may have found relevant material if it uncovered a defect in the plaintiffs’ software system.” Yoder & Frey Auctioneers, Inc. v. EquipmentFacts, LLC, 2013 WL 6180696, at *1 (N.D.Ohio Nov. 25, 2013). The district court never made an explicit finding on the first two prongs of the Beaven test.

To establish relevance under Beaven, the moving party must make “some showing indicating that the destroyed evidence would have been relevant to the contested issue.” 622 F.3d at 554. *1071 In this context, we have held that “relevant” means:

something more than sufficiently probative to satisfy Rule 401 of the Federal Rules of Evidence. Rather, the party seeking an adverse inference must adduce sufficient evidence from which a reasonable trier of fact could infer that the destroyed [or unavailable] evidence would have been of the nature alleged by the party affected by its destruction.

Automated Solutions, 756 F.3d at 514 (internal quotation marks omitted; brackets in original). To make this showing, the moving party “may rely on circumstantial evidence to suggest the contents of destroyed evidence.” Beaven, 622 F.3d at 555.

As previously discussed, Efacts argues that because it only had access to the digital copy of the logs and not the underlying evidence, it was unable to properly challenge Plaintiffs’ claims and determine whether the RTB system accurately and reliably recorded associations between specific bids and IP addresses. Before the district court, Efacts pointed out that RTB’s auction platform was a “prototype” and that bugs and errors are to be expected in , any new software. It also made much of the fact that the system may have had security vulnerabilities and was “fully exposed to the public internet.” [R. 77-1, Mem. of Law in Support of Mot. in Limine and Summ. J., § IV.C.] However, the testimony Efacts cited for these propositions does not bear out its claims. The third-party software developer expressed full confidence in RTB’s system’s ability to accurately log bids placed during the auction and explained that it was protected by a firewall and sophisticated antivirus software.

Whether Efacts presented evidence whereby the jury could infer that the auction platform was error-prone is a question of fact. The district court implicitly found that conjecture does not constitute evidence, and that Efacts did not otherwise provide any evidence for a reasonable trier of fact to infer that the RTB system was faulty or corrupted. Because this finding was not clearly erroneous, we will not disturb the district court’s determination that a spoliation sanction was unwarranted.

B. Business Records Exception

When presented with a challenge to a district court’s evidentiary determinations, this Court reviews de novo “the [lower] court’s conclusions of law, e.g., the decision that certain evidence constitutes hearsay, and reviews for clear error the court’s factual determinations that underpin its legal conclusions.” United States v. McDaniel, 398 F.3d 540, 544 (6th Cir.2005) (internal quotation marks omitted). “This standard is consistent with the Supreme Court’s admonition in General Electric Co. v. Joiner, 522 U.S. 136, 142 [118 S.Ct. 512, 139 L.Ed.2d 508] (1997), that we review evidentiary decisions for an abuse of discretion, because it is an abuse of discretion to make errors of law or clear errors of factual determination.” Id. (citation omitted).

Federal Rule of Evidence 803(6), commonly referred to as the business records exception to the bar against hearsay, provides for the admission of documents if certain conditions are met. To qualify for admission under Rule 803(6), a business record must satisfy four requirements: (1) it must have been created in the course of a regularly conducted business activity; (2) it must have been kept in the regular course of that business; (3) the regular practice of that business must have been to have created the document; and (4) the document must have been created by a person with knowledge of the transaction or from information transmitted by a per *1072 son with knowledge. United States v. Baker, 458 F.3d 513, 518 (6th Cir.2006). A custodian or otherwise qualified witness must attest that the proffered document meets these conditions. Fed.R.Evid. 803(6)(D).

At trial, Plaintiffs presented testimony from a representative of each of the four ISPs, and those witnesses produced documents identifying IP addresses assigned to Efacts as the same IP addresses that accessed the RTB system at specified times during the February 2010 auction. Efacts argued that each of the ISP representatives failed to testify to at least one of the conditions required by Rule 803(6). The district court overruled the objection as to each ISP representative, finding that on direct examination the witnesses’ testimony established that the documents satisfied the requirements of the business records exception. The court also found that though the depth of each witness’ knowledge was tested on cross-examination, the foundation for admitting the records was not undone.

It is undisputed that the documents admitted into evidence were business records. 3 We agree with the district court’s determination that the documents themselves and the testimony provided by the ISPs’ custodians satisfy the requirements of Rule 803(6).

C. Computer Fraud and Abuse Act Claim

This Court reviews “a district court’s denial of a Rule 50(b) motion de novo, applying the same deferential standard as the district court.” Radvansky v. City of Olmsted Falls, 496 F.3d 609, 614 (6th Cir.2007). We do not weigh the evidence, question the credibility of the witnesses, or substitute our judgment for that of the trier of fact. K & T Enters., Inc. v. Zurich Ins. Co., 97 F.3d 171, 175-76 (6th Cir.1996). The motion may be granted only if in viewing the evidence in the light most favorable to the non-moving party and drawing all reasonable inferences in its favor, there is no genuine issue of material fact for the jury, and reasonable minds could come to but one conclusion, in favor of the moving party. Radvansky, 496 F.3d at 614.

Plaintiffs alleged that Efacts violated the Computer Fraud and Abuse Act by intentionally accessing “a protected computer without authorization, and as a result of such conduct, cause[d] damage and loss.” 18 U.S.C. § 1030(a)(5)(C). 4 The CFAA is primarily a criminal statute, but it provides for a civil right of action and economic damages in certain circumstances, such as when a violator causes “loss” of at least $5,000 in value to one or more persons during any one-year period. See id. §§ 1030(g), (e)(4)(A)(i)(I). Here, the jury found in favor of Plaintiffs, but only awarded damages to RTB.

To prevail on their claims, Plaintiffs were required to show that Efacts’ actions caused both “damage” and “loss.” See id. § 1030(a)(5)(C). “Damage” is statutorily defined as “any impairment to the integrity or availability of data, a program, a 2system, or information.” Id. § 1030(e)(8). 5 “Loss” means

*1073 any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service.

Id. § 1030(e)(ll). Although Efacts perfunctorily contends that Plaintiffs failed to establish “damage,” the focus of its argument is that RTB was not entitled to a recovery because it failed to produce evidence establishing that it incurred damages resulting from an “interruption in service,” and therefore it failed to demonstrate “loss.”

The district court rejected this argument. It found that Plaintiffs had provided sufficient evidence that Efacts’ action denied service to Yoder & Frey’s other bidders by fraudulently occupying bidding slots (i.e., when Efacts placed a $10,000 bid on an item, no other auction participant could bid $10,000 on that same item) on which it had no intention of making good. By crowding out legitimate bids, the court reasoned, Efacts caused an interruption in service. The district court did not believe it was necessary for Plaintiffs to establish that Efacts’ conduct completely overwhelmed the system or rendered it inoperable.

First, Plaintiffs presented evidence sufficient to establish that Efacts caused “damage.” Justin Clark testified: “If ultimately the winning bid was for $10,000, it would have prevented [an auction participant] not only from bidding but from actually winning the item. So a false $10,000 winning bid would have precluded a legitimate buyer from actually acquiring that item at $10,000.” [R. 139, Tr. Trial I, PGID 2539-40.] By placing false bids and occupying bidding slots, Efacts impaired the integrity of the program and/or system because legitimate bidders were unable to bid that same amount. See 18 U.S.C. § 1030(e)(8) (defining damage). Stated differently, Efacts’ conduct interfered with the ability of the auction platform to function as intended — true bidders were unable to acquire the items at issue for their lowest possible price.

Second, and at issue here, Plaintiffs also demonstrated that Efacts caused “loss” by accessing the auction platform without authorization and fraudulently using the bidding system. Clark testified that his probe into the false bidding took him between 200 and 300 hours to complete and that his typical hourly billing rate is between $100 and $200. “Loss” is defined in the disjunctive — it includes “any reasonable cost to any victim including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense.” 18 U.S.C. 1030(e)(ll). It also encompasses “any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service.” Id. If a plaintiff is able to establish a loss of at least $5,000 in value, whether that be composed solely of costs identified in the first clause, or solely costs identified in the second clause, or a combination of both, then he may recover under the statute. See Nexans Wires S.A. v. Sark-USA, Inc., 166 Fed. *1074 Appx. 559, 563 (2d Cir.2006) ("[Tihe plain language of the [CFAA] treats lost revenue as a different concept from incurred costs, and permits recovery of the former only where connected to an `interruption in service.' ").

Efacts' actions required RTB to investigate the offense and conduct a damage assessment, thereby causing "loss." See A.V. ex rel. Vanderhye v. iParadigms, LLC, 562 F.3d 630, 646 (4th Cir.2009) (holding that "loss" is broadly defined and "plainly contemplates . . . costs incurred as part of the response to a CFAA violation, including the investigation of an offense"). Thus, contrary to Efacts' belief, it was not necessary that Plaintiffs establish that an "interruption in service" occurred. It is equally unnecessary, for disposition of this case, that we delineate the scope of "interruption in service," and we decline to do so.

In sum, when the evidence is viewed in the light most favorable to Plaintiffs, and all reasonable inferences are drawn in their favor, we conclude that there was ample basis for the jury to find that Efacts caused Plaintiffs damage and loss when it accessed the auction without authorization, thereby violating the CFAA.

D. Rule 37 Sanctions

We review a district court's imposition of Rule 37 sanctions for an abuse of discretion. Sommer v. Davis, 317 F.3d 686, 692 (6th Cir.2003) (citation omitted).

Federal Rule of Civil Procedure 36 provides for parties in litigation to serve on any other party written requests to admit the truth of any non-privileged matter relevant to any party's claim or defense, including matters of fact and the genuineness of documents. Fed.R.Civ.P. 36(a)(1).

Federal Rule of Civil Procedure 37 provides:

(2) Failure to Admit. If a party fails to admit what is requested under Rule 36 and if the requesting party later proves a document to be genuine or the matter true, the requesting party may move that the party who failed to admit pay the reasonable expenses, including attorney's fees, incurred in making that proof. The court must so order unless:

(A) the request was held objectionable under Rule 36(a);

(B) the admission sought was of no substantial importance;

(C) the party jailing to admit had a reasonable ground to believe that it might prevail on the matter; or

(D) there was other good reason for the failure to admit.

Fed.R.Civ.P. 37(c).

In the instant case, Plaintiffs made a post-trial motion for Rule 37 sanctions against Efacts for allegedly improperly denying five requests for admission during discovery. The district court reviewed the requests at issue-numbers 3, 10, 11, 12, and 13-and the submissions of the parties, and ultimately ruled in Plaintiffs' favor, sanctioning Efacts $25,879.31 for attorneys' fees and costs incurred in proving the matters at trial.

i. Request for Admission 3

Plaintiffs asked Efacts to "{a]dmit you accessed the online bidding system provided for Yoder & Frey's February, 2010 Florida auction using the username of Allied Erecting & Dismantling, Inc. (Buyer Number 102703)." [R. 131-2, Reqs. for Admiss.] "You" was defined as "Equi-mentfacts, LLC, its representatives, agents, officers, directors, and employees, including, but not limited to, Larry Garafo-la." [[Y;117;2216;134;2245]Id.] Efacts denied this, but at trial, one of the company's employees admitted that she created a bidding account using the name of Allied Erecting's owner. Ga- *1075 rafola admitted that he knew that his employee accessed Plaintiffs’ auction using Allied Erecting’s credentials, but explained that he denied the request for admission because he did not believe his employee’s actions were attributable to Efacts. More specifically, he believed that because the employee’s conduct was against company policy her conduct could not be imputed to the company.

In reviewing the motion for sanctions, the district court considered whether Efacts “had reasonable grounds to believe it would prevail by convincing the jury it had no vicarious liability for [its employee’s] actions.” Yoder & Frey, 2013 WL 6180696, at *7 (citing Fed.R.Civ.P. 37(c)(2)(C)). Having previously determined that Florida law governed this claim, the court found that the employee’s conduct was within the scope of her employment because under Florida law “conduct may be within the ‘scope of employment’ even if it is unauthorized, if it is of the same general nature as, or sufficiently similar to, authorized conduct.” Id. (quoting Padgett v. Sch. Bd. of Escambia Cnty., 395 So.2d 584, 586 (Fla.Dist.Ct.App.1981)). Accordingly, the district court concluded that Efacts did not have reasonable grounds to believe that it would prevail on this issue.

Before awarding sanctions, the district court noted its “hesitation] to sanction a party for failing to admit a question that is a pillar of the case’s ultimate issue.” Id. at *8. The court went on to explain that “[w]here a party has a reasonable belief it may prevail,” courts should not sanction that party in the event it does not prevail. Id. However, because Efacts did not have reasonable grounds to believe it might prevail, the district court awarded nominal sanctions and costs in order to “effect the principle of accurate admission responses without compromising the principle of allowing juries to decide reasonably contestable issues.” Id.

Efacts does not assign error to the district court’s application of Florida law; rather, before this Court, it argues that because the jury had to decide the contested issue of when Garafola became aware that an employee accessed Plaintiffs’ auction without authorization, it could deny the request in good faith. 6 However, Efacts did not make this timing argument to the district court and, as a result, has forfeited its right to have argument addressed on appeal. See Poplar Creek Dev. Co. v. Chesapeake Appalachia, L.L.C., 636 F.3d 235, 242 n. 5 (6th Cir.2011).

The district court held that Efacts did not have reasonable grounds to believe that it cou,ld convince the jury that it was not liable for its employee’s actions. Because “you” in the request for admission included “employees,” and Florida law allows for vicarious liability for unauthorized conduct that occurs within the scope of employment, the district court did not abuse its discretion in awarding sanctions for Efacts’ failure to admit Request 3. 7 Indeed, Rule 37 requires the district court to impose sanctions if the non-moving party’s conduct does not fall into one of the subsection (c)(2) safe harbors.

B. Requests for Admission 10, 11, 12 and 13

Requests 10 through 13 asked Efacts to admit that four internet-service- *1076 provider-logs documenting who leased an IP address on given date and at a specific time were authentic business records as defined by Federal Rules of Evidence 803(6) and 902(11). Efacts stated that it was unfamiliar with the business records of the ISPs and without knowledge or information sufficient to admit or deny the requests. Plaintiffs deposed three ISP representatives and called the fourth as a witness at trial to authenticate the records. The district court denied Efacts’ motion in limine to bar the records as hearsay and overruled Efacts’ objections at trial when the records were introduced.

“The answering party may assert lack of knowledge or information as a reason for failing to admit or deny only if the party states that it has made reasonable inquiry and that the information it knows or can readily obtain is insufficient to enable it to admit or deny.” Fed.R.Civ.P. 36(a)(4). Before the district court, Efacts did not claim it made a reasonable inquiry into the records’ authenticity; instead, it argued that it was unable to know the authenticity of another company’s records. However, eschewing form over substance, the district court looked beyond the language of the response to determine whether Efacts actually inquired into the authenticity of the records. The court found that during the entirety of the litigation, Efacts never argued that it made the required inquiry and only pointed to perceived shortcomings in Plaintiffs’ authentication efforts. Accordingly, the court concluded that Efacts was unable to demonstrate that it had a reasonable ground to believe it could establish that the documents were not authentic. Because Plaintiffs prevailed in showing that the records were admissible, and Efacts’ failure to admit was not protected by any Rule 37(c)(2) safe harbor, the district court awarded sanctions.

The district court’s finding that Efacts never stated it made a reasonable inquiry and that it was unable to show that it actually inquired is not clearly erroneous. Moreover, Efacts’ assertion that “even if [it] had admitted the authenticity of the ISP documents, Plaintiffs would still have been required to prepare for and put on at least a portion of the same or similar testimony” from the ISP representatives is meritless. [Appellant’s Br., § IV.C.]; see United States v. Johnson, 831 F.2d 124, 129 (6th Cir.1987) (pointing out that hearsay objections could be overcome via the business records exception where the objecting party stipulated prior to trial that the documents at issue were authentic business records). Therefore, we conclude that the district court did not abuse its discretion in awarding sanctions.

III. CONCLUSION

For the foregoing reasons, the judgment of the district court is AFFIRMED in its entirety.