Matter of Nunz

[*1] Matter of Nunz 2016 NY Slip Op 51185(U) Decided on August 9, 2016 Surrogate's Court, Erie County Howe, J. Published by New York State Law Reporting Bureau pursuant to Judiciary Law § 431. This opinion is uncorrected and will not be published in the printed Official Reports.

Decided on August 9, 2016
Surrogate's Court, Erie County

In the Matter of the Estate of William R. Nunz, Sr., Deceased.



2012-4075/A



JOHN RICHARD STREB, ESQ.

Attorney for Preliminary Executor Mary Jane Nunz

MICHAEL O. MORSE, ESQ.

Attorney for Objectants William Nunz, Jr., Michael Nunz,

Kathleen Danheiser, and Tambra Nunz

LAW OFFICES OF SHELBY, BAKSHI & WHITE

Attorneys for Estate of Wendy Fecher

Justin S. White, Esq., of Counsel

DEBORAH A. BENEDICT

Appearing Pro Se
Barbara Howe, J.

Decedent died at age 79 on September 22, 2012, survived by his wife, Mary Jane Nunz [hereafter, Mary Jane], and six children from a prior marriage: William Nunz, Jr. [hereafter, William Jr.], Michael Nunz [hereafter, Michael], Kathleen Danheiser [hereafter, Kathleen], Tambra Nunz [hereafter, Tambra], Wendy Fecher [hereafter Wendy],[FN1] and Deborah Benedict [hereafter, Deborah]. His Will, dated August 17, 2012, was offered for probate on October 18, 2012 by his nominated executrix, Mary Jane.

Preliminary letters testamentary were issued to Mary Jane on November 7, 2012. An SCPA 1404 hearing was held in January, 2013, at which Keith Perla, Esq., the attorney draftsperson and witness to the Will's execution, and his wife (the other Will witness) testified. Following the hearing, objections were filed by all six of decedent's children. On December 22, 2015, Deborah withdrew her objections, but all other objections remain pending.

During the on-going discovery, Perla stated in an affidavit that he had "prepared the will using a Microsoft Word for Mac word processing program on an Apple IMAC computer," that [*2]he had "deleted the digital file [he] had created in preparing the will immediately after printing a copy of the will," and that "any computer files or other materials relating to the preparation of this will which were created and/or stored in electronic or digital format have been destroyed or no longer exist" (emphasis added).

As a result of this acknowledgment, William, Michael, Kathleen, and Tambra [collectively referred to here as the Morse objectants] have sought production of the computer used by Perla in preparing decedent's Will, and they seek electronically stored information [ESI] from the computer about the draft of the Will by means of forensic analysis. The estate has opposed production and forensic analysis of the computer, and has requested, inter alia, that this Court grant a protective order.

On August 24, 2015, I issued a Memorandum and Order in which I deferred decision on the production and forensic analysis request and directed the submission of certain information from the Morse objectants' proposed forensic expert. Once that information had been provided, and the parties had briefed the issues further, I set the matter down for an evidentiary hearing.

On April 20, 2016, the evidentiary hearing took place, on consent of the parties, before the Chief Attorney of this court on a hear and report basis. The parties waived the filing of a written referee report and consented that I could decide the issues on the record before me (SCPA 506[6][c]).

The parties have since submitted papers detailing their legal positions, and I now find and decide as follows.

(A)

In my August 24, 2015 decision, I discussed the general principles involved in the discovery request before me. Briefly, the law requires "full disclosure of all matter material and necessary in the prosecution or defense of an action, regardless of the burden of proof" (CPLR 3101[a]). When there is a dispute as to whether production is "material and necessary," "[t]he test is one of usefulness and reason" (Allen v. Crowell-Collier Publ. Co., 21 NY2d 403, 406 [1968]:

"The terms material' and necessary' are liberally construed to further the disclosure of any facts bearing on the controversy which will assist preparation for trial by sharpening the issues and reducing delay and prolixity' (Allen v. Crowell-Collier Publ. Co., 21 NY2d 403, 406; see Reid v. Soults, 114 AD3d 921, 922)" (Kaous v. Lutheran Med. Ctr., 138 AD3d 1065, 1068 [2016]; see also Matter of Aylward v. Assessor, City of Buffalo, 125 AD3d 1344 [2015] and Rawlins v. St. Joseph's Hosp. Health Ctr., 108 AD3d 1191 [2013]).

Furthermore, the type of ESI which may be gleaned by a forensic analysis of [*3]the hard drive of Perla's computer is clearly discoverable (see, Tener v. Cremer, 89 AD3d 75, 78-79 [2011], Matter of Irwin v. Onondaga Cty. Resource Recovery Agency, 72 AD3d 314, 319-320 [2010], and Matter of Tilimbo, 36 Misc 3d 1232A [2012]).

(i)

Perla testified at the hearing that, in drafting the Will in question, he used "an Apple iMac [computer], around ten years old." Perla was asked about his usage of that computer after decedent's August, 2012 Will had been drafted on it:

"Q. With regard to the computer at issue, has that been the computer you have done your legal work on since the day you did —A. Yes.Q. — this will?A. Yes.Q. Did you use any other computer?A. I might have. I mean, I might have used other computers, sure.Q. All right. Could you characterize — and I understand it would only be a percentage estimate —A. Well, 95 percent of my stuff is on that computer.Q. Okay. For the time period —A. Of the hundreds of clients I have, yes.Q. Okay. From —A. And all my personal information and personal photos, yes."

In my August 24, 2015 decision, I had directed that "Perla shall ensure that the computer on which he drafted decedent's 2012 Will at issue here is preserved and is not removed, replaced or destroyed pending the further Order of this Court." At the hearing, Perla testified that he had become aware of this direction:

"A. No, no, the computer, I haven't used the computer since the order when they said not to use it and the machine has not been functioning well. It's in the closet and I'm using another computer 'cause it's just very old and it doesn't operate correctly. And then I got nervous I couldn't fix it. If I had gone and fixed it, you know — I didn't fix it, but it's still sitting at my home.Q. Where is the physical location of the computer, in your home?A. It's in my office in my home.Q. Okay. And that's the address you gaveA. Yep.Q. on Quaker Street? Thank you. And is the computer functioning at the present time?A. I — the last time I operated it, it had a question mark on it and I didn't know what that meant and I made some calls and they said, you have to bring it in, and then the order came down. I said, I'm not touching this computer.Q. Okay. So the time the computer stopped functioning was in and around the time the order came out?A. A month — month either way, yeah."

(ii)

The Morse objectants' proposed computer forensic examiner, John Clingerman, also testified at the hearing. Clingerman is employed at D4, LLC — an "international provider of data and discovery services to law firms and corporations"[FN2] — as vice-president of forensic services in its Rochester, New York offices. Based upon his testimony and credentials, I conclude that he qualifies as an expert on the issues before me.

Because the requested production and forensic analysis involve an attorney's computer on which there is undisputedly the potential for finding significant non-relevant confidential information and non-relevant information falling within the attorney-client privilege, it is essential to understand how D4 proposes to proceed in examining Perla's computer for ESI concerning decedent's August, 2012 Will. As to what such an examination would involve generally, Clingerman testified as follows:

"Q. Could you explain step by step what's involved in a computer forensics examination of an Apple iMac computer approximately ten years old?A. Typically what is involved would be, for any forensic analysis, is to remove the hard drive from the computer. That original hard drive that's in the computer is then write protected so it is connected to a hardware device to prevent the forensic person from making any changes whatsoever to that original hard drive. And then from there the data is pulled out of that hard drive — or I should say copied over to another destination piece of media. That destination piece of media is always sterilized ahead of time so it is full of zeros and it has absolutely no data on it whatever. So at the end of the process, what we get as the end result on that destination media is an exact replica of the original piece of media.Q. When you make that copy, what danger is there to the originating computer? Is there any danger of damage?A. No. Everything that we do is forensically sound and it's fully defensible" (emphasis added).

Once Perla's hard drive is copied, Clingerman explained what would be done with the copy:

"Q. The actual storage of a hard drive, the cloned hard drive, where would you put it?A. We have a secure evidence room. While it's under examination, it's in our secure forensic laboratory in Rochester. Very limited access to that room."

Clingerman's testimony also described how D4 would search the cloned data base for relevant ESI:

"Q. And you have observed the will, the purported will in this case?A. I have.Q. And you understand it's a three-page will and that there's a difference with the first page as opposed to the other two, correct?A. That's what I was told, yes.Q. Okay. But you did see the will, is that correct?A. Yes.Q. All right. Now, how do you propose to conduct an investigation that would help us to determine what happened to that will and whether it was actually created on the date Mr. Perla said, whether there are other versions of the will or any other useful information based upon both your experience with D4 and your law enforcement background?A. Quite specifically, we would make a forensic image of the hard drive of that computer. We would then take that forensic image, load it into a software forensic tool and we would conduct examination by doing a couple of very specific things. So it's my understanding that this will was originally in a Microsoft Word document. So I would look in the unallocated space of the computer and I would look for Microsoft Word type of documents. I would also run or execute very specific search terms against that area of the hard drive as well to see if we can find fragments of a deleted file" (emphasis added).

Clingerman acknowledged during cross-examination that his forensic search for relevant ESI using "very specific search terms" would not be without its problems:

"Q. When Mr. Morse asked you what search terms you would use, you suggested that perhaps ten search terms might be appropriate for this particular project. Do you know — and the only specific you gave us was the word Nunz, N-u-n-z. Is it your understanding that the only file with the name Nunz in it on Mr. Perla's computer is the file regarding William R. Nunz, Sr.?A. I have no idea.Q. Did Mr. Morse ever inform you, either by his own communication or by documents, that Mr. Perla has indicated that on his computer he also has files of many other Nunz family members, including William R. Nunz, Jr., Mary Jane Nunz, Michael Nunz and William R. Nunz, Sr. — Jr.s' son. Has he ever told you that?A. I don't recall that being any of our conversations.Q. I'm so sorry, sir. The affidavit of Keith Perla's that you do recall receiving at one point, is that Exhibit 3 or Exhibit 4?MR. SHIFFLETT: It's the earlier exhibit, Mr. Streb. It's the earlier.MR. STREB: Thank you. Would you agree then, sir, assuming hypothetically that there are many other files regarding other Nunz family members on Mr. Perla's computer, would you agree that using the search term Nunz will bring up those files as well if they can still be recovered on the hard drive?MR. MORSE: Objection. Nobody testified to those facts before the Court.MR. SHIFFLETT: It's a hypothetical to an expert. Overruled.A. Certainly.Q. Okay. And would you agree then that that — we're going to get into the confidentiality issues in a moment, but would you agree then that that is going to pose an issue in terms of confidentiality, that if you do recover some document fragments, you may be recovering document fragments for, say, a will for another Nunz family member or a DWI case for another family member or other sensitive matter, would you agree?A. Yes.Q. And would you agree that if you use the word will, w-i-1-1, that could also pose different possibilities? For example, would you agree that if you find the word will, that we've now seen the ASCII binary code equivalent of, that that could reference a text that says the Last Will and Testament. Would [*4]you agree that's one possibility?A. Yes.Q. Would you agree that it could also call up a person's name Will?A. Yes.Q. For example, there's a William R, Nunz, Sr. and a Jr. Would you agree?A. It would certainly find Will.'Q. Would it also potentially call up phrases that say, I will say' or They will call you'?A. Yes.Q. So again, there's a potential here, a very serious potential, that you could be, when you try to do this analysis, looking at completely unrelated confidential files, correct?A. Yes" (emphasis added).

Clingerman also explained who would be doing the forensic analysis of Perla's hard drive:

"A. Initially I would be doing the examination, but when it comes to digital forensics, we pride ourselves, industry standard, to do a peer review of our activities to ensure that we're doing everything correctly, we haven't missed something, in essence leaving no stone unturned.Q. How many other people would be involved?A. I would say probably one other person.Q. So when you use the word team, you're just referring to one other person?A. I have another person that works in the office next to me. My manager is in Chicago and I would discuss my findings with him, as I do all the time and the person who works in my office is a junior member of my team who I [*5]will frequently share results or investigative processes with him.Q. So we've got at least three people that would be having access to Mr. Perla's computer, you, a junior member and your manager?A. We could do it that way" (emphasis added).

Once the forensic examination of the cloned hard drive was completed, Clingerman explained what procedures would be followed in reporting what had been discovered:

" MR. SHIFFLETT: All right. Mr. Morse, before I turn to you for redirect, Mr. Clingerman, what ultimately happens to the cloned hard drive?THE WITNESS: Anything that the client wants to have happen to it. So when a case is resolved, we give the clients a choice and there are actually several choices. We can maintain possession of the cloned hard drives in our evidence vault until whenever they want to have something else occur to it. We can ship that to the client. We can ship it to a third party at their direction. We can have it physically destroyed if they want or we can wipe the hard drive, which means fill it full of zeros and purpose it for another day. So those are the choices.MR. SHIFFLETT: And the client in this case would be Mr. Morse, as you understand where you are at this point in these proceedings?THE WITNESS: Yes, he is my client, but in a situation like this, we can be directed by the Court, we can — you know, opposings could have an agreement. You know, we can do whatever we're instructed to do.MR. SHIFFLETT: I understand. I just wanted to know what your normal procedure is. What happens if, in your search of the cloned hard drive, you find no relevant document, as relevancy is defined for you?THE WITNESS: Whatever we find or don't find gets reported. You know, we're an unbiased third party. We do our search and we provide the findings.MR. SHIFFLETT: And you write a report, is that how it's done?THE WITNESS: It's always done differently. It all depends on what protocol is agreed to between the parties, such as, you know, protocol would consist of search terms and the processes post examination. I mean, the protocol could address how, where, when we're going to do a forensic image, what we're gonna do with it afterwards and how the examination would be conducted, how we report our findings and who we report our findings to and then, you know, in what format and then ultimately what happens to the clone. So it can all be spelled out" (emphasis added).

Finally, Clingerman elaborated on the concept of, and need for, a well-defined protocol before proceeding:

"A. Confidential protocol is the process that we're going to undertake and we have — it's basically rules of engagement and it's determined by the attorneys that are on each side of the matter, so together they devise a plan that we're going to work under and we follow that protocol.Q. The confidential protocols in — so you're expecting a confidential protocol to be developed for this particular case?A. Well, are we talking about protocol or are we talking about, say, the process of nondisclosure? Because which — I'm thinking that's maybe what I'm hearing. So when it comes to the protocol of nondisclosure, again, when we are engaged with clients, sometimes they request of us a very specific nondisclosure agreement, that either they can use our documentation or we can use theirs so — and the protocol may say who we can disclose things to and who we cannot" (emphasis added).

(B)

(i)

I find and conclude that there is a proper basis in the record before me to order the production of Perla's computer on which decedent's August, 2012 Will was drafted and to permit a forensic analysis of its hard drive by D4, LLC. Although Clingerman was not in a position to state with certainty that anything relevant could be recovered due to various unknown factors,[FN3] he pointedly [*6]observed:

"All things considered, I still — I don't know whether or not it's possible. I mean, it's always poss — we have to look. Until we look, we don't know" (emphasis added).

Furthermore, I am satisfied that the forensic examination process can be properly carried out by Clingerman, a Rochester associate, and his "manager", and I hereby so direct.

(ii)

On the record before me, it is much more difficult to decide on the protocol to be followed by D4. Some aspects of the protocol are easier to determine than others, but what is clear is (a) that the parties have never attempted to resolve these issues, and (b) that, left on their own, the parties seem unlikely to come to accord on the protocol. However, without a clear protocol in place, the process will be pointless.

One protocol issue, however, can be dealt with at this point. In order to ensure confidentiality, I direct as follows:

(1) Perla's computer shall be delivered to D4 either by Perla himself or by the estate attorney, as they shall determine, at a date, time and place to be agreed upon directly with Clingerman, and neither the Morse objectants nor their attorney shall have any part in that turnover process, except that such objectants' attorney shall be notified by the estate attorney immediately after the turnover has taken place;

(2) Once Perla's hard drive has been cloned, D4 shall ensure the immediate return of the computer itself to whomever D4 had received it from;

(3) After it has received Perla's computer, D4 shall not communicate in any manner whatsoever either with the Morse objectants, or with their attorney, or with Perla or with the attorney for this estate (except to return the computer), or with anyone else except the three D4 employees involved with the project, and D4 shall direct any and all communications, including any reports about its findings, directly and only to this Court, by confidential correspondence only;

(4) Any D4 employee who is involved in this project shall give written assurance that he or she shall abide by the directions herein, and by any further protocol established for this project hereafter, and shall not disclose any of D4's analysis, findings or conclusions except as may otherwise be authorized in writing by this Court;

(5) Once D4's report and findings have been transmitted in confidential form to this Court, I will issue whatever further Order is appropriate and necessary regarding disclosure (or not) of all or any part of the contents thereof.

With respect to all other protocol issues — such as, by way of example only, search terms [*7]to be utilized by D4, what will happen at the conclusion of D4's review to the cloned hard drive, and the format to be utilized in reporting specific findings by D4 — these shall be worked out by counsel for the parties. In that regard, I direct that counsel shall confer with each other and shall thereafter appear for a "protocol conference" with the Chief Attorney of this Court on Wednesday, September 14, 2016, at 11:00 a.m. At that conference, counsel should have with them proposed written protocols which can either by incorporated into a further Order to be issued by the undersigned on consent, or which can be tendered to the undersigned for review, consideration and determination. Counsel should reflect on the guidelines referred to in Tener v. Cremer, supra, at 78-79, and should refer particularly to the Guidelines for Discovery of Electronically Stored Information [ESI] of the Nassau County Supreme Court Commercial Division. Counsel may also wish to consult with Clingerman prior to the protocol conference about any and all outstanding protocol issues that will be important to include in whatever Order I subsequently issue.

This decision shall constitute the Order of this Court and no other or further order shall be required.

DATED: BUFFALO, NEW YORK

August 9, 2016

____________________________________

HON. BARBARA HOWE

Surrogate Judge Footnotes

Footnote 1:Wendy died in August, 2015 and her estate has been substituted in this proceeding.

Footnote 2:The description of D4, LLC is taken for background purposes only in this decision from a July 28, 2016 press release, "D4 Names Tom Groom as Managing Director, China," by Martha MacPherson, D4 Senior Vice President, Marketing, on the D4 website [www.D4discovery.com]. See also, hearing exhibit C, the September 25, 2015 Clingerman affidavit, at pghs 1 and 2.

Footnote 3:Such factors as the size of the computer's hard drive, the passage of time since the Will was deleted, the frequency and extent of use after the Will was deleted, and the manner in which it was deleted, are all significant variants which would have a bearing on what, if anything, could be recovered, but about which Clingerman had no specific information.