## Memorandum: Northstar Components – Preservation, Spoliation, Sanctions, Forensic Imaging, and the Inadvertently Produced Privileged Memorandum ### I. Executive Summary and Recommended Posture Northstar’s preservation record is not clean, but it is also not a case of obvious, deliberate spoliation. The strongest adverse facts are: 1. The legal hold did not mention Slack, text messages, personal phones, or outside pricing consultants. 2. After a clear litigation threat, the general counsel’s statement that Northstar should “do the minimum until they actually sue” and that “email is the official record” is damaging if Slack was a business communication channel. 3. Slack vendor disaster-recovery data was overwritten after suit was filed because Northstar did not request restoration. 4. The vice president of sales deleted approximately 200 text messages after the preservation duty had arisen, and two of those messages contain potentially suspicious language. 5. Northstar’s initial document search omitted “Project Lighthouse,” a term already used in the legal hold. But the strongest favorable facts are: 1. The duty to preserve arose on January 5, and Northstar issued a written hold on January 8. 2. The hold captured the core issues: distributor pricing, competitor communications, and Project Lighthouse. 3. Northstar produced approximately 1.2 million documents, showing substantial preservation and production effort. 4. Some relevant Slack conversations survive through screenshots and a manual export. 5. Some text-message recipients may still possess copies of deleted messages. 6. The vice president’s deletion may have been a routine cleanup, and the surviving text excerpts are ambiguous. 7. The memorandum was marked privileged in the review platform and was produced due to a script error; Northstar promptly clawed it back. 8. The plaintiff’s requests for an adverse inference and broad forensic imaging of all executives’ personal phones are disproportionate on the current record. The most defensible position for Northstar is **candor plus containment**: acknowledge the preservation gaps, explain them, show remediation, and offer targeted relief, while opposing the plaintiff’s most severe and overbroad requests. Northstar should not argue that its preservation was perfect. It should argue that its failures were inadvertent, partially cured, not undertaken with intent to deprive, and not sufficiently prejudicial to justify an adverse inference or sweeping personal-device forensics. Northstar should tell the court: - “The January hold was timely but incomplete.” - “Some Slack and text-message data were lost after routine systems and a vice president’s cleanup.” - “Northstar did not act with intent to deprive the plaintiff of the use of that information.” - “The lost information can be substantially addressed through targeted preservation, supplemental search, and limited forensics.” - “The memorandum was inadvertently produced, remains privileged, and must be returned.” - “The plaintiff must stop using the memorandum now and should face consequences for continued post-notice use.” --- ## II. When Northstar’s Preservation Duty Arose A duty to preserve arises when litigation is reasonably anticipated. Here, that occurred on **January 5**. The demand letter from the former distributor: - accused Northstar and competitors of coordinating prices; - threatened that suit would be filed unless the dispute was resolved; - identified the subject matter of the anticipated case: distributor pricing and competitive conduct. That is a classic trigger. Northstar could not reasonably claim that litigation was not anticipated on January 5. The preservation duty attached at least by that date, and possibly earlier if Northstar had other internal or external warnings of antitrust exposure, but the facts given support January 5 as the clear trigger. Once the duty arose, Northstar had to take reasonable and proportional steps to preserve potentially relevant ESI, including documents and communications concerning: - distributor pricing; - competitor communications; - Project Lighthouse; - pricing discipline; - communications with executives, sales managers, pricing consultants, and distributors; - communications on email, Slack, text messages, personal devices used for business, and vendor-hosted systems. The duty was continuing. It was not enough to issue one initial hold and stop. As Northstar learned more about the sources of relevant ESI—Slack, text messages, consultants, vendor backups—it had to update its preservation efforts. --- ## III. Reasonableness of the January 8 Hold ### A. What the Hold Did Right The January 8 hold was issued three days after the demand letter. That timing was reasonable. The hold also identified the core subject matter: - distributor pricing; - competitor communications; - Project Lighthouse. Those were the right categories. The hold also suspended ordinary email deletion, which was the most obvious corporate communication system. Northstar should emphasize that perfection is not required. A legal hold does not have to name every possible source of ESI on day one. It must be reasonably calibrated to the anticipated litigation and updated as facts develop. ### B. What the Hold Did Not Do The hold had significant gaps: 1. **It did not mention Slack.** 2. **It did not mention text messages.** 3. **It did not mention personal phones or personal devices used for business.** 4. **It did not mention two outside pricing consultants.** 5. **It was limited to twelve executives**, which may have been too narrow if sales managers, pricing analysts, consultants, or other employees had relevant communications. These gaps matter because antitrust cases often turn on informal communications—text messages, instant messages, Slack, and short-code phrases—not just formal emails. ### C. The General Counsel’s January 9 Statement The most damaging fact in the preservation record is the general counsel’s January 9 response to IT: > “Do the minimum until they actually sue. Email is the official record.” That statement will be used to argue that Northstar consciously chose not to preserve Slack despite a litigation threat. Northstar should not overstate the strength of that statement. The best argument is: - On January 9, suit had not yet been filed. - The general counsel was attempting to balance cost, proportionality, and litigation risk. - Email was likely the primary formal business record. - The $18,000 Slack upgrade was a real cost, though not a large one in a major antitrust case. - The statement reflects a business and litigation-risk judgment, not an intention to destroy evidence. But that is a weak argument if Slack was a meaningful channel for pricing-related business communications. If Slack was used by relevant custodians to discuss pricing, competitors, distributors, or Project Lighthouse, then a reasonable party would have preserved, exported, or at least evaluated the Slack data before it was auto-deleted. The more honest position is: - Northstar’s initial hold was timely but incomplete. - The decision not to upgrade Slack was questionable, but not necessarily intentional spoliation. - Northstar should remediate and offer targeted relief rather than insist that its initial approach was flawless. --- ## IV. Loss of Slack Data ### A. Slack Auto-Deletion Slack automatically deleted messages after 30 days. The January 8 hold did not suspend Slack deletion. On January 9, IT informed the general counsel that suspending deletion would require an $18,000 account upgrade. Northstar did not take that step before suit was filed. By March 1, January Slack messages were already gone. If Slack was a source of potentially relevant ESI, Northstar had a duty to reasonably suspend or modify the auto-deletion process. The question is not whether deletion was routine. It is whether Northstar reasonably preserved relevant data after the duty arose. The fact that “some relevant Slack conversations survive because employees took screenshots and because one participant manually exported a channel” cuts both ways. It helps Northstar because it shows that not all relevant Slack content was lost and that some replacement exists. It hurts Northstar because it confirms that Slack was used for relevant conversations. If relevant Slack conversations existed, the initial failure to suspend auto-deletion was more significant. ### B. Slack Vendor Disaster-Recovery Data The Slack vendor maintained disaster-recovery data for 60 days. That data was overwritten on March 15 under the vendor’s default schedule because Northstar did not request restoration after suit was filed. This is a significant weakness. Once suit was filed on March 1, the preservation duty was beyond serious question. If Northstar knew or should have known that Slack contained potentially relevant messages and that vendor disaster-recovery data existed, a reasonable party would have asked the vendor to preserve or restore that data. The 60-day window meant that January data was recoverable only for a short time after the suit was filed. Northstar’s failure to request restoration before March 15 may be found unreasonable. But that failure does not automatically show intent to deprive. It may show negligence or, at most, gross negligence. The key question remains whether the lost Slack data caused prejudice that cannot be cured through additional discovery. ### C. Whether Slack Data Can Be Replaced Some Slack data may be replaceable or recoverable through: - existing screenshots; - the manually exported channel; - Slack audit logs; - Slack user exports; - email equivalents; - meeting notes; - pricing documents; - depositions of relevant employees; - third-party recipients; - forensic examination of devices that may have Slack application data or caches. But if the lost Slack messages contain unique discussions of competitor conduct, Northstar may not be able to fully replace them. Still, the plaintiff must show that the lost information cannot be restored or replaced through additional discovery. The plaintiff has not yet identified specific lost Slack messages that are uniquely probative. Its request for broad forensic imaging is premature until targeted recovery has been attempted. --- ## V. Loss of Text Messages and the Vice President’s Deletion ### A. The Vice President’s Conduct On February 2, the vice president of sales sent managers a text: > “Clean up jokes and speculation. Keep real business records.” He then deleted approximately 200 text messages. He says the deleted messages consisted of: - personal jokes; - political comments; - embarrassing but irrelevant speculation. A whistleblower preserved screenshots of two deleted messages: > “Lighthouse only works if the others hold the umbrella.” > “Do not undercut the signal before Q3.” The vice president explains that: - “umbrella” referred to maintaining Northstar’s own pricing discipline; - “signal” referred to published commodity prices. ### B. Why This Is Problematic The deletion occurred after the preservation duty had arisen. If text messages were used for business communications about pricing, competitors, distributors, or Project Lighthouse, Northstar should have preserved them. The two surviving excerpts are potentially suggestive. “Lighthouse” was Northstar’s internal name for its pricing initiative. The phrase “if the others hold the umbrella” could sound like reliance on competitors or other market participants. The phrase “do not undercut the signal before Q3” could sound like a coordination signal, though the vice president gives an innocent explanation. The plaintiff will argue: - the vice president deleted messages after litigation was reasonably anticipated; - the messages were not “jokes and speculation” but business-related code; - the deletion was deliberate; - the company should be responsible for its senior employee’s conduct; - the lost messages likely contained evidence favorable to the plaintiff. ### C. Why an Adverse Inference Is Still Not Clear Deliberate deletion is not automatically sanctionable. The critical question is whether the party intended to deprive the other side of the information’s use in litigation. The vice president’s explanation is not perfect, but it is not empty. He said he was cleaning up jokes and speculation while keeping real business records. The two surviving messages are ambiguous. They could be interpreted as: - internal pricing discipline; - references to market signals; - informal sales-team chatter; - metaphorical language; - speculation rather than operative coordination. The plaintiff has not yet shown that the vice president knew those messages were relevant to anticipated antitrust litigation and deleted them to prevent their use. Nor has it shown that Northstar directed, encouraged, or ratified a deliberate effort to destroy evidence. The better conclusion is that Northstar may be exposed for negligent or possibly grossly negligent preservation failures, but the plaintiff has not yet shown the intent required for a severe adverse inference. ### D. Whether the Vice President’s Conduct Is Attributable to Northstar A corporation is responsible for preservation failures by employees within its possession, custody, or control. A senior employee’s deliberate deletion may be attributed to the corporation depending on authority, purpose, and the company’s response. Here: - The vice president of sales is a senior employee. - He likely had authority over sales managers. - The text was sent to managers. - The deleted messages likely involved business or work-related channels. - The deletion occurred during the period when litigation was reasonably anticipated. For negligence, Northstar will likely be charged with the vice president’s failure to preserve. For intent to deprive, attribution is harder. Northstar should argue that the vice president acted in a personal cleanup or routine message-management capacity, not to conceal evidence. If, however, the court finds that he deleted messages because he knew they were relevant and wanted to prevent their use in litigation, his state of mind may be attributed to Northstar. Northstar’s response matters. If Northstar investigated, preserved devices, identified recipients, and cooperated with targeted recovery, that supports mitigation. If Northstar ignored the issue, the vice president’s conduct becomes more damaging. --- ## VI. Whether Lost Information Can Be Replaced For sanctions, the plaintiff must show that the lost information cannot be restored or replaced through additional discovery. ### A. Slack Some Slack content survives. The plaintiff may be able to obtain: - the surviving screenshots; - the manually exported channel; - Slack audit logs; - Slack vendor data that may still exist; - device-based Slack data; - emails that may reflect the same discussions; - formal pricing documents; - depositions. If the plaintiff cannot identify particular lost Slack messages that are uniquely important, replacement is plausible. ### B. Text Messages The mobile provider cannot restore deleted content, but replacement may still exist through: - recipients’ phones; - employees who received the texts; - outside parties who received the texts; - metadata showing timestamps, recipients, and message existence; - forensic examination of the vice president’s device; - email or other documents reflecting the same facts. The fact that some recipients may still possess copies is important. Northstar should offer to preserve and collect those copies to the extent they are within its control or reasonably obtainable. ### C. Search-Defect Replacement The omission of “Project Lighthouse” from the initial search is not lost data; it is a search defect. It can be cured by supplemental search and production. That fact weakens any claim that Northstar’s failures were incurable. --- ## VII. Prejudice and Intent to Deprive ### A. Prejudice The plaintiff must show prejudice. Prejudice means more than a possibility that lost data might have been useful. The plaintiff must show an actual or reasonably identifiable disadvantage caused by the loss. On the current facts, Northstar should argue: 1. The plaintiff has not identified specific lost Slack messages that are uniquely probative. 2. Some relevant Slack content survives. 3. Some text-message content may survive in recipients’ copies. 4. Northstar produced 1.2 million documents. 5. The core pricing and competitor-communication documents appear to have been produced. 6. The lost text messages are ambiguous and may be replaceable by other evidence. 7. The plaintiff’s request for broad forensic imaging is disproportionate because it has not shown that ordinary discovery is inadequate. If the court finds that some prejudice exists, the appropriate measures should be no greater than necessary to cure that prejudice. ### B. Intent to Deprive An adverse inference requires a finding that the party acted with intent to deprive the other party of the information’s use in litigation. Northstar should argue that no such intent is shown. #### General Counsel The general counsel’s “do the minimum” statement is not evidence of intent to deprive. It reflects cost concerns, litigation-risk assessment, and reliance on email. It may be unreasonable in hindsight, but it is not a statement that Northstar intended to hide evidence. #### Vice President The vice president deliberately deleted messages, but deliberate deletion is not the same as intent to deprive. His stated purpose was to clean up jokes and speculation. The surviving messages are ambiguous. There is no direct evidence that he deleted them because he knew they were relevant and wanted to prevent their use. #### Company Northstar has not directed deletion, encouraged concealment, or shown a pattern of destroying evidence. The failures are more consistent with inadequate initial preservation and a senior employee’s unilateral cleanup than with a deliberate corporate effort to deprive the plaintiff. --- ## VIII. Appropriate Curative Measures If the court finds some preservation failure and some prejudice, the appropriate measures should be tailored. Northstar should resist punitive or outcome-determinative relief. It should offer, instead: 1. **Targeted forensic examination** of the vice president’s device and, if necessary, devices of identified custodians with a reasonable basis for text or Slack use. 2. **Supplemental search** for “Project Lighthouse” and related terms. 3. **Supplemental production** of any responsive documents. 4. **Preservation and collection of recipient text copies** within Northstar’s control. 5. **Slack recovery efforts**, including vendor audit logs, exports, device data, and any remaining disaster-recovery remnants. 6. **Deposition of the vice president** on the deletion and meaning of the messages. 7. **Limited deposition of the general counsel** on non-privileged preservation decisions. 8. **Payment of reasonable incremental costs** caused by Northstar’s search or preservation failures, if the court finds prejudice. 9. **A limiting instruction**, if necessary, that the jury may consider the preservation failure but may not presume that deleted messages established price coordination. ### A. Adverse Inference Northstar should argue that an adverse inference is not justified. The requested inference is especially bad: > “deleted messages showed price coordination.” That is not a neutral curative measure. It is a substantive inference that the deleted messages proved a key element of the plaintiff’s antitrust claim. Even if the court found intent to deprive, the proper inference would normally be limited to the lost ESI itself. For example: - the lost messages contained evidence favorable to the plaintiff; or - Northstar’s failure to preserve those messages caused prejudice to the plaintiff. It would not automatically be proper to instruct the jury that the deleted messages “showed price coordination,” particularly where the surviving excerpts are ambiguous and alternative evidence exists. ### B. Monetary Sanctions Monetary sanctions should be limited, if any. If the court finds prejudice but no intent, Northstar should be prepared to pay the plaintiff’s reasonable incremental costs caused by the preservation or search failures. That may include: - reasonable costs of targeted forensics; - supplemental review costs; - reasonable deposition costs related to the preservation issues. Northstar should oppose punitive sanctions. The facts support at most negligence, and possibly gross negligence, but not the intent required for severe sanctions. --- ## IX. Forensic Imaging of All Executives’ Personal Phones The plaintiff’s request for forensic images of **all executives’ personal phones** is overbroad and not proportional. Forensic imaging is not automatic. It must be targeted and supported by evidence that ordinary discovery is inadequate. Here, the plaintiff has not shown: - that every executive’s personal phone contains unique, relevant, unrecoverable data; - that ordinary document production, depositions, Slack recovery, and recipient text copies are insufficient; - why all personal phones must be imaged rather than targeted extraction; - what privacy protections apply to personal data. Imaging all executives’ personal phones would be intrusive, burdensome, costly, and potentially disproportionate, especially when Northstar has already produced approximately 1.2 million documents. ### A. What Northstar Should Offer Northstar should offer a targeted protocol: 1. **Vice president’s phone** - The vice president deleted text messages. - His device is the most obvious forensic target. - If the device is corporate property, imaging or extraction is more straightforward. - If it is personal but used for business, a narrow protocol can protect personal data. 2. **Identified text recipients** - If metadata or other evidence identifies recipients who may still have copies, those devices can be examined or the recipients can be required to preserve and produce relevant text data. 3. **Slack users with particularized relevance** - If specific executives or managers are shown to have used Slack for relevant discussions, their Slack application data may be targeted. - A full personal-phone image is unnecessary if Slack application data or specific message threads can be extracted. 4. **Search terms and date range** - Limit the search to relevant time frames. - Use terms such as “Lighthouse,” “umbrella,” “signal,” competitor names, distributor names, pricing terms, “Q3,” and other appropriate terms. - Exclude irrelevant personal data to the extent possible. 5. **Privilege and personal-data protections** - Use a privilege screen. - Protect personal, medical, financial, or otherwise sensitive data not relevant to the case. - Use secure handling and limited access. ### B. Bottom Line Northstar should oppose imaging all executives’ personal phones but should offer targeted imaging or extraction of the vice president’s device and, if warranted, other specifically identified devices. --- ## X. Depositions of the General Counsel and Outside Counsel ### A. General Counsel The general counsel may be deposed on non-privileged business and preservation decisions. She is not beyond deposition merely because she is in-house counsel. A company’s preservation decisions, legal hold implementation, and communications with IT may be relevant to spoliation claims. However, privilege should still be protected. Some communications may involve legal advice or mental impressions. Northstar should offer a controlled deposition protocol: - Questions may address factual preservation decisions: - when the hold was issued; - who received it; - what categories were included; - what was omitted; - what IT reported; - what steps were taken; - why Slack was not upgraded; - when the company learned of vendor backups; - what remediation occurred. - Questions should not be used to extract privileged legal advice. - If the general counsel’s statements were part of legal advice, privilege should be asserted. - If the statements were business decisions or cost judgments, they may be admissible. The general counsel’s January 9 email to IT may be discoverable if it reflects a business or operational decision. But if it contains legal advice, Northstar should object and, if necessary, seek in camera review. ### B. Outside Counsel Deposition of outside counsel should be opposed. Outside counsel is generally protected by attorney-client privilege and work-product doctrine. A deposition of outside counsel to explore legal advice, mental impressions, litigation strategy, or privilege issues is not appropriate. The fact that one privileged memorandum was inadvertently produced does not waive privilege over outside counsel’s communications or allow a deposition of outside counsel. Northstar should argue: - outside counsel’s communications with the board were confidential legal advice; - the memorandum was prepared in anticipation of litigation or for legal advice; - inadvertent production did not waive privilege; - no broad waiver occurred; - deposing outside counsel would undermine the privilege. If the plaintiff wants to depose outside counsel on purely administrative, non-privileged facts, Northstar can consider a very narrow, limited deposition, but the default position should be opposition. --- ## XI. The Privileged Memorandum ### A. Whether It Is Privileged The memorandum was from outside counsel to the board and analyzed antitrust exposure. It is likely protected by: 1. **Attorney-client privilege** - It was a confidential communication. - It was between outside counsel and corporate decision-makers. - It was made for the purpose of obtaining or providing legal advice. - Antitrust exposure analysis is legal advice, not ordinary business advice. 2. **Work product** - If prepared after the January 5 demand letter, it was likely prepared because of anticipated litigation. - Even if some portions contain business context, the core purpose was legal risk analysis. The business-advice exception should not defeat privilege here. The fact that a lawyer participated in a business conversation does not make every statement privileged. But a memorandum from outside counsel analyzing antitrust legal exposure is different. It is at the core of attorney-client protection. If the memorandum contains mixed business and legal content, Northstar can offer in camera review or redaction of any purely business portions, but the core legal analysis should remain protected. ### B. Whether Privilege Was Waived Northstar should argue that privilege was not waived. The memorandum was: - correctly marked privileged in Northstar’s review platform; - included in the production because of a production-script error; - discovered within twelve days; - immediately subjected to a clawback notice. Under the court’s clawback order, inadvertent production does not waive privilege if the producing party took reasonable precautions and promptly sought return after discovering the production. Northstar’s precautions included: - using a review platform; - marking the document privileged; - conducting a large-scale production; - using a production script. The production-script error does not defeat reasonable precautions. Perfection is not required, especially in a production of approximately 1.2 million documents. The twelve-day delay should be measured from when Northstar discovered the error, not from the date of production. Once discovered, Northstar immediately served a clawback notice. That is prompt. ### C. Whether It Must Be Returned Yes. The memorandum must be returned or destroyed, with certification, unless the court orders otherwise. If the plaintiff has copies in litigation files, drafts, or correspondence, those should be returned or destroyed under the clawback protocol. If the plaintiff claims it has a legal obligation to retain a copy, it should be sequestered and not used. --- ## XII. The Plaintiff’s Use of the Memorandum ### A. Use Before the Clawback Notice Before receiving the clawback notice, plaintiff’s counsel questioned a witness about the memorandum and quoted from it in a deposition exhibit. If the plaintiff did not know the document was privileged, that pre-notice use may not be sanctionable in the same way as post-notice use. But it still creates a contamination problem. Northstar should ask the court to neutralize the effect: - withdraw the deposition exhibit; - redact the deposition if necessary; - prohibit further use; - require the witness to be admonished; - if necessary, order a limited re-deposition or protective order. The fact that the plaintiff used the document before notice does not automatically defeat the clawback. The clawback order and privilege doctrine can still require return and protection. ### B. Continued Use After the Clawback Notice After receiving the clawback notice, plaintiff’s counsel continued referring to the memorandum’s “admissions” in correspondence. That is a clear violation of the receiving party’s duty to stop using the document after a valid clawback demand until the court resolves the privilege claim. Northstar should ask the court to: 1. Order plaintiff’s counsel to cease all further use. 2. Order removal of the memorandum from all exhibits, drafts, and working files. 3. Order certification of return or destruction. 4. Sanction the plaintiff or its counsel for post-notice misuse, including costs and, if necessary, preclusion. 5. Consider whether the continuing misuse requires stronger measures, such as disqualification of arguments based on the memorandum or an adverse inference against the plaintiff, though that may be too severe unless the misuse is severe or repeated. The post-notice use also helps Northstar’s overall credibility argument: Northstar is the party seeking to protect privilege and cure errors, while the plaintiff is the party that continued using the document after notice. --- ## XIII. Northstar’s Duty to Disclose Additional Preservation Failures or Search Defects Northstar has duties of candor and supplementation. It should not sit on known preservation failures or search defects. ### A. Search Defect The initial search omitted “Project Lighthouse,” even though the legal hold used that term. Northstar discovered the omission after producing 400,000 documents, paused production, and added the term. Northstar should: - disclose the search-term omission; - explain when it was discovered; - describe the corrective search; - conduct a supplemental search for “Project Lighthouse” and related terms; - produce supplemental documents; - consider searching for related code terms, including “umbrella” and “signal,” if supported by the facts; - review the 1.2 million produced documents for any missed responsive material. This is not spoliation, but it is a discovery defect. Proactive disclosure and correction are far more defensible than silence. ### B. Preservation Failures Northstar should disclose known preservation failures relevant to the motion: - the initial hold omitted Slack, text messages, personal phones, and consultants; - Slack auto-deletion continued after the duty arose; - the general counsel’s January 9 statement; - vendor disaster-recovery data was overwritten after suit; - the vice president deleted text messages. Northstar should not volunteer unknown failures, but it must investigate and supplement if new failures are discovered. Candor here is strategically important. If the court later learns that Northstar knew of a preservation issue and failed to disclose it, the case becomes much worse. Proactive disclosure, combined with remediation, is the best position. --- ## XIV. Immediate Remediation Steps Northstar should act now, not merely after a court order. ### A. Issue a Supplemental Legal Hold The supplemental hold should: 1. Extend to all relevant custodians, including: - executives; - sales managers; - pricing analysts; - employees involved in distributor pricing; - employees who used Slack or text messages for business; - the two outside pricing consultants; - any other employees with knowledge of Project Lighthouse or competitor communications. 2. Expressly require preservation of: - email; - Slack; - text messages; - SMS; - iMessage; - instant messages; - personal devices used for business; - mobile device applications; - chat logs; - screenshots; - vendor-hosted data; - consultant communications. 3. Suspend deletion, auto-archive, or auto-purge for covered systems and custodians. 4. Require custodians to preserve devices and not delete or clean up messages. 5. Require prompt notification of any deletion or device loss. ### B. Preserve Slack and Vendor Data Northstar should: - issue a preservation demand to the Slack vendor; - request preservation of all Slack workspace data, audit logs, channel data, user data, and any remaining disaster-recovery remnants; - attempt restoration of any recoverable data; - export relevant channels; - collect screenshots and manual exports already in Northstar’s possession; - preserve metadata. Even if the primary disaster-recovery data was overwritten, Northstar should document what was attempted and what remains. ### C. Preserve Text-Message Devices and Recipient Copies Northstar should: - preserve the vice president’s phone; - identify all recipients of the deleted texts; - issue holds to those recipients; - collect copies of text threads within Northstar’s control; - request preservation from third-party recipients if reasonably necessary; - preserve mobile-provider metadata; - preserve any screenshots. ### D. Conduct a Targeted Forensic Review Northstar should engage a forensic expert to prepare a targeted protocol. The protocol should: - focus on the vice president’s device first; - expand only to custodians with a reasonable basis; - limit search terms and date ranges; - preserve metadata; - use secure handling; - protect personal data; - include privilege screening; - allow plaintiff access under appropriate protective conditions if the court orders it. ### E. Correct the Document Search Northstar should: - add “Project Lighthouse” to the search; - consider adding related terms: - “umbrella”; - “signal”; - “hold the line”; - “pricing discipline”; - “Q3”; - competitor names; - distributor names; - other code terms identified during review; - re-search all custodial data; - review the previously produced 400,000 documents for any missed responsive material; - produce supplemental documents; - document the corrective process. ### F. Fix Production Controls Northstar should: - investigate the production-script error; - confirm that all documents marked privileged are excluded; - re-review the 1.2 million produced documents for additional privileged documents; - issue clawback notices for any further inadvertent productions; - implement or improve quality-control checkpoints. ### G. Investigate the Vice President’s Deletion Northstar should: - interview the vice president; - identify the exact messages deleted, to the extent possible; - identify recipients; - determine whether the device was corporate or personal; - determine whether the deletion was within his authority; - assess whether the messages were business-related; - preserve all related metadata; - take appropriate internal action if warranted. This investigation should be documented. A reasonable corporate response helps mitigate attribution and shows the court that Northstar is not indifferent. ### H. Meet and Confer with the Plaintiff Northstar should meet and confer with a concrete proposal: - targeted forensic review of the vice president’s device; - supplemental search and production; - limited deposition of the vice president; - controlled deposition of the general counsel; - payment of reasonable incremental costs; - return and destruction of the memorandum; - protocol for personal-device forensics. This makes Northstar look reasonable and the plaintiff’s broad requests excessive. --- ## XV. Most Defensible Position Northstar Should Take with the Court Northstar should not merely oppose every request. It should take a position that is honest about the preservation gaps but firm on the legal limits of sanctions and privilege. The best position is: > “Northstar’s preservation duty arose on January 5. It issued a timely hold, but the hold was incomplete. Some Slack data and some text messages were lost after routine systems and a vice president’s cleanup. Northstar did not act with intent to deprive the plaintiff. It has remediated, and it is willing to accept targeted, proportional measures. But the plaintiff is not entitled to an adverse inference that deleted messages showed price coordination, forensic imaging of all executives’ personal phones, or use of a privileged memorandum that was inadvertently produced.” ### A. On the Adverse Inference Northstar should ask the court to deny the adverse inference. The court should be told: - the plaintiff has not shown intent to deprive; - the lost information is not uniquely unrecoverable; - some replacement exists; - the surviving text messages are ambiguous; - the requested inference is outcome-determinative and disproportionate; - if the court finds prejudice, a limiting instruction or cost-shifting is enough. ### B. On Monetary Sanctions Northstar should say: - punitive sanctions are not supported; - if the court finds prejudice, Northstar will pay reasonable incremental costs caused by its preservation or search failures; - monetary sanctions should be curative, not punitive. ### C. On Depositions Northstar should say: - the vice president should be deposed; - the general counsel may be deposed on non-privileged preservation decisions; - outside counsel should not be deposed; - privilege and work product protect outside counsel’s communications and mental impressions. ### D. On Forensic Imaging Northstar should say: - imaging all executives’ personal phones is overbroad; - the plaintiff has not shown that ordinary discovery is inadequate; - Northstar will offer targeted forensic review of the vice president’s device and other specifically justified devices; - the protocol should protect personal data and privilege. ### E. On the Memorandum Northstar should say: - the memorandum is privileged; - it was marked privileged in the review platform; - it was produced due to a script error; - Northstar promptly clawed it back; - no waiver occurred; - the memorandum must be returned or destroyed; - the plaintiff must stop using it; - the plaintiff’s post-notice use violates the clawback order and should be sanctioned. --- ## XVI. Proposed Relief Northstar Should Seek Northstar should seek an order providing, in substance: 1. **Deny the adverse inference** that deleted messages showed price coordination. 2. **Deny forensic imaging of all executives’ personal phones.** 3. **Authorize targeted forensic review** of: - the vice president’s device; - other devices only if the plaintiff identifies a particularized basis. 4. **Require supplemental search and production** for: - “Project Lighthouse”; - related code terms; - competitor and distributor terms; - pricing-related communications. 5. **Allow a limited deposition of the vice president** concerning the deleted messages and their meaning. 6. **Allow a limited deposition of the general counsel** on non-privileged preservation decisions, with privilege protections. 7. **Deny deposition of outside counsel**, except in narrow, non-privileged circumstances if the court finds an exceptional need. 8. **Grant the clawback** of the memorandum. 9. **Order the plaintiff to return or destroy the memorandum** and certify compliance. 10. **Order withdrawal or redaction of the deposition exhibit** containing the memorandum. 11. **Prohibit further use of the memorandum** by the plaintiff. 12. **Require the plaintiff to cease referring to the memorandum** in filings, correspondence, and discovery. 13. **Impose costs or other appropriate sanctions** against the plaintiff for post-notice use of the privileged memorandum, if warranted. 14. **Require Northstar to pay reasonable incremental costs** caused by its preservation or search failures, if the court finds prejudice, but no punitive sanctions. 15. **Direct a joint protocol** for any targeted personal-device forensics, including search terms, date ranges, privilege screening, and personal-data protections. --- ## XVII. Final Strategic Assessment The most dangerous facts for Northstar are the general counsel’s “do the minimum” statement, the Slack vendor overwrite, and the vice president’s deletion of text messages containing potentially coded language. The most defensible response is not denial. It is: - acknowledge the gaps; - show they were not deliberate; - show remediation; - offer targeted relief; - protect privilege; - hold the plaintiff to its clawback obligations. Northstar should present itself as a party that made preservation mistakes, corrected them, and is willing to pay for the plaintiff’s reasonable incremental costs, but not a party that intentionally destroyed evidence or should be punished with an adverse inference or invasive personal-device forensics.