# Analysis and Recommended Strategy for Northstar Components ## Preliminary framing The defensible posture here is **not** blanket opposition. Northstar has a strong record on some issues (the memorandum, forensic imaging of all phones, the search-term omission) and a weak-to-indefensible record on others (the Slack decision, the vendor backups, the VP's text deletion). A brief that fights everything will lose credibility precisely where credibility matters most — on the intent question that separates monetary and evidentiary curative measures from an adverse inference. The strategy: **concede the preservation failures candidly, propose robust curative relief ourselves, and use that credibility to defeat the two requests that would actually be case-threatening — the adverse inference and the loss of the privileged memorandum.** --- ## 1. When the preservation duty arose **January 5, on receipt of the demand letter.** The letter identified the conduct (coordinated pricing), named Northstar, and threatened suit absent resolution. That is textbook reasonable anticipation of litigation. There is no serious argument for a later trigger, and we should not make one. We should affirmatively concede January 5. Two reasons: (a) the January 8 hold shows Northstar itself anticipated litigation, so any later-trigger argument is contradicted by our own conduct; and (b) conceding the trigger date costs us nothing on the issues that matter and buys credibility on intent. We should, however, resist the plaintiff's likely effort to push the duty earlier (e.g., to the time of internal Project Lighthouse discussions). There is no evidence Northstar anticipated litigation before January 5. --- ## 2. Reasonableness of the January 8 hold **Partially reasonable; materially deficient in scope.** Reasonable features: issued within three days; written; substantively specific as to subject matter (distributor pricing, competitor communications, Project Lighthouse); suspended ordinary email deletion. Deficiencies: - **No mention of Slack**, despite a 30-day auto-delete cycle — the single most fragile data source in the environment. - **No mention of text messages or personal devices**, despite sales executives who plainly transacted business by text. - **No coverage of the two outside pricing consultants**, who are likely to hold the most probative pricing-analysis material. - **Only twelve executives**, with no evident custodian analysis of sales managers or the consultants' internal counterparts. - **No follow-up, acknowledgment, or compliance verification** — which is why the VP's February 2 text went undetected. The law does not require perfection, and we should invoke that standard. But the standard is *reasonable and proportional*, and a hold that omits the two systems with the shortest retention and the highest likelihood of candid discussion is not reasonable. We should say so plainly rather than defend the indefensible. --- ## 3. Loss of Slack, vendor backups, and text messages ### (a) Slack auto-deletion — the weakest point The problem is not the 30-day policy; it is the general counsel's January 9 instruction after being told suspension was available for $18,000. "Do the minimum until they actually sue. Email is the official record" is: - A **conscious decision not to suspend** a known auto-delete function after the duty attached — squarely within the rule that routine deletion is not automatically excused once a duty arises; - **Cost-based in a manner that is indefensible on proportionality** in a federal antitrust case, where $18,000 is trivial against the exposure and the discovery budget; - **Premised on a legally wrong assumption** — that the duty begins at filing rather than at reasonable anticipation, and that a company may designate email as the "official record" and disregard other channels. This is the fact pattern most likely to draw judicial displeasure, and it is unwinnable on the merits. Our position should be: this was an error of judgment by counsel, Northstar does not defend it, and it warrants curative relief. What we *can* argue is the **characterization**: the instruction reflects cost-minimization and a mistaken legal premise, not a desire to eliminate proof. Nothing in it references Project Lighthouse, competitor contacts, or any specific content; it is a generic, systemic instruction applied indiscriminately. That distinction matters enormously for intent. ### (b) Vendor disaster-recovery backups — the most damaging single fact Sixty days of vendor DR data existed and were overwritten **March 15 — two weeks after suit was filed.** After the complaint arrived, no one asked the vendor to restore or preserve. This is worse in some respects than the January decision, because it eliminated the cure for the January decision. Even under the general counsel's own (erroneous) "wait until they sue" framework, the trigger had occurred and the fix was still available. Northstar should not attempt to characterize this as the vendor's default schedule operating innocently. The obligation was Northstar's. This is a clear failure to take reasonable steps, and the lost data was recoverable at the time and is not now. The one mitigating point worth preserving: this was an **omission amid a litigation-onset scramble**, not an affirmative destruction order, and it is consistent with the same systemic blind spot (Slack was simply not on anyone's list) rather than with targeted suppression. But we should lead with the concession, not the mitigation. ### (c) The vice president's text deletion — the intent battleground The February 2 text — "Clean up jokes and speculation. Keep real business records" — followed by deletion of roughly 200 messages, is the plaintiff's best intent evidence, and the two preserved screenshots make it far worse: > "Lighthouse only works if the others hold the umbrella." > "Do not undercut the signal before Q3." These are not jokes, political comments, or personal chatter. On their face they concern Project Lighthouse and appear to reference coordinated behavior with third parties. The VP's benign readings ("umbrella" = internal pricing discipline; "signal" = published commodity prices) are *possible* and we may preserve them for the merits, but we cannot ask a sanctions court to accept them as established. The court is entitled to note that the messages are at minimum plainly within the hold's subject matter and that the VP's stated rationale is contradicted by the only two messages we can actually see. Realistic assessment: the plaintiff has a **strong case for intent to deprive as to the VP's texts.** The instruction was directed at a group, it used a euphemism ("clean up"), it drew a self-serving line between "jokes and speculation" and "real business records" that the VP himself had no authority to draw, it occurred after a hold he received, and the surviving samples fall on the wrong side of the line he claims to have drawn. Our defensible positions are narrower: - The intent finding, if made, should be **confined to the VP's text messages** and not extended to the Slack or backup losses, which arose from a different actor, a different mechanism, and a different (non-content-specific) motive. - Any adverse inference should be **calibrated to what the deleted texts plausibly contained**, not to the plaintiff's proposed sweeping inference of "price coordination" across the case. --- ## 4. Can the lost information be replaced? Sanctions require that the information cannot be restored or replaced through additional discovery. This element is **only partially satisfied**, and it is our most productive line of argument because it directly limits the remedy. **Slack:** Partially replaceable. Employee screenshots survive. One participant manually exported an entire channel. Custodians' own recollections, and the email record (which was preserved), overlap substantially with Slack content. Northstar should proactively produce every surviving screenshot and the full manual export, and undertake a targeted custodian canvass for locally cached Slack data, personal archives, and forwarded copies. **Vendor backups:** Not recoverable. Overwritten. We must concede this. **Texts:** Partially replaceable. The mobile provider cannot restore content, but **recipients may still hold copies** — indeed, the whistleblower's screenshots prove at least some copies persist. Because these were group texts to managers, each recipient device is a potential source. Northstar should immediately pursue recipient-side collection, and should propose doing so at its own expense. The practical consequence: much of the plaintiff's asserted prejudice is curable by replacement, and a court applying "measures no greater than necessary" should order replacement efforts before turning to evidentiary sanctions. **This argument only works if Northstar volunteers the replacement effort rather than being ordered into it.** --- ## 5. Prejudice and intent **Prejudice:** Real but incompletely quantified. The plaintiff has lost a full month of Slack from the period when Project Lighthouse was active, and roughly 200 texts from the head of sales. In a price-coordination case, contemporaneous informal communications are the heart of the proof. We should concede prejudice as to the vendor-backup gap and the unreplaced portion of the texts, while arguing that the surviving screenshots, the manual channel export, the preserved email corpus, and recipient-side text recovery materially reduce it. **Intent:** Must be analyzed separately for each loss. | Loss | Actor | Best characterization | Likely finding | |---|---|---|---| | Slack auto-delete | General counsel | Cost-driven, legally mistaken, content-neutral | Negligent to grossly negligent; **not** intent to deprive | | Vendor DR backups | Company/IT | Omission post-filing; recoverable fix ignored | Gross negligence; **not** intent to deprive | | ~200 texts | VP of Sales | Targeted, euphemistic, post-hold, contradicted by surviving samples | **Intent to deprive plausibly established** | The most important line we must hold is that a finding of intent as to the VP does not convert the Slack and backup failures into intentional spoliation. Different actors, different mechanisms, different motives. A court should not bootstrap one employee's misconduct into a company-wide intent finding. --- ## 6. Attribution of the VP's conduct Governing principle: a senior employee's deliberate deletion may be attributed depending on **authority, purpose, and the company's response.** Factors favoring attribution: the VP is a senior officer; he instructed subordinates, exercising managerial authority; the subject matter was core to the litigation; the deletion concerned the company's business records. Factors against, or limiting attribution: he acted contrary to an express written hold he had received; there is no evidence any lawyer or executive authorized, knew of, or ratified the instruction; his purpose appears personal and self-protective (embarrassment, insulation) rather than pursuant to any corporate policy. Realistically, **the conduct will be attributed to Northstar** for purposes of remedying prejudice — the messages were within Northstar's control and the company bears responsibility for custodian compliance. What Northstar can still influence is the *culpability* attached to the attribution, and that turns almost entirely on **the company's response.** This is the single most important lever Northstar controls right now. The response must be immediate, documented, and visibly adverse to the VP's interest: - Suspend the VP from any role in discovery and from custodianship decisions. - Independent forensic examination of his devices and accounts by an outside vendor, with results disclosed. - Interview every recipient of the February 2 text; collect their devices; determine what was deleted at his direction and what survives. - Separate counsel for the VP, with a clear disclosure that company counsel does not represent him on this issue. - Preserve and produce the whistleblower material; take no adverse action against the whistleblower and document that protection. - Consider employment consequences on advice of independent review. - A sworn declaration from the general counsel and the CISO/IT lead describing the failure, the remediation, and the current preservation state. A company that investigates and disciplines its own senior officer presents very differently from one that adopts his "jokes and speculation" explanation. **Northstar must not adopt the VP's characterization as the company's position.** --- ## 7. Curative measures and the adverse inference ### What Northstar should oppose The plaintiff's requested inference — that the deleted messages *showed price coordination* — is far too broad. It would effectively establish the central liability element of an antitrust conspiracy by way of a discovery ruling, sweeping in the Slack and backup losses for which intent is absent. That is not a measure "no greater than necessary." ### What Northstar should proactively propose Volunteering meaningful relief is the most defensible position available. Proposed package: 1. **Replacement first.** Court-supervised, Northstar-funded recovery: full production of surviving Slack screenshots and the manual channel export; custodian canvass for cached and archived Slack; recipient-side text collection from every February 2 text recipient; forensic examination of the VP's devices. 2. **Fee-shifting.** Northstar pays the plaintiff's reasonable fees and costs attributable to investigating and litigating the preservation failures, including the sanctions motion and any resulting discovery. Northstar should offer this rather than contest it — the failures are real and the plaintiff should not bear the cost. 3. **Evidentiary stipulations in lieu of an inference.** Northstar stipulates that: (a) it had a preservation duty from January 5; (b) it did not suspend Slack auto-deletion and did not preserve vendor backups; (c) the VP deleted approximately 200 texts after receiving the hold; (d) the two screenshot messages are authentic. Northstar waives any objection to the plaintiff presenting these facts to the jury and to arguing their significance. 4. **Permission to present the spoliation evidence.** The plaintiff may introduce evidence of the deletions and argue what the messages likely contained; Northstar may respond. This gives the plaintiff the practical benefit of the conduct without a mandatory inference. 5. **Narrow, targeted instruction as the outer limit.** If the court finds intent as to the VP's texts, any instruction should be limited to *those texts*, permissive rather than mandatory (the jury *may* infer the deleted texts were unfavorable to Northstar), and expressly not extended to the Slack or backup losses. 6. **Reopened depositions.** Reopen the depositions of the VP and relevant sales managers on deletion and content, at Northstar's expense. Dismissal or default is plainly unavailable: the loss is partial, substantial replacement is possible, the core email corpus was preserved, and 1.2 million documents were produced. --- ## 8. Forensic imaging of all executives' personal phones **Oppose as drafted; propose a targeted alternative.** Imaging is not automatic; it must be proportional, targeted, and supported by evidence that ordinary discovery is inadequate. Imaging *all* executives' personal phones fails on every prong: - **Not targeted.** No showing that any executive other than the VP deleted anything. Blanket imaging is a fishing expedition premised on one custodian's misconduct. - **Disproportionate.** Personal phones contain medical, financial, family, and other privileged and irrelevant material. Full images sweep in vast non-responsive content. - **Ordinary discovery not shown inadequate** as to non-VP custodians, whose email was preserved and produced. But Northstar cannot credibly claim ordinary discovery suffices as to the VP. There, the predicate is met. **Proposed alternative:** - **VP of Sales:** full forensic image by a neutral or court-appointed examiner, at Northstar's expense. - **Recipients of the February 2 text:** targeted collection of messaging data for a defined date range (e.g., December 1–March 1) and defined search terms, not full imaging — escalating to imaging only on a specific showing of deletion. - **All others:** no imaging absent a custodian-specific showing. - **Protocol:** neutral examiner; agreed search terms and date ranges; Northstar privilege and personal-information review before production; non-responsive personal data returned or destroyed; costs allocated per the court's direction. Offering full imaging of the VP's devices is what makes the objection to the rest credible. --- ## 9. Depositions of the general counsel and outside counsel **General counsel — likely permitted in narrow scope.** Ordinarily counsel depositions are disfavored, but the general counsel is a **fact witness on preservation**: he issued the hold, received the IT cost advice, and authored the January 9 instruction. That instruction is central to the sanctions inquiry and is not itself legal advice to a client so much as an operative preservation decision. Realistically, the court will permit some examination. Northstar's position should be **sequencing and scope, not prohibition**: - First, a detailed sworn declaration from the general counsel plus a Rule 30(b)(6) witness on preservation, hold implementation, IT communications, and remediation. - Deposition only if the declaration and 30(b)(6) testimony prove inadequate. - If permitted: time-limited (e.g., 3 hours), confined to preservation steps, systems, custodians, the January 9 exchange, and remediation — expressly excluding case strategy, merits assessments, and advice on liability. - Northstar does **not** waive privilege by describing preservation steps; we should state this expressly and obtain an order confirming it. **Outside counsel — oppose.** No showing that outside counsel had any role in the preservation decisions. The only connection is authorship of the board memorandum, and permitting a deposition on that basis would reward the plaintiff's improper use of a clawed-back document. There is no crime-fraud or at-issue predicate. This request should be denied outright. --- ## 10. The privileged memorandum ### Is it privileged? **Yes, on the facts presented.** A memorandum from outside counsel to the board analyzing antitrust exposure is a confidential communication for the purpose of providing legal advice — the paradigm case. It is independently protected as work product: prepared because of anticipated litigation, and to the extent it reflects counsel's assessment of exposure, it is **opinion work product**, entitled to near-absolute protection. The plaintiff will argue business advice is not privileged merely because a lawyer participates. That principle does not help here: legal exposure analysis is legal advice, not business advice. To the extent discrete portions contain purely business recommendations severable from legal analysis, Northstar should be prepared to offer redactions rather than stake everything on an all-or-nothing claim — but the analytical core is privileged. The plaintiff's framing — that the memo is evidence of Northstar's "knowledge and intent" — is precisely why the privilege exists and is not a basis to override it. Using a lawyer's exposure assessment as proof of the client's scienter would eviscerate the privilege in every antitrust case. ### Was privilege waived? **No.** Under the clawback order, inadvertent production does not waive privilege where the producing party took reasonable precautions and promptly sought return. - **Reasonable precautions:** the memorandum was **correctly identified and marked privileged in the review platform.** The substantive privilege review worked. The document escaped because of a **production-script error** — a technical failure downstream of review, in a production of approximately 1.2 million documents. That is the paradigm of inadvertence. - **Prompt remediation:** discovered at twelve days and clawback notice sent **immediately**. Twelve days in a production of this scale is prompt. - **The clawback order controls.** Its purpose is to allocate the risk of exactly this error away from waiver, so that parties can produce at scale. Denying the clawback would nullify the order the court itself entered. Northstar should also volunteer a declaration describing the review workflow, the privilege coding, the script defect, root-cause analysis, the remediation, and the sweep for any other affected documents. That transparency is what converts a plausible clawback claim into an easy ruling. The plaintiff's strongest argument is that the memorandum's "admissions" are highly probative and it has already been used. Neither is a waiver theory. Probative value is irrelevant to inadvertence, and the plaintiff's own use after notice cannot manufacture waiver. ### Must it be returned? **Yes.** Northstar should seek an order requiring: - Return or certified destruction of all copies, including derivatives, notes, summaries, and work product incorporating its contents; - Sequestration and striking of the deposition exhibit and the related testimony; - A prohibition on use of the memorandum or its contents for any purpose, including cross-examination, expert reliance, and witness preparation; - Certification identifying everyone to whom the memorandum or its contents were disclosed, including experts and consultants; - Certification that no derivative work product retains its contents. --- ## 11. The receiving lawyer's continued use after notice This is Northstar's strongest offensive point and should be pressed firmly but without overreach. **Before notice:** questioning a witness and quoting the memorandum in a deposition exhibit was not sanctionable — counsel had no reason to know of the privilege claim. We should say so, which enhances our credibility on what follows. **After notice:** the obligation is unambiguous — stop using the document until the court resolves the claim. Continuing to characterize its "admissions" in correspondence is a **direct violation** of the clawback order and the governing rule. The proper course was to sequester the document and move to challenge the claim, not to keep exploiting it while the claim was pending. Requested relief: - An order directing immediate cessation of all use; - Sequestration of the correspondence referencing the memorandum; - Striking the deposition exhibit and testimony; - Disclosure of whether the memorandum was shared with experts or consultants, and appropriate remedial measures if so; - Reasonable fees for the motion to enforce the clawback order. **Calibration is important.** Northstar should stop short of demanding disqualification of plaintiff's counsel. That request would be disproportionate on these facts, would likely be denied, and would undercut the measured tone that is Northstar's principal asset on the spoliation issues. Seeking enforcement plus fees is credible; seeking disqualification looks like retaliation for the sanctions motion. There is also a strategic asymmetry worth surfacing in the brief, carefully: both sides made discovery mistakes. Northstar's were preservation failures it is now remediating and paying for; the plaintiff's was continued use of a privileged document after an explicit notice and in the face of a court order. Northstar should draw that parallel once, without gloating, to frame the court's overall equitable assessment. --- ## 12. Duty to disclose additional failures and search defects Northstar's credibility on everything above depends on complete candor now. Concealment of a further defect discovered later would be catastrophic and would likely convert negligence findings into intent findings. **The Project Lighthouse search-term omission must be disclosed affirmatively and in detail.** The facts are actually favorable: the hold itself used the term; the omission was in the initial search protocol; Northstar's own reviewers caught it after 400,000 documents; and Northstar **paused production and added the term.** Self-detection and self-correction is the strongest possible framing — but only if Northstar discloses it rather than having it discovered. Northstar should also disclose: - The full January 9 IT exchange and the general counsel's instruction; - The vendor DR backup existence, retention window, and the March 15 overwrite, with the vendor's confirmation; - The February 2 text, the VP's deletion, the whistleblower screenshots, and the investigation status; - The hold's gaps (Slack, texts, personal devices, the two consultants) and the number and identity of custodians; - The consultants' status: whether they were ever notified, what they hold, and what has been collected; - Whether any documents were re-reviewed or re-produced after the term was added, and whether other terms were similarly omitted; - A complete privilege-error root-cause report. Northstar should propose filing a **comprehensive preservation and search declaration** and offer a 30(b)(6) witness on discovery process. Volunteering this is what earns the benefit of "perfection is not required." --- ## 13. Immediate remediation steps **Within 24–48 hours:** 1. Litigation-hold reissue covering Slack, texts, personal devices, ephemeral and collaboration platforms, and third-party consultants; individual acknowledgments required; distributed to a properly scoped custodian list, not twelve executives. 2. Written preservation demands to the Slack vendor, the mobile carrier, and both pricing consultants, with confirmation of compliance. 3. Suspend all auto-deletion across every system; confirm in writing with IT and each vendor. 4. Preserve and image the VP's devices and accounts through an outside forensic vendor; remove him from all discovery roles. 5. Preserve the whistleblower's material; protect the whistleblower from retaliation and document that protection. 6. Enforce the clawback: written demand for return/destruction, sequestration certification, and identification of all recipients. **Within 1–2 weeks:** 7. Independent internal investigation of the VP's instruction and its effect on other custodians; separate counsel for the VP. 8. Recipient-side text collection from every February 2 addressee. 9. Comprehensive Slack recovery effort: all screenshots, the manual channel export, cached local data, personal archives, forwarded copies. 10. Full search-term audit and re-run of the entire corpus with corrected terms, including Project Lighthouse and related code words ("umbrella," "signal," and any others the investigation identifies); re-produce as needed. 11. Root-cause analysis and fix of the production script; QC re-review of all prior productions for other privileged escapes. 12. Consultant collection and production. 13. Prepare the preservation declarations (general counsel, IT lead, forensic vendor). --- ## 14. The most defensible overall position **Concede fully, remediate visibly, pay the costs, and fight only where the law and facts genuinely favor us.** The brief should open with what Northstar concedes, not with what it disputes: > Northstar's preservation duty arose January 5. Its January 8 hold was timely but too narrow — it omitted Slack, text messages, personal devices, and two consultants. Its decision not to suspend Slack auto-deletion was wrong, and its failure to secure the vendor's disaster-recovery data after suit was filed compounded that error. A senior officer deleted approximately 200 text messages after receiving the hold, and Northstar is investigating that conduct rather than defending it. Northstar has reissued its hold, engaged a forensic examiner, begun recovery efforts, and is prepared to bear the plaintiff's reasonable costs of addressing these failures. Northstar does not ask the Court to excuse these failures. It asks only that the remedy be no greater than necessary to cure the prejudice they caused. From that foundation, three focused arguments: 1. **No company-wide intent.** Intent to deprive, if found, is confined to the VP's texts. The Slack and backup losses were content-neutral, systemic, and driven by cost and legal error — negligent or grossly negligent, but not intentional. The plaintiff's proposed inference of "price coordination" across the case is orders of magnitude greater than necessary. 2. **Substantial replacement is available and Northstar will fund it.** Screenshots, a full manual channel export, preserved email, recipient-side texts, and forensic examination of the VP's devices. Replacement precedes evidentiary sanctions under the governing standard. 3. **The privileged memorandum must come back, and the plaintiff's post-notice use must stop.** The privilege claim is clean: correctly coded, escaped by script error, clawed back in twelve days out of 1.2 million documents, under an order designed for exactly this. And the plaintiff's continued use of the document after notice is the one clear violation of a court order in this record. Northstar's realistic best outcome: **monetary sanctions and fee-shifting, court-supervised replacement discovery, reopened depositions, agreed evidentiary stipulations, at most a narrow permissive instruction limited to the VP's texts, targeted imaging of the VP's devices only, a narrowly scoped general counsel deposition with no outside-counsel deposition, and full return of the memorandum with the plaintiff's post-notice use struck.** That is a materially better result than the plaintiff seeks, and it is achievable only by conceding early and generously what cannot be defended.