Bloomberg Law
Free Newsletter Sign Up
Bloomberg Law
Advanced Search Go
Free Newsletter Sign Up

Protecting Confidential Data: Lessons From the Apple v. Samsung Firestorm

Aug. 26, 2014, 4:00 AM

The circumstances leading to the recent imposition of sanctions against Quinn Emanuel Urquhart & Sullivan LLP, counsel for Samsung Electronics, Inc., provides a warning for law firms and their clients regarding protection of confidential information (Apple, Inc. v. Samsung Electronics Co. Ltd.,, 2014 BL 35321, 5:11-cv-01846 (N.D. Cal. Jan. 29, 2014)).

The decision came in the fierce patent litigation Apple, Inc. and Samsung have been waging for years against one another regarding features of their respective mobile devices. Magistrate Judge Paul S. Grewal sanctioned Quinn Emanuel for violating the court’s protective order for the firm’s handling of an improper disclosure to Samsung of confidential, competitively-sensitive information received from Apple in the litigation. Id.

What began with “an inadvertent mistake” by a junior associate on the case—which Judge Grewal found was not sanctionable itself id.—culminated in sanctions against Quinn Emanuel because, according to the decision, the mistake was “permitted to go unchecked, unaddressed, and propagated hundreds and hundreds of times by conscious—and indeed strategic—choices by that associate’s firm and client alike … .” Id.

Judge Grewal ordered Quinn Emanuel to “reimburse Apple, Nokia, and their counsel for any and all costs and fees incurred in litigating” this issue and the associated discovery. Judge Grewal concluded: “That expense, in addition to the public findings of wrongdoing, is, in the court’s opinion, sufficient both to remedy Apple and Nokia’s harm and to discourage similar conduct in the future.” In response, Nokia moved Feb. 17 for a total of $1,114,288.40 in attorneys’ fees and $82,274.86 in costs (Apple, Inc. v. Samsung Electronics Co. Ltd., , 2014 BL 46539, 5:11-cv-01846 (N.D. Cal. Feb. 17, 2014)), stating its request was reasonable in light of Samsung’s own costs and “litigiousness.”

Quinn Emanuel’s actions and Judge Grewal’s decision offer valuable lessons about how law firms and their clients can avoid similar missteps and, perhaps more importantly, avoid sanctions should a misstep occur. As Judge Grewal observed, the inadvertent disclosure here was “not exactly a historical event in the annals of big-ticket patent litigation” id. and, ultimately, was “predictable.” Id. How such mistakes are handled can mean the difference between a mere caution by the court and sanctions of the sort imposed here.

Lawyer Makes Simple Mistake

In March 2012, a Quinn Emanuel junior associate worked late into the night redacting documents produced by Apple in the smartphone patent litigation so that they could be shared with Samsung. Id. Pursuant to a protective order entered by the court, Apple had marked the documents “HIGHLY CONFIDENTIAL-ATTORNEYS’ EYES ONLY,” which meant they could not be distributed to Samsung until “pricing information … financial data [and] licensing” information related to Apple’s intellectual property were fully redacted. Id.

Unfortunately, the junior associate inadvertently failed to redact confidential licensing terms that were included in an expert report among the documents to be shared with Samsung. Id. The relevant document, dubbed the “Teece Report” after the expert who authored it, contained confidential terms of a licensing agreement whereby Apple provided intellectual property to other cell phone producers, including Nokia and Ericsson. Id.

On March 29, 2012, Quinn Emanuel uploaded the improperly redacted report “to an FTP site and emailed more than 90 Samsung employees with instructions for accessing the document,” at which point it was “downloaded and distributed widely.” Id. By December 2012, “over 200 people not authorized by the protective order [had] receive[d] the document with the confidential license terms.” Id. This simple mistake would set in motion a series of events that would reveal what Judge Grewal characterized as “significant and blameworthy flaws” in Quinn Emanuel’s internal “system” for protecting such confidential information. Id.

Attorneys Learn of Mistake,
Take Limited Action

On December 22, 2012, nearly nine months after the ill-fated disclosure, a senior associate at Quinn Emanuel responded to a request from a Samsung employee by e-mailing him a copy of the Teece Report, bearing the same redactions as before. Id. At this time, for reasons that remain unclear, a Quinn Emanuel junior associate reviewed the report and recognized the incomplete redaction. Id. According to the decision, “the junior associate immediately brought it to the attention of the senior associate and a partner, specifically noting that Apple had never approved the redactions to the original Teece Report, which contrasted with their explicit approval of other reports.” Id.

Upon recognizing the mistake, the senior associate contacted the Samsung employee and asked him to delete the e-mail containing the report, which the employee confirmed. The court found that “nothing more was done to contain or investigate the damage, and neither Apple nor Nokia were notified that there had been a disclosure,” as required by the protective order. Id.

Nearly six months later, on May 13, 2013—now more than a year after the initial disclosure—a Samsung employee “emailed Quinn Emanuel a copy of the Teece Report with the confidential license terms still unredacted.” Id. According to the decision, “Quinn Emanuel did nothing in response.” Id.

Nokia Brings the Issue to the Court

On June 4, 2013, in the course of negotiations between Samsung and Nokia, a Samsung representative reportedly made various statements reflecting knowledge of Nokia’s confidential licensing agreement with Apple. Id. When asked how he knew the information, the Samsung representative allegedly “stated that he had learned the terms from his lawyers because ‘all information leaks.’ ” Id. A month later, on July 1, 2013, Nokia sought relief from the court, setting off the firestorm ending with Judge Grewal’s decision. Id.

Judge Grewal began his analysis by determining that: (1) violations of a protective order need not be intentional to be sanctionable, and (2) courts have the authority to impose sanctions for violations of a protective order under Rule 37 of the Federal Rules of Civil Procedure. Id. In determining whether sanctions were warranted, Judge Grewal considered the totality of the circumstances, including the actions of Quinn Emanuel and its client after the disclosure came to light.

Inadvertent Mistake
Not Necessarily Sanctionable

Perhaps the most valuable—and positive—lesson comes from Judge Grewal’s finding that the initial inadvertent disclosure by a junior associate was not sanctionable. The court explained:

In a case of this size and scope, it would be completely unreasonable to expect every person on every team to perform perfectly at all times … . For the simple error in redaction … the court does not find that sanctions can reasonably be imposed; the harm resulting from this error alone is too small and speculative to punish when it is so clear that this act, more than any other before the court, was inadvertent. Id.

Judge Grewal wisely recognized that lawyers are not perfect and should not be sanctioned for the sort of good faith mistake that occurred at the outset here. This raises the question of whether, had Quinn Emanuel immediately notified Apple when senior attorneys first learned of the disclosure (or at least months later when they discovered that the client still had the improperly redacted report) and taken certain steps to ensure that the disclosure was fully rectified at that time, might the firm have avoided sanctions?

The lesson here ultimately is one of responsibility and accountability: act fast, fairly, and forthrightly when a mistake occurs. Such an approach will help avoid further harm, contain any damage already done, and garner invaluable credibility with the affected parties and the court. Judge Grewal found that, by not taking certain steps sooner, Quinn Emanuel permitted “[o]ne inadvertent mistake [to result] in the widespread distribution of confidential information to hundreds of people….” Id.

He explained that sanctions were “warranted here due to the breadth/volume of violations and the fact that Samsung and its outside counsel made a conscious decision to set up a system that would allow violations of that scope to ensue from a mistake that small and, frankly, predictable.” Id.

Coming Clean Quickly and Candidly

When mistakes occur, especially of this apparent magnitude, the offending party generally may be best served by ensuring that those affected—and the court—first learn of the mistake from the offending party rather than another source. This sort of self-reporting can achieve important advantages, including preempting allegations of dishonesty, concealment, or other bad faith conduct and presenting the mistake in a more positive and understandable context than an aggrieved party likely will.

Appropriate self-reporting also can help position the offending party as a victim itself, worthy of grace and understanding rather than sanctions, especially harsh penalties. Too often the victims of mistakes overreach in the relief they seek, perhaps because they are driven by anger over the mistake or by a misplaced intention to exploit an inadvertent mistake in the litigation.

According to the decision, “Apple and Nokia propose[d] a number of creative sanctions that Quinn and Samsung should face in light of their misconduct, suggesting everything from an injunction against Samsung in [another] case to a ten-year ban from representing any party adverse to Nokia.” Id. Judge Grewal remarked that “[t]he vast majority of these are ludicrously overbroad, such as the suggestion that both Samsung and Quinn Emanuel should be banned from any situation in which they might make use of licensing information for the next two years.” Id.

The court observed that after discovery was conducted regarding the disclosure, “what began as a chorus of loud and certain accusations had died down to aggressive suppositions and inferences.” Id. Quinn Emanuel avoided these more severe sanctions, but it may have been able to quiet this chorus much earlier—and perhaps even prevented the chorus from ever taking voice—had it been the one to alert the court, or at least Apple and Nokia, to its mistake. This approach might have avoided the costly discovery and motions practice that ensued, including “substantial document production and depositions.” Id.

If, for any reason, a court learns of a mistake from a source other than the offending party, candor still can go a long way. Quickly taking responsibility for the conduct and providing relevant information about the mistake in a straightforward fashion can help ease the court’s concerns.

Judge Grewal remarked that he ordered substantial discovery into the details of the events involving the inadvertent disclosure “[i]n light of the scant explanation and evidence proffered by Samsung.” Id. Even then, according to the decision, the documents Judge Grewal reviewed in camera—because Samsung asserted privilege—“gave the court an outline that filled in many of the whos, whats, and whens of the information’s transmission, but very few whys or hows.” Id.

The “whys and hows” are especially important to provide when an offending party acted in good faith, because those details bear on that party’s culpability, which can be a dispositive element in determining the appropriate relief. Withholding those details can raise suspicions, whereas affirmatively showing inadvertence can put doubts to rest and avoid sanctions.

Second Set of Eyes Provides Vital Safety Net

According to the decision, Quinn Emanuel named partner, John Quinn, defended his firm by describing it as “650 lawyers wide and 1 lawyer deep.” Id. Judge Grewal took issue with this structure, remarking:

In cases of this complexity, relying on such a structure to manage highly confidential information from both parties and non-parties is akin to a trapeze artist flying high without a net. 99.99% of the time, no net is required. But in the 0.01% of the time when the trapeze fails, the net is not there, and the fall causes much more damage than it otherwise might. Id.

Judge Grewal correctly observed that such valuable information is “worth a second, or even a third, round of review before producing it to a competitor corporation, who would know exactly how to exploit it,” yet this evidently was not done. Id. Notably, the failure that the court finds “unacceptable” is that of the firm to provide the associate a critical safety net—namely, a second or third set of eyes to catch the mistake at the outset. Id.

Whether the product of inexperience, bad decisions, sheer exhaustion or some other factor, mistakes are bound to happen. This is why courts require quality control measures in discovery, such as checking responsiveness determinations by attorneys conducting document review or assessing the accuracy of electronic search protocols. These measures may be best administered by more senior attorneys who can bring greater insight and experience.

Inhouse Counsel Provides Safeguard

Judge Grewal found that Samsung also was culpable for the improper disclosure because it had “adopted the practice of downloading and circulating litigation documents to the far comers of the globe,” including “hundreds of people who were in no way involved in the Apple litigation.” Id. The court deemed this “willful failure to institute sufficient safeguards for the information” also responsible for the broad distribution of the inadvertently disclosed information in the Teece Report, which the court concluded otherwise would have been far more limited and thus less damaging. Id.

Judge Grewal’s decision serves as a valuable reminder that clients also may be held accountable for the mistakes of their outside counsel. Companies can mitigate this risk in at least a couple ways.

First, they can adopt the sort of policies Judge Grewal found lacking at Samsung—namely, those limiting access to information obtained in litigation to individuals directly involved in the litigation and who need access for litigation-related purposes. As the court observed, “there is always a risk that something slips through, and Samsung could just as easily have chosen to minimize the individuals exposed to litigation documents in case it did.” Id.

Often, the litigation documents that would be most interesting or useful to company personnel not involved in the litigation are those that contain competitively-sensitive information and thus are most likely subject to a protective order restricting disclosure.

Moreover, protective orders commonly provide that information obtained in litigation may be used only for that litigation. Therefore, even if access to the information were given to persons not involved in the underlying litigation, it would be of little to no utility to them because of the prohibition on its subsequent use.

Second, inhouse counsel can serve as gatekeepers for the information they receive from litigation counsel. Here, Quinn Emanuel evidently provided access to the improperly redacted Teece Report to some 90 Samsung employees. Id. Rather than relying on outside counsel to distribute litigation documents or other information directly to business personnel, companies can require that inhouse counsel handle internal distribution or at least review any non-public litigation information before it is disseminated to others within the company.

This process admittedly could be burdensome for corporate counsel, who already have many responsibilities extending well beyond any particular action, and thus may not always be feasible for all non-public litigation information. But it may still be workable for documents requiring redactions or that are otherwise likely to contain protected information, such as expert reports, which routinely quote the most material—and thus sensitive—portions of the discovery record.

Judge Grewal’s decision provides another valuable reminder—that disclosure alone, without any use, may be deemed harmful and warrant sanctions. Id. Thus, sharing confidential litigation information with clients with the admonition that they may not use it for business purposes nonetheless may be improper, depending on the information and the terms of any applicable protective order.

Timely Compliance With Court Orders Critical

Finally, Judge Grewal found that Quinn Emanuel failed to comply with the protective order by not timely informing Apple that the inadequately redacted Teece Report had been circulated within Samsung. The protective order reportedly requires that, in the event of an inadvertent disclosure, the disclosing party “shall immediately notify counsel for the Producing Party whose Discovery Material has been disclosed and provide to such counsel all known relevant information concerning the nature and circumstances of the disclosure.” Id.

It appears undisputed that Quinn Emanuel did not notify Apple when the junior associate raised the improper redaction in December 2012, or months later in May 2013 when a Samsung employee e-mailed the improperly redacted report to Quinn Emanuel, or later when Nokia filed its motion for relief. Id.

Judge Grewal held that Quinn Emanuel violated the notification requirement of the protective order as early as December 2012 and as late as July 2013, finding either timing sufficient for sanctions. He reasoned that when a junior associate noted the improper redactions to a partner and a senior associate in December 2012, “Quinn Emanuel should have ‘immediately’ picked up the phone to call Apple and let them know that there was a problem. … Instead, it did nothing.” Id.

Even after Nokia filed for a protective order in July 1, 2013, according to the decision, “Quinn Emanuel kept the information quiet for another fifteen days while independently negotiating with Nokia, as though hoping that would make the problem go away.” Id.

Communicate, Keep Records to Reduce Risk

Judge Grewal’s ruling also teaches that communication, collaboration, and record-keeping are key to avoiding mistakes and effectively remedying them when they occur. Quinn Emanuel defended the lack of notification to Apple in December 2012 with the argument that the firm did not actually know at that time that there had been an improper disclosure. Id. Judge Grewal rejected this argument, noting that the junior associate who provided the inadequately redacted report to Samsung in March 2012 and later identified the issue in December 2012 certainly knew of the disclosure. Id.

Even if that associate were the only Quinn Emanuel attorney who knew of the improper disclosure at that time, Judge Grewal nonetheless concluded sanctions were warranted, as this was indicative of a deeper, structural failure within the firm.

In rejecting Quinn Emanuel’s defense, Judge Grewal explained:

In a case of this size with this many resources and this much confidential information floating about, it is only reasonable to expect that a firm’s left hand will know what the right hand has been doing with that information. Id.

Picking up on John Quinn’s remark about the firm’s “1 lawyer deep” structure, the court observed that “one lawyer doesn’t necessarily know what another lawyer is doing.” Id. at n.74.

Keeping Team Members Informed

The case illustrates the need for members of case teams to keep each other informed and to collaborate on important decisions that may put the firm or its client at risk. Although every member of a case team obviously need not inform every other member of every action taken, generally more than one member should be aware of any significant action, especially those implicating compliance with a court order.

This case also teaches the need to keep records of litigation information provided to the client, and anyone else for that matter. Doing so serves two important functions.

First, if a concern is raised, it enables a party to see whether there has been an inadvertent disclosure by consulting the log of what was shared with whom and when. As Judge Grewal concluded, “[i]f no one on the Quinn Emanuel team was responsible for knowing what documents had gone out to the client, such that that person would have been aware that the Teece report had gone out before, that is a flaw for which the firm must be held accountable.” Id.

Second, if an inadvertent disclosure is discovered, a disclosure log enables the offending party to identify all the recipients and thus take appropriate steps to remedy the disclosure, which protective orders commonly require.

Lessons Learned

At the end of the day, there is nothing extraordinary about Quinn Emanuel’s reliance on a single junior associate to review and redact a set of litigation documents on a time-sensitive project. Indeed, in the harrowing world of litigation, where a great premium is placed on efficiency, productivity, and speed, law firms often task individual associates with all sorts of assignments with tight time limits and little hand-holding. And only those living in glass houses could fairly cast stones at the associate for the mistake made. As Judge Grewal emphasized, nobody is perfect—and therein lies the fundamental lesson at the core of this decision.

Because some mistakes are unavoidable, law firms and their clients are well served taking certain reasonable measures to reduce the risk of mistakes and negative repercussions when they inevitably occur. This includes appropriate quality control measures.

Avoid Being `One Lawyer Deep’

Perhaps most important, though, is to create a cohesive environment where no firm or even case team is “1 lawyer deep.”

Children typically learn the “buddy system” the first time they get into a swimming pool, and it is used in various forms in a multiplicity of sports and other activities, including in the U.S. Armed Forces. Perhaps if every attorney had a “wingman” (or “wingwoman”) fewer mistakes would be made.

Law firms and their clients also need to recognize that some actions or decisions are so significant that the risk of falling and the resulting harm are too great to fly through the air without a safety net. This is especially true as laws governing personal protected information—such as the Health Insurance Portability and Accountability Act, the Stored Communications Act, and evolving privacy statutes and regulations—expand in their scope and application, and the penalties for missteps become more severe.

This case involved disclosure of some confidential licensing terms to a single company. A law firm could suffer far worse consequences were an inadvertent disclosure to involve certain personal protected information, which law firms and their clients increasingly handle in litigation.

There is nothing wrong with maximizing efficiency and cutting cost by delegating responsibilities downward or even using technology to help. For example, conducting electronic searches for certain competitively-sensitive terms before a redacted document goes out the door may help catch something weary eyes overlooked. Technology-assisted review, or predictive coding, may help locate confidential information buried within a large volume of documents.

Regardless of the approach or tools used, however, Judge Grewal’s decision teaches that certain safeguards are expected—and if and when those fail, certain immediate actions, exhibiting responsibility and accountability, also are expected. Those law firms and businesses who take Judge Grewal’s lessons to heart will be well served, and ultimately may avoid sanctions, should they find themselves defending their own actions someday.