BUSINESS AND PROPERTY COURTS OF ENGLAND AND WALES
QUEEN'S BENCH DIVISION
COMMERCIAL COURT
Rolls Building, Fetter Lane, London, EC4A 1NL |
||
B e f o r e :
____________________
(1) KAZAKHSTAN KAGAZY PLC | ||
(2) KAZAKHSTAN KAGAZY JSC | ||
(3) PRIME ESTATE ACTIVITIES KAZAKHSTAN LLP | ||
(4) PEAK AKZHAL LLP | ||
(5) PEAK AKSENGER LLP | ||
(6) ASTANA-CONTRACT JSC | ||
(7) PARAGON DEVELOPMENT LLP | Claimants | |
- and - | ||
(1) BAGLAN ABDULLAYEVICH ZHUNUS (formerly | ||
BAGLAN ABDULLAYEVICH ZHUNUSSOV) | ||
(2) MAKSAT ASKARULY ARIP | ||
(3) SHYNAR DIKHANBAYEVA | ||
(4) SHOLPAN ARIP | ||
(5) LARISSA ASILBEKOVA | Defendants | |
- and - | ||
HARBOUR FUND III LP | Additional Party | |
- and - | ||
(1) COOPERTON MANAGEMENT LIMITED | ||
(2) FABLINK LIMITED | ||
(3) WAYCHEM LIMITED | ||
(4) STANDCORP LIMITED | ||
(5) PERMAFAST LIMITED | ||
(6) DENCORA LIMITED | ||
(7) UNISTAREL CORPORATION | ||
(8) XYAN HOLDINGS LIMITED | ||
Respondents to the Applications for Charging Orders |
____________________
William Mc Cormick QC, Rebecca Drake and Joe-Han Ho (instructed by Preiskel & Co LLP) for the Sixth and Seventh Defendants to the Applications for Charging Orders
Hearing date: 13 August 2020
Draft judgment circulated to the parties on 8 September 2020
____________________
Crown Copyright ©
Covid-19 Protocol: This judgment was handed down at a hearing attended by the judge remotely via Skype, and by circulation to the parties' representatives by email and release to Bailii. The date and time for hand-down is deemed to be 10 September 2020 at 10:30 am.
Mr Justice Henshaw:
(A) INTRODUCTION
(B) BACKGROUND
(1) General
(2) Claims against the Respondents
(3) Disclosure in the Burlington charging order application
(4) Charging order applications relating to the Wycombe and Montrose Properties
(5) Orders made by Jacob J on 28 June 2019
(6) Events in the second half of 2019
(7) January 2020 application for relief from sanctions
(8) Events leading to the Butcher J Order
(9) Events leading to the Baker J Order
(10) Subsequent events
(C) RELIEF FROM SANCTIONS: PRINCIPLES
(D) COMPLIANCE WITH THE RELEVANT ORDERS
(1) Circumstances resulting in destruction/why allowed to happen
(2) When the ISS Image was destroyed or not preserved
(3) On whose instruction the ISS Image was destroyed
(4) Procedures used to take image
(5) Chain of custody of image
(6) Record of the 4,709 'hits'
(7) Conclusion on compliance with Orders
(E) APPLICATION OF THE DENTON CRITERIA
(F) APPLICATION TO DELETE OR VARY PARAGRAPH 5 OF THE BAKER J ORDER
(1) The order
(2) The Respondents' application
(3) Mr Georghiou's further proceedings in Cyprus
(4) Merits of the Respondents' application
(A) INTRODUCTION
i) An application by the Claimants dated 31 July 2020 for declarations that the Sixth and Seventh Respondents, Dencora Limited and Unistarel Corporation ("the Respondents"), have failed to comply with provisions made on an 'unless' basis in an order made by Andrew Baker J on 10 July 2020 ("the Baker J Order"), and for judgment against the Respondents accordingly. The Baker J Order in turn referred to certain parts of an order made by Butcher J on 10 June 2020 ("the Butcher J Order"). Paragraph 4(ii) of the Butcher J Order required the Respondents' director, Mr Georghiou, and Mr Mavros (of ISS Information Security Services Limited ("ISS"), the Respondents' IT expert for a disclosure exercise carried out in 2019) to file witness statements addressing the circumstances in which a forensic image taken by ISS of certain data ("the ISS Image") was not preserved. Paragraph 5 of the Butcher J Order required the Respondents to serve a witness statement addressing the procedures used in the exercise that produced the ISS Image, and related matters.
ii) The Respondents' application dated 7 August 2020 for relief from sanctions regarding the breaches alleged by the Claimants in their application of 31 July 2020.
iii) The Respondents' application dated 22 July 2020 to delete paragraph 5 of the Baker J Order. That paragraph relates to 2,660 documents which the Respondents' legal representatives were ordered to review, but which they now say cannot be reviewed within the timeframe ordered.
(B) BACKGROUND
(1) General
(2) Claims against the Respondents
(3) Disclosure in the Burlington charging order application
"57. Ms Vaswani asserts that Quinn Emanuel came off the record because they had concerns about the Respondents' disclosure, and demands that the Respondents "waive privilege and explain why Quinn Emanuel suddenly came off the record" (Vaswani 32/22(d)(iv)). This is an astonishing position for the Claimants to take. The Claimants are not entitled to know the reasons why the Respondents changed their lawyers, and are not entitled to demand that the Respondents waive privilege in order to respond to the Claimants' allegations.
58. I am not willing to waive privilege, but what I can say is that the change in lawyers had nothing whatsoever to do with disclosure or Quinn Emanuel's professional obligations."
"During the past few weeks, we have tried our utmost to advise Cooperton on how best to comply with its disclosure obligations. In particular, we have repeatedly expressed the view that the failure to search for electronic emails (whether before or after your appointment) is likely to adversely impact on the Judge's perception of the Respondents and their Defence. Despite our best endeavours, we have not been able to agree on the proper approach. Notwithstanding our serious concerns as to whether Cooperton is complying with its disclosure obligations, and our notices that we may need to go off the record, we stayed on the record in order to ensure that Cooperton was in a position to provide disclosure on 21 September, and gave disclosure on that date in accordance with your strict instructions.
On any view, there has unfortunately been a breakdown of trust and confidence between Quinn Emanuel and Cooperton. We therefore regrettably consider that it would be in the interests of both parties for Quinn Emanuel to come off the record as soon as possible."
(4) Charging order applications relating to the Wycombe and Montrose Properties
(5) Orders made by Jacob J on 28 June 2019
"There were two causes, each sufficient, of the adjournment of the July 2019 trial. One was the degree to which the case was not ready for trial because of the respondents' failures to complete disclosure properly. That increases the seriousness of the Unless Order defaults as regards disclosure, although those defaults came after the adjournment of the trial, as it means the Unless Order was imposed in respect of prior failures to comply with disclosure obligations that had rendered the trial liable to be lost: see British Gas Trading Ltd v Oak Cash & Carry Ltd [2016] EWCA Civ 153, [2016] 1WLR 4350. The other sufficient cause to adjourn the July trial was the claimants' desire at the last hour (relative to the trial listing) to take concrete steps to pursue their stance, which had been consistent throughout the enforcement process, that their case in the charging order applications, to the effect that the properties belonged in equity to Mr Arip and so could be charged by way of enforcement of his judgment debts, was strictly in the alternative to a primary argument that the properties belonged in equity to the claimants. In a case in which there seems always to be another layer to every point, what I have just said is not a criticism of the claimants. They were for a long time seriously hampered in what they could pursue here by injunctions improperly obtained by or at the behest of Mrs Arip it may be at the ultimate behest of Mr Arip from courts in Cyprus. " (§ 56)
(6) Events in the second half of 2019
i) On 5-6 September 2019, ISS created a forensic Image, i.e. the ISS Image, from all the electronic sources at Mr Georghiou's Cypriot legal firm (A.A. Georghiou LLC) prescribed in the Jacobs J Order (the "Sources"). This amounted to a cache of around 3.2 million documents.
ii) ISS applied the court-ordered search terms to the entire population of 3.2 million documents. After excluding certain files as permitted by paragraph 4(b) of the Jacobs J Order, 4,709 files containing court-ordered search terms were identified.
iii) At the same time, on the instructions of Mr Georghiou's (as the Respondents' director), ISS also applied a number of 'exclusionary' search terms, which the parties have referred to as the Unrelated Search Terms or "USTs", to the entire population of 3.2 million documents. 117,213 files containing USTs were identified.
iv) ISS then compared the search results above: 3,649 files containing both court-ordered search terms and USTs were identified. These were excluded from manual review.
v) The remaining 1,060 files, containing court-ordered search terms but not USTs, were sent to Candey for manual review. Candey produced from these files the documents produced on disclosure on 25 September 2019.
vi) Of the 3,649 files containing court-ordered search terms and USTs (sub-paragraph (iv) above), a total of 2,660 files contained in the 'To' or 'From' fields one of the four USTs identified in the Claimants' solicitors' letter of 6 January 2020, namely "@candey.com", "@quinnemanuel.com", "@Russell-cooke.co.uk", and "@signaturelitigation.com". These search terms referred to the Respondents' former solicitors, and, the Respondents maintain, would very likely be privileged.
vii) That left a total of 989 files (i.e. 3,649 2,660 = 989). These files were sent to London in early January 2020 and were manually reviewed under the supervision of the Respondents' then leading Counsel (Dominic Chambers QC, acting on a Direct Access basis) and by junior Counsel (Joe-Han Ho). As a result of this review, it was determined that none of the 989 files fell to be disclosed.
(7) January 2020 application for relief from sanctions
(8) Events leading to the Butcher J Order
i) by 4pm on 24 June 2020, Mr Georghiou and Mr Mavros should provide witness statements explaining the circumstances in which the ISS Image was destroyed, when it was destroyed, upon whose instruction that took place, and why this was allowed to happen given the Respondents' obligations to preserve documents (§ 4(ii) of the Order);
ii) by 4pm on 1 July 2020, the Respondents should provide a witness statement setting out how that data had originally been collected, the chain of custody of that data, and related information (§ 5 of the Order); and
iii) by 4pm on 15 July 2020 the Respondents should allow the independent IT expert access to Mr Georghiou's offices to collect the data afresh (§ 4(iii) of the Order).
(9) Events leading to the Baker J Order
"The evidence of Mr. Georghiou's actual condition and activity in recent days causes me to conclude that the respondents have set out to mislead the court, in an effort to avoid complying with Butcher J's order, and that their non-compliance, with that one exception concerning Mr. Georghiou's own statement, both was initially and most certainly is now entirely deliberate and calculated" (§ 15)
"The respondents are conducting themselves in the manner of parties with material they know needs to be disclosed to the claimants but they wish to hide. Whether that is the truth of it or not may ultimately be a matter to consider at trial, depending on how matters develop. For present purposes I am clear that the court must act on the basis that there is a significant chance that that is the position, and do all it can to ensure that proper disclosure is given, or the respondent must be debarred from defending the merits because of their failure to ensure that any trial would be fair. They are also, by their conduct, treating the court and its orders with a degree of contempt that in the public interest cannot be seen not to have consequences." (§ 22)
i) by 4pm on 17 July 2020, provide the witness statement from the Respondents' IT expert Mr Mavros addressing the destruction of the ISS Image, as well as the witness statement explaining the procedures he followed when taking the ISS Image and the chain of custody of the ISS Image;
ii) by 4pm on 24 July 2020, provide the witness statement from Mr Georghiou addressing the destruction of the ISS Image; and
iii) by 4pm on 11 September 2020, review the 2,660 documents which had been omitted from the Respondents' previous disclosure review.
(10) Subsequent events
"4. The reasons why those statements did not comply is due to a misunderstanding by both Mr Mavros and by Mr Georghiou as to the extent of the obligations on them. As the Court is aware, Mr Georghiou is a practising Cypriot lawyer and was heavily influenced by his view of what a Cypriot court would have expected from him. In circumstances where he believes that under Cypriot law the failure by Mr Mavros to preserve the image when carrying out the forensic exercise would have been the standard method in carrying out the forensic exercise, and in circumstances where he was content to entrust the process to Mr Mavros as an IT specialist without seeing a need to discuss the detail of Mr Mavros's task with him, Mr Georghiou did not consider he had acted improperly. Whilst the requirements under the 10th June 2020 Order and 10th July 2020 were therefore explained to Mr Georghiou, the importance of precise compliance was not fully understood by Mr Georghiou. Mr Georghiou has also been very worried about the effect of any work upon his continued recovery from a heart attack, and considers a Cypriot court would have been more lenient in requiring compliance with Court orders during this time.
5. As to Mr Mavros, he did not consider he had acted in any way improperly in accordance with his understanding of Cypriot law, and therefore did not fully understand the severity of the Unless order being sought.
6. Given the relatively tight deadlines between the date of the 10th July 2020 Order and the dates by which the witness statements were to be served, coupled in Mr Georghiou's case with continued recovery from a heart attack, this witness statement was received from the witnesses at a stage too late for any further amendments and had to be served only partially compliant. Indeed, Mr Georghiou's witness statement was received back from him after the deadline of 4pm on 24th July 2020 and therefore after the deadline for compliance had already passed.
7. The position has been attempted to be rectified by way of serving supplemental witness statements by both Mr Mavros and Mr Georghiou which do comply fully with the requirements in the 10 June 2020 order. These supplemental witness statements have been served on 7 August 2020.
8. Whilst therefore we accept and apologise for the lateness of the statements, we request the Court grant relief from sanctions"
(C) RELIEF FROM SANCTIONS: PRINCIPLES
"(1) On an application for relief from any sanction imposed for a failure to comply with any rule, practice direction or court order, the court will consider all the circumstances of the case, so as to enable it to deal justly with the application, including the need
(a) for litigation to be conducted efficiently and at proportionate cost; and
(b) to enforce compliance with rules, practice directions and orders.
(2) An application for relief must be supported by evidence."
" A judge should address an application for relief from sanctions in three stages.
The first stage is to identify and assess the seriousness and significance of the "failure to comply with any rule, practice direction or court order" which engages rule 3.9(1). If the breach is neither serious nor significant, the court is unlikely to need to spend much time on the second and third stages.
The second stage is to consider why the default occurred.
The third stage is to evaluate "all the circumstances of the case, so as to enable [the court] to deal justly with the application including [factors (a) and (b)]" ."
(paragraph breaks interpolated)
"Factors (a) and (b)" are those referred to at (a) and (b) of CPR 3.9(1), i.e.:
"the need (a) for litigation to be conducted efficiently and at proportionate cost; and (b) to enforce compliance with rules, practice directions and orders".
"26. Triviality is not part of the test described in the rule. It is a useful concept in the context of the first stage because it requires the judge to focus on the question whether a breach is serious or significant. In Mitchell itself, the court also used the words "minor" (para 59) and "insignificant" (para 40). It seems that the word "trivial" has given rise to some difficulty. For example, it has given rise to arguments as to whether a substantial delay in complying with the terms of a rule or order which has no effect on the efficient running of the litigation is or is not to be regarded as trivial. Such semantic disputes do not promote the conduct of litigation efficiently and at proportionate cost. In these circumstances, we think it would be preferable if in future the focus of the enquiry at the first stage should not be on whether the breach has been trivial. Rather, it should be on whether the breach has been serious or significant. It was submitted on behalf of the Law Society and Bar Council that the test of triviality should be replaced by the test of immateriality and that an immaterial breach should be defined as one which "neither imperils future hearing dates nor otherwise disrupts the conduct of the litigation". Provided that this is understood as including the effect on litigation generally (and not only on the litigation in which the application is made), there are many circumstances in which materiality in this sense will be the most useful measure of whether a breach has been serious or significant. But it leaves out of account those breaches which are incapable of affecting the efficient progress of the litigation, although they are serious. The most obvious example of such a breach is a failure to pay court fees. We therefore prefer simply to say that, in evaluating a breach, judges should assess its seriousness and significance. We recognise that the concepts of seriousness and significance are not hard-edged and that there are degrees of seriousness and significance, but we hope that, assisted by the guidance given in this decision and its application in individual cases over time, courts will deal with these applications in a consistent manner.
27. The assessment of the seriousness or significance of the breach should not, initially at least, involve a consideration of other unrelated failures that may have occurred in the past. At the first stage, the court should concentrate on an assessment of the seriousness and significance of the very breach in respect of which relief from sanctions is sought. We accept that the court may wish to take into account, as one of the relevant circumstances of the case, the defaulter's previous conduct in the litigation (for example, if the breach is the latest in a series of failures to comply with orders concerning, say, the service of witness statements). We consider that this is better done at the third stage rather than as part of the assessment of seriousness or significance of the breach.
28. If a judge concludes that a breach is not serious or significant, then relief from sanctions will usually be granted and it will usually be unnecessary to spend much time on the second or third stages. If, however, the court decides that the breach is serious or significant, then the second and third stages assume greater importance."
"41. The very fact that X has failed to comply with an unless order (as opposed to an 'ordinary' order) is undoubtedly a pointer towards seriousness and significance. This is for two reasons. First, X is in breach of two successive obligations to do the same thing. Secondly, the court has underlined the importance of doing that thing by specifying an automatic sanction in default (in this case the Draconian sanction of strike out).
42. On the other hand, as Mr Weston rightly says, not every breach of an unless order is serious or significant. In Utilise the claimant was just 45 minutes late in complying with an unless order. He filed his budget by 4.45 p.m., rather than 4 p.m. when it was due. The Court of Appeal held that a delay of only 45 minutes in compliance was "trivial". The court also noted that, contrary to the district judge's view, there was no underlying breach of the rules onto which the unless order was attached."
i) whilst all the circumstances of the case should be considered, two factors, namely the need for litigation to be conducted efficiently and at proportionate cost, and the need to enforce compliance with rules, practice directions, and orders, are to be given particular weight: Denton § 38 and see Clearway Drainage Systems Ltd v Miles Smith Ltd [2016] EWCA Civ 1258;
ii) "When a Court is considering an application for relief from sanction where there has been a failure to comply with an unless order which has specified that a strike out is the sanction for failure to comply, the Court must proceed on the basis that the sanction of strike out contained in the unless order was properly imposed as a proportionate sanction for failure to comply.": Sinclair § 25; and
iii) there is "a very powerful public interest in ensuring that parties recognise the importance of complying with unless orders": ibid. § 42.
(D) COMPLIANCE WITH THE RELEVANT ORDERS
"(2) Unless, by 4pm on Friday 17 July 2020, Dencora and Unistarel comply with the obligations in respect of Mr Mavros in paragraph 4(ii) of the 10 June Order, and the obligation not being in respect of a specific witness in respect of paragraph 5 of the 10 June Order, their Points of Defence shall be immediately struck out and judgment shall be entered for the Claimants in the Wycombe Application and the Montrose Application, and the Charging Orders in the Claimants' favour over the Wycombe Property and the Montrose Property shall be made final.
(3) Unless, by 4pm on Friday 24 July 2020, Dencora and Unistarel comply with the obligations in respect of Mr Georghiou in paragraph 4(ii) of the 10 June Order, their Points of Defence shall be immediately struck out and judgment shall be entered for the Claimants in the Wycombe Application and the Montrose Application, and the Charging Orders in the Claimants' favour over the Wycombe Property and the Montrose Property shall be made final."
"(4) In the event that Dencora and Unistarel contend that compliance with paragraphs (2) and (3) above is not possible because ISS has destroyed or otherwise not preserved the images and copies of documents referred to in those paragraphs (the "Destroyed Data"), then:
(ii) By 4pm on 24 June 2020 Dencora and Unistarel shall file and serve witness statements from each of Mr Georghiou and Mr Mavros stating:
a. the circumstances resulting in the destruction or non-preservation of the Destroyed Data;
b. when the Destroyed Data was destroyed or otherwise failed to be preserved;
c. upon whose instruction this took place; and
d. why they allowed this to happen, given the obligation on Dencora and Unistarel as parties to these proceedings to preserve potentially disclosable documents."
"(5) By 4pm on 1 July 2020, Dencora and Unistarel are to serve on the Claimants' solicitors, a witness statement:
(i) setting out the procedures followed by ISS to take each image or copy of the devices referred to in paragraphs (2)(i) and (2)(ii) above (exhibiting to the said witness statement all records or other documents evidencing the procedures used);
(ii) setting out the chain of custody from:
(a) the taking of the original image or other copy; to
(b) provision of the image or other copy of the document to the Independent IT Expert, or to its destruction or non-preservation, as the case may be
(exhibiting to the said witness statement all records or other documents evidencing the chain of custody); and
(iii) exhibiting a record of the 4,709 documents that Mr Mavros of ISS concluded were hit by the Court-Ordered Search Terms."
(1) Circumstances resulting in destruction/why allowed to happen
"6. I would like to begin by saying that I am not party to this litigation. As I explain below, I was hired to carry out certain tasks by Mr. Georghiou (acting on behalf of Dencora and Unistarel). I did not and do not have a wider role. I do not work for Mr. Georghiou or his firm."
"9. I was not informed that the Jacobs Order required ISS to store any of the items described and/or to create or keep the forensic images reviewed, and most importantly ISS was not instructed to do so. Having reviewed the Jacobs Order (a copy of which is attached to the Brief report [10-19] I can say from my own knowledge and experience that this is NOT a mandatory procedure in the computer forensic science since in many cases a live index search with special software and hardware applied at the investigation scene to bypass exactly the legal issues on seizing evidence which includes personal communication data. Moreover, when I worked for the police, the legitimate procedure would be that forensic images could be seized and retained by the police ONLY after special relevant court orders both for seizing and retaining and if such an order was not made then such material could not be retained. I know that the same situation applies and that it would be a breach of Cyprus law and EU law (in the form of the GDPR) to retain such material myself. I have worked with lawyers and police officers all of my career and this is what I have always been doing.
10. I repeat that the Jacobs Order did not require ISS to store any of the items and/or to create or keep forensic images and did not specify any procedure which ISS should follow.
13. As explained above I was not instructed to store and/or create or keep forensic images and the Jacob's Order did not require me to do so thus I considered that what needed to be preserved was the original material in Mr. Georghiou's office, and of course the product of the searches which I uploaded to Candey and to its platform and also delivered it to Mr Georghiou in a USB drive.
14. As I set out above, this is NOT a mandatory procedure in the computer forensic science. Active relevant court orders, with clear instructions for seizing and retaining digital evidence for each case should be issued by an authorized regional Court of Law. I was especially conscious of the fact that the images referred to at para. 10 above were taken from an established law firm. Signing before I proceed a relevant legal NDA agreement obviously understood that any electronic documents taken from a law firm would be likely to contain private and legally privileged information.
15. I cannot now recall the date when this took place. It must have happened some time after 13 January 2020.
17. I took the image from Mr Georghiou's firm (as I explain in the Brief Report) and took it to ISS for examination. I then kept it until all questions were answered. "
"19. The Jacobs Order did not provide anything about the procedure and the method to be followed for the IT forensic exercise, did not provide about images and any retaining of images and of what images of what data. The Jacobs Order was providing only for the performance of an IT forensic exercise in relation to Dencora and Unistarel and the delivery of a brief report with the results of the IT Forensic Expert.
21. I am not computer literate and I do not understand much about technology, while I do not understand anything about forensic process. At that time I did not know anything about images, what images are and how the things are working. My concern was to comply with the Jacobs Order and concurrently to protect the data of the third parties and to have a USB with the responsive documents. There has been no issue in relation to the preservation of the data. The data was either on the electronic systems of AAG or on USBs kept by AAG. Specifically the responsive documents of Dencora and Unistarel, including all disclosure documents, apart from the electronic systems and/or the USBs, are also preserved on the USB delivered to me by Mr Mavros.
.
23. It has been very clear to me, and the Claimants and their lawyers made a big noise and criticised me that I have not stated previously how I preserve the data, that I am the one who is responsible to preserve the data and I hereby state and confirm that all electronic and hard copy data in AAG's system and my possession are securely preserved and that all these documents were reviewed and disclosed by the lawyers of the Respondents.
24. Specifically, I hereby state and confirm that all the population of the electronic data of AAG, including the data related to Dencora and Unistarel, as well as to the other Respondents for the period from 01 January 2014 until 31 January 2020 are stored and preserved on a Network Attached Storage ("NAS") in the server room of AAG, of which (room) I am the only one who has the key, on two USBs which I am the only one who keeps them and knows where they are. Furthermore, all the electronic documents which are responsive in relation to Dencora and Unistarel, according to the Jacobs Order, are kept on one USB which is also in my exclusive possession.
25. To my knowledge and understanding, the images are not data which should be preserved and ISS has not have the legal right to preserve any images or even data. There has been no valid legal basis to retain them. The duty to preserve the data is mine and I have stated and explained how the data are preserved in paragraphs 47 to 52 of my Sixth Witness Statement. Therefore, no data and in no case have been destroyed or not preserved as the lawyers of the Claimants submitted and managed to convince the court that this is the case.
.
37.1 There are not destroyed data or non preserved data and I do not accept the term "Destroyed Data". None of the data was destroyed and all the data are preserved, as stated hereinabove.
37.2 As I understand, the imaging is a forensic exercise method and not data to be preserved. The preservation of images and data by an IT Forensic Expert is governed by the law and the GDPR unless there is a specific court order
.
37.5 The Jacobs Order did not provide for the taking or retaining any images, especially of those not related to Dencora and Unistarel. The Jacobs Order was only ordering De[n]cora and Unistarel to file a Brief Report of the IT Forensic Expert which they did."
"While I am not party of these proceedings, as a matter of good will and to be fully cooperative with the Court without accepting any of the unsubstantiated allegations made by Hogan Lovells reference my expertise and manner I have contacted and implement my forensic examinations I have decided to provide this supplementary witness statement for the avoidance of any doubt or challenge in a final effort to clarify the issue at hand."
"In addition it is obvious that the Jacobs Order did not require forensic images and made no reference to any specific IT forensic procedure which should have been followed. The images were taken according to the procedure I have decided to implement that would allow to secure the integrity of the data. As explained I had no instructions to retain them and obviously I couldn't predict and/imagine that forensic copies that already were provided to the parties would become of such significance and importance taking also into consideration that any other expert can proceed to the examination of all original data at any time.
Images are not retained unless there is a specific provision/order in the relative court order. Otherwise and in accordance with GDPR laws/regulations anything related to any data, including images must be retained only until the scope of the relative order, and in general the scope of the forensic exercise is fulfilled. Immediately thereafter, the images/data must be deleted. Several laws/regulations deal with the subject matter some of which are: The Retaining of the Telecommunication Data for the Purpose of Serious Criminal Offences of 2007 (Law 183 (I)/2007 in combination with the laws on the Protection of the Confidentiality of Private Communication (Surveillance of Communication and Access to Recorded Content of Private Communication) (Law 92 (I) 1996, the Protection of Natural Persons with Regard to the Processing of Personal Data (Law 125 (I)/2018) and the Regulation of Electronic Communication and Mail Services (Law 112 (I)/2004 the data/images in no case can be retained for a period of more than 6 months without the specific provision of any law or any court order.
It is for me absolutely clear the Jacobs Order did not provide for the retaining of any images. On the contrary, the Jacobs Order was providing only for the IT Forensic Exercise to be conducted by applying the relevant search terms, to upload the responsive documents to a designated platform for review and disclosure and to prepare and deliver a brief report on the electronic data and forensic analysis (Brief Report). I have done everything and I consider that I have acted in full compliance with the Jacobs Order and with all due respect there has been no expert evidence before Mr Justice Butcher to the contrary.
I must clarify that no data has been destroyed. I only created forensic copies of the original data when I needed them to preserve the integrity of the actual original data and when I needed them for the forensic exercise and I deleted them when I did not need them.
The actual original data has been at all times on the electronic systems of the law firm A.A.Georghiou LLC (AAG) and in the possession and/or control of Mr Georghiou. The Jacobs Order did not contain such instructions and none of the parties instructed and/or suggested and/or asked and/or demanded and/or even mentioned to create and/or retain and/or return any forensic copies to Mr Georghiou or to anyone else. It has always been my understanding that the taking of the images was part of my forensic exercise procedure which, according to the applicable legislation, the practise and the way I have understood the NDA Statement should be deleted at the end of the exercise and on the fulfilment of the scope of the exercise.
As I said, I have uploaded all the responsive documents to the OpenText platform. OpenText said that 350 emails could not be opened in the native format and it took a long time to solve this issue and from what I know some emails were required to be sent by AAG in their original form. Furthermore, Hogan Lovells raised issues about the USTs and finally it was agreed between the parties to exclude the 2660 documents/emails containing the USTs in the "To" or "From": @candey.com, @quinnemanuel.com, @russel-cooke.co.uk, @signaturelitigation.com and to send the remaining responsive documents to Mr Dominic Chambers.
Consequently, I excluded the 2660 email which were responsive to the aforesaid email addresses, and the remaining 989 responsive documents to the USTs were sent to Mr Dominic Chambers for review and disclosure.
Nobody gave me instructions to retain the images pending any possible issues/questions/requests of Hogan Lovells. Nobody told me that issues/questions were pending and that the images were of relevance and/or importance.
I repeat, that no data has been destroyed. The forensic images are only copies of the original data, and the original data are existing, preserved and never destroyed. The forensic images were deleted by myself for the reasons I explained above.
... I emphasize that at no point Mr Georghiou or anybody else pointed out to me that the forensic copies could have been considered as potentially disclosable documents, and I myself didn't know that the forensic copies were required to be preserved as potentially disclosable documents. Nobody and nothing directed my mind to this possibility. I only acted according to the Jacobs Order, to the Cyprus laws, the GDPR and the practice."
(2) When the ISS Image was destroyed or not preserved
"15. I cannot now recall the date when this took place. It must have happened some time after 13 January 2020".
"(a) I must repeat that no data has been destroyed. Speaking about the forensic copies of the original data which have not been preserved, this should have taken place after 13th January 2020. I say this because on the 13th January 2020 was the date during which I sent the 989 documents to Mr Dominic Chambers and thereafter there was nothing else, to my understanding, I should do, in relation to this case.
(b) I do not remember when exactly the deletion of the forensic copies was made. As regards the keeping of records, I keep records only in cases where I will be called to testify as a witness before a Competent Court. I repeat that in this case, apart from the fact that it is a civil case, the requirement from the forensic expert was only to deliver a Brief Report which I did.
(c) I have not and never discussed such issue with Mr Georghiou. With all due respect, I did not consider and/or could have imagined that the non-preserving of the forensic copies (the original data can be retrieved at any time) was going to be of such a big issue in order to preserve them or to record it.
(d) please see above."
(3) On whose instruction the ISS Image was destroyed
"16. I understand from Mr. Dougans that Dencora and Unistarel and Mr. Georghiou have been criticised for not preserving this material. I am not party to this case and not able to speak on their behalf. All I can say is that, without clear written and specific instructions to do so in a Relevant Court Order applicable in our jurisdiction, I would NOT have retained such material in any case, as such action on behalf of ISS would lead to violation of GDPR laws."
"22. According to the Jacobs Order, ISS was not to keep and was not allowed legally to keep any images or data. I, myself, didn't know about any images and therefore I could not give any instructions to Mr Mavros about them. My ignorance led me to be mistaken, something which was considered by HL as contradiction between me and Mr Mavros.
"37.4 I have not had any idea about the forensic search procedure and about images and I have not participated in the search or given any instructions to Mr Mavros apart from the conducting of the search according to the Jacobs Order."
Mavros 2:
"I do not accept the terms "destroyed data" or "destruction of data". I only accept the terms "deletion of images" or non-preserving of images" and this was made only by me without the discussion with anybody or the participation of anybody, or the instructions of anybody, and I did it because I considered that the scope of the forensic exercise had been fulfilled and my job was done.
I have not and never discussed such issue with Mr Georghiou. With all due respect, I did not consider and/or could have imagined that the non-preserving of the forensic copies (the original data can be retrieved at any time) was going to be of such a big issue in order to preserve them or to record it.
No, I did not consult with Mr Georghiou or anyone else. ...
Georghiou 9:
"I have not given any instructions about this and I do not know that anyone has given such instructions."
(4) Procedures used to take image
"11. At pages 2-3 of the Brief Report [2-3] I set out the process used by which I took images from Mr. Georghiou's firm to conduct further searches. As I say in the Brief Report, this procedure took place on 5 and 6 September 2019.
12. Following that, as I set out at pages 3-4 of the Brief Report [3-4] I set out the analysis procedure and what took place next. I confirm that this material is true. Specifically, after the application of the Search Terms and the Unrelated Terms to the images responsive electronic files and their metadata were sent to Candey (the solicitors then representing Dencora and Unistarel) and uploaded to their review Platform "Open Test". This analysis took place in the lab of ISS."
"Actions
In order to execute the assigned instructions, on the 5th of September 2019 and the 6th of September 2019, the ISS team headed by me visited the premises of the legal company A.A. Georghiou LLC to create forensic images of electronic data of the existing computing devices. Specifically, we found and created forensic images of the electronic data stored on the following computing/mobile devices, by using Access Data FTK Imager, XRY, UFED Cellebrite and Magnet AXIOM:
A. Desktops (8) which are used by the following employees:
a. Adamos Aristidis
b. Kyriaki Siantani
c. Alexandrina Buceatch
d. Angelina Schukina
e. Chloe Pharmkalidi
f. Lola Champidi
g. Alexandra Oikonomou
h. Charoula Artemiou
According to Mr. Andreas Georghiou, the above Desktops cover the period of 1st of January to the dates of the imaging.
B. Servers (3) Virtual Servers
a. Active Directory
b. File Server
c. Application Server
C. An external USB drive containing archived emails and attachments, which according to Mr. Andreas Georghiou cover the period 1st of January 2014 to 31st December of 2017.
D. Mobile Devices including their SIM cards (2)
a. Nokia Asha RM-840 IMEI 355520053666200 with CYTA SIM 99434443
b. Samsung SM-A300FU IMEI 359665065108712 with CYTA 9940333
Forensic Analysis Procedure
Between the dates 7th of September 2019 and 14th September 2019, we conducted an automated analysis of all the obtained images in our facilities. For the analysis we used the forensic software/tool "Access Data FTK" that I am a qualified examiner for, and our company has a valid usage license (License 2-1 312310).
Specifically, we performed recognition and categorization of all electronic data that were stored on the electronic devices under investigation, including Optical Character Recognition (OCR) and indexing of file content.
Thereafter we applied all Search Terms of the List provided by Mr. Leo Nabbaro (APPENDIX C) according to the court order (APPENDIX B) and we found all the responsive documents that contained any of the related key words for the period 1st January 2014 to the dates of the imaging.
Then according to paragraph 4(b) of the court order (APPENDIX B), we excluded the results found on the C and D Drives of Mrs. Lola Champidi computer for the period 1st January 2018 to 3rd June 2019.
Then, to these search results we applied the Unrelated Terms (APPENDIX D) and we removed all search results according to this list. The list (APPENDIX D) was not applied to the mobiles of Mr. Andreas Georghiou because no responsive hits were found when we applied the Search Terms contained in APPENDIX C."
"I obtained image copies of the electronic data stored on the computer devices under search using the latest release at the time of Access Data FTK Imager.
The software was configured to create a bit by bit forensic images/copies of the physical storage (Full) of all the data including all the documents and of all folders on each device. Thereafter, I conducted an automated analysis of all the obtained images and specifically I performed recognition and categorization of all electronic data that were stored on the electronic devices under investigation, including Optical Character Recognition (OCR).
I say all these and generally, I describe all the procedures followed in my Brief Report which I repeat and adopt."
(5) Chain of custody of image
"17. Insofar as the Court and the Claimants are interested in the chain of custody of the image and the material extracted from the image according to my analysis, the matter is simple. I took the image from Mr. Georghiou's firm (as I explain in the Brief Report) and took it to ISS lab for examination. I then kept it until all questions were answered. Nobody else had any access.
18. I do not believe there are any documents exhibiting this chain of custody, as simply, I did not pass it to other people. I did not (for example) sign any agreement with a third party to handle the material because I did not give it to them to handle."
"All the above findings (responsive electronic files and their metadata) were sent electronically to Candey Limited in their original state and to their Review Platform "OpenText".
The Findings were also saved in read-only mode and stored on a USB Storage which will be delivered to Mr. Andreas Georghiou."
(6) Record of the 4,709 'hits'
"19. Noted that, after applying the court Order search terms I found 4709 unique bundles.
20. After applying the USTs to the 4709 unique bundles the responsive documents reduced to 1060.
21. There was a difference of 3649 (4709 1060) from which I excluded 2660 which was related to the 4 law firms (@candey.com @quinnemanuel.com @Russsell-cooke.co.uk and @signaturelitigation.com) after (as I understand it) all parties agreed to do so.
22. The final number was 989, which I send them to Mr Dominic Chambers, on the January 2020. The 2660 were excluded completely according to an agreement between the lawyers of parties and were never retained by me/ISS"
"Out of the 4709 responsive documents, the 1060 were uploaded on the OpenText platform, the 989 were sent to Mr Dominic Chambers and the 2660 were excluded according to the agreement between the parties and after the deletion of the images, for the reasons I explained, the 2660 documents are not existing separately anywhere, but there are existing in their original form and they are, from what I know, in the control of Mr Georghiou.
"The 2660 documents are included in the 4709 documents. Obviously, a record of the 4709 documents cannot be presented because it was not provided by the Jacobs Order and the forensic copies which I created were not preserved for the reasons I explained.
In this respect, I feel the need to repeat and state the following:
- 1060 file bundles that are part of the 4709 documents were uploaded to OpenText.
- 989 file bundles that are also part of the 4709 documents were sent/uploaded to Mr Chambers.
- The remaining 2660 file bundles were excluded and are existing only in the systems of AAG.
Please put the above in a witness statement format bearing in mind that I do not accept any changes."
(7) Conclusion on compliance with Orders
(E) APPLICATION OF THE DENTON CRITERIA
i) Mr Georghiou is the director and sole natural person with control of the Respondents. He has a distinguished and unblemished record as a very senior Cypriot lawyer (and former Member of Parliament).
ii) Mr Georghiou does not speak English as his mother tongue, and is not an English lawyer familiar with English litigation. He is also substantially IT illiterate, having stated on the Respondents' disclosure certificate that he does not personally use any computer or other such device, relying on others in this regard. He had no meaningful involvement in the obtaining of the ISS Image or the processes conducted upon it, effectively leaving everything to Mr Mavros.
iii) In this hard-fought litigation, there is very bad blood between the Claimants and Mr Georghiou, and the Claimants are said to have made a number of belligerent personal attacks on Mr Georghiou.
iv) These factors have contributed to imperfect decision-making and to unnecessarily straining relations.
v) There is a different cultural approach in Cyprus, which manifests itself most strikingly in the law and practice towards the preservation of the ISS Image. Mr Georghiou has admitted that he was mistaken as to his duty to preserve the ISS Image. However, it was an innocent mistake, and one which viewed from outside the UK can be seen as reasonable. Put simply the ISS Image was seen as being "only" a copy of the data upon which the disclosure exercise was focused, with no inherent value.
vi) ISS is completely independent from the Respondents. Mr Mavros cannot be taken to be as available to the Respondents as Mr Georgiou.
vii) Mr Georghiou is clear that the Sources are pristine and untouched: if the disclosure exercise were repeated, exactly the same results should ensue.
viii) Once the potential for a finding of breaches was fully apprehended, the Respondents swiftly sought to remedy that risk. This is all in the context of Mr Georghiou's serious heart-related illness.
ix) Each of Mr Georghiou and Mr Mavros was unduly (if understandably) upset by the definition "Destroyed Data" in the Order (which implied the destruction of the underlying data with all that that means for professional men in their positions). Similarly, each of Mr Georghiou and Mr Mavros considers that he has acted in accordance with Cypriot law and procedure and so has not fully appreciated the need for any more detailed explanation as to why the ISS Image as not retained (and the disclosure obligations under English law strictly complied with).
x) Mr Georghiou has been understandably concerned about the effect of any stress on his recovery from a heart attack.
xi) Any non-compliance has been contributed to by the lack of "bright lines" marking out what was required.
i) Mr Georghiou, in his sixth witness statement of 6 November 2019, said that: "now being more familiar with how the litigation process works in England, I will do everything I can to ensure that there are no repeats of the mistakes of the past"; and
ii) in evidence of the same date, Mr Chambers QC said: "I have ensured that the Respondents are fully aware of their obligations to the Claimants and to the Court so as to ensure that this litigation is conducted with maximum efficiency and cooperation in accordance with the overriding objective. I am now confident that, going forward, there will be no repeat of the type of events which led to the making of the 'unless' provisions of the 28 June order."
"100. the Respondents' conduct is now imperilling the fairness of these proceedings. They have destroyed, or allowed to be destroyed, important data in circumstances which remain opaque and which they refuse properly to explain. They are also refusing to allow a reputable independent IT expert to re-conduct their disclosure exercise, with the effect of (1) preventing the integrity and accuracy of their previous disclosure exercise being tested (as the Court has deemed necessary) and (2) preventing proper disclosure being given at all. And they continue to accuse the Claimants of serious wrongdoing without any basis and continue to contest the validity of this Court's Orders.
101. The Respondents have shown no remorse and, regrettably, have shown that the Court can have no confidence that matters will ever improve. It is not fair for the Claimants to be required to continue to litigate these Charging Order Applications at considerable expense in circumstances where (1) the fairness of the proceedings has now been jeopardised and (2) it is overwhelmingly likely that granting the Respondents a yet further indulgence will merely result in further non-compliance, further cost and the use of further Court time in dealing with those."
(F) APPLICATION TO DELETE OR VARY PARAGRAPH 5 OF THE BAKER J ORDER
(1) The order
"(5) Unless by 4pm on 11September 2020, the remaining 2,660 documents out of the 4,709 said on behalf of Dencora and Unistarel already to have been hit by the Court-Ordered Search Terms are manually reviewed by qualified solicitors employed by Preiskel familiar with the issues in dispute in these proceedings, alternatively by Counsel for Dencora and Unistarel, Mr Jo-Han Ho, for the purposes of Extended Disclosure, and any disclosable documents are produced to the Claimants, their Points of Defence shall be immediately struck out and judgment shall be entered for the Claimants in the Wycombe Application and the Montrose Application, and the Charging Orders in the Claimants' favour over the Wycombe Property and the Montrose Property shall be made final. Liberty to apply so long as the application is made and notified to the Claimants by 4pm on 22 July 2020".
"I understand that those particular documents are here and are on my system, so I believe but I would wish to reserve our right to say that for some reason they are not."
(2) The Respondents' application
"6. Paragraph 5 of the Order provides for a review of the remaining 2,660 documents out of the 4,709 located by Mr. Mavros' review of a much wider tranche of material to be carried out on or before 4pm on 11 September 2020. These were the product of a number of electronic searches carried out by Mr. Mavros. As Mr. Mavros makes clear in his evidence, the work produced from these searches has not been preserved. It is therefore not possible to comply with this provision of the Order we cannot review what has not been preserved.
7. I should add that a further IT forensic exercise is taking place in that Deloitte have been instructed to repeat the imaging carried out by Mr. Mavros, and to carry out further searches of these images. The documents located by these searches will then be reviewed by my firm. I would, therefore, expect that the remaining 2,660 documents would be located by these searches and will fall to be reviewed by my firm".
(3) Mr Georghiou's further proceedings in Cyprus
"Mr Georghiou has given full access to all the electronic systems of AAG [Mr Georghiou's firm] to Mr Ioannides [of Deloitte] and his associates and gave instructions to all the employees to cooperate fully with them and render to them every assistance and this is what is happening. The whole process has been agreed between the Deloitte's IT Experts team and the IT Experts of AAG Dinos Pastos and Spiros Konstantinou without any involvement or interference by me or on behalf of AAG".
i) There appears to have been no proper basis for proceeding without notice or ex parte. Deloitte and the Claimant could and should have been given notice of the applicants' intention to apply for an injunction, even if there were some perceived urgency.
ii) The applicants failed to mention that the relevant provisions of the Butcher J Order of 10 June 2020 were made because of the destruction of the ISS Image.
iii) No disclosure was made of the fact that at the hearing on 10 June before Butcher J, the Respondents conceded that they had breached the 28 June 2019 order of Jacobs J.
iv) There was no disclosure of Andrew Baker J's findings, in his Judgment of 10 July 2020, that Mr Georghiou and the Respondents were serial defaulters on their disclosure obligations and had deliberately sought to mislead the Court in order to avoid compliance.
v) The applicants failed to disclose that in his eighth witness statement dated 24 July 2020, in purported compliance with the 'unless' orders, Mr Georghiou stated that he was voluntarily complying with the Butcher J Order.
vi) There was no disclosure of the fact that the legal principles relied upon as prohibiting Deloitte's work were never raised by the Respondents at the hearings in this jurisdiction on 10 June 2020, 3 July 2020 or 10 July 2020.
(4) Merits of the Respondents' application
(G) OVERALL CONCLUSIONS