Exhibit ‘G’

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 1 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 1

 IN THE UNITED STATES DISTRICT COURT

 FOR THE WESTERN DISTRICT OF TEXAS

 SAN ANTONIO DIVISION

 MELODY JOY CANTU AND §

 DR. RODRIGO CANTU, §

 §

 §

 §

 VS. § CASE NO. 5:20-CV-0746 JKP-HJB

 §

 DR. SANDRA GUERRA AND §

 DIGITAL FORENSICS §

 CORPORATION, LLC §

 REMOTE ORAL AND VIDEOTAPED DEPOSITION

 SHAWN KASAL

 July 18, 2022

 REMOTE ORAL AND VIDEOTAPED DEPOSITION OF SHAWN KASAL,

produced as a witness at the instance of the Plaintiff and duly

sworn, was taken in the above-styled and numbered cause on the

18th day of JULY, 2022, from 1:33 p.m. to 5:47 p.m., before

Nancy Tamez, Certified Shorthand Reporter in and for the State

of Texas, reported by oral stenography by via zoom video

conference pursuant to the Federal Rules of Civil Procedure and

the provisions stated on the record or attached hereto.

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 2 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 2

1 APPEARANCES

2

3 ATTORNEY FOR PLAINTIFF:

4 Tor Ekeland

 TOR EKELAND LAW, PLLC

5 30 Wall Street, 8th Floor

 New York, NY

6 Telephone: 718-737-7264

 Fax: 718-504-5417

7 E-mail: Tor@torekeland.com

8

ATTORNEY FOR DEFENDANT DIGITAL FORENSICS CORPORATION:

9

 David Apple

10 APPLE & FINK, LLP

 735 Plaza Blvd, Suite 200

11 Coppell, Texas 75019

 Telephone: 972-315-1900

12 E-mail: 972-315-1955

13

ATTORNEY FOR DEFENDANT SANDRA GUERRA:

14

 Brandy Peery

15 DAVIS, CEDILLO & MENDOZA, INC

 755 E. Mulberry Ave, Suite 250

16 San Antonio, Texas 78212

 Telephone: 210-822-6666

17 E-mail: Bpeery@lawdcm.com

18

ALSO PRESENT:

19 Liz Kemp, Videographer

20 Jeromy Simonovic

21

22

23

24

25

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 3 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 3

1 INDEX

2 WITNESS: PAGE

3 SHAWN KASAL

4 Examination by Mr. Ekeland 4

5 Errata Sheet 120

6 Witness Signature 121

7 Court Reporters Certification 122

8

9

10

11 EXHIBITS

12 NO. DESCRIPTION PAGE

13 ( None Attached)

14

15

16

17

18

19

20

21

22

23

24

25

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 4 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 4

1 P-R-O-C-E-E-D-I-N-G-S

2 Whereupon,

3 1:33 p.m.,

4 THE VIDEOGRAPHER: We're now on the media

5 record, this is the beginning of the media file number one.

6 The time is 2:33 p.m. Eastern Standard Time. Will the court

7 reporter please swear in the witness.

8 SHAWN KASAL,

9 having been first duly sworn, testified as follows:

10 EXAMINATION

11 BY MR. EKELAND:

12 Q. Good afternoon, Mr. Kasal. My name is Tor Ekeland.

13 I represent the Plaintiffs in this case. I'm just going to ask

14 you some preliminary questions that you've probably been asked

15 before.

16 Are you under the influence of any drugs or

17 alcohol or any type of medication that would affect your

18 ability to testify truthfully today?

19 A. No.

20 Q. Are you subject to any medical condition, physical or

21 mental or otherwise that would render you incapable of

22 testifying truthfully today?

23 A. No.

24 Q. Okay. If -- sometimes I speak fast, sometimes I

25 might mumble, so if you don't understand a question, please

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 5 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 5

1 feel free to ask me to ask it again or explain. If you don't

2 do that I'm just going to assume that you understood and heard

3 my question. Is that okay?

4 A. Yes.

5 Q. Great. And if you need a break for any reason just

6 let us know and we can take a break. I'm not, you know, here

7 to try to exert any kind of physical punishment or anything

8 like that, okay, so you'll just ask for a break when you need

9 it.

10 A. Very good, sir.

11 Q. Great. And you're here in the capacity of a digital

12 forensics expert on behalf of the defendant, Digital Forensics

13 Corporation, correct?

14 A. Yes.

15 Q. And it was Digital Forensics Corporation's general

16 counsel, I believe his name is Mr. Jeremy Simonovic who hired

17 you, is that correct?

18 A. Yes.

19 Q. And you're being paid for your testimony today?

20 A. Yes.

21 Q. How much are you being paid?

22 A. My rate currently is 229 an hour.

23 Q. You said 229 an hour?

24 A. Yes, sir.

25 Q. And when did they retain you to work on this matter?

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 6 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 6

1 A. I would have to reference my records, but it's been

2 over a year, I believe, since they originally retained me.

3 Q. And you've over the course of that last year, you've

4 been reviewing documents and information related to this

5 matter?

6 A. Yes.

7 Q. And so you're familiar with this matter, and what

8 this case is about, correct?

9 A. Yes.

10 Q. Do you know what a coaxial cable is?

11 A. Yes.

12 Q. What's a coaxial cable?

13 A. A coaxial cable is reference to an Internet service

14 provider's physical means of providing service to a residence

15 or business.

16 Q. So when we say that someone has cable in their house,

17 the cable that we're referring to is a coaxial cable, correct?

18 A. That's one of the mediums that ISPs use to deliver

19 service to homes, yes.

20 Q. And you've worked as a digital forensic expert before

21 with coaxial cables before, correct?

22 A. I have. I've even worked for Internet service

23 providers over the years of my career. I have worked with two

24 specifically, Internet service providers as both an installing

25 technician and an engineer in design of the overall network.

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 7 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 7

1 Q. So you -- you know that you can slice in to a coaxial

2 cable, correct?

3 A. I am familiar with different means of repairing

4 cables, yes.

5 Q. And you can also splice in what's called a signal

6 splitter, correct?

7 A. Yes.

8 Q. And that's one way that you could listen or surveil

9 or record the information that's traveling over that coaxial

10 cable, correct?

11 MR. APPLE: Objection, compound.

12 Q. (BY MR. EKELAND) You can answer.

13 A. Okay. Using a splitter of that type would possibly

14 facilitate that type of operation, but there's still many

15 layers of understanding and technology that would still have to

16 be applied on top of that.

17 Q. But you could install a cable splitter or device on

18 the coaxial cable and monitor the Internet travel going --

19 signals going over that cable, correct?

20 A. There are several signals that travel over that

21 coaxial cable and the ability to split those streams of data

22 whether it be television, phone, or Internet still requires an

23 understanding of the Internet service provider's encryption

24 methodologies and pacification of the data traveling over it.

25 So it's possible in a remote capability, sure.

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 8 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 8

1 Q. So is it -- is it your testimony -- it's your

2 testimony that it is possible if you have that information?

3 A. It is possible, yes.

4 Q. As a matter fact, as a digital forensics expert you

5 are aware that people do splice into cables to monitor Internet

6 traffic, correct?

7 A. Typically governments.

8 Q. But not always governments, correct?

9 A. Correct.

10 Q. And have you ever spliced into coaxial cable to

11 monitor any signals?

12 A. I would be under a protective order for any such

13 operation.

14 Q. That's a yes?

15 A. I would be under perfective order to state, or

16 affirm, or negate any operation I was involved in that required

17 tapping of Internet service monitoring.

18 Q. Could you please identify the case and the court that

19 issued that protective order?

20 A. I don't know off the top of my head, sir.

21 Q. But that's information that you could look up and

22 provide to us?

23 A. I was employed by a cable Internet provider and under

24 NDA and protective order, so I honestly don't know how much I

25 could talk to you without referring to counsel.

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 9 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 9

1 MR. EKELAND: Okay. Mr. Apple, we request that

2 information.

3 THE WITNESS: On any other time?

4 MR. APPLE: Tor, that -- I don't know. He

5 probably would need to speak to his former employer on that.

6 I'm not going to agree to produce something that -- what he's

7 bound by through a protective order in another case through

8 other counsel through another party.

9 MR. EKELAND: Mr. Apple, we can discuss this

10 outside of here. We're going to request it, we'll subpoena it,

11 we'll go to the court, whatever we need to do, but let's --

12 we'll have the discussion about the discovery later. So I'm

13 just letting you know that we're going to request that

14 information.

15 Q. (BY MR. EKELAND) So Mr. Kasal, right? Am I saying

16 that?

17 A. It's Kasal, sir.

18 Q. Kasal, Mr. Kasal, I apologize. Outside of this

19 protective order, are there any other any other times that

20 you've spliced into coaxial cable for anybody you've been

21 working for, for the purpose -- let me limit this so it's not

22 just, you know, you're cutting cables for whatever, is there

23 any time that you've ever spliced into a coaxial cable to

24 monitor signal traffic on that cable?

25 A. No.

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 10 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 10

1 MR. APPLE: I'm going to object. I'm going to

2 object on the grounds of relevancy too.

3 Q. (BY MR. EKELAND) Okay. So you're a digital forensic

4 expert and I've reviewed your CV and you've got a lot of

5 experience, true?

6 A. Yes.

7 Q. And part of your experience, you know, as a digital

8 forensics investigator is that you have to keep very good

9 records, correct?

10 A. Yes.

11 Q. And those records include logs, types of software

12 used, reports. As a matter fact, when you work on a typical

13 forensic investigation, what kind of information do you log and

14 record?

15 A. The civil court has different standards than the

16 criminal court does as well as the Uniform Code of Military

17 Justice, those different courts have different standards of

18 admission recording preservation and how long you keep it.

19 Q. So what were those three courts that you mentioned?

20 A. The military courts, the Uniform Code of Military

21 Justice and that's supported JAG counsel, both prosecution and

22 defense trial counsel. Civil courts and working in, like,

23 district criminal courts.

24 Q. Let's start with JAG military courts. What are their

25 standards? And you see I'm -- first of all, I'm assuming

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 11 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 11

1 you've done forensic work on a military case, correct?

2 A. Yes.

3 Q. Describe for me what kind of records you generated,

4 what kind of records you looked at, for a typical military?

5 A. Some of that -- some of that stuff is going to be

6 not -- I can't discuss it. I can give you some ideas, I can

7 give you some of the things that I've done.

8 As an example working for defense trial counsel

9 in support of JAG, my role was a consultant in helping defense

10 trial counsel understand the weight of the evidence or

11 liability against their client and the information that the

12 government had collected and was attempting to use as evidence

13 and substantiate it with foundation against their client. I

14 did not in fact maintain or create any records, as was be

15 discoverable by prosecution counsel. It was my job to measure

16 or offer insight that pertains to what the government had done

17 as peer review to make sure that those records were

18 memorialized and preserved and handled properly as per the

19 rules of evidence found in JAG.

20 For the board of the prosecution counsel, it was

21 my role or function to use evidence that had been collected by

22 another investigator and offer foundation as to its means,

23 method, and collection methodology so that it could be entered

24 into the record.

25 Q. You said you reviewed evidence?

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 12 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 12

1 A. Yes.

2 Q. And that evidence included computer logs?

3 A. Yes. Multiple aspects of digital forensics, whether

4 it be subscriber records from a phone carrier or Internet

5 service provider, to the records that would be contained within

6 a mobile device or a computer.

7 Q. And you'd agree with me that good record-keeping is a

8 critical aspect of digital forensic investigation?

9 A. It is. Different companies have different standards

10 or policies, but yes, it is a foundational key.

11 Q. Okay. I would like to turn Exhibit B, if we could

12 get that up on the screen.

13 THE VIDEOGRAPHER: One moment.

14 Q. (BY MR. EKELAND) And I would like to go to where it

15 says on top of the page on the corner, like, you see that

16 printing page 6 of 15 with the -- it has the title here with

17 digital shot I wanted. Actually, go back to that first page

18 for a second and then we'll jump to that page.

19 Q. (BY MR. EKELAND) So Mr. Kasal, do you recognize this

20 document?

21 A. So far, yes.

22 Q. And you are the Shawn Kasal that's on the front of

23 this document, correct?

24 A. That is me, yes.

25 MR. EKELAND: Okay. Could we go to page 6 of

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 13 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 13

1 15?

2 Q. (BY MR. EKELAND) Do you recognize the writing on this

3 page?

4 A. Yes.

5 Q. Did you write this?

6 A. Yes, this looks like my authorship.

7 Q. Okay. I'm just directing your attention to the first

8 paragraph. Under the header your digital shadow. I'm going to

9 read it. It says, my name is Shawn Kasal and I'm a digital

10 forensics expert. I've had the opportunity to serve and be

11 qualified as a forensic expert in Nebraska state district and

12 federal court, is that accurate?

13 A. I may have misstated the federal but, the federal

14 court is across the United States, but yes Nebraska State

15 District Court.

16 Q. You testified as a computer expert in federal courts

17 across United States?

18 A. Multiple, yes.

19 Q. How many times?

20 A. At least eight times, but no more than 12?

21 Q. And you've got records of all those and names of all

22 those cases that testified in?

23 A. I don't keep a running log of every case that I've

24 testified in. No, sir.

25 Q. Did you produce the names of those cases to Mr.

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 14 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 14

1 Apple?

2 A. I did not.

3 MR. EKELAND: And Mr. Apple we're going to

4 request those as well.

5 Q. (BY MR. EKELAND) So you said between -- that you

6 testified roughly between eight and twelve times in federal

7 district courts across the country; is that true?

8 A. Yes.

9 Q. Did you qualify as an expert in all those cases?

10 A. I did.

11 Q. Has ever been a time in any court where you weren't

12 qualified as an expert?

13 A. I had one state district court case in which the

14 judge did not qualify me but it was on the grounds of the

15 francs matter not digital forensics.

16 Q. Do you recall what court that was?

17 A. Stark County, Nebraska. And again, it wasn't a -- I

18 wasn't disqualified as a digital forensic expert, counsel

19 became -- began discussing francs matters and I'm not an

20 attorney and therefore I didn't qualify as an expert in francs

21 matters, specifically.

22 Q. I understood. So what you're saying -- what you're

23 saying is that basically you're a computer expert and you got

24 put on the stand as mistakenly as an expert on franks. Is that

25 what you're saying?

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 15 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 15

1 A. I took the stand under the understanding that we were

2 going to be discussing the digital forensics in the matter and

3 prosecution counsel and defense counsel got locked in a debate

4 on francs matter and that was outside the scope of my

5 understanding or expertise.

6 Q. And the -- and the court disqualified -- didn't

7 qualify you or actually ruled from the bench that you were

8 unqualified as a forensic expert?

9 A. They didn't rule I wasn't qualified as a forensic

10 expert, he just -- the judge asked me to step down because I

11 was not an expert on francs matter.

12 Q. Understood. And aside from that is there any other

13 time that you haven't qualified?

14 A. No.

15 Q. As an expert?

16 A. No.

17 Q. And in federal court, was any of this testimony on

18 behalf of Digital Forensics Corporation?

19 A. No.

20 Q. So is the exhibits up? So I just want to direct your

21 attention to the last sentence in the first paragraph that's

22 put up there. I was retained by legal counsel, Jeremy

23 Simonovic, Esquire in-house counsel digital forensics to assist

24 in their investigation of certain allegations regarding

25 concerning online behavior.

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 16 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 16

1 What allegations are you talking about in that

2 sentence?

3 A. Both actions taken by the individual or company who

4 hired their services for the purposes of identification and

5 there's a subsequent concerns surrounding their methodologies

6 in identifying that individual.

7 Q. Okay. I'm sorry, I'm not completely sure I

8 understood your answer, so I want to just make sure I got --

9 A. It's twofold. One, the Digital Forensics Corp was

10 hired and retained to produce a method of unmasking or

11 identifying an individual involved in some litigation. And

12 then two, the subsequent as it pertains to visual printing

13 corporations use of ways and means.

14 Q. You were brought in response to this lawsuit; is that

15 correct?

16 A. Yes.

17 Q. You didn't work on the initial investigation that

18 generated the Phase 1 report in this matter; is that correct?

19 A. I did not, correct.

20 Q. Have you worked for Digital Forensics Corporation

21 before working for them on this matter?

22 A. No.

23 Q. How -- do you know how Mr. Simonovic came to find out

24 about you?

25 A. I believe it may have been a referral through a

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 17 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 17

1 common colleague based on my experience in working with several

2 members of former law enforcement and military.

3 Q. And do you know him -- do you know Mr. Simonovic

4 personally?

5 A. I do not.

6 Q. And then the next few paragraphs are just sort of --

7 they're not specifically written to address anything in

8 particular in this matter are they?

9 A. For the layperson, they would establish foundation

10 for the type of networks and the network technology and

11 acronyms that may have been used in this document, sir.

12 Q. But to the non-layperson, it's pretty generic

13 information, wouldn't you agree?

14 A. Yeah.

15 MR. EKELAND: I'd like to just go to, what's

16 page 7 of 15 if we could in this same exhibit, and then just

17 going down to the -- under the header tracking web clients and

18 if you could just blow up the first paragraph, that would be

19 awesome.

20 Q. (BY MR. EKELAND) So this is, I guess what you said,

21 text that lays the foundation for the layperson to understand

22 some of the basics here. And this paragraph here is about

23 tracking IP addresses, correct?

24 A. Yes.

25 Q. And there's various ways to do that, correct?

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 18 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 18

1 A. It doesn't go into the ways and means, it's just a

2 statement outlining that this type of technology is commonly

3 used on a daily basis by multiple writers in websites.

4 Q. Yeah, so I wasn't clear. I wasn't asking for an

5 interpretation of the paragraph and I wasn't clear on that, I

6 apologize. What I meant is just there's multiple ways to track

7 IP addresses, correct?

8 A. There are several methods, yes.

9 Q. And when -- when you track an IP address, you

10 generally keep some kind of log or record of the tracking of

11 that IP address, correct?

12 A. If I'm the one implementing or instituting the

13 methodology used, yes, that would be information I would log or

14 possibly record.

15 Q. Right. And just like it says in the last sentence of

16 this paragraph, it says, even the most basic web servers log

17 the date and time, IP address, browser specification for

18 incoming requests. And you have to log it somehow, correct?

19 A. It would be ideal, yes.

20 Q. And did you review any logs related to this matter?

21 A. It is my understanding that the technology that was

22 used for the IP tracking was not implemented specifically by

23 Digital Forensics Corp. That they simply gave the enduser or

24 client the utility to use and they were not directly

25 responsible for its implementation.

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 19 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 19

1 Q. Who was responsible for monitoring it after it was

2 implemented?

3 A. I don't recall. Whoever they sold it to.

4 Q. I'm sorry, sold what?

5 A. Whoever they referred the services to.

6 Q. I don't -- I'm not understanding. They referred --

7 are you -- is it your testimony that Digital Forensics Company

8 hired a third-party vendor?

9 A. No. I believe that the -- this particular matter

10 that they produced a ways of -- a package. The package was a

11 solution to try to gain the identity or geolocation information

12 of someone online. That package was then sent to the -- the

13 subsequent enduser who was responsible for its implementation

14 and use.

15 Q. But that user's not the one keeping track of the

16 information, correct?

17 A. Based on my understanding, the enduser would send

18 this snippet of code in some form of whether a post on social

19 media or an e-mail or some type of digital medium or

20 communication in the efforts of getting the other party to

21 click on it and thus revealing the IP address and possible

22 additional geolocation information of that -- that visit.

23 Q. And when you say geolocation information you mean

24 that there was GPS tracking in that; is that correct?

25 A. No. The link does not contain GPS as far as global

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 20 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 20

1 positioning system radio technology that GPS information would

2 be derived from either the IP address or the system information

3 that was gleaned as a result of the code.

4 Q. Right. So the tracking link can glean the

5 geolocation of the phone, correct?

6 A. The link could get the geolocation of whatever device

7 possibly had clicked on the link whether it be a phone or a

8 laptop or a tablet.

9 Q. And that's precisely what happened here, isn't it?

10 A. I don't recall seeing the end result of that -- that

11 implementation.

12 Q. But did you testify earlier that you believed that

13 DFC produced a package for implementation by the user. So what

14 is the basis of your belief?

15 A. I'm sorry. I don't quite understand the question,

16 sir.

17 Q. Okay. So you just testified that Digital Forensics

18 Corporation produced a package, right, in this case the

19 tracking link, for implementation by the user, in this case

20 defendant Dr. Sandra Guerra. So I am asking you, what is the

21 basis for that belief?

22 A. It doesn't seem complete, sir. The package was

23 multiple stages and that tracking link was just one component

24 of the stages within that package. I believe --

25 Q. Okay. So -- I didn't mean to talk over you. Go

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 21 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 21

1 ahead and finish.

2 A. No. Go ahead, sir, I wasn't.

3 Q. So you just testified that the package came in

4 multiple stages; is that correct?

5 A. Yes.

6 Q. Can you described those stages for me?

7 A. Stage 1 is the ways and means and the snippet of code

8 that could be implemented to determine -- to send whether it be

9 a link on social media, e-mail or text message that the enduser

10 would click on that would produce some returning information

11 being the IP address, possible geolocation and some basic

12 system information, like, maybe the browser version or the UUID

13 of the session that the user was in. It did not install any

14 piece of malware or any kind of persistent threat to the

15 device.

16 Q. And how do you know that?

17 A. By a preview of the snippet of code that's simply a

18 basic code that would just simply much like a website get the

19 IP address, the identity of the web browser, and possibly

20 geolocation information.

21 Q. You've reviewed the code?

22 A. Based on what they produced for me, the link that was

23 provided, and the code that was embedded in it.

24 Q. What did they produce to you to review?

25 A. What I just stated.

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 22 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 22

1 Q. You reviewed the code?

2 A. I reviewed what was embedded in the link that was

3 produced as a part of the package.

4 Q. What was produced to you?

5 A. I've already stated that, sir.

6 Q. I want to know specifically what you reviewed that's

7 the basis of your opinion here?

8 A. I believe it's stated in my report.

9 Q. What report?

10 A. The one that you just had up as an exhibit.

11 Q. It's your testimony here today that what is Exhibit B

12 constitutes a forensic report?

13 A. I wouldn't call it a forensics report, I would call

14 it information or an understanding of what I had an opportunity

15 to review in this matter.

16 Q. And what -- I'm asking you, what underlying

17 documents, information and records formed the basis for your

18 statement, sir?

19 A. Are they not -- are they not stated in that report,

20 sir?

21 Q. No. I don't see them and I don't see a reference to

22 you saying that you reviewed the code. I don't know what logs

23 you reviewed, have you reviewed logs in this matter?

24 A. I don't know what happened with the code after it was

25 sold as a package to the enduser. I don't know it's exact

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 23 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 23

1 means of implementation because I don't believe that Digital

2 Forensics Corp was attributed to that as well. They -- this is

3 a package that they allowed to -- in the market to endusers.

4 Stage 2 of that package being getting legal counsel to assist

5 them in the use of that.

6 Q. Is it -- was it -- did I just hear you testify that

7 you're not even sure that Digital Forensics Corporation knows

8 what's going to happen with it's code?

9 A. No. That is not what I said. That is not what I

10 said at all.

11 MR. APPLE: An objection to form. Misstates the

12 record.

13 Q. (BY MR. EKELAND) What did you say?

14 A. I said that the package that was offered as a

15 solution, that once it is in the hands of the enduser, I have

16 not seen what became of it. I don't know that once they sold

17 the package to the enduser that Digital Forensics Corp knows

18 either.

19 Q. What would you need to know?

20 A. There are multiple factors of information that would

21 be necessary, I guess, I don't understand what the -- what it

22 is that you're seeking in that question.

23 Q. I want to know what of those multiple -- name some of

24 those multiple factors of information for me, just name some of

25 them?

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 24 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 24

1 A. Where the link was posted or how the link was used,

2 if the link was clicked on, if it was clicked on what resulting

3 information was reported, things like that.

4 Q. And it's your testimony today that you reviewed the

5 code that comprised this phishing link that's -- that is in

6 this case?

7 A. I saw what lines of information were embedded in the

8 link that was possibly used for the identification.

9 Q. In what format did you see that in?

10 A. Raw text.

11 Q. A raw text file sent to you by Mr. Apple or DFC?

12 A. Yes, I believe so.

13 Q. And did you also, did you review any other raw text

14 files related to this matter?

15 A. I would have to go back and look at some of my case

16 notes to recall.

17 Q. Okay. I'd like you to go do that and --

18 A. I've got them right here. I can pull that up just

19 give me a second.

20 Q. So you've taken written notes on your investigation?

21 A. I have, I believe, one document that I used as a

22 means of recording my thoughts. I don't know how elaborate it

23 is, it's all written in shorthand.

24 Q. But you wrote down --

25 A. I believe. Let me -- let me open it up before I go

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 25 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 25

1 making statements that are incorrect.

2 Q. Okay.

3 THE WITNESS: David, do you recall when I

4 submitted this report initially.

5 MR. APPLE: I don't but I can --

6 THE WITNESS: I'm just going back through my

7 historical case file to try to find that original report that I

8 had submitted other than the copy that you guys had.

9 Q. (BY MR. EKELAND) When you're referring to the

10 original report, are you referring to what's in Exhibit B?

11 A. Yes.

12 Q. Are you referring -- okay. It's the same document?

13 A. Yes.

14 Q. Substantially.

15 A. Yes. I've archived off a bunch of data so I'm just

16 trying to locate that specific case file.

17 MR. APPLE: If you look at the data in that

18 designation, that might help you.

19 THE WITNESS: Yeah.

20 Q. (BY MR. EKELAND) And you've got a case file on this

21 matter?

22 MR. EKELAND: Let me ask that question and I'll

23 get back to you, Mr. Apple. I'm sorry.

24 Q. (BY MR. EKELAND) Did you just say, Mr. Kasal, that

25 you've got a case file on this matter?

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 26 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 26

1 A. That contains three documents, one of them being what

2 I received from them, one of them being the statement of work

3 or agreement between us, and the third being my limited

4 shorthand notes.

5 Q. Okay. And I heard you say you archived data, but

6 when you talk about archived data that's just what you're

7 talking about, the case file. You're not talking about

8 archiving any other type of data on this case anywhere?

9 A. Correct. No, that's -- that's all it is.

10 MR. EKELAND: And I'm sorry, Mr. Apple, what

11 were you saying?

12 MR. APPLE: I was just helping him to locate the

13 date and I was just looking -- thinking about the date from the

14 expert designation that might help him. I don't have it in

15 front of me and it's off the screen now.

16 A. Ah, here we go. It's 8/22 of '18. Okay. That's why

17 I was not seeing it it's because it was back a few years.

18 Q. (BY MR. EKELAND) Did you just say that you were

19 first retained on this matter on August?

20 A. No. The completed phase 1 evaluation report that I

21 received from them was completed on 8/24/18. That was just a

22 means of me trying to find out when I would have put it in

23 chronological order in my file.

24 Q. Did you just say that you received it -- I'm sorry

25 when, the Phase 1 report?

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 27 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 27

1 A. I don't know when I received it that's just the date

2 that is on the report. It's not letting me see the file.

3 MR. APPLE: The expert designation is dated

4 November of 2021, if that helps.

5 THE WITNESS: Yes, it does. Thank you.

6 A. I believe I may have found it. One second here, I'm

7 just opening up the document to validate that this is it.

8 Ah, yeah. I found it. Okay. All right. P --

9 well, I apologize I may have misspoken. I do not have any case

10 notes at all. I have the draft that I sent and my final and an

11 invoice and the statement invoice that we agreed on.

12 Q. (BY MR. EKELAND) But it's your recollection that you

13 reviewed raw text files?

14 A. Yes. I do recall having looked at the snippet of

15 code that was contained in the tracking link.

16 Q. Do you recall reviewing any logs of any type?

17 A. No, I do not.

18 Q. Do you recall reviewing any forensic images of any

19 devices?

20 A. Oh, no. Absolutely not, no.

21 Q. Do you recall how the raw text file was sent to you

22 by DFC?

23 A. Because I do not have a copy of it most likely it was

24 a screen sharing session of some kind.

25 Q. And you communicate -- but you communicate with DFC

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 28 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 28

1 via e-mail, correct?

2 A. I did but it was never sent via e-mail.

3 Q. It would have been sent normally, you say, via screen

4 sharing session?

5 A. I believe there was some initial property concerns

6 and we didn't want it to open so as for information assurance I

7 believe we did a screen sharing session for my purposes of

8 checking that.

9 Q. Did -- do you recall receiving any other information

10 from DFC to review in this matter besides what we just

11 discussed?

12 A. I do not.

13 Q. And you, I believe just testified that you don't have

14 any data related to this matter in your custody, possession, or

15 control on any server in the world?

16 A. I do not.

17 Q. Let's go back to the tracking web client section that

18 we were looking at before, but let's take a look at the second

19 paragraph there that starts out there is a sprawling sector in

20 the information economy. And would it be fair to say in this

21 paragraph you're talking about the various ways that people can

22 be tracked on the Internet or their iPhones can be tracked?

23 A. Yes. For the purposes of marketing and

24 merchandising, absolutely.

25 Q. And you'd agreed that that last sentence, the far end

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 29 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 29

1 of the spectrum includes services ranging from tracking the

2 latest model iPhones that visit from specific companies in

3 order to offer highly targeted advertising to executives to the

4 ability to deliver a personalized birthday greeting via

5 Facebook ad having it appear just once for the intended

6 recipient. That's a true statement, right?

7 A. That is one of the capabilities within these types of

8 technology, yes.

9 Q. And these types of technologies, they can target

10 specific phones and gather a host of information from the phone

11 depending on --

12 A. As an example, that wasn't the case with this piece

13 of code.

14 Q. That's not what I was asking, but you do agree with

15 me that the technology exists where you can target someone's

16 iPhone and extract information from it, correct?

17 A. Yes, technology like that exists. That did not

18 appear to be the technology used here.

19 Q. But the technology exists, correct?

20 A. Yes.

21 Q. And you know what malware is, right?

22 A. I do.

23 Q. What's your basic definition of malware?

24 A. A computer code written with a nefarious intent or

25 purpose.

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 30 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 30

1 Q. And you would consider a nefarious intent or purpose

2 to be, to take control of someone's phone without their

3 consent, correct?

4 A. That would be an example of a nefarious use, yes.

5 Q. Another nefarious use would be to monitor someone's

6 conversations without their consent through their iPhone,

7 correct?

8 A. Again, that would be an example apart and separate

9 from this instance of that type of technology.

10 Q. That was yes?

11 A. Nuanced.

12 Q. Yes. And it's possible, to do -- introduce malware

13 onto an iPhone through a phishing link, is it?

14 A. Oh, sir, if you want to go into the realm of

15 possibilities there are infinite possibilities.

16 Q. That was a yes?

17 A. Restate the question, I'm not really sure I

18 understood its scope.

19 Q. Okay. It's possible to install malware on an iPhone

20 by sending the iPhone owner a link, say via a message or a

21 chat, and having them click on that link?

22 A. Yes. As exampled by the Jeff Bezos hack, and the

23 Washington Post reporter who was subsequently murdered by

24 unnamed individuals, yes. Those types of technologies exist.

25 Q. Yes, it can be quite dangerous. It's led to people

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 31 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 31

1 being murdered.

2 MR. APPLE: Objection, relevancy.

3 Q. (BY MR. EKELAND) So it's actually quite common?

4 A. Not common, no. I would not say common.

5 Q. How do you know that?

6 A. The implementation of that kind of code, is typically

7 only afforded by governments.

8 Q. It's your testimony here today that only governments

9 have the capability to install malware on a smart phone through

10 a phishing link? That's your testimony here today?

11 A. That is a component. It is not the sole and only. I

12 was referencing the Bezos matter, not this one specifically.

13 Q. Isn't it true that there's a number of commercially

14 available programs that one can purchase to install malware on

15 someone's iPhone?

16 A. That was not the case here.

17 Q. That's a yes?

18 A. There are commercially available tools that are in

19 that realm, yes. That was not the code that was used here.

20 Q. But you didn't examine any logs in this case,

21 correct?

22 A. By the examination of the snippet of code that was

23 contained in the tracking link, I can with some degree of

24 certainty say that it was not an advanced persistent threat and

25 it did not have the capabilities of that type of attack

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 32 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 32

1 service.

2 Q. But you only examined a snippet of code, correct?

3 A. The snippet of code that was contained within the

4 tracking link.

5 Q. And you referred to advanced persistent threat, APT,

6 but APT and what they're talking about here can be more than

7 just a snippet of code, correct?

8 A. It can be, I did not see that type of code in this.

9 Q. But you only saw a snippet of code, correct?

10 A. I saw the code that was embedded in the link and if

11 by the term snippet, I meant redacted or restricted or not in

12 full as it pertained to very specifically the tracking link at

13 debate in this matter. A snippet was probably the incorrect

14 word to use.

15 I saw the embedded code in that tracking link

16 that was offered as part of the solutions package in this

17 matter. It did not contain any capabilities of persistence or

18 infiltration past the identification of very simply information

19 that one could get or any web provider could get as embedded in

20 website that is worth further specificity here.

21 Q. But that's all you saw of the package, correct?

22 A. Yes.

23 Q. And you didn't see anything on how the package was

24 deployed?

25 A. I did not.

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 33 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 33

1 Q. And you've reviewed no information or any kind of

2 record at all of what happened after that package was deployed,

3 correct?

4 MR. APPLE: I'm going to object to the form of

5 question, it's compound.

6 A. I did not see any result of the implementation of

7 this code but I don't know how it would be dissimilar from the

8 payload as it is and as I had a chance to review. I am unaware

9 of Digital Forensics Corp adding or subtracting anything to the

10 package past what I had opportunity to review.

11 Q. (BY MR. EKELAND) It's your testimony that you don't

12 know?

13 A. That would be a fair answer.

14 Q. It's your testimony that you are unaware?

15 A. When it comes to the implementation or subsequent

16 result of, that is correct.

17 MR. EKELAND: If we could go to page 8 of 15 and

18 go to the section on concealment of activity. I'd just like to

19 blow up the last paragraph in that section.

20 Q. (BY MR. EKELAND) And just take a second if you need

21 it just to refresh your recollection of this section and just

22 let me know when you're good.

23 A. I'm familiar with this line. What's your question,

24 sir?

25 Q. I'm getting to it, one second. So in this paragraph

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 34 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 34

1 you mentioned the network engineer skill set to the level of

2 being able to capture and analyze traffic, right?

3 A. I'm referring to those people who would need to do

4 investigative work on the Internet who would need to move with

5 a degree of anonymity and/or would be in reference to law

6 enforcement as their ability to collect information or

7 intelligence for the purposes of investigation on the Internet.

8 Q. So you'd agree with me that it's possible to

9 anonymously collect and analyze traffic on the Internet for an

10 individual or even a group anonymously?

11 A. There's a very specific and nuanced answer. The

12 network carrier or the Internet service provider at the end of

13 the day is the only one who has the visibility to do that kind

14 of traffic patterning or capture if they don't already exist on

15 the network. And simply that is done with permission of a

16 warrant or subpoena from the government to do so.

17 And me working for an Internet service provider,

18 there's secure check -- checks and balances in place that would

19 prohibit or otherwise restrict just some random person walking

20 into the data rack and just capturing packages for that

21 purpose.

22 Q. Is it your testimony here today that it's only the

23 Internet service provider that can capture and analyze traffic

24 on a network; is that your testimony?

25 A. As it pertains to traffic traversing the Internet,

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 35 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 35

1 unless you're -- there is a type of technology used like you

2 first referenced, just tap into a coax system which would be

3 inviolate of the law and I don't know who would be actively be

4 involved in such things without understanding of its legal

5 recourse.

6 Q. Are you aware that in the state of Texas phishing is

7 a crime?

8 A. I'm sorry, what, like, catching catfish?

9 MR. APPLE: And I'm going to object to the term

10 phishing because that's obviously a vague term and has many

11 connotations.

12 Q. (BY MR. EKELAND) All right. Are you familiar with

13 the term phishing spelled with a p-h?

14 A. I am.

15 Q. Explain to the jury what that term means.

16 A. There are multiple types of phishing. Phishing can

17 be used as a social engineering method to glean intelligence

18 for information. Phishing can be used as a larger part of a

19 fraud or misuse, phishing can be a means of identification. It

20 has multiple definitions and without further context it would

21 be tough to give you an answer that would be specific enough

22 for this matter.

23 Q. Okay. Well, let's use this matter as a concrete

24 example. And you said you were familiar with the snippet of

25 code that went in the package that was sent out by DFC and that

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 36 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 36

1 was a link, correct?

2 A. Yes.

3 Q. And the implementation as you said, of that link was

4 for the user to do, correct?

5 A. As you're referencing this package, that package also

6 talks about the proper implementation under the guides of

7 proper oversight by their own legal counsel and pertinent use

8 of its capability list.

9 Q. But actually, what DFC recommended -- well,

10 actually -- withdraw. You mentioned social engineering as part

11 of phishing, correct?

12 A. It can be a component, yes.

13 Q. And social engineering is persuasively getting

14 someone to do something that allows you access to their

15 computer system without their consent or authorization,

16 correct?

17 A. I -- I don't persuasively -- off getting someone to

18 give you access without authorizing?

19 Q. Well, you discussed social engineering, you just

20 mentioned it. So why don't tell you us what your definition of

21 social engineering is?

22 A. Again, it depends on context. Social engineering can

23 be as simple as convincing the clerk at the gas station to give

24 you a discount on fuel. There's nothing nefarious or criminal

25 about it.

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 37 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 37

1 Q. And sending somebody a link with the deceptive

2 message saying, hey, click on this link and you'll get

3 whatever, when it's really a tracking link, that's -- that's a

4 from of social engineering, isn't it?

5 A. That would be a form, yes.

6 Q. It's deceptive, isn't it?

7 A. It could be construed that way.

8 Q. That was a yes. And as such, you would agree with me

9 that social engineering is a type of fraud?

10 A. No. We all negotiate everyday. Social engineering

11 is a form of negotiation.

12 MR. EKELAND: Objecting to that last comment as

13 nonresponsive.

14 MR. APPLE: All right. Tor, when you're getting

15 to a stopping point can we take a five-minute break.

16 MR. EKELAND: Yeah. I think now is a good

17 stopping point. Do you want to take, you know, whatever, like,

18 a 15 and then come back and I don't even know what time it is.

19 MR. APPLE: I would prefer five if we can do it,

20 because I just -- I don't know how long you're going to go

21 today but I mean, I just don't --

22 MR. EKELAND: Yeah. It's fine. I don't think

23 it's going to be that killer of a day. I think we're doing all

24 right. I'm about -- I mean don't hold me to this, I think I'm

25 about, like, half way through maybe. I never know, you know,

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 38 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 38

1 how these things go. So I'm not -- listen, why don't we take

2 -- how about we spit the baby and say 10 minutes.

3 MR. APPLE: Okay.

4 MR. EKELAND: And then we'll just come back and

5 go.

6 MR. APPLE: Okay. All right. Sounds good.

7 THE VIDEOGRAPHER: Going off the video record.

8 (Short break was taken at 2:40 p.m.)

9 (Deposition resumed at 2:56 p.m.)

10 THE VIDEOGRAPHER: We're back on the media

11 record. This is beginning of media file Number 2. The time is

12 3:56 p.m.

13 THE COURT REPORTER: And before we continue,

14 this is Nancy Tamez. I just wanted to get the appearances for

15 the record, please.

16 MR. EKELAND: Sure. It's Tor Ekeland for

17 Plaintiffs Dr. David Rodrigo Cantu and Melody Cantu.

18 MS. PEERY: Brandy Peery on behalf of Defendant

19 Dr. Sandra Guerra.

20 MR. APPLE: David Apple on behalf of Defendant

21 Digital Forensics Corporation.

22 THE WITNESS: Shawn Kasal, digital forensics

23 expert on behalf of Digital Forensics Corporation.

24 MR. EKELAND: Are we ready to proceed everybody?

25 MR. APPLE: Yes.

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 39 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 39

1 MS. PEERY: Yes.

2 Q. (BY MR. EKELAND) Okay. A formality, Mr. Kasal did

3 anything happen on the break or did you ingest anything that

4 would cause you not to be able to answer truthfully in your

5 testimony here today?

6 A. No.

7 Q. I'd like to just finish up with Exhibit B if we could

8 get that back up on the screen again and then we'll move on.

9 MR. EKELAND: I would like to go to page 14 of

10 18. It has a header on it that says forensics tools and

11 software qualification.

12 Q. (BY MR. EKELAND) And Mr. Kasal, are you -- can you

13 see the document, Exhibit B?

14 A. Yes. I'm sorry. Can I --

15 Q. That's fine. Take a moment. Yeah. We'll take a

16 moment.

17 THE VIDEOGRAPHER: Going off the record.

18 Q. (BY MR. EKELAND) Mr. Kasal, sorry, can you see

19 Exhibit B on the screen?

20 A. Yes, I can.

21 Q. And do you see the page that says forensics tools and

22 software qualifications, you see this?

23 A. Yes. Yup.

24 Q. And that's a listing of your qualifications, correct?

25 A. Training I've had or tools I've used or contributed

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 40 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 40

1 in the construction of, yes.

2 Q. And you're trained in a fair amount of forensic

3 software, for instance, Cellebrite, correct?

4 A. Yes.

5 Q. And that's a software as you described it here is a

6 forensics extraction device that you can use to image

7 cellphones with, correct?

8 A. That's one of its uses, yes.

9 Q. And are you familiar with the types of forensics

10 software that Digital Forensic Corporation or DFC uses?

11 A. In total scope, no. They're a decent sized firm,

12 they probably have tools that I don't. I don't know the extent

13 of their tools though.

14 Q. You said not in total scope but in partial scope you

15 are aware of some of the software and forensic techniques that

16 they use?

17 A. I would be making an assumption to state. They have

18 never offered or volunteered their toolset or training to me.

19 Q. Looking at this list here under forensics tool and

20 software qualifications, do you know if DFC uses anything

21 that's listed on this page of Exhibit B?

22 A. I would be making an assumption to do so. I have not

23 been told of their total toolset.

24 Q. So you don't know what type of forensic tools Digital

25 Forensic Corporation has?

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 41 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 41

1 A. I can't state -- in full, no, I don't.

2 Q. You've never asked them, have you?

3 A. No. Outside of the scope of what I was hired.

4 Q. You asked them within the scope of your hiring, is

5 that what you just testified?

6 A. Yes. I had on the break I had an opportunity to

7 review the -- the report from which I derived my -- my record

8 that you see that you had already presented as an exhibit and I

9 do have a correction as far as it wasn't screen share from

10 which I saw the components of the code used in the tracking

11 link. It was the report that they offered in discovery that I

12 had saw that -- those snippets or bits of code, yes.

13 Q. You are referring to what's entitled as the Phase 1

14 report; is that correct?

15 A. Yes.

16 Q. And -- I'm sorry, do you need a moment?

17 A. No. I was just making sure it was the Phase 1

18 evaluation report that you're referring to.

19 Q. Outside of the Phase 1 report, did you review

20 anything else provided to you by DFC?

21 A. No. That's why I wanted to offer that correction, it

22 wasn't a screen share session from which I saw the components

23 or the snippets of code, it was this report.

24 Q. So you didn't see the code in native, you just saw

25 what was printed out in the Phase 1 correct?

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 42 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 42

1 A. I'm sorry -- I don't understand, that's not -- what

2 do you mean "in native". I don't understand what that means.

3 Q. Well, you're just -- you just -- your testimony is

4 based on what you read in the Phase 1 report, correct?

5 A. Yes. I don't know that there's any other more native

6 or otherwise information.

7 Q. Well, there's the actual code itself existing on the

8 computer, correct?

9 A. I don't understand how it would be any different that

10 what's in the Phase 1 report.

11 Q. Well, you don't have any way of knowing do you?

12 A. No more than you do, I have no idea.

13 Q. Let me finish my question, please. You have no way

14 of knowing if what you're seeing in the Phase 1 report in

15 relation to that snippet of code is everything involved in the

16 package, correct?

17 MR. APPLE: Objection, form.

18 Q. (BY MR. EKELAND) You can answer.

19 A. I don't understand why any of that would have been

20 redacted from me.

21 Q. Did you ask anyone at DFC?

22 A. Yes.

23 Q. Who did you ask?

24 A. I asked, is there any additional information as it

25 pertains to this code that I'm not aware of, or is there any

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 43 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 43

1 hidden features and functions that are not enumerated or

2 described in this report. And their answer was no, there was

3 no -- not any additional information nor was there any

4 additional ossification in technologies or a code built into

5 this specific instance than what had been revealed in the Phase

6 1 report.

7 Q. And who did you speak to at DFC?

8 A. General counsel. General counsel.

9 Q. General counsel, was that the only person you spoke

10 to at DFC?

11 A. As it pertains to that question, general counsel is

12 the only one I talked to.

13 Q. Did you talk to any of the forensic investigators at

14 DFC?

15 A. As to that question or outside of that question?

16 Q. Outside of that question, within that question, in

17 relation to this matter?

18 A. Oh, in relation to this matter, no. On one of the

19 calls that I had we were joking about, you know, Cellebrite

20 getting kind of some bad press, but other than that, no. I did

21 not talk to any of the forensic investigators specifically

22 about this -- this matter. General Counsel was my point of

23 contact.

24 Q. I'm a little confused, did you just say you were on a

25 phone call with forensic investigators that you were joking

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 44 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 44

1 about Cellebrite having issues, did I hear that correctly?

2 A. During one of my calls with General Counsel, a

3 forensic investigator happened by the office and we had joked

4 about Cellebrite.

5 Q. So you were on the phone with General Counsel --

6 General Counsel at his office and a forensic investigator came

7 by and you made jokes about Cellebrite; is that correct?

8 A. I believe that to be the case, yeah.

9 MR. APPLE: Objection, relevancy.

10 Q. (BY MR. EKELAND) Do you know the name of that

11 forensic investigator?

12 A. No.

13 Q. Do you know the names of the forensic investigators

14 who worked on the Phase 1 report?

15 A. I don't recall. I don't --

16 Q. Do you know who wrote the Phase 1 report?

17 A. It's author isn't stated?

18 Q. That's a no. You don't know who wrote the Phase 1

19 report, correct?

20 A. Well, I could look at the Phase 1 report and.

21 Q. You don't need to look at it, you don't know, is that

22 what you said?

23 A. It's not that I don't know, I could recall it if I

24 looked at the report.

25 Q. Then take a second and look at the report and tell me

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 45 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 45

1 who write it?

2 A. Examiner name 223.

3 Q. Do you know how many examiners they have at DFC?

4 A. No.

5 Q. Do you know who examiner 223 is?

6 A. I do not.

7 Q. Did you ever ask to speak to examiner 223?

8 A. No.

9 Q. Did you ever ask to speak to the coder who wrote the

10 snippet of code that we were discussing earlier?

11 A. No.

12 Q. Did you speak to anybody at all in relation to the

13 Phase 1 report besides General Counsel for DFC and the forensic

14 investigator who happened to walk by General Counsel's office?

15 A. I don't recall, no.

16 Q. That was a no.

17 A. It was I don't recall.

18 Q. Do you have any records?

19 A. No.

20 Q. Or call logs or calendars that would hope you recall?

21 A. I do not.

22 MR. EKELAND: I'd like to go to exhibit D now.

23 Q. (BY MR. EKELAND) If you can just take a look at that

24 real quickly and let me know when you've had a chance to look

25 at it?

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 46 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 46

1 A. I've had a chance to review it, sir.

2 Q. Have you seen this before?

3 A. It doesn't look familiar to me.

4 Q. Okay. Do you see the -- up on the header on the left

5 where it says DocuSign Envelope ID and then it's a 4A8BD and a

6 long list of numbers?

7 A. That doesn't look familiar to me.

8 Q. And you familiar with DocuSign?

9 A. I am.

10 Q. DocuSign's a way to electronically sign contracts

11 over the Internet, correct?

12 A. Yes, I believe that the primary service, yes.

13 Q. Did you sign your contract with DFC via DocuSign?

14 A. I'd have to go back and look, I don't recall.

15 MR. EKELAND: Could we go to the next page,

16 please?

17 Q. (BY MR. EKELAND) And just directing your attention

18 just to the top under the terms of service where the word

19 agreement is bolded. And you can see it says, this client

20 services agreement is by and between Sandra Guerra client and

21 company and collectively referred to as the parties. Have you

22 seen this document before?

23 A. This appears to be a component of a larger document,

24 I couldn't say without seeing the document in full.

25 Q. Okay. Well, let -- let's go through it.

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 47 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 47

1 A. I'm not a contract specialist, sir. I don't -- I'm

2 not really sure what I can answer here.

3 Q. Well, you're here today in the context as a digital

4 forensics expert, correct?

5 A. Yes.

6 Q. And this is a terms of service contract between

7 Dr. Sandra Guerra and DFC.

8 A. I'm not a specialist in their contracts, sir, I'm

9 don't know what wisdom I could offer you on their contracts, I

10 didn't write it.

11 Q. Right. So you've got no way of knowing one way or

12 the other, correct?

13 A. As far as what?

14 Q. You have no reason to doubt that this is a copy of

15 the contract between Dr. Sandra Guerra and Digital Forensics

16 Corporation, do you?

17 A. No. I have no reason to doubt that.

18 MS. PEERY: Objection, form and relevance. He

19 hasn't been designated as an expert on this topic.

20 MR. APPLE: Same objection. I couldn't get my

21 phone off of mute quick enough.

22 MR. EKELAND: Who is objecting here and

23 defending his client.

24 MS. PEERY: Well, I'm not defending him, but I

25 have a right to object.

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 48 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 48

1 MR. EKELAND: Nobody's designating him as an

2 expert in contract law.

3 MS. PEERY: You're asking -- your questions call

4 for legal conclusion.

5 MR. EKELAND: No. My question didn't, my

6 question is very simple.

7 Q. (BY MR. EKELAND) As you sit here today, Mr. Kasal,

8 you have no way of knowing whether or not this is Dr. Guerra's

9 contract?

10 A. It's Mr. Kasal.

11 MR. APPLE: Objection, form.

12 A. It's Mr. Kasal.

13 MR. APPLE: Mr. Kasal, before you respond let me

14 have an opportunity to make an objection. Again I'm going to

15 object to the form of the question both on grounds of relevancy

16 as well as it's ambiguous.

17 MR. EKELAND: Everybody ready?

18 A. Yes, first of all it's Mr. Kasal.

19 Q. (BY MR. EKELAND) Mr. Kasal, I apologize. I'm sorry.

20 A. Okay. If you would restate your question, I'm not

21 sure I understood what you were asking.

22 Q. You have no reason to believe that this isn't the

23 contract that Dr. Sandra Guerra executed with Digital Forensics

24 Corporation, do you?

25 A. I was not a party to that.

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 49 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 49

1 Q. That's a -- that's a yes. So I'm --

2 A. I'm sorry. I don't understand. What did you want

3 from me as an affirmation of.

4 Q. I said you answered yes. I said that your testimony

5 was that you answered yes to the question --

6 A. Who's testimony?

7 Q. -- that you had no reason to believe, you had no

8 reason one way or the other to know whether or not this was the

9 contract executed between Dr. Guerra and DFC, correct?

10 MR. APPLE: And I'm going to object to counsel's

11 sidebar comments. We're mischaracterizing what the witness is

12 testifying to, his testimony will speak for itself unless

13 you're doing a follow-up question but I don't think you're --

14 you're just making a statement.

15 MR. EKELAND: Okay. And that's enough with the

16 leading objections, Counsel. State your objection or form but

17 don't coach the witness.

18 Q. (BY MR. EKELAND) You can answer.

19 MR. APPLE: Objection, form.

20 Q. (BY MR. EKELAND) You can answer.

21 MR. APPLE: There's not a question pending.

22 MR. EKELAND: Yes, there is.

23 Q. (BY MR. EKELAND) The question pending is whether or

24 not you have any reason to doubt that this is the contract

25 executed between Dr. Guerra and Digital Forensics Corporation.

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 50 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 50

1 MS. PEERY: Objection, form.

2 Q. (BY MR. EKELAND) You can answer.

3 MR. APPLE: Same objection.

4 Q. (BY MR. EKELAND) You can answer.

5 A. I was not a party to that agreement.

6 MR. EKELAND: Okay. Directing, go down to the

7 section that says services quote. It's about -- there you go.

8 Q. (BY MR. EKELAND) Are you aware whether a services

9 quote was provided to Dr. Guerra in this matter?

10 MS. PEERY: Objection, form.

11 MR. APPLE: Same objection.

12 A. I was not a party to this agreement, sir, I don't

13 know what I can offer insight to you at all.

14 Q. (BY MR. EKELAND) I'm asking -- I'm not asking you in

15 relation to a matter of contract law, I'm asking you if you're

16 aware of whether or not Dr. Guerra was provided with a services

17 quote?

18 A. Again, I wasn't a party to that.

19 Q. That's a no, you're not aware of whether she's --

20 A. I do not know either way.

21 Q. Yeah. You do not know either way, correct. Thank

22 you. Going to the next paragraph, price quote. Do you know

23 either way whether Dr. Guerra was provided with price quote?

24 MS. PEERY: Objection, form.

25 Q. (BY MR. EKELAND) You can answer.

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 51 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 51

1 MR. APPLE: Same objection.

2 Q. (BY MR. EKELAND) You can answer.

3 A. None of this information you're asking me to I was

4 party to.

5 Q. (BY MR. EKELAND) Have you ever read any contract

6 provided by DFC to any of its clients?

7 MS. PEERY: Objection, form.

8 Q. (BY MR. EKELAND) You can answer.

9 MR. APPLE: Same objection. Objection, form.

10 Q. (BY MR. EKELAND) You can answer.

11 A. The reports that I was provided did not contain any

12 contract languages or go into extensive detail as to that at

13 all. I don't know.

14 Q. Because you only reviewed the Phase 1 report and

15 nothing else in connection with this matter, correct?

16 A. That would be correct.

17 Q. But you did read the Phase 1 report?

18 A. I read the Phase 1 report as it was given in

19 discovery.

20 Q. And after you read the Phase 1 report, did you try

21 and reach anyone at DFC outside of General Counsel to ask

22 questions about it?

23 A. I don't believe so, no. General Counsel was my

24 primary contact and source of information.

25 Q. Did you have any questions about it after you read

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 52 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 52

1 it?

2 A. No. It seemed extremely straight forward and cut and

3 dried as to the implication used in what the code was capable

4 of. I didn't see any reason to ask any further questions, it

5 was a pretty clear document.

6 Q. And do you normally come to your digital forensics

7 conclusions without reviewing the underlying material that

8 supports the assertions in a report?

9 MS. PEERY: Objection, form.

10 MR. APPLE: Objection.

11 Q. (BY MR. EKELAND) You can answer.

12 A. I -- I don't understand the question, sir.

13 Q. Do you normally, when you conduct a forensic

14 investigation simply rely on the written report provided by a

15 client?

16 MS. PEERY: Form.

17 MR. APPLE: Objection, form.

18 Q. (BY MR. EKELAND) You can answer.

19 A. In a criminal proceeding when I am looking at data

20 provided by the government in discovery, no, I do not have

21 opportunity to interview the digital forensics expert who

22 conducted that examination. I have to base my opinion or

23 understanding on facts based on a report generated by that

24 individual or investigator.

25 Q. But you also did say that you reviewed data, correct?

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 53 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 53

1 MR. APPLE: Objection, form.

2 Q. (BY MR. EKELAND) You can answer.

3 A. There are times and in the cases of child abuse

4 material where I do not have the opportunity to view that data.

5 Q. But those times you say are not the only times that

6 you're doing an investigation, correct?

7 MS. PEERY: Objection, form.

8 A. That's correct.

9 Q. (BY MR. EKELAND) And all those other times you're

10 reviewing the underlying data and evidence that's supporting

11 the claims in any report you're reading, correct?

12 MR. APPLE: Objection, form.

13 A. Sometimes, yes, I do have opportunity to look at the

14 data.

15 Q. (BY MR. EKELAND) And you asked for the data when

16 you're hired, right?

17 A. Yes.

18 MS. PEERY: Objection, form.

19 MR. APPLE: Objection, form.

20 Q. (BY MR. EKELAND) So I just want to direct your

21 attention to the paragraph that says about the Phase 1 service.

22 Have you read this paragraph before?

23 A. Asked and answered. I have already stated I have no

24 purview of this document.

25 Q. But you haven't read it anywhere else outside this

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 54 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 54

1 document, have you?

2 MS. PEERY: Form.

3 A. Again, I don't understand your question, sir.

4 Q. (BY MR. EKELAND) Sorry. My phone was going off.

5 MR. APPLE: And for purposes of record, since

6 there's multiple objections for the same reason, can one

7 objection by one counsel apply for all parties so that we're

8 not having duplicate objections. Is that agreeable Tor?

9 MR. EKELAND: Yes that's agreeable. I agree to

10 that. That's fine.

11 MR. APPLE: Okay. Thank you.

12 MR. EKELAND: All right. Is everybody good?

13 MS. PEERY: Yes.

14 Q. (BY MR. EKELAND) Okay. So I'm just asking if you've

15 read that paragraph anywhere in any documentation from DFC?

16 MS. PEERY: Form.

17 A. With that precise wording exactly, I don't believe

18 so, no.

19 Q. (BY MR. EKELAND) Have you read anything

20 substantially the same from DFC?

21 A. The Phase 1 report does talk about two phases.

22 That's the only similarity I can find.

23 Q. And are you familiar with those two phases?

24 A. As they are represented in that evaluation report.

25 Q. And how are they represented in that Phase 1 report?

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 55 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 55

1 A. Would you like for me to read them for you, sir?

2 Q. No, I want you to tell me from your memory.

3 A. I could read them to you. I'm not going to misquote

4 by trying to recall the precise words.

5 Q. I'm not asking you to quote. I'm asking you to

6 summarize without looking at the Phase 1 document, what the two

7 phases -- or the two phase procedures involved in the Phase 1

8 report is.

9 A. I don't want to misquote or misrepresent that

10 information.

11 Q. I'm asking you for your opinion in your memory and

12 I'm not concerned about misquoting and I'm not concerned about

13 misrepresentation, I'm concerned with what you know?

14 MR. APPLE: Objection, asked and answered.

15 Q. (BY MR. EKELAND) I'm asking you to tell me you what

16 you remember right now of the two components, the two-phase

17 procedure that DFC uses to generate its Phase 1 reports?

18 A. One component is the solution, one component is

19 assisting them in finding counsel for its implementation.

20 That's as much as I can recall or really go off on.

21 Q. And what's your understanding of the word solution?

22 MS. PEERY: Objection, form.

23 Q. (BY MR. EKELAND) You can answer.

24 A. Solution in what regard?

25 Q. I'm asking you what your understanding is if you have

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 56 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 56

1 one of --

2 A. I'm not understanding -- I'm sure --

3 Q. Well, let me finish it first. Have you had any

4 conversations with anybody at DFC about this two-phase

5 procedure involving the Phase 1 report?

6 A. General Counsel and I had a discussion as it pertains

7 to their typical implementation of the two-phase component of

8 their solution.

9 Q. And can you describe for me in relation to this case,

10 particularly what was done in both those phases of the Phase 1

11 report?

12 A. An explanation of the tool that would be used to

13 assist in the identification of this alleged troll or cyber

14 stalker and the component of them having general or seek

15 counsel so that those methods would stay within the confines of

16 enforceable law.

17 Q. You just referenced a tool. What tool are you

18 referring to?

19 A. The code that would be used to identify either IP

20 address or location information of a visitor to that link.

21 Q. The phishing link, correct?

22 A. That's misconstrued, I don't want to call it

23 phishing, there was nothing fraudulent about it if you want to

24 use your previous definition of phishing being a fraud.

25 Q. You don't think there was anything deceptive about

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 57 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 57

1 how--

2 A. The very nature of deception does not constitute

3 fraud.

4 MS. PEERY: Objection, form.

5 Q. (BY MR. EKELAND) Are you a lawyer?

6 A. No.

7 MR. EKELAND: I'd like to go to the next

8 paragraph please. That starts with the Phase 1 process. Yup,

9 that it. You've got it right there.

10 Q. (BY MR. EKELAND) Now, were you familiar in your

11 understanding of the Phase 1 process that it's designed to

12 identify devices which may contain digital evidence of

13 relevance to the client?

14 A. If you're referring to this document again, sir, I

15 don't know what this document is. I've never seen this

16 document. I don't know what insights I can offer you.

17 Q. I'm asking you if -- and not in relation to the

18 contract, all right. I'm asking you if your understanding of

19 the Phase 1 procedure -- I'm asking if your understanding of

20 the Phase 1 procedure is such that you know it's designed to

21 identify devices which may contain digital evidence relevant to

22 the client?

23 MR. APPLE: Objection, form.

24 MS. PEERY: Form.

25 Q. (BY MR. EKELAND) You can answer.

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 58 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 58

1 A. The Phase 1 examination or evaluation report does

2 talk about the possibility of identification of devices that

3 may contain pertinent information, that identification just by

4 naming will show you devices that the enduser may have had.

5 Again, this document is new to me I don't have any idea what

6 this may or may not represent.

7 Q. I'm not referring to the document I'm asking you

8 about your --

9 A. You highlighted a section of the document and then

10 asked me a question that pertains to it.

11 Q. I'm using it for reference and if you'd like I can

12 take it down and go through this document and ask you the same

13 questions, would you prefer that?

14 A. In context, yeah, that would be awesome.

15 MR. EKELAND: You want -- okay so let's -- let's

16 take down. No, let's leave it up actually. You can read it.

17 A. Was at an instruction to read it because I don't have

18 to.

19 Q. (BY MR. EKELAND) No. No. No. You can, you don't

20 have to. I'm not here to tell you what to do, I'm here to ask

21 you questions. Do you see the third sentence that says the

22 process --

23 A. Again, I have no -- no ability to answer questions in

24 this document, sir.

25 Q. I'm not asking you to answer questions about the

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 59 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 59

1 document, I am asking you questions about your knowledge and

2 I'm asking you to read along with me and then I'm going to ask

3 you questions about the subject matter.

4 A. I have no insight into this document.

5 Q. I'm asking you for your insight into the Phase 1

6 investigation and what you can remember about it and you're

7 constantly referring to the contract. Let's take the exhibit

8 away and I will ask you questions about your knowledge of Phase

9 1 without the contract in front of you. Are you ready?

10 Are you aware that it's part of Digital

11 Forensics Corporation Phase 1 procedure to identify devices

12 that -- client devices that may have digital evidence on them,

13 yes or no?

14 MS. PEERY: Form.

15 A. It is typical procedure for any forensic to assist

16 the client in identifying devices that may be used by the other

17 party.

18 Q. (BY MR. EKELAND) And is typical procedure for a

19 digital forensics expert like you to ask for devices with

20 evidence on them, correct?

21 MS. PEERY: Objection, form.

22 Q. (BY MR. EKELAND) You can answer.

23 A. In the context of a child pornography case, no. I

24 don't ask for some of those things because I'm not looking to

25 re-victimize individuals involved.

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 60 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 60

1 Q. (BY MR. EKELAND) But we're not here talking about a

2 child pornography case, are we?

3 A. No. I was just -- you're not being very specific so

4 neither am I.

5 Q. I'm asking you if you're aware that as part of DFC's

6 Phase 1 procedure, they identify devices belonging to the

7 client that may have digital evidence on them?

8 A. I believe I already answered.

9 MS. PEERY: Form.

10 A. I believe already answered that in general nature

11 that would be a procedure that most would have.

12 Q. (BY MR. EKELAND) And that's something you do when

13 you investigate, correct?

14 A. It can --

15 MS. PEERY: Objection, form.

16 A. It can be in a form, maybe acknowledged time.

17 Q. (BY MR. EKELAND) It's your testimony here today that

18 there's times outside of the context of the child photography

19 investigation that you don't ask to see the electronic devices

20 involved with the matter that you're investigating?

21 MS. PEERY: Objection, form.

22 MR. APPLE: Objection, form.

23 Q. (BY MR. EKELAND) You can answer.

24 A. When the government has produced a report that

25 contains shaw signing of content captured and that shaw signing

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 61 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 61

1 not being a depreciated means of signing for it, there are

2 times when, no. I accept the evidence as it is offered because

3 it comes with the foundational identification and signatures

4 that would validate it.

5 Q. And you don't have those foundational signatures here

6 that validates anything you see in the Phase 1 report, correct?

7 MS. PEERY: Form.

8 MR. APPLE: Objection, form.

9 Q. (BY MR. EKELAND) You can answer.

10 A. I don't understand the question, sir. There was no

11 devices involved. There was a piece of code.

12 Q. You have no way of verifying the accuracy of the

13 Phase 1 report, do you?

14 MS. PEERY: Objection, form.

15 A. Once Digital Forensic Corporation released that

16 solution to the enduser, they don't have a way to it either.

17 Q. (BY MR. EKELAND) It's your testimony here today that

18 when DFC releases its package or whatever word you're using to

19 the enduser they have no way of verifying the information?

20 MR. APPLE: Objection, form.

21 MS. PEERY: Objection, form.

22 A. Information what? What information.

23 Q. (BY MR. EKELAND) Well we'll get to that. So you

24 haven't reviewed any communications between DFC and Dr. Guerra?

25 A. No, why?

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 62 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 62

1 Q. Did you ask for any communications between Dr. Guerra

2 and DFC?

3 A. I'm not sure why'd they be of relevant to me taking a

4 look at a piece of code to determine it's payload capability.

5 Q. That was a no, you didn't ask for any of the

6 communications between Dr. Guerra and DFC; is that correct?

7 A. Not relevant to my employment.

8 Q. So you didn't ask?

9 A. No.

10 Q. Did you ask for images of any devices that DFC may

11 have gotten from Dr. Guerra?

12 MR. APPLE: Objection, form.

13 Q. (BY MR. EKELAND) You can answer.

14 A. The snippet of code that I had an opportunity to

15 review did not have any kind of a payload that would've

16 facilitated the necessity to confirm on any device.

17 Q. But the code you reviewed was a snippet of text on a

18 Phase 1 report and you have no way of knowing whether or not it

19 was complete?

20 MR. APPLE: Objection, form.

21 A. The information I was provided is how I derived my

22 report and my opinion.

23 Q. (BY MR. EKELAND) And the Phase 1 report is the only

24 information at you were provided?

25 A. It was.

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 63 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 63

1 MS. PEERY: Form.

2 A. And it appeared to be complete in its understanding

3 of the code used.

4 MR. EKELAND: Can we put exhibit D back up and

5 then I just want to go to the page after the one we were last

6 on.

7 Q. (BY MR. EKELAND) So just for reference, I'm not

8 asking you questions about this contract. I'm asking you about

9 your knowledge about the subject matter that's referenced in

10 this contract which is a separate thing than this contract, do

11 you understand that?

12 A. I understand that.

13 MS. PEERY: Objection to the sidebar.

14 MR. EKELAND: It's not a sidebar it was a

15 question I was asking about the witness's understanding.

16 MS. PEERY: You were explaining your -- your

17 interpretation and that's a sidebar.

18 MR. EKELAND: No, I was explaining to him how my

19 line of questioning was going to go and he answered. And your

20 objection --

21 MS. PEERY: Objection, form.

22 Q. (BY MR. EKELAND) So are you aware of any

23 comprehensive Internet-based search process that Digital

24 Forensics Corporation uses in its investigations?

25 MR. APPLE: Objection, form.

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 64 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 64

1 Q. (BY MR. EKELAND) You can answer.

2 A. No.

3 Q. Did you ask DFC if they used any such service or

4 investigative tools?

5 MR. APPLE: Objection, form.

6 A. This would be -- appear to be another type of social

7 engineering or phishing to derive information that's irrelevant

8 to this matter. I don't understand how that question is

9 relevant to my investigation.

10 Q. (BY MR. EKELAND) I wasn't asking you about phishing

11 and social engineering which we'll get to next, but what I'm

12 asking you is if you're aware of --

13 A. That's outside the scope of my investigation.

14 Q. You're -- it's -- you're saying, your answers is, is

15 that --

16 MR. EKELAND: I'm going to object to that last

17 answer as nonresponsive.

18 A. I didn't understand the question.

19 Q. (BY MR. EKELAND) Here's my -- let me rephrase that.

20 All right. Are you aware of the Internet databases DFC uses to

21 investigate a matter?

22 MR. APPLE: Objection, form.

23 A. No.

24 Q. (BY MR. EKELAND) Did you ask DFC what Internet

25 databases or search engines they used in their investigation?

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 65 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 65

1 A. Outside the scope of my engagement.

2 Q. So you -- you didn't ask them because it's your

3 testimony that it's outside of the scope of your engagement?

4 MR. APPLE: Objection, form.

5 A. I did not ask DFC about their use of any information

6 outside of that report that I was provided to gain my

7 understanding of the code that was used to identify a party,

8 possibly. I don't even know if it was used.

9 Q. (BY MR. EKELAND) You don't even know if the code --

10 the snippet of code that we've been talking about was used?

11 MS. PEERY: Objection, form.

12 Q. (BY MR. EKELAND) You can answer.

13 A. As you previously stated, I did not see any logs of

14 result.

15 Q. Okay. Are you aware of any third party vendors that

16 DFC used in its investigation of the plaintiffs?

17 A. Other than myself, no, I do not.

18 Q. Are you aware of whether or not a private

19 investigator was hired?

20 A. No.

21 MS. PEERY: Objection, form.

22 Q. (BY MR. EKELAND) After DFC hired you on this matter,

23 did you ask them to see all the data that they had related to

24 it?

25 MS. PEERY: Objection, form.

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 66 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 66

1 Q. (BY MR. EKELAND) You can answer.

2 A. I was given a very narrow scope to offer my expert

3 opinion on whether or not the piece of code that could possibly

4 be used to identify someone had any intent, purpose, or

5 capability of -- passed it's obviously stated capability.

6 MR. EKELAND: Object to the last answer as

7 nonresponsive.

8 A. I'm sorry. I didn't answer a question.

9 Q. (BY MR. EKELAND) After -- and I'm asking one --

10 after you were hired on this matter by DFC did you ask DFC for

11 all the data, logs, computer data, related to this matter?

12 MR. APPLE: Objection, form.

13 MS. PEERY: Objection, form.

14 Q. (BY MR. EKELAND) You can answer.

15 A. The report that I received from which I derived my

16 expert opinion appeared to be transparent and forthright as to

17 the exact -- the use of the code and its capabilities. No, I

18 did not ask for any additional information outside of that, it

19 was unnecessary.

20 Q. It's your testimony that additional information

21 outside of the Phase 1 report was unnecessary?

22 MS. PEERY: Objection, form.

23 Q. (BY MR. EKELAND) Is that your expert opinion in this

24 matter?

25 MR. APPLE: Objection, form.

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 67 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 67

1 A. Specifically to these of the code, I don't see any

2 reason why I needed it, or why DFC would have it.

3 MR. EKELAND: I'd like to go ahead a few pages

4 to the one that's Bates stamped 0190 also has a page 5 of 10 on

5 the bottom.

6 MR. APPLE: What exhibit.

7 MR. EKELAND: I'm sorry I didn't realize I

8 hadn't said it. Exhibit D, apologize.

9 Q. (BY MR. EKELAND) Just directing your attention to

10 the middle of the page where it says expert testimony. If you

11 can highlight that and if you could just take a moment and read

12 it and let me know when you're done reading it.

13 A. I'm sorry. Is this that same contract that we were

14 discussing previously?

15 Q. Yes and I'm asking you to read the paragraph saying

16 expert testimony and I'm going to ask you some questions. Let

17 me know when you're done reading it?

18 A. I have no insight into this document.

19 Q. That's not the question I'm asking about, I'm asking

20 you to read the paragraph and I'm going to ask you some

21 questions. So please read it and let me know when you're done.

22 A. Okay.

23 Q. Did DFC hire you under the same terms and rates as

24 described in that paragraph?

25 MR. APPLE: Objection, form.

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 68 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 68

1 Q. (BY MR. EKELAND) You can answer.

2 A. No.

3 MR. EKELAND: You could take Exhibit D down.

4 Q. (BY MR. EKELAND) Are you aware that DFC provides GPS

5 tracking services for its clients?

6 MS. PEERY: Objection, form.

7 A. No idea, sir.

8 Q. (BY MR. EKELAND) Do you know whether or not

9 Dr. Guerra submitted any of her electronic devices to DFC?

10 A. I'm unaware.

11 MR. EKELAND: I'd like to go to Exhibit F now.

12 Q. (BY MR. EKELAND) And you can see the exhibit?

13 A. The first page, yes.

14 Q. And this is the first page in the Phase 1 report,

15 correct?

16 A. It reports to be, yes.

17 Q. I'm sorry, I'm just having a problem with my screen

18 for a moment. Sorry about that.

19 So I believe you testified previously that you

20 don't know who wrote this report?

21 A. My recollection was not clear and when I referenced

22 it it looked like the examiner's name was 223.

23 Q. But you don't know examiner 223's real name do you?

24 A. It may be stated later on in the report, but I do not

25 recall it.

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 69 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 69

1 Q. And you never spoke with examiner 223 about this

2 report, correct?

3 A. I did not feel the necessity based on the

4 transparency and forthrightness of the report.

5 Q. You've read this report before?

6 A. I have read the report.

7 Q. And you've discussed this report with General

8 Counsel?

9 A. What do you mean by discussed, more specifically

10 about what?

11 Q. When you read the report, did you have any questions

12 about it?

13 A. I had a couple questions as to their policy and

14 implementation to which I received the answer of once this

15 enduser or client has the solutions package there's no further

16 involvement with Digital Forensics Corp unless they're

17 reengaged to assist.

18 MR. EKELAND: Could we go to page three, please?

19 Q. (BY MR. EKELAND) Directing your attention to the

20 paragraph number one under the section header, background. Do

21 you see where it says attempted phone hacking?

22 A. Yes.

23 Q. What's your understanding of that sentence?

24 MR. APPLE: Objection, form.

25 A. Based on this report, it was a possibility that her

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 70 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 70

1 phone had been somehow breached.

2 Q. (BY MR. EKELAND) But you never looked at an image of

3 her phone?

4 A. It was an accusation of attempt, it wasn't a

5 confirmed or proven component. It was just a side note for

6 context and background.

7 Q. But you didn't review any evidence of any attempt,

8 did you?

9 A. My job in this instance was to validate the piece of

10 code that would be used to identify an individual to whom it

11 was sent. This was just background into the case so that I

12 would have an understanding of that. Not relevant to my

13 investigation or why I was hired.

14 Q. Your purpose was just to validate a snippet of code,

15 is that what you said?

16 MR. APPLE: Objection, form.

17 A. I was hired to validate based on this report and its

18 contents that a piece of code that could possibly be used to

19 identify an IP address or geolocation did not contain any

20 additional or nefarious purposes.

21 Q. (BY MR. EKELAND) Directing your attention to

22 paragraph two in the same section, identity theft and

23 misappropriation, did you review any evidence outside the Phase

24 1 report related to paragraph two?

25 A. Again, outside the scope of what I was hired for.

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 71 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 71

1 MR. EKELAND: Could we go to the next page,

2 please? And I'd just like to take a look at paragraph two

3 under Phase 1 scope of work.

4 Q. (BY MR. EKELAND) When did you get the Phase 1 report

5 in relation to when you were hired?

6 A. I would need to reference the -- I don't remember off

7 the top of my head. So without referencing some documents that

8 I received it from I don't know the exact dates.

9 Q. But like you testified, you did read it after you got

10 it, correct?

11 A. Yes, I did.

12 Q. And so you read paragraph two which says Phase 1

13 includes the collection, extraction, recovery and preservation

14 of all data from available client devices and online accounts

15 and performing an extensive search of the online presence of

16 the suspects based on the information provided?

17 A. I read that piece, yes.

18 Q. And you also read the paragraph underneath it,

19 paragraph three which says Phase 1 also includes the creation

20 of tracking URLs to target at the suspect or suspects. The

21 client will send the tracking URLs to the suspects Digital

22 Forensics Corporation, DFC, will monitor the tracking URLs for

23 any activity by the suspects.

24 A. Yes, I read that piece.

25 Q. And you're not aware, based on your previous

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 72 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 72

1 testimony, on what DFC did to monitor those tracking links, are

2 you?

3 A. No, I don't know.

4 Q. You don't know who performed the monitoring?

5 MR. APPLE: Objection, form.

6 A. It states there that Digital Forensics Corporation

7 would do the monitoring. I don't know that there was any

8 monitoring done.

9 Q. Directing your attention to the next section, Phase 2

10 scope of work, paragraph two. It says, Phase 2 includes the

11 creation of a searchable archive of all data successfully

12 collected, extracted, recovered and preserved from all devices

13 and/or accounts as part of Phase 1. Do you know where this

14 information is?

15 MR. APPLE: Objection, form.

16 A. I do not.

17 Q. (BY MR. EKELAND) And you didn't think it was

18 necessary to review this information to validate the narrow

19 scope of work that you were hired for, correct?

20 A. It's not relevant.

21 MR. APPLE: Objection, form.

22 A. How does me looking at the data collected or

23 extracted or preserved of the person's phone data or computer

24 data relevant to the use of this piece of code for the identity

25 of another individual. They're not connected.

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 73 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 73

1 Q. And -- and you can tell that just by reading the

2 Phase 1 report?

3 A. The piece of code that was used to possibly identify

4 an individual does not seem connected to or in any way

5 contextual to the devices of the individual.

6 Q. Does not seem?

7 A. They're separate pieces. If, you know, understanding

8 of digital forensics investigation, how does the identity of

9 someone who possibly breached accounts or finding the identity

10 of someone who allegedly breached accounts, necessitate looking

11 at those devices for the purposes of identification. I don't

12 have to look at a phone and the data contained within a phone

13 to understand if a piece of code did or did not identify an

14 individual. They're separate and unrelated.

15 Q. So the only thing you say that you actually have any

16 knowledge of in this case and that you can testify to is just a

17 snippet of code that you read in the phase report?

18 MS. PEERY: Objection, form.

19 Q. (BY MR. EKELAND) Is that your testimony here today?

20 MR. APPLE: Objection, form.

21 A. I have not had access to or preview to any other

22 devices as it pertains to this investigation because it was

23 outside the scope of my necessity of hiring of validating that

24 this piece of code had any other purpose passed it's stated

25 intent.

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 74 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 74

1 MR. EKELAND: Let's go to page five if we can,

2 and let's go to paragraph six.

3 Q. (BY MR. EKELAND) Well, you've already read this?

4 A. I'm familiar with it.

5 Q. All right. So paragraph six says, in Phase 2 Digital

6 Forensics will provide any IP addresses obtained as a result of

7 DFC's tracking URLs engineered specifically for the client.

8 Are you aware or do you know the names of anyone who engineered

9 this snippet of code?

10 MR. APPLE: Objection, form.

11 MR. EKELAND: You can answer.

12 A. The snippet of code was fairly generic in its purpose

13 and intent to -- for this document to state as a result of

14 tracking URLs you engineered specifically for the client, does

15 not denote any customization inspect other than offering

16 personalization to this document.

17 MR. EKELAND: Object to the last answer as

18 nonresponsive.

19 A. I answered your question, sir.

20 Q. (BY MR. EKELAND) My question was whether or not you

21 knew the names of any engineers that worked on the piece of

22 code that you review in the Phase 1 report?

23 A. No, I do not know any names.

24 Q. Do you know the names of any engineers at DFC?

25 A. Without referencing the website not at top of my

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 75 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 75

1 head, no.

2 Q. Do you know of the names of any forensic examiners at

3 DFC?

4 A. Outside the scope of what I was hired to do.

5 Q. You don't know the names of any forensic examiners at

6 DFC, correct?

7 A. Not that I can recall.

8 Q. Is what you read in paragraph six your understanding

9 of the snippet of code that you reviewed in the scope of your

10 work?

11 MS. PEERY: Objection, form.

12 MR. APPLE: Objection, form.

13 A. I don't understand your question.

14 Q. (BY MR. EKELAND) Is paragraph six correct in your

15 opinion?

16 MR. APPLE: Objection, form.

17 A. As to what? I don't understand your question.

18 Q. (BY MR. EKELAND) As to -- okay. I mean, that's

19 fine. I can break it down.

20 Are you aware of whether or not DFC issued a

21 Phase 2 report?

22 THE WITNESS: Can we stop for a moment? I

23 actually had a client come in and this is outside of and of

24 their -- I don't want anyone else involved in this recording or

25 deposition. I had a client step in and I need to ask them to

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 76 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 76

1 go upstairs momentarily while we continue.

2 Q. (BY MR. EKELAND) Okay. There's a pending question

3 can you answer it quickly?

4 A. Yes. State it one more time quickly.

5 Q. Yeah. Sure. Are you aware of whether or not DFC

6 produced a Phase 2 report?

7 A. I am not.

8 MR. EKELAND: So how long do you need?

9 THE WITNESS: Actually, I can just mute myself

10 really quickly.

11 MR. EKELAND: Okay. So --

12 THE VIDEOGRAPHER: Going off the video record.

13 (Short break was taken at 4:03 p.m.)

14 (Deposition resumed at 4:21 p.m.)

15 THE VIDEOGRAPHER: We're back on the video

16 record. This is the beginning of media file Number 3. The

17 time is 5:21 p.m.

18 Q. (BY Mr. Ekeland) Mr. Kasal, are you ready to begin

19 again?

20 A. Yes. I apologize for the interruption. I wasn't

21 intending the deposition going this long. I had scheduled

22 afternoon appointments.

23 Q. I'm sorry. I don't think we're going to take that

24 much longer. Let me just ask the formal question whether you

25 ingested anything or did anything happen over the break that

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 77 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 77

1 renders you incapable answering all the questions truthfully?

2 MR. APPLE: Objection, form.

3 A. Not at all.

4 Q. Thank you. If we could get Exhibit F back up and we

5 can skip ahead to page 7 on it. And I just want to confirm

6 that -- well take a look for a second to refresh your

7 recollection on this page and let me know when you are done

8 looking at it.

9 A. Okay.

10 Q. I just want to confirm your previous testimony that

11 you haven't examined any of the documents or information in

12 relation to this alleged foreign hacking, correct?

13 A. No, I have not. It's outside the scope of what I was

14 hired for.

15 Q. And just going -- if we can go to the next page

16 please, page eight. And just let me know when you're

17 recollection is refreshed.

18 A. I'm good.

19 Q. So this page entitled indemnity theft and

20 misappropriation, that was also outside the scope of your work,

21 correct?

22 A. It was contextual information. But as it pertains to

23 the phishing visa code that was used for the identity of

24 possible attacker, it was not anything that I needed any

25 further information on.

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 78 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 78

1 Q. And you didn't review any further information besides

2 what was on this page, correct?

3 A. Correct.

4 Q. Could you go to the next page. I'm sorry, on page

5 nine please or did I skip.

6 A. I'm familiar.

7 Q. Do you know what software was used to create this

8 image?

9 A. I do not.

10 Q. Do you know who created the image?

11 A. I do not looks like a website of some kind.

12 Q. Do you know when it was created?

13 A. There did not appear to be any time date stamps or

14 retaining information that would avail itself to that

15 knowledge.

16 Q. But if we had the file in native with its meta data,

17 we may have that information, correct?

18 MS. PEERY: Objection, form.

19 MR. APPLE: Objection, form.

20 Q. (BY Mr. Ekeland) You can answer.

21 A. I'm not sure I understand the question. This, this

22 snippet right here that has IP address in it, and the IP

23 address look-up component appears to be a website, that would

24 be publicly available to anyone to go to attempted reverse look

25 up of an IP address.

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 79 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 79

1 Q. Do you know what meta data is?

2 A. Yes.

3 Q. Meta data is --

4 A. Yes, I do.

5 Q. What is meta data?

6 A. Meta data is the data surrounding a given piece of

7 digital artifact with time date stamp or exit data, a photo, or

8 in this case maybe the URL from which it was derived.

9 Q. And the time and date that the file image was created

10 like you said, correct?

11 A. Yes.

12 Q. I'm going now to page ten, please. And just

13 confirming your testimony that, or rather the implication of

14 how I'm reading your testimony that the information on this

15 page is you considered contextual and outside the scope of your

16 employment DFC, correct?

17 MR. APPLE: Objection, form.

18 MS. PEERY: Objection, form.

19 Q. (BY Mr. Ekeland) You can answer.

20 A. It was contextual in the sense of understanding what

21 had possibly transpired. But as to the analysis of the piece

22 of code that was used to identify someone, it wasn't -- there

23 wasn't -- it doesn't help me identify what that code does or

24 doesn't do.

25 Q. Right. And you don't know who generated this image

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 80 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 80

1 of -- in the box with the contact information, correct?

2 A. I'm guessing either the author, technician, choochoo

3 train or whoever provided him that information or her.

4 Q. And directing your attention to the bottom paragraph

5 with the sentence, the first sentence that starts, on August

6 21st, 2018 DFC contacted the second website. You don't know

7 who the person was from DFC that contacted that website?

8 A. No, it's not stated there.

9 Q. Let's go to page 11. And, likewise, with the box on

10 the top of this page that has on its left-hand side showing

11 results for HSVSingles.com, you don't know who generated that

12 image either, do you?

13 A. No, I do not. I guessing the author of the document.

14 I can't guess. Nevermind.

15 Q. And it's fair to say that this box, again, is

16 information that you considered merely contextual to the scope

17 of your employment for DFC, correct?

18 MR. APPLE: Objection, form.

19 Q. (BY Mr. Ekeland) You can answer.

20 A. Yes.

21 Q. So directing your attention to the bottom paragraph

22 under the heading suspicious LinkedIn account quotation, Gary

23 Moran, close quote, particularly the first sentence where it

24 says, DFC engineers acquired and archived the client's LinkedIn

25 and Facebook accounts, you don't know who those DFC engineers

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 81 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 81

1 are, do you?

2 A. I don't know them. I'm trying to figure out why you

3 would ask me that. I don't know.

4 Q. And you have no knowledge of the archived data

5 referred to in if this sentence?

6 A. Nope.

7 Q. And you don't know who Gary Moran is?

8 A. I do not other than what this document purports to

9 say.

10 Q. Let's go to page 12. Likewise -- well, take a moment

11 and take a look at the page if you need to and let me know when

12 familiar with it.

13 A. I'm familiar with it.

14 Q. Likewise, this is information you considered

15 contextual to the scope of your employment with DFC, correct?

16 MR. APPLE: Objection, form.

17 Q. (BY Mr. Ekeland) You can answer.

18 A. While interesting and understanding of maybe why a

19 tool was needed, no, this doesn't have any relevance to the

20 determination of the scope of what the tool does that I was

21 hired for to analyze.

22 Q. And so it wasn't necessary for you to review any

23 information related to it?

24 A. That's correct.

25 Q. If you can go to page 13, please. And just directing

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 82 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 82

1 your attention to the first paragraph under the header at the

2 top that says, web investigation, the sentence that says:

3 Forensic examiner conducted web investigation to identify

4 additional information regarding individuals responsible or

5 suspected of harassment. You don't know who that forensic

6 examiner was, do you?

7 A. No.

8 Q. You're not aware of any information that that

9 forensic examiner recorded or came across?

10 A. I don't -- no, I don't have any idea.

11 Q. And then directing your attention to the paragraph

12 under the header info about Melody Joy Brown Cantu,

13 particularly the first sentence where it is says our engineers

14 performed a thorough web search using advanced tools and

15 techniques. First of all, you don't know who those engineers

16 were, do you?

17 A. No, outside the scope of the piece of code that was

18 used to possibly identify an individual, all your questions

19 have been information I am not privy to, sir.

20 Q. And you don't know what thorough web search they did,

21 do you?

22 A. No, I do not know what that referred to nor are used

23 involved in doing.

24 Q. And you don't know what advance tools and techniques

25 they may have used?

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 83 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 83

1 A. No.

2 Q. And you don't know who generated the two boxes

3 underneath the paragraph we just read, correct?

4 A. I do not. I've already stated outside of code that I

5 was hired to examine.

6 Q. Let's go to page 14. Did you -- is it Joy Cantu's

7 Facebook page?

8 A. I don't know her Facebook page looks like. I have no

9 way to authorize or authenticate it.

10 Q. Okay. Let's go to page 15. Directing your attention

11 to the box with the pattern that says comprehensive report, you

12 don't know who generated this report, do you?

13 A. I do not.

14 Q. Let's go to page 16, please. I think we might be

15 getting closer to the scope of your work here.

16 So directing your attention to the first

17 sentence under the heading tracking URLs where it says, Our

18 forensic examiners have created some links that will help

19 identify people, but we need your cooperation and that's going

20 to be Dr. Guerra. You don't know who the forensic exercise

21 were?

22 A. No, sir. It's not stated. I don't know why you are

23 asking me questions clearly do no which way to identified.

24 Q. I'm just asking you for the record and I'm just

25 asking you to answer limited questions and we'll get done

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 84 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 84

1 quicker that way. Is that okay?

2 A. This already ran way longer than necessary. I got

3 clients that are being ignored because of this.

4 Q. I believe we noticed the deposition until 7:00 p.m.

5 eastern.

6 A. I was not notified of that. I was told it was going

7 to be a 30 minute deposition.

8 Q. Well, we didn't tell anybody that. So I understand

9 and I appreciate your patience, and let's try to get through

10 this as quickly as possible.

11 So you just testified you didn't know who the

12 forensic exercise were.

13 A. That's correct.

14 Q. And then after it says our forensic examiners have

15 created some links, do you know how many links they created?

16 A. Is it stated there, sir?

17 Q. I'm not asking you -- I'm asking if you know from

18 your memory how many links -- how many tracking URLs links were

19 created by DFC forensic examiners?

20 A. Outside questions of my report, I do not know.

21 Q. Do you see that first bullet point under than first

22 sentence that we were just looking at. It starts, tracking

23 URLs are links which send back information to the link creator

24 when the link is clicked by a device on the internet. In your

25 expert opinion is that an accurate statement?

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 85 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 85

1 A. That would be one of the things that a tracker or URL

2 could do.

3 Q. And in your expert opinion is that something that

4 happened in this case?

5 A. I did not see any subsequent logs or result of use of

6 it, so I don't know.

7 Q. Just so I understand your testimony, you would need

8 to see logs or some other form of evidence to know what

9 actually happened?

10 A. No, that's not the case. The code very plainly

11 described what its capabilities were. The only reason I would

12 ever need the logs of the results is to determine what

13 information it returned, specifically, the code clearly stated

14 what its capabilities were, and that's all I needed to know to

15 offer my expert opinion.

16 Q. You just testified that the code clearly stated what

17 its capabilities were. What were those capabilities?

18 A. They're in the document, sir. You can read it for

19 yourself.

20 Q. I'm asking you to tell me from your memory because

21 you just stated that the code clearly stated.

22 A. They would have use HTML canvasing, convas like as in

23 a ship's sail, canvas, to determine the identity of the web

24 browser used, the IP address of the visitor and possibly the

25 geolocation information if it was available via that HTML

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 86 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 86

1 canvas utility.

2 Q. And in your expert opinion, if somebody wanted to put

3 connect malware to a link somewhere to this one, they could if

4 the link is clicked on infect someone's device with that

5 malware, correct?

6 MS. PEERY: Objection, form.

7 Q. (BY Mr. Ekeland) You can answer.

8 A. I saw no indication in the code that I examined that

9 would lead one to believe that was the case; however, I do not

10 know outside of that context if there was or was not.

11 Q. And in your experience as a digital forensic expert,

12 you are aware of malware being delivered to smart phones, iPads

13 and other electronic devices when the unsuspecting user clicks

14 on the phishing link, correct?

15 MS. PEERY: Objection, form.

16 A. I am aware of those types of utility, but based on my

17 analysis of this specific code, I did not see any function of

18 that.

19 Q. And when you say you analyzed your analysis to the

20 specific code you were just analyzing what was printed on the

21 page in this Phase 1 report, correct?

22 MS. PEERY: Objection, form.

23 A. I have no reason to believe or to show otherwise.

24 Q. And you didn't ask?

25 MR. APPLE: Objection, form.

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 87 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 87

1 Q. (BY Mr. Ekeland) You can answer.

2 A. Outside of this document, its transparency and

3 forthrightnous did not facilitate the need ask further

4 questions based on the understanding that I had.

5 Q. Because the document is transparent?

6 MS. PEERY: Objection, form.

7 A. Yes.

8 Q. So directing your attention to the next bullet point,

9 it says, Each individual tracking URL captures IP address,

10 operating system, browser, screen resolution and hash

11 information for the device from which the tracking URL is

12 clipped.

13 As far as you know is that statement accurate?

14 A. Yes.

15 Q. Can you explain for the jury what hash information

16 is?

17 A. Yes. Hashing is that digital signature that I had

18 referred to previously. It is a means of validation so that

19 the information that was captured or collected in this instance

20 could be given a digital signature. A digital signature then

21 returned to, perhaps, maybe your experts to in turn validate

22 that there was nothing further, tampered with, modified or

23 otherwise edited.

24 Q. And we have that hash information?

25 A. I don't know if it was provided you or not.

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 88 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 88

1 Q. Have you reviewed hash information?

2 A. I did not see the results of that logs, so I don't

3 know.

4 Q. But the hash information is necessary to validate the

5 authenticity of the digital evidence, correct?

6 A. I did not see the results of this code just that the

7 code itself and its capabilities were stated and for all

8 appearances appeared to be correct and accurate.

9 MR. EKELAND: Object to the last sentence as

10 nonresponsive.

11 Q. (BY Mr. Ekeland) My question was that the hash

12 information --

13 A. In this instance talks about --

14 Q. I would like to finish -- the hash information is

15 necessary for validating the authenticity of the information,

16 correct?

17 A. If you read the question you asked her, the hash

18 information is referencing a device from which the tracking URL

19 is clicked. It's not asking about the hash of the code itself.

20 It's asking about the hash or the device that clicked on it, so

21 your question is improperly informed.

22 Q. So there's hash information regarding this link; is

23 that correct?

24 MR. APPLE: Objection, form.

25 A. Sir, we're talking in circles. I don't understand

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 89 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 89

1 your question.

2 Q. (BY Mr. Ekeland) I'm asking you based on your

3 understanding of this sentence that the hash --

4 A. Hash refers to for the device.

5 Q. -- for the device?

6 A. The device would be the one not that visited the

7 link, not the code itself.

8 Q. So it's your testimony that what DFC is saying here

9 is that the reporting hash is for the devices they re using to

10 send out these tracking links; is that correct?

11 A. No. Are you reading the same thing I am?

12 Q. Let me ask you this, why don't you explain for us how

13 and why DFC is collecting the hash information on its own

14 devices?

15 MR. APPLE: Objection, form.

16 A. That's not what that states, sir.

17 Q. Explain it. Tell me what it states?

18 A. I don't know. You can read English, correct?

19 Q. You are a digital forensic expert, correct?

20 A. I am. And I am stating that your understanding of

21 the statement is incorrect to the point of fallibility.

22 Q. I'm asking you is to state the correct version.

23 A. I can read to you as it is stated on the page. Each

24 individual tracking URL captures the IP address, operating

25 system, browser and screen resolution and hash information for

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 90 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 90

1 the device from which the tracking URL is clicked. That is not

2 a device that DFC, it's not code. It is a device from which it

3 is clicked.

4 Q. And in your expert opinion as a digital forensics

5 expert why would somebody want to collect the hash information

6 on their device in a situation like this?

7 A. Your question is misleading. It's not even correct

8 based on just what I read.

9 MR. APPLE: Objection, form to the question.

10 Q. (BY Mr. Ekeland) Did you just read to me that in this

11 sentence that hash information for the device from which the

12 tracking URL is clicked is reported by DFC, is that not true?

13 MS. PEERY: Objection, form.

14 A. Sir, your questions, I don't understand it. I mean,

15 I just read it.

16 Q. (BY Mr. Ekeland) Right. So it's true that DFC as far

17 as you know based on this report that DFC was collecting hash

18 information on the devices that they were using to send out

19 these tracking links; is that correct?

20 MS. PEERY: Objection, form.

21 MR. APPLE: Objection, form.

22 A. They're collecting the hash information for the file

23 returned to them in understanding so it can be verified. It

24 showed it was not edited. It's not the device itself. It's

25 information returned from the tracking URL.

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 91 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 91

1 Q. Excellent. So the information that was returned from

2 the tracking URL had a hash attached to it so it could later be

3 verified, correct?

4 MR. APPLE: Objection, form.

5 A. That would be more correct.

6 Q. And you haven't seen the hashes?

7 A. For what?

8 Q. You haven't reviewed any of this information?

9 A. Yes, I have. I have reviewed this entire document.

10 MR. APPLE: Objection, form.

11 Q. I'm talking about the files, the information that was

12 sent back to DFC with the hash on it?

13 A. You say a misleading question and then accuse me of

14 not doing, so I have a problem with you asserting for the

15 record what it is I say. You are misconstruing my words.

16 Q. Speak your words then.

17 A. I'm only answering your questions.

18 Q. According to what you just read here --

19 A. This is my testimony. You are making me look like a

20 fool because you are misconstruing my words.

21 Q. Isn't it true that according to what you just read,

22 if it's true --

23 A. What's true?

24 Q. Listen, if you aren't going to be cooperative --

25 A. You have tried to misconstrue my answers.

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 92 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 92

1 MR. EKELAND: Mr. Apple, if we have to finish

2 this another day or can we get through this? I would like to

3 be able to ask my questions, get an answer and move on.

4 A. When you misconstrue my answers --

5 MR. APPLE: Hang on. I think what the witness

6 is asking that you -- I think it would be helpful is to

7 simplify your questions, and if you are referencing certain

8 verbiage, explain it, but you are misconstruing his testimony.

9 MR. EKELAND: I am not misconstruing his

10 testimony.

11 A. You are. It's my narrative. You have made some of

12 my answers appear incorrect in lies.

13 MR. APPLE: Let us -- we will object to the

14 form, okay, so just bear with us. Let the attorneys do our job

15 and make our objections.

16 MR. EKELAND: Why don't we take five?

17 THE WITNESS: No, I don't have time for that.

18 We do not have time for that.

19 MR. EKELAND: We have noticed this deposition

20 until 7:00 p.m. eastern.

21 THE WITNESS: I was not given that implication.

22 We are passed the scope of what I can do.

23 MR. EKELAND: I want to take five.

24 MR. APPLE: Tor, hang on. Listen. As you know,

25 we did the depositions for the afternoon. It was never

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 93 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 93

1 communicated to me we were going to be going into the evening

2 late. It's 4:40 now. The expert has been designated on a very

3 limited basis, and so we are, we presented here him here today

4 for that deposition. Your questions are totally off base from

5 what he --

6 MR. EKELAND: Are you telling me you are not

7 going to have this witness testify as to the time agreed to

8 because you are already eating up my deposition time. So if

9 you'd like to finish this today, let's take a five minute

10 break.

11 MR. APPLE: Hey, Tor. Hey, listen, I have a

12 medical issue and I have to get --

13 MR. EKELAND: I would like to go off the record.

14 MR. APPLE: If you were going to take over six

15 hours, I would have liked to have known that.

16 MR. EKELAND: You were noticed. Read the

17 notice.

18 MR. APPLE: Yes, and we also have professional

19 courtesy and I'm trying to accommodate you.

20 MR. EKELAND: I'm taking off my headphones.

21 Speak to your client, okay.

22 MR. APPLE: He's not my client.

23 THE VIDEOGRAPHER: Going off the video record.

24 We're back on the video record at

25 5:56 p.m.

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 94 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 94

1 Q. (BY Mr. Ekeland) Mr. Kasal, on the break just now,

2 did you ingest anything or did anything happen that would make

3 you incapable of testifying truthfully?

4 A. No, I had a glass of water.

5 Q. If you get Exhibit F back up and if we can go to page

6 16, please. If we can go to the bullet point in big all caps

7 letters in bold first. Mr. Kasal, let me know when you had a

8 second to --

9 A. Okay. I'm familiar with this piece. Thank you.

10 Q. So that HTTPS://GOO.GL/J5GE97 is the tracking link

11 that you analyzed?

12 A. You said 7 was the final digit. It's actually Z, so

13 that would be incorrect.

14 Q. So I stand corrected. So HTTPS://GOO.GL/J5GE9Z is

15 that the link that you reviewed in the scope of your employment

16 for DFC?

17 A. That is a URL, sir. That URL points to the code that

18 would be used to identify an individual. So, yes, I did

19 analyze that URL, but that URL is not the actual code that is

20 used for the identification of the person who clicks on it.

21 Q. And where would that code be?

22 A. That code would reside on the server in which that

23 URL points to.

24 Q. And that URL pointing to that server where the code

25 is on, that's a server that's controlled by DFC, correct?

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 95 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 95

1 A. I -- maybe.

2 Q. DFC sent the link, created the link, correct?

3 A. Yes.

4 Q. And in order for the link to work when you click on

5 it, it has to direct the device that was clicked upon to a

6 server where the code is, correct?

7 MS. PEERY: Objection, form.

8 A. The link that you refer to on this page that is HTTPS

9 is a URL that points to a document on the internet. That

10 document may be on a server that is, controls or does not

11 control. It may contained code that is used for purposes of

12 identifying an individual that clicked on it.

13 Q. Are you aware of what server this hypertext link

14 linked to with the code that you're talking about?

15 MS. PEERY: Objection, form.

16 A. As far as the actual physical location of the server

17 or the type of server or whether it was a hosting server or a

18 leased server, no, I do not.

19 Q. But it's your testimony that the code resides on the

20 server and the link merely points to that server, connects with

21 that server, correct?

22 MS. PEERY: Objection, form.

23 Q. Let me take another approach. So this piece of

24 coding in this URL is a pointer for a link to a document that

25 does, in fact, reside in a server somewhere that contains a

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 96 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 96

1 piece of code that is used to identify the visitor. And did

2 you review that piece of code on that document stored on that

3 server?

4 A. I reviewed the code in this document as it was given

5 to me by DFC. I didn't look at the code as it was deployed.

6 Q. The code that is in this document?

7 A. I don't understand your question.

8 Q. You said that the code that you reviewed is contained

9 in the Phase 1 report?

10 A. Yes, I already answered that question, sir.

11 Q. I'm just asking for clarity sake. But the code that

12 you are talking about is not embedded in this hyperlink?

13 MR. APPLE: Objection, form.

14 Q. (BY Mr. Ekeland) You can answer.

15 A. This hyperlink is a pointer to a server that had the

16 code on it.

17 Q. And in order for anybody to obtain information about

18 the device on which this link was clicked, they would have to

19 go to that server and get that information, correct?

20 MS. PEERY: Objection, form.

21 A. Again, I don't know if it's -- you're not

22 understanding or circular questioning. This URL is a link or a

23 pointer, okay. A link is something that's clickable hypertext

24 link or a pointer, meaning that it references another document

25 somewhere else that would have a copy of the code that is

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 97 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 97

1 represented in this report that would be used to identify as

2 previously stated in our last section basic information about

3 visitor to that site.

4 Q. All right. And that information is stored in a file

5 on a server connected to the internet.

6 MS. PEERY: Objection, form.

7 Q. Correct?

8 A. I need you to restate it, sir. Your questions don't

9 make sense.

10 Q. Okay. You said that the code was stored in a

11 document on a server, correct?

12 A. Yeah. Yes.

13 Q. You said that the hyperlink links and points to that

14 information on a server, correct?

15 A. Yes, it does.

16 Q. That information is not stored on a device that the

17 hyperlink was sent to, correct?

18 A. That's the part where you lost me. Say that again.

19 MR. APPLE: Objection, form.

20 Q. Okay. On the server where you said there's a

21 document where the code is stored, correct, that code is not on

22 the device that the hypertext link was sent to, correct?

23 MS. PEERY: Objection, form.

24 Q. It's a yes or no question.

25 A. No, it's not. The question is circular. It's not

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 98 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 98

1 even a logical question.

2 Q. Yes, it is.

3 MS. PEERY: Objection.

4 Q. I'm asking you, does the code that's on the document

5 on the server is it also on the device that the hyperlink was

6 sent to?

7 MS. PEERY: Objection, form.

8 Q. You can answer.

9 A. Your question is ambiguous. It doesn't state or ask

10 anything. It's --

11 Q. Yes, it does.

12 A. No, it doesn't.

13 Q. I'll clarify. Okay. You got the code that you

14 referred to when you say it's on a document on a server,

15 correct?

16 A. Okay.

17 Q. Is that same code on the device that this hypertext

18 link was sent to?

19 MS. PEERY: Objection, form.

20 A. It sounds like you just asked the same question in a

21 circle. Like, you just answered your own question.

22 Q. It's a yes or no question. Is the code that you're

23 saying DFC uses to identify people it's not transmitted to the

24 device that the link is sent to, correct?

25 MS. PEERY: Objection, form.

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 99 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 99

1 Q. (BY Mr. Ekeland) You can answer.

2 A. Sir, your question is circular. It doesn't logically

3 state anything. It's --

4 Q. It's not circular. It's a yes or no question.

5 A. No, it's not.

6 Q. -- referring to.

7 A. Because you answered your own question.

8 Q. Yes, it is. Answer the question. The code that

9 you're talking about, it's stored on a server on a document on

10 internet, correct?

11 MS. PEERY: Objection, form.

12 MR. APPLE: Objection, form.

13 A. It's leading, but okay.

14 Q. That was a yes.

15 And in order to get the information about the

16 identity, you have to access that information off of the

17 server, correct?

18 A. Yes.

19 Q. So let's go to the next page, page 17.

20 A. You haven't finished your question.

21 MR. APPLE: Let him finish.

22 Q. You said, yes, that information is stored in a

23 document on a server on the internet?

24 MR. APPLE: Objection, form.

25 Q. (BY Mr. Ekeland) So directing your attention to the

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 100 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 100

1 first paragraph from page 17. Let me know if you need a second

2 to read it again.

3 A. Okay.

4 Q. Okay. So just directing your attention to the

5 sentence that says you need to include the link in a message

6 containing something the suspect might be interested enough to

7 click on. Do not mention the real purpose behind the link.

8 The message could be something, like, I'd like to send you

9 money or you will not believe this, along with that URL created

10 for that suspect. Be creative, but do not reveal what the link

11 really is. Do you consider that to be social and generic?

12 MS. PEERY: Objection, form.

13 MR. APPLE: Objection, form.

14 A. It seems to -- it is a means of getting the person on

15 the other end to click on a link.

16 Q. By not telling them the truth?

17 MR. APPLE: Objection, form.

18 MS. PEERY: Objection, form.

19 A. The document states, do not mention the real purpose

20 behind the link, that's --

21 Q. You would agree with me that's deceptive?

22 MR. APPLE: Objection, form.

23 MS. PEERY: Objection, form.

24 A. It simply says do not mention the real purpose behind

25 the link.

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 101 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 101

1 Q. (BY Mr. Ekeland) Do you consider that as a digital

2 forensics expert ethical?

3 MS. PEERY: Objection, form.

4 MR. APPLE: Objection, form.

5 A. I'm not a member of --

6 Q. You can answer?

7 A. Nor have I ever served on an ethics committee, sir.

8 Q. Do you do stuff like this?

9 MS. PEERY: Objection, form.

10 MR. APPLE: Objection, form.

11 A. I have not participated in that type of an

12 investigation.

13 Q. Would you?

14 MS. PEERY: Objection, form.

15 MR. APPLE: Objection, form.

16 A. I'm not sure why it's relevant to me investigating a

17 piece of codes.

18 MR. EKELAND: Objection to the last answer as

19 nonresponsive.

20 Q. (BY Mr. Ekeland) Would you send out on a phishing

21 link --

22 A. You're asking me to answer a hypothetical.

23 MS. PEERY: Objection, form.

24 MR. APPLE: Objection, form. Let him finish his

25 question. Move on.

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 102 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 102

1 Q. (BY Mr. Ekeland) Let's go to page 18. Let's go to

2 the bottom paragraph bullet point. And as you can see, it once

3 a tracking URL link us accessed DFC will receive a report with

4 the detected IP address and location from which tracking URL

5 access is detected.

6 You haven't reviewed any of this coming from any of the URL

7 links, have you?

8 A. No, sir. Restate your question.

9 Q. Directing your attention to the sentence that says,

10 once a tracking URL is accessed, DFC will receive a report. Do

11 you see that?

12 A. I do.

13 Q. Have you reviewed any of the reports that DFC

14 received from the tracking link?

15 A. I have not.

16 Q. Do you know where they are?

17 A. I do not.

18 Q. Did you ask for them after reading this report?

19 A. I did not.

20 Q. You see the last part of that bullet point sentence

21 that says, it's the last clause, which says, then would be used

22 to identify internet service provider and the approximate

23 location of the suspect. Do you have any reason to believe

24 that that is inaccurate?

25 MS. PEERY: Objection, form.

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 103 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 103

1 MR. APPLE: Objection, form.

2 A. I don't understand your question, sir.

3 Q. (BY Mr. Ekeland) Can you determine someone's

4 approximate location through using a tracking URL?

5 A. It depends.

6 Q. So you can determine someone's geolocation through a

7 tracking URL?

8 MS. PEERY: Objection, form.

9 A. It depends on the capabilities of the tracking URL,

10 what information it's teached. This tracking URL tends to do

11 that with the IP address.

12 Q. And it's your testimony here that it only does it

13 through the IP address?

14 MS. PEERY: Objection, form.

15 A. I did not see any capabilities in the code for this

16 to breach any security parameters of the device to derive at

17 information from a source within it.

18 Q. (BY Mr. Ekeland) Okay. Well, when we get to the code

19 you can explain that to us. Let's go to page 19. Let me know

20 when you had a moment to review it?

21 A. I have reviewed it.

22 Q. Okay. So you see the heading where it says, Client

23 directed URLs. What's your understanding of that?

24 A. Those are the URLs provided to the client.

25 Q. And in terms -- what's your understanding what it

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 104 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 104

1 means for the client to direct the tracking URLs?

2 A. It would be used to the client's discretion or

3 communicated to the possible target.

4 Q. And do you see those two hypertext links next to the

5 Melody_Cantu: Rodrigo_Cantu?

6 A. Yes.

7 Q. Are either of those the code that you reviewed in the

8 scope of your employment for DFC?

9 A. I've already stated this once, sir. Those are just

10 hypertext links. They're not code as pertains to the payload

11 of this incident.

12 Q. That was a no.

13 MS. PEERY: Objection, form.

14 Q. So directing your attention -- was it not your

15 testimony just now that what I was referring to are two

16 hypertext links and not the code?

17 A. Can the court reporter restate his previous question

18 so I understand it properly because he -- again, restate the

19 question you asked.

20 THE COURT REPORTER: Was on it your testimony

21 just now that I referring to two hypertext links not the code?

22 MR. APPLE: Objection, form.

23 A. Before that. Are you waiting on me? I'm sorry.

24 THE COURT REPORTER: It's me. Hold on. I'm

25 sorry. This thing is frozen. I'm sorry. Give me one moment.

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 105 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 105

1 Are either of those -- are either of those two

2 hypertext links the codes that you reviewed.

3 A. Correct. Thank you. That's what he asked.

4 No.

5 Q. (BY Mr. Ekeland) Thank you. Directing your attention

6 to the header that's underlined saying DFC directed tracking

7 for URLs. What's your understanding of the phrase DFC directed

8 tracking URLs?

9 A. Those would be the hypertext links that DFC

10 implemented to as a control group for the doctors devices so

11 they can be eliminated as possibles in this method of

12 identification.

13 Q. Where does it say that in the Phase 1 report?

14 A. You actually had the exhibit on page up earlier, but

15 it talks about DFC sending links to the client so that she

16 would click on them and they could identify those devices, so

17 that when the other individual clicked on the link that was

18 provided, the client directed URLS, they could eliminate the

19 doctors devices as the ones that were responsible for that

20 visit, a control group.

21 Q. Anywhere on this page do you see the code that you

22 reviewed in the scope of your employment for DFC as you have

23 defined it here today?

24 A. On this page or just simply the URLS that were

25 pointing to it, sir?

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 106 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 106

1 Q. Do you know any of these URLS were sent out or

2 deployed?

3 A. I believe that the DFC tracking -- DFC directed

4 tracking URLs were so that they could identify their client's

5 devices.

6 Q. And when that information was sent out from DFC's

7 computers it would have been logged, there would be server

8 logs, correct?

9 A. For the visit to the URLs, yes.

10 Q. Directing your attention to the bottom page in the

11 box on the bottom bullet point, it says, any information

12 obtained, including IP addresses will be extracted, analyzed

13 and provided to the client in a Phase 2 report.

14 What's your understanding of what is meant by

15 the information being extracted?

16 MR. APPLE: Objection, form.

17 Q. (BY Mr. Ekeland) You can answer.

18 A. I'm sorry. I've got client is going to be

19 incessantly calling for next several minutes because I didn't

20 know it was going to go this long.

21 In answer to your question it was -- they were

22 additional information that was needed for Phase 2 to be

23 provided and they're telling the client that after they send

24 the client directed URLs to let them know and the information

25 that was gleaned as a result of that would be provided to them

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 107 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 107

1 in that second phase. I'm sorry. I can't hear you.

2 MR. APPLE: You're on mute, Tor.

3 Q. My bad. Where is that information being extracted

4 from?

5 A. I'm sorry. Which information? The information from

6 the device that visits the tracking link and which tracking

7 link, the client directed one or DFC directed on?

8 Q. I'm referring to the last bullet point on the page

9 we're looking at, the sentence that says any information

10 obtained, including IP addresses will be extracted, extracted,

11 you know, meaning pulled out of or taken from?

12 A. Or gleaned as a result of.

13 Q. Gleaned.

14 A. Meaning there wasn't anything necessarily maliciously

15 pulled so much as awkward.

16 Q. Awkward?

17 A. Yes. Tracking URL does not make the end user who

18 clicks on it give anything away other than what their computer

19 volunteers.

20 Q. Is it your testimony here that extracted is

21 synonymous with offered?

22 MR. APPLE: Objection, form.

23 A. -- of that word in this report, I can't speak to.

24 Q. But you're a digital forensics expert, correct?

25 A. This doesn't have anything to do with digital

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 108 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 108

1 forensics. This has to do with the way they chose to state a

2 word in a context.

3 Q. But the verbiage extraction is a term of art in

4 digital forensics, isn't it, you extract data?

5 A. Yes, and it's information that the machine offers.

6 It's not violently pulled or taken with the rest.

7 Q. What machine is offering it in this instance?

8 A. The machine that clicks on the tracking URL.

9 Q. It offers the information?

10 A. Yes.

11 Q. And who accepts the offer?

12 A. The other machine.

13 Q. And that's the server with the document with the code

14 on it, correct?

15 A. Yes.

16 Q. And for DFC to get the information to create its

17 Phase 2 report, it needs to extract that information from the

18 server that it's on, correct?

19 MR. APPLE: Objection, form.

20 Q. (BY Mr. Ekeland) You can answer.

21 A. It can go to the server and request the information

22 that was returned from the tracking URL. If one was to use the

23 word "extracted" you could extract it. It doesn't denote

24 pejorative sense.

25 Q. I didn't say it was pejorative.

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 109 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 109

1 Let's go to page 20. Directing your attention

2 to the second bullet point on that page under the heading

3 tracking URL result. And it says, tracking URLs were sent to

4 the appropriate communication platform for the suspects to

5 click on. When activated tracking URLs capture; recipient's

6 geographic location and IP address.

7 Do you have any reason to believe that's not an

8 accurate statement.

9 A. It doesn't say where it originates the information

10 for that data port.

11 Q. I didn't hear you. I didn't hear you.

12 A. That statement does not enumerate where it sources

13 that information.

14 Q. Right. Directing your attention to the next bullet

15 point, once a tracking URL link is accessed, the DFC will

16 receive a report with detected IP address and location from

17 which tracking URL access is detected which will then be used

18 to identify the internet service provider. Do you have any

19 reason to believe that statement is not accurate?

20 A. No, that seems to be fairly concise.

21 Q. And directing your attention to the box down at the

22 bottom of the page under the sentence that says sample DFC

23 created tracking URLs targeted at the suspect. Do you know if

24 that tracking URL was used?

25 A. I don't know if it appeared in the reports earlier.

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 110 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 110

1 I mean, I see it. No, I don't know if it was used.

2 Q. And you --

3 A. It says sample.

4 Q. And you don't know who created the sample?

5 A. This would appear to just be a sample or add an

6 example of. It doesn't state that that is the tracking URL

7 that was used.

8 Q. And you don't know who created the sample?

9 A. No.

10 Q. And you don't know how many tracking URLs DFC

11 created?

12 MR. APPLE: Objection, form.

13 A. It states it clearly previously in the report.

14 Q. But you haven't checked out any information outside

15 the four corners of the Phase 1 report, correct?

16 MR. APPLE: Objection, form.

17 A. Sir, I don't understand your question.

18 Q. You haven't reviewed any information outside of this

19 Phase 1 report --

20 A. For what purpose?

21 Q. -- in preparation for your testimony today?

22 A. No, I have not reviewed any information --

23 MR. APPLE: Objection, form.

24 A. -- outside that report.

25 Q. (BY Mr. Ekeland) Let's go to page 21.

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 111 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 111

1 A. What does four corners mean?

2 Q. It means within the document so that you're not going

3 outside the four corners of the document that you are not

4 referring to extrinsic evidence outside the document. Does

5 that help?

6 A. Yes.

7 Q. Does that change your answer?

8 A. No.

9 Q. And so directing your attention to the page 21,

10 bullet point sentence at the top says, below are the

11 preliminary results and IP information of the tracking URLs

12 activated today.

13 Are you aware of any final results?

14 A. Are they stated later in the document?

15 Q. I don't know. We'll see, I guess. But as you sit --

16 A. It's a line of question like you are trying to get me

17 to say something and then lie later or say that I was

18 misstated.

19 Q. No. I'm merely asking you what you remember at the

20 present moment.

21 A. It's an effort to try to trap me into stating

22 something incorrectly later and making me look like a liar.

23 And that's what I'm saying, I will not stand you are

24 misconstruing my words in the efforts of making me look stupid,

25 and I'm sick of it. Can you stick to an honest question.

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 112 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 112

1 Q. Yes. Here is an honest question. Are you aware of

2 -- do you recall as you sit here now, do you recall any final

3 results?

4 A. Let's review the document and I'll answer your

5 question.

6 Q. So the answer is, no, you don't remember?

7 MR. APPLE: Objection, form.

8 A. I'm not answering because your question is leading.

9 Q. You are refusing to answer a question?

10 A. I'm not refusing answer a question. I'm asking you

11 to restate it in a nonleading way.

12 Q. I'm asking you if you know whether or not there were

13 any final results?

14 A. Not without reviewing the document further, no.

15 Q. You don't remember?

16 MR. APPLE: Objection, form.

17 A. That's not what I said.

18 Q. Do you remember whether or not there were final

19 results issued by DFC?

20 MR. APPLE: Objection, form.

21 A. The question -- I'm not answering questions.

22 Q. Are you refusing to answer the question?

23 A. I'm not refusing to answer. I'm asking you to

24 restate it in a way that is not misleading.

25 Q. As you sit here right now, do you recall whether or

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 113 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 113

1 not DFC issued final results after they issued their

2 preliminary results?

3 MR. APPLE: Objection, form.

4 A. I do not recall, but my memory could be refreshed.

5 Q. That's all I'm asking.

6 A. No, you're asking a leading question.

7 Q. It's appropriate for me to ask leading questions. If

8 you need a moment to speak with Mr. Apple about that, you can,

9 if there is a misunderstanding about that. But if you'd like

10 to finish by 7:00 or close, we can push on through the end. Do

11 you need a second to talk to Mr. Apple?

12 MR. APPLE: Court reporter, we can go ahead.

13 Just answer the questions. We will object. If you don't

14 understand, we'll ask him to repeat it.

15 MR. EKELAND: Are we good to move on now?

16 MR. APPLE: Yes.

17 Q. (BY Mr. Ekeland) So looking at the box and you can

18 see the IP address and Mac operating system, do you have any

19 reason to believe that this wasn't extracted from one of my

20 client's phones?

21 MR. APPLE: Objection, form.

22 MS. PEERY: Objection, form.

23 A. Please restate the question.

24 Q. (BY Mr. Ekeland) Do you have any reason to believe

25 that the information contained in the table on page 21 wasn't

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 114 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 114

1 extracted?

2 A. I'll ask you to restate.

3 Q. I'm not done with my question.

4 You see the box on page 21, correct?

5 A. Which box, sir?

6 Q. The one under the bold heading that says tracking

7 link letter. Quotation mark Melody_Joy_via_phone, close

8 quotation mark, HTTPS:// GOO.gl/scBWZZ. Do you see --

9 A. I see several boxes, sir.

10 Q. Do you see the one that has first click and a date on

11 it?

12 A. Yes.

13 Q. And do you see the IP address?

14 A. Yes.

15 Q. Do you see the user operating system where it says

16 right next to Mac OS10. Do you see that?

17 A. Yes.

18 Q. That's referencing an operating system, right?

19 A. Yes, it is.

20 Q. You see user agent and you see the reference to

21 Mozilla, Apple webkit and Safari, and you see entry for device

22 it says Safari?

23 A. Yes.

24 Q. And then you see all the information underneath that,

25 correct?

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 115 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 115

1 A. The second link, the second?

2 Q. Yeah, the second clip?

3 A. Yes, I do.

4 Q. You see that?

5 A. Yes, I do.

6 Q. That was information extracted from Melody Joy

7 Cantu's phone, correct?

8 MS. PEERY: Objection, form.

9 A. It was information offered by the browser on that

10 system.

11 Q. It was offered by the browser after the link was sent

12 to Melody Joy Cantu's phone, correct?

13 MS. PEERY: Objection, form.

14 A. That is information a system volunteered to another

15 system.

16 Q. When the link was sent or as a result as a result of

17 a link being sent --

18 A. And clicked on.

19 Q. -- and clicked on without the person clicking on it

20 knowing that that information was being sent and recorded,

21 correct?

22 MS. PEERY: Objection, form.

23 MR. APPLE: Objection, form.

24 A. Much like a Facebook or Twitter.

25 Q. So it's your testimony that it was entirely

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 116 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 116

1 voluntarily -- it it was entirely voluntarily on Ms. Cantu's

2 phone part that it offered up information to a server of that

3 DFC had access to? Ms. Cantu's phone just volunteered the

4 information, is that your testimony?

5 MS. PEERY: Objection, form.

6 A. The device responded to a request of information.

7 Whether or not the end user was aware of it no different than a

8 visit to Instagram or Twitter or Facebook.

9 Q. Does Instagram Twitter or Facebook send out links

10 that they try to get you to click without telling you what

11 they're for?

12 A. Yeah. Yes. Oh, my goodness.

13 MS. PEERY: Objection, form.

14 A. Yes. By going into those websites you volunteered

15 that information and a lot of times unknowingly.

16 Q. Is it your testimony that Facebook sends phishing

17 links --

18 A. I did not say phishing links.

19 MR. APPLE: Objection, form.

20 MS. PEERY: Objection, form.

21 Q. That's what we're talking about here, aren't we,

22 talking about phishing variable?

23 A. You're asking if the machine volunteered information

24 unknowing to the end user? And to that answer -- that question

25 I answered, yes, very similar parallel to social media.

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 117 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 117

1 Q. Now, machines have intentional states and volitional

2 states, is that your testimony?

3 MR. APPLE: Objection, form.

4 A. That's not what I said either.

5 MS. PEERY: Objection, form.

6 Q. You said offered, correct?

7 A. Yes, in response to inquiry.

8 Q. Let's go to page 22. Do you know generated this

9 image?

10 A. I -- does not say the author, sir.

11 Q. You don't know?

12 A. That would be correct.

13 Q. Do you know what software was used to generate the

14 image?

15 A. I've seen similar types, but I can't state

16 emphatically who, what software title was used, no.

17 THE COURT: And when you read this report and

18 you saw this IP address did you look it up.

19 A. No.

20 Q. Did you look up any of the IP addresses that are

21 contained in this report?

22 A. They're not relevant to the function or form of the

23 code used to spot an identity.

24 Q. That's a no?

25 A. Correct.

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 118 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 118

1 Q. Let's go to page 23. Directing your attention to the

2 top paragraph it says, Based on the evidence provided, the

3 Digital Forensics Corporation my client and Digital Forensics

4 Corporations independent investigation we conclude that a Phase

5 2 forensics examination is recommended. Do you agree with that

6 conclusion?

7 MR. APPLE: Objection, form.

8 MS. PEERY: Objection, form.

9 A. I was not hired to conduct an investigation into the

10 named parties involved, sir.

11 Q. And I believe you testified earlier that you don't

12 know if a Phase 1 -- a Phase 2 report was produced?

13 A. That's correct.

14 Q. Did you ask DFC if they produced a Phase 2 report?

15 A. I did not ask. It was outside the scope of what I

16 was hired to do.

17 MR. APPLE: You're on mute.

18 MR. EKELAND: I need to take five minutes. I

19 may wrap it up. I just want to check for a second.

20 MR. APPLE: Okay.

21 MS. PEERY: Okay.

22 (Short break was taken at 5:42 p.m.)

23 (Deposition resumed at 5:47 p.m.)

24 MR. EKELAND: Mr. Kasal, thank you very much. I

25 have no further questions and I pass the witness.

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 119 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 119

1 MS. PEERY: This is Brandy Peery, we will

2 reserve our questions for trial.

3 MR. APPLE: This is David Apple, we will reserve

4 our questions for the time of trial.

5 THE WITNESS: I apologize, I got frustrated. I

6 didn't understand the logic of the counsel's questions.

7 MS. PEERY: Thank you Mr. Kasal for being here.

8 THE VIDEOGRAPHER: Going off the record.

9 (Signature having not been waived, the

10 deposition concluded at 5:47 p.m.)

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 120 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 120

1 ERRATA SHEET -- CHANGES AND SIGNATURE

2 PAGE LINE CHANGE REASON

3 ____________________________________________________

4 ____________________________________________________

5 ____________________________________________________

6 ____________________________________________________

7 ____________________________________________________

8 ____________________________________________________

9 ____________________________________________________

10 ____________________________________________________

11 ____________________________________________________

12 ____________________________________________________

13 ____________________________________________________

14 ____________________________________________________

15 ____________________________________________________

16 ____________________________________________________

17 ____________________________________________________

18 ____________________________________________________

19 ____________________________________________________

20 ____________________________________________________

21 ____________________________________________________

22 ____________________________________________________

23

24 ______________________

 SHAWN KASAL

25

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 121 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 121

1 WITNESS SIGNATURE

2 I, SHAWN KASAL have read the foregoing

3 deposition and hereby affix my signature that same is true and

4 correct, except as noted above.

5

6 _______________________

 SHAWN KASAL

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 122 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 122

1 THE STATE OF TEXAS §

2 COUNTY OF _______ §

3 COURT REPORTER CERTIFICATE

4 I, Nancy Tamez, Certified Shorthand Reporter in

5 and for the State of Texas, do hereby certify that the facts as

6 stated by me in the caption hereto are true; that there came

7 before me the aforementioned named person, who was by me duly

8 sworn to testify the truth concerning the matters in

9 controversy in this cause; and that the examination was reduced

10 to writing by computer transcription under my supervision; that

11 the deposition is a true record of the testimony given by the

12 witness.

13 I further certify that I am neither attorney or

14 counsel for, related to or employed by, any of the parties to

15 the action in which this deposition is taken, and, further,

16 that I am not a relative or employee of any attorney or counsel

17 employed by the parties hereto, or financially or otherwise

18 interested in the action.

19 Pursuant to Rule 30(e)1:

20 __XX_ Reading and Signing was requested.

21 _____ Reading and Signing was waived.

22 _____ Reading and signing was not requested.

23 Given under my hand and seal of office on this 11th

24 day of August, 2022.

25

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 123 of 124
214-747-8007

Gwendolyn Parker & Associates

Page 123

1

2 ________________________

 NANCY TAMEZ, CSR

3 TX CSR#12265, Exp: 6/30/24

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

Case 5:20-cv-00746-JKP Document 110-7 Filed 10/14/22 Page 124 of 124