EXHIBIT 4 

Case 5:17-cv-00551-LHK Document 278-5 Filed 10/04/18 Page 1 of 18
Page 1

·1· · · · · · · · · UNITED STATES DISTRICT COURT

· · · · · · · · · NORTHERN DISTRICT OF CALIFORNIA

·2· · · · · · · · · · · ·SAN JOSE DIVISION

·3· ·__________________________________________________________

·4· ·CHRISTINA GRACE and KEN POTTER,

· · ·Individually and on Behalf of

·5· ·All Others Similarly Situated,

·6· · · · · · · Plaintiffs,

·7

· · · · · -vs-· · · · · · · · · · · · ·No. 5:17-cv-00551-LHK-NC

·8

·9· ·APPLE INC,

10· · · · · · · Defendant.

· · ·__________________________________________________________

11

12· · · · ** HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY **

13· · · · · · ·VIDEO DEPOSITION OF DR. MARK T. JONES

14· · · · · · · · · · ·8:32 a.m. to 5:32 p.m.

15· · · · · · · · · · · ·September 24, 2018

16· · · · · · · · · · · Blacksburg, Virginia

17

18

19

20

21

22

23

24· ·Job No. 37982/307500

25· · · · · · ·REPORTED BY:· Rhonda D. Tuck, RPR, CRR

Case 5:17-cv-00551-LHK Document 278-5 Filed 10/04/18 Page 2 of 18
Page 2

·1· · · · · · ·Video Deposition of DR. MARK T. JONES,

·2· ·taken and transcribed on behalf of the Defendant, by

·3· ·and before Rhonda D. Tuck, RPR, CRR, Notary Public

·4· ·in and for the Commonwealth of Virginia at large,

·5· ·pursuant to Rule 30 of the Federal Rules of Civil

·6· ·Procedure, and by Notice to Take Depositions;

·7· ·commencing at 8:32 a.m., September 24, 2018, at The

·8· ·Inn at Virginia Tech and Skelton Conference Center,

·9· ·901 Prices Fork Road, Blacksburg, Virginia.

10

11· · ·APPEARANCES OF COUNSEL:

12

13· · · · · · · · CALDWELL CASSADY & CURRY

14· · · · · · · · · 2101 Cedar Springs Road, Suite 1000

15· · · · · · · · · Dallas, Texas 75201

16· · · · · · · · · (214) 888-4848

17· · · · · · · · · acurry@caldwellcc.com

18· · · · · ·BY:· J. AUSTIN CURRY, ESQUIRE

19· · · · · · · · · Counsel for the Plaintiffs

20

21

22

23

24

25

Case 5:17-cv-00551-LHK Document 278-5 Filed 10/04/18 Page 3 of 18
Page 3

·1· ·APPEARANCES OF COUNSEL CONTINUED:

·2

·3· · · · · · · DURIE TANGRI

·4· · · · · · · · 217 Leidesdorff Street

·5· · · · · · · · San Francisco, California 94111

·6· · · · · · · · (415) 362-6666

·7· · · · · · · · enovikov@durietangri.com

·8· · · · ·BY:· EUGENE NOVIKOV, ESQUIRE

·9· · · · · · · · Counsel for the Defendant

10

11

12

13· ·ALSO PRESENT:

14· ·J.B. STEPHENS - Videographer

15· ·GABE ZELDIN, ESQ., Apple Inc. (Telephonically)

16· ·AVIEL RUBIN (Telephonically)

17

18

19

20

21

22

23

24

25

Case 5:17-cv-00551-LHK Document 278-5 Filed 10/04/18 Page 4 of 18
Page 4

·1· · · · · · · · · · · · · ·I N D E X

·2

· · ·WITNESS:· DR. MARK T. JONES

·3

· · · ·Examination by Mr. Novikov.............................6

·4

·5

· · · · · · · · · · · · · E X H I B I T S

·6

· · ·Jones Exhibit Number 193................................11

·7· · ·Y2K Bug Encyclopedia Entry

·8· ·Jones Exhibit Number 194................................15

· · · ·Expert Report of Dr. Mark T. Jones

·9

· · ·Jones Exhibit Number 195................................17

10· · ·Merriam-Webster Definition of "Bug"

11· ·Jones Exhibit Number 196................................20

· · · ·Emails, Bates-numbered APL-GRACE_00007274 to

12· · ·APL-GRACE_00007277

13· ·Jones Exhibit Number 197................................23

· · · ·Email, Bates-numbered APL-GRACE_00056772 to

14· · ·APL-GRACE_00056786

15· ·Jones Exhibit Number 198................................60

· · · ·"Certificates - Apple Developer Documentation"

16

· · ·Jones Exhibit Number 199................................65

17· · ·"RFC 5280 - Internet X.509 Public Key Infrastructure

· · · ·Certificate and Certificate Revocation"

18

· · ·Jones Exhibit Number 200................................87

19· · ·"Policies - Apple Developer Documentation"

20· ·Jones Exhibit Number 201...............................122

· · · ·Emails, Bates-numbered APL-GRACE_00024933 to

21· · ·APL-GRACE_00024938

22· ·Jones Exhibit Number 202...............................172

· · · ·Graphs, Bates-numbered AKAM-0052 to AKAM-0109

23

· · ·Jones Exhibit Number 203...............................172

24· · ·Graph "Overall FaceTime User Traffic (Rolling Max)"

25· · · · · · · · · · · · · ·* * * * *

Case 5:17-cv-00551-LHK Document 278-5 Filed 10/04/18 Page 5 of 18
Page 70

·1· · · ·A.· · ·I think in a typical system, it would be

·2· ·good to check the expiration dates.

·3· · · ·Q.· · ·So what you're saying here really is that

·4· ·it was technically possible not to check the

·5· ·expiration dates?

·6· · · ·A.· · ·Well, not only can you technically

·7· ·possible not check the expiration dates, you can

·8· ·take different actions based on whether the

·9· ·certificate is expired or not.

10· · · ·Q.· · ·On that same page, actually right above

11· ·that -- and I don't really mean to go in reverse

12· ·order, but that's the way things shook out -- you

13· ·say, "I note that while the certificates in this

14· ·chain were created in the 2007 timeframe to have

15· ·certain validity periods, Apple could have created

16· ·certificates with the same hierarchy of authorities

17· ·with updated expiration dates when developing the

18· ·FaceTime feature in the 2009 and 2010 timeframe."

19· · · · · · · Do you see that?

20· · · ·A.· · ·Yes.

21· · · ·Q.· · ·What does that mean?

22· · · ·A.· · ·That Apple could have created new

23· ·certificates for at least portions of the chain and

24· ·used those with updated expiration dates.

25· · · ·Q.· · ·Got it.· So it would have been an all new

Case 5:17-cv-00551-LHK Document 278-5 Filed 10/04/18 Page 6 of 18
Page 71

·1· ·set of certificates that they would have created for

·2· ·this purpose, in your hypothetical?

·3· · · ·A.· · ·It wouldn't have required all new.· They

·4· ·had the freedom to do whatever they wanted with

·5· ·respect to those certificates, but they wouldn't

·6· ·have required the entire chain to be new.· That,

·7· ·however, was under their control.

·8· · · ·Q.· · ·Okay.· So either they could have gotten

·9· ·new, like bottommost lease certificates issued or

10· ·some -- could have built a new subset of the chain

11· ·for this purpose, is essentially what you're saying?

12· · · ·A.· · ·Those are both things they could have

13· ·done.· Yes.

14· · · ·Q.· · ·Was there a reason to do that at the

15· ·time, as opposed to use these certificates, that you

16· ·can think of?

17· · · ·A.· · ·If you didn't want the system to be

18· ·unable to operate past a certain date, then yes,

19· ·that would be a good reason.

20· · · ·Q.· · ·Okay.· Do you agree that the private keys

21· ·of a certificate should be renewed periodically?

22· · · ·A.· · ·It depends on the circumstances.· It

23· ·certainly is possible that I want to update a

24· ·certificate from time to time.· Yes.

25· · · ·Q.· · ·Just as a matter of computer security

Case 5:17-cv-00551-LHK Document 278-5 Filed 10/04/18 Page 7 of 18
Page 72

·1· ·best practices, is that something that you would

·2· ·want to do from time to time in a situation like

·3· ·this?

·4· · · ·A.· · ·I don't know that I'd want to do it

·5· ·periodically, because there's always risk to

·6· ·changing things.· It would depend whether I had a

·7· ·reason to do it or not.

·8· · · ·Q.· · ·Well, I guess you mentioned -- when I

·9· ·asked you why expiration is sometimes checked, you

10· ·said that one reason is that keys can sometimes be

11· ·compromised, and as computational power increases

12· ·encryption once thought to be powerful turns out not

13· ·to be as powerful as you thought.

14· · · · · · · Aren't those kind of general reasons why

15· ·you would want to do this from time to time?· And by

16· ·"this," I mean renew private keys and certificates?

17· · · ·A.· · ·It would depend on if there were changes

18· ·that were relevant during that timeframe, in terms

19· ·of what my key size was set to, for example.· It

20· ·also may depend on how much I want to rely on the

21· ·capability to revoke certificates.

22· · · ·Q.· · ·So you don't agree that as a general

23· ·principle it is a good security practice to renew

24· ·certificate keys periodically.· Is that fair?

25· · · ·A.· · ·I would say it's not a universal rule.

Case 5:17-cv-00551-LHK Document 278-5 Filed 10/04/18 Page 8 of 18
Page 73

·1· ·There's certainly cases where it would be a good

·2· ·practice.· It would depend on balancing the risks

·3· ·between renewing it and not renewing it.

·4· · · ·Q.· · ·Okay.· Do you know what the certificate

·5· ·revocation list is in this context?

·6· · · ·A.· · ·Sure.

·7· · · ·Q.· · ·Is that something that's maintained by

·8· ·the certificate authority?

·9· · · ·A.· · ·At some level.· I don't recall how it's

10· ·done now in the infrastructure.· My recollection is

11· ·there have been changes to make it efficient, but I

12· ·don't recall the specifics of who's responsible for

13· ·both maintaining and also propagating the list.

14· · · ·Q.· · ·Okay.· Is it right that the certificate

15· ·revocation list under the X.509 standard will only

16· ·have information about unexpired certificates?

17· · · ·A.· · ·I don't know one way or the other.

18· · · ·Q.· · ·Okay.· Could you take a look back at the

19· ·last exhibit, 199, in the same section that we were

20· ·looking at before, 4.1.2.5, the first sentence in

21· ·particular.

22· · · ·A.· · ·I see that.

23· · · ·Q.· · ·Does that suggest to you that the

24· ·revocation list is only going to have information

25· ·about certificates that aren't expired?

Case 5:17-cv-00551-LHK Document 278-5 Filed 10/04/18 Page 9 of 18
Page 108

·1· ·weren't followed completely within FaceTime?

·2· · · ·A.· · ·No.

·3· · · ·Q.· · ·So you would agree -- would you agree

·4· ·that it was impossible -- it would have been

·5· ·impossible for Apple to change the expiration date

·6· ·on the Device Sub-CA after it was coded in 2007?

·7· · · ·A.· · ·I am not sure what you mean by it was --

·8· ·I guess both by change and coding it.

·9· · · ·Q.· · ·So on Page 21 of your report, you say,

10· ·"The device certificate expiration dates are stored

11· ·as data in the certificates themselves."

12· · · · · · · Do you see that?

13· · · ·A.· · ·Yes.

14· · · ·Q.· · ·I guess my question is, once that occurs

15· ·and the certificate is created and the expiration

16· ·date is set, do you agree with me that date cannot

17· ·be changed and have that certificate remain valid?

18· · · ·A.· · ·Effectively, yes.· It requires me to be

19· ·able to -- to change something in the certificate

20· ·after the fact would require me to forward the

21· ·certificate, and that is not generally viewed as a

22· ·computationally feasible task.

23· · · ·Q.· · ·For the Device Sub-CA, that expiration

24· ·date was coded in 2007, correct?

25· · · ·A.· · ·Again, I guess the word -- I'm not sure

Case 5:17-cv-00551-LHK Document 278-5 Filed 10/04/18 Page 10 of 18
Page 110

·1· ·proposed.

·2· · · ·Q.· · ·Okay.· And how much -- how long after the

·3· ·dates were the original -- I'm having trouble.· It's

·4· ·after lunch.

·5· · · · · · · How long after the dates were originally

·6· ·proposed did Mr. De Atley change them?

·7· · · ·A.· · ·Without looking back at the email chain,

·8· ·I don't know if I have -- I've cited to the

·9· ·documents, but I -- let me see.· I've got a March --

10· ·maybe -- if I'm -- I believe it's four days, but I

11· ·really would want to check to make sure that's

12· ·correct.

13· · · ·Q.· · ·Got it, and the certificate -- at the

14· ·time that Mr. De Atley changed the dates, the

15· ·certificate hadn't been created yet.· Is that your

16· ·understanding?

17· · · ·A.· · ·Yes.

18· · · ·Q.· · ·Do you know in 2007 how many people were

19· ·involved in this process of creating the certificate

20· ·framework at Apple?

21· · · ·A.· · ·No.

22· · · ·Q.· · ·Do you think it was like a whole team?

23· · · ·A.· · ·In terms of making the decision?· I guess

24· ·I'm not sure what you're asking me, but I don't know

25· ·how many people were part of the decision-making

Case 5:17-cv-00551-LHK Document 278-5 Filed 10/04/18 Page 11 of 18
Page 112

·1· ·like.

·2· · · ·A.· · ·I believe it was June 2010.

·3· · · ·Q.· · ·Yep.

·4· · · ·A.· · ·I could check that, but that's what comes

·5· ·to mind.

·6· · · ·Q.· · ·Do you know when either Ms. Grace or

·7· ·Mr. Potter bought their iPhone 4 units?

·8· · · ·A.· · ·Not off the top of my head, no.

·9· · · ·Q.· · ·Does that matter to your analysis at all?

10· · · ·A.· · ·It doesn't change my technical analysis,

11· ·no.

12· · · ·Q.· · ·Did Apple do anything between when they

13· ·would have bought their phones to when this Device

14· ·Sub-CA expired to affect the date that it would

15· ·expire?

16· · · ·A.· · ·In terms of the Device CA?

17· · · ·Q.· · ·Yes.

18· · · ·A.· · ·Not that I'm aware of, no.

19· · · ·Q.· · ·Did Apple do anything that you're aware

20· ·of to interfere with Mr. Potter's or Ms. Grace's

21· ·physical possession of their device?

22· · · ·A.· · ·Not that I'm aware of, no.· You're

23· ·talking about just like physically holding it?

24· · · ·Q.· · ·Yes.

25· · · ·A.· · ·Not that I know of.

Case 5:17-cv-00551-LHK Document 278-5 Filed 10/04/18 Page 12 of 18
Page 113

·1· · · ·Q.· · ·Does it make sense to you to call this a

·2· ·trespass case?

·3· · · ·A.· · ·I understand that a trespass is at issue,

·4· ·but I also understand a context under which I can

·5· ·trespass rights that aren't physical.· So I suppose

·6· ·it does, but we're into specifically requirements

·7· ·that are just kind of beyond my --

·8· · · ·Q.· · ·Legal territory?

·9· · · ·A.· · ·Yeah.

10· · · ·Q.· · ·Do you think that the team that created

11· ·these certificates in 2007 intended for FaceTime to

12· ·break for users on iOS 6 in 2014?

13· · · ·A.· · ·I don't know that they were even aware

14· ·that FaceTime was -- I don't even know if FaceTime

15· ·was contemplated at Apple in 2007, let alone whether

16· ·this team was aware of it.

17· · · ·Q.· · ·What about the people who coded the X.509

18· ·framework into FaceTime in 2009 and 2010, in that

19· ·timeframe?· Have you seen any evidence that they

20· ·intended for FaceTime to break for users in April of

21· ·2014?

22· · · ·A.· · ·I don't know what their intention was. I

23· ·believe that they would have been aware of the

24· ·expiration date of the various certificates at that

25· ·time.

Case 5:17-cv-00551-LHK Document 278-5 Filed 10/04/18 Page 13 of 18
Page 115

·1· ·in the company and it was a -- it's not a programmer

·2· ·error.· I've seen no explanation for how it's a

·3· ·programmer error when it's doing exactly what it was

·4· ·meant to do.

·5· · · ·Q.· · ·What are you referring to there when you

·6· ·say, "It's doing exactly what it was meant to do"?

·7· · · ·A.· · ·The code was designed to check the

·8· ·expiration date of the certificate and the

·9· ·certificates in the chain, and that's exactly what

10· ·it did.

11· · · ·Q.· · ·But do you think that the behavior, the

12· ·resulting behavior of FaceTime calls failing for a

13· ·set group of users -- was that the intended

14· ·behavior, in your view?· Because I think we just

15· ·established that you didn't think there was any

16· ·evidence that that was anybody's intent at least in

17· ·2007 and 2010.

18· · · ·A.· · ·In 2007 and 2010, I haven't seen evidence

19· ·that there was an intent to have FaceTime fail.

20· · · ·Q.· · ·So when did that intent manifest?

21· · · ·A.· · ·I haven't seen any intent to have it fail

22· ·beyond the settings of the certificate dates and

23· ·coding to check the certificate expirations.· There

24· ·certainly wasn't -- but I just haven't seen enough

25· ·discussions to know whether there was intent beyond

Case 5:17-cv-00551-LHK Document 278-5 Filed 10/04/18 Page 14 of 18
Page 118

·1· · · ·Q.· · ·Okay.

·2· · · ·A.· · ·But they already had code available to

·3· ·them that would check and acquire certificates over

·4· ·the internet.

·5· · · ·Q.· · ·Why would they build a system -- what

·6· ·would be the motivation for building a system that

·7· ·failed for a substantial number of users either

·8· ·seven years later or four years later, depending on

·9· ·what timeframe you're looking at?

10· · · ·A.· · ·It can be a desire to have people upgrade

11· ·to new versions of an operating system.· It can be a

12· ·desire to have people buy new versions of the phone.

13· · · ·Q.· · ·Okay.· Do you really think that -- we'll

14· ·just focus on 2010 to make it easier.· Do you really

15· ·think that in 2010 the people making FaceTime

16· ·thought, "Aha, I'm going to design this to break in

17· ·four years for a whole bunch of people so they have

18· ·to upgrade to a new iOS version or buy a new phone"?

19· · · ·A.· · ·I can't know one way or the other whether

20· ·that's their intent.· Just like I can't know whether

21· ·or not it was their intent to change this down the

22· ·line.

23· · · ·Q.· · ·You haven't seen any evidence that that's

24· ·the case, that it was the intent to have the system

25· ·break so that people would buy new phones or

Case 5:17-cv-00551-LHK Document 278-5 Filed 10/04/18 Page 15 of 18
Page 119

·1· ·upgrade?

·2· · · ·A.· · ·Certainly not in 2010, no.

·3· · · ·Q.· · ·Or in 2007?

·4· · · ·A.· · ·Or in 2007.

·5· · · ·Q.· · ·When was the first -- did you see such

·6· ·intent manifest later?

·7· · · ·A.· · ·I have seen discussions of the benefits

·8· ·of it breaking for iOS 6 with respect to relay

·9· ·usage.

10· · · ·Q.· · ·Have you seen such discussions from

11· ·before April 16th, 2014?

12· · · ·A.· · ·If I have seen them in this case, they

13· ·would be cited in my report.

14· · · ·Q.· · ·Okay.· Do you cite to any in your report?

15· · · ·A.· · ·I would have to look back.· I'm not

16· ·certain one way or the other.

17· · · ·Q.· · ·Okay.· Why don't you take a look, because

18· ·I think this is important.

19· · · ·A.· · ·I don't know that merely looking at the

20· ·citations is going to tell me in all cases what's in

21· ·them.

22· · · ·Q.· · ·Okay.· Then I guess there's probably no

23· ·point in your looking, but is there anywhere -- I

24· ·mean, do you point -- it seems like a pretty

25· ·important fact.· Do you point it out in the text of

Case 5:17-cv-00551-LHK Document 278-5 Filed 10/04/18 Page 16 of 18
Page 121

·1· · · ·break point, and I think we're about to run out

·2· · · ·of tape.· So let's take ten.

·3· · · · · · · THE VIDEOGRAPHER:· The time on the

·4· · · ·monitor is 1:48 p.m., and we are off the record.

·5· · · ·This is the end of DVD Number 2.

·6· · · · · · · (Break in proceedings.)

·7· · · · · · · THE VIDEOGRAPHER:· This is the beginning

·8· · · ·of DVD Number 3.· The time on the monitor is

·9· · · ·1:56 p.m., and we are now back on the record.

10· ·BY MR. NOVIKOV:

11· · · ·Q.· · ·I just want to circle back to one thing

12· ·that we talked about in the last round, just to make

13· ·something clearer.

14· · · · · · · When you say in your report that the

15· ·device -- that the certificate expiration dates were

16· ·accelerated, you're referring to Dallas De Atley's

17· ·response to the initial proposal four days after it

18· ·was made in 2007 and before the certificates were

19· ·created, correct?

20· · · ·A.· · ·Yes.

21· · · ·Q.· · ·You don't have anything else in mind when

22· ·you talk about the expiration dates being

23· ·accelerated?

24· · · ·A.· · ·Correct.

25· · · · · · · MR. NOVIKOV:· I'm going to mark the next

Case 5:17-cv-00551-LHK Document 278-5 Filed 10/04/18 Page 17 of 18
Page 226

·1· ·COMMONWEALTH OF VIRGINIA AT LARGE, to wit:

·2· · · · · ·I, Rhonda D. Tuck, RPR, CRR, Notary Public in and

·3· ·for the Commonwealth of Virginia at Large, and whose

·4· ·commission expires on May 31, 2020, do certify that the

·5· ·aforementioned appeared before me, was sworn by me, and

·6· ·was thereupon examined by counsel; and that the foregoing

·7· ·is a true, correct, and full transcript of the testimony

·8· ·adduced.

·9· · · · · ·I further certify that I am neither related to nor

10· ·associated with any counsel or party to this proceeding,

11· ·nor otherwise interested in the event thereof.

12· · · · · ·Given under my hand and notarial seal at

13· ·Charlottesville, Virginia, this 27th day of September,

14· ·2018.

15

16

17

18· · · · · · · · __________________________________

19· · · · · · · · · · Rhonda D. Tuck, RPR, CRR

20· · · · · · ·Notary Public Registration No. 224847

21· · · · · · · ·Commonwealth of Virginia at Large

22

23

24

25· ·Job No. 37982/307500

Case 5:17-cv-00551-LHK Document 278-5 Filed 10/04/18 Page 18 of 18