1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Case No.3:17-cv-00939 

DECLARATION OF GARY BROWN

UNITED STATES DISTRICT COURT

NORTHERN DISTRICT OF CALIFORNIA, SAN FRANCISCO DIVISION

WAYMO LLC,

Plaintiff,

vs.

UBER TECHNOLOGIES, INC.; 

OTTOMOTTO LLC; OTTO TRUCKING 

LLC,

Defendants.

CASE NO. 3:17-cv-00939

DECLARATION OF GARY BROWN

REDACTED VERSION OF DOCUMENT 

SOUGHT TO BE SEALED
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

-2- Case No. 3:17-cv-00939 

DECLARATION OF GARY BROWN

I, Gary Brown, hereby declare as follows. 

1. I have been employed by Google Inc. (“Google”) since August 2013. I currently 

hold the position of Security Engineer, Forensics. I make this declaration in support of Waymo’s 

Motion for a Preliminary Injunction and have personal knowledge of the facts stated herein. 

2. I received an M.S. in Enterprise Computing and a B.S. in Cybersecurity from the 

Stevens Institute of Technology. 

3. In my role as a Security Engineer in Forensics, I am responsible for gathering 

evidence, from logs and hosts, to confirm or refute suspected compromise or abuse. I am familiar 

with Google’s secure networks and with logs of activity on those networks that are maintained by 

Google in the ordinary course of its business. 

4. It is Google’s policy to assign unique identifiers to devices issued to employees for 

work purposes, such as work laptops. Among other functions, these unique identifiers help 

maintain the security of Google’s secure networks. When an employee’s device interacts with a 

Google service or is active on a Google network, those interactions and activities can be recorded 

in logs that identify the device (by its unique identifiers) and/or the interaction or activity (for 

example, downloading files from a secure repository). 

5.

6.

 

7.

 
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

-3- Case No. 3:17-cv-00939 

DECLARATION OF GARY BROWN

8.

9.

10.

11.

. 

Anthony Levandowski 

12. Google issued a work laptop to Anthony Levandowski in July 2013 that was 

assigned the asset inventory tag (“the Levandowski work laptop”). 

13. Based on my review of host metadata, an installed Windows operating system 

on the Levandowski work laptop made no check-ins to between March 2, 2015 and 

November 25, 2015, despite the agent being configured to do so every 15 minutes when an 

internet connection is present. Based on my review of Google corporate network logs, the 

Levandowski work laptop’s network interfaces appeared on the Google network a total of three 

times between March 2, 2015 and November 25, 2015: for a period of approximately two hours on 

October 22, 2015, approximately two hours on November 20, 2015, and then briefly on November 

25, 2015. 

14. Based on my review of host and metadata, the Windows operating 

system on the Levandowski work laptop was re-installed on November 26, 2015. 
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

-4- Case No. 3:17-cv-00939 

DECLARATION OF GARY BROWN

15. Based on my review of log data, the Levandowski work laptop ran a 

MoMA search for the strings “chauffeur svn login” and “chauffeur svn eee setup” on December 3, 

2015. “Chauffeur” was the name of Google’s self-driving car project, and “SVN” refers to a 

repository used by that project which contains Waymo's design files, schematics and other 

confidential information. 

16. Based on my review of logs of Google corporate network traffic and log data, 

the Levandowski work laptop downloaded and installed TortoiseSVN, which is software that can 

access the self-driving car project’s SVN repository, on December 11, 2015. 

17. Based on my review of logs from the SVN repository and of Google corporate 

network traffic, the Levandowski work laptop then downloaded over 14,000 files from the SVN 

repository, also on December 11, 2015. Based on my review of logs from the SVN repository, 

that download totaled 9.7 GBs of data, including 2 GBs from LiDAR subdirectories. 

18. Based on my review of log data, a Transcend RDF5 USB 3.0 card reader was 

attached to the Levandowski work laptop for a period of approximately eight hours on December 

14, 2015. 

19. Based on my review of host metadata in and a timeline of the hard drive of 

the Levandowski work laptop, the Levandowski work laptop was reformatted from a Windows 

operating system to a Linux operating system (Goobuntu, Google’s custom version of Ubuntu 

Linux) on December 18, 2015. 

20. Based on my review of Google machine certificate logs, Google network logs, 

Google host logs, and host metadata, the Levandowski work laptop maintained a consistent 

connection on Google’s network from the time of reformat on December 18th through its last 

check-in to , and obtention of a machine certificate, on December 21, 2015. The final 

appearance of the Levandowski work laptop on Google’s corporate network occurs approximately 

one minute after it obtained the machine certificate on December 21, 2015. From that point on, 

there is no further appearance of the Levandowski work laptop on Google’s corporate network, 

nor any check-ins to despite the agent being configured to do so every 15 minutes 

when an internet connection is present. 
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

-5- Case No. 3:17-cv-00939 

DECLARATION OF GARY BROWN

21. When a Google employee uses his or her corporate account credentials to log onto 

Google Drive, those interactions can also be recorded even if the Google employee is accessing 

Google Drive from a personal device. For example, if a Google employee “exports” (i.e., saves a 

local copy of) a document from Google Drive, that interaction will be recorded in a Drive log, 

identifying (among other things) the Google employee’s GAIA ID (a unique identification number 

assigned by Google, resolvable to a username and domain on Google’s services), the unique ID of 

the document exported, the operating system and browser in use, and the time and date of the 

export. 

22. Based on my review of Drive log data, the Google GAIA ID which 

resolves to “ @google.com” – assigned to Anthony Levandowski – exported five 

documents from Google Drive to a personal device (i.e., one that was not issued by Google) on 

January 4, 2016, over an approximately three minute period. The names of those files are: 

● Intensity Calibration 

● Extrinsic Calibration 

● and tuning Instructions 

● Assembly Flowchart SOP 

● TESTING STATION 

23. Based on my review of Drive log data, on January 11, 2016, the Google GAIA ID 

 – assigned to Anthony Levandowski – exported another document from Google 

Drive to a personal device. The name of this file is: 

● Chauffeur TL weekly updates - Q4 2015 

Sameer Kshirsagar 

24. Based on my review of Drive log data, the Google GAIA ID – 

assigned to Sameer Kshirsagar – exported a document from Google Drive on June 3, 2016. The 

name of this file is: 

● Laser questions 
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

-6- Case No. 3:17-cv-00939 

DECLARATION OF GARY BROWN

25. Based on my review of Drive log data, the Google GAIA ID – 

assigned to Sameer Kshirsagar – exported another document from Google Drive on June 14, 2016. 

The name of this file is: 

● Ramp Checklist 

26. Based on my review of Drive log data, the Google GAIA ID – 

assigned to Sameer Kshirsagar – exported another document from Google Drive on June 21, 2016. 

The name of this file is: 

● and Packaging 

27. Based on my review of Drive log data, the Google GAIA ID – 

assigned to Sameer Kshirsagar – exported another document from Google Drive on June 22, 2016. 

The name of this file is: 

● -Lens Placement-01 

28. Based on my review of Drive log data, the Google GAIA ID – 

assigned to Sameer Kshirsagar – exported another document from Google Drive on July 12, 2016. 

The name of this file is: 

● All things Part 3- mode - 

Radu Raduta 

29. Based on my review of Drive log data, the Google GAIA ID – 

assigned to Radu Raduta – exported, over an approximately ten minute period, three documents 

from Google Drive on July 28, 2016. The names of those files are: 

● Die - wire bonding houses 

● External Vendors and Consultants List 

● automation vendors 

I declare under penalty of perjury that the foregoing is true and correct. Executed in San 

Jose, California, on March 9, 2017.