FAULKNER DECL. ISO DEFENDANTS’ OPPOSITION TO PLAINTIFF’S MOTION FOR PRELIMINARY INJUNCTION

Case No. 3:17-cv-00939-WHA 

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

MICHAEL A. JACOBS (CA SBN 111664)

MJacobs@mofo.com 

ARTURO J. GONZÁLEZ (CA SBN 121490) 

AGonzalez@mofo.com 

ERIC A. TATE (CA SBN 178719) 

ETate@mofo.com 

MORRISON & FOERSTER LLP

425 Market Street 

San Francisco, California 94105-2482 

Telephone: 415.268.7000 

Facsimile: 415.268.7522 

Attorneys for Defendants 

UBER TECHNOLOGIES, INC., 

OTTOMOTTO LLC, and OTTO TRUCKING LLC 

KAREN L. DUNN (Pro Hac Vice) 

kdunn@bsfllp.com 

HAMISH P.M. HUME (Pro Hac Vice) 

hhume@bsfllp.com 

BOIES SCHILLER FLEXNER LLP 

1401 New York Avenue, N.W. 

Washington DC 20005 

Telephone: 202.237.2727 

Facsimile: 202.237.6131 

Attorneys for Defendants 

UBER TECHNOLOGIES, INC. 

and OTTOMOTTO LLC 

UNITED STATES DISTRICT COURT 

NORTHERN DISTRICT OF CALIFORNIA 

SAN FRANCISCO DIVISION 

WAYMO LLC, 

Plaintiff, 

v. 

UBER TECHNOLOGIES, INC., 

OTTOMOTTO LLC; OTTO TRUCKING LLC, 

Defendants. 

Case No. 3:17-cv-00939-WHA

DECLARATION OF KEVIN 

FAULKNER IN SUPPORT OF 

DEFENDANTS’ OPPOSITION TO 

PLAINTIFF WAYMO LLC’S 

MOTION FOR PRELIMINARY 

INJUNCTION 

Date: May 3, 2017 

Time: 7:30 a.m. 

Ctrm: 8, 19th Floor 

Judge: The Honorable William Alsup 

Trial Date: October 2, 2017

REDACTED VERSION OF DOCUMENT SUBMITTED UNDER SEAL

Case 3:17-cv-00939-WHA Document 183 Filed 04/07/17 Page 1 of 5
FAULKNER DECL. ISO DEFENDANTS’ OPPOSITION TO PLAINTIFF’S MOTION FOR PRELIMINARY INJUNCTION

Case No. 3:17-cv-00939-WHA 1

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

I, Kevin Faulkner, declare as follows: 

1. I am a Managing Director and head of the New York digital forensics lab at Stroz 

Friedberg, a specialized risk management firm with expertise in digital forensics, security science 

and investigations. I co-manage the firm’s technical operations in areas of digital forensics and 

incident response. I supervise and perform digital forensic acquisitions and examinations on 

laptop and desktop computers, e-mail and file servers, handheld/mobile devices, backup tapes and 

network logs in civil and criminal cases, internal investigations, and cybercrime engagements. I 

make this declaration in support of Uber’s opposition to plaintiff’s motion for preliminary 

injunction. I make this declaration based on personal knowledge and, if called as a witness, I 

would testify to the facts listed below. 

2. I have over 13 years of experience in digital forensics and incident response, and 

over 18 years of experience in technology. I have attained a number of certifications in digital 

forensics, computer security, and information technology including: 

 EnCase Certified Examiner (EnCE) 

 Certified Computer Examiner (CCE) 

 GIAC Certified Forensic Examiner (GCFE) 

 PCI Qualified Security Assessor (QSA) 

 CompTIA Linux+ 

 Microsoft Certified Professional 

I am a member of the International Society of Forensic Computer Examiners and The Sedona 

Conference Working Groups on Electronic Document Retention and Production, and Data 

Security and Privacy Liability. I have testified, submitted affidavits, declarations, witness 

statements and/or expert reports in my capacity as a digital forensic expert approximately 

30 times in the following courts: 

 The United States District Court for the Eastern District of New York 

 The United States District Court for the Southern District of New York 

 The United States District Court for the District of New Jersey 

 The United States District Court for the District of Massachusetts 

 The United States District Court for the District of Maryland 

 The United States District Court for the Northern District of Georgia 

Case 3:17-cv-00939-WHA Document 183 Filed 04/07/17 Page 2 of 5
FAULKNER DECL. ISO DEFENDANTS’ OPPOSITION TO PLAINTIFF’S MOTION FOR PRELIMINARY INJUNCTION

Case No. 3:17-cv-00939-WHA 2

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

 The United States District Court for the Eastern District of Texas 

 The United States District Court for the District of Nevada 

 The United States District Court for the District of Arizona 

 New Jersey Superior Court, Law Division 

 Court of Chancery of the State of Delaware 

3. On or around March 15, 2017, Stroz Friedberg was hired to investigate whether 

any Waymo confidential material was placed on the computer systems of defendants Uber 

Technologies, Inc., Ottomotto LLC and Otto Trucking LLC’s (collectively, “Uber”). 

4. Though our investigation is ongoing, to date, Stroz Friedberg has imaged the 

workstations of 87 employees, which I understand constitutes all former Google employees who 

are now at Uber. We also worked with Uber to preserve and collect data from the company’s 

G Suite applications, including Gmail email and Google Drive file server storage. Uber primarily 

uses Google Drive to provide its employees with cloud-based server storage in lieu of traditional 

on premise file servers. As of the date of this declaration, we have collected a total of 

approximately 106.5 terabytes of data. 

5. It was not possible to search the entirety of this tremendous volume of data before 

March 31. Thus, we examined data from the three custodians named in Waymo’s preliminary 

injunction papers (Anthony Levandowski, Sameer Kshirsagar and Radu Raduta), as well as seven 

additional former Google employees who worked on Chauffeur or LiDAR at Google (Asheem 

Linaval, Daniel Gruver, George Lagui, Jur van den Berg, Michael Tocce, Nikko Alcantara, and 

Rudy Sevile). In addition, we searched Uber’s Git version control system software repositories 

and Mr. Kshirsagar’s personal phone and email. 

6. We searched these devices and accounts for the 14,107 Waymo SVN filenames 

identified by Waymo as allegedly having been downloaded (referred to herein as the “Waymo 

SVN Files”). We also searched for the filenames of documents included in Waymo’s preliminary 

injunction papers. We also searched for a set of search terms derived from Waymo’s preliminary 

injunction papers that were likely to identify Google confidential information. Finally, we used 

Case 3:17-cv-00939-WHA Document 183 Filed 04/07/17 Page 3 of 5
FAULKNER DECL. ISO DEFENDANTS’ OPPOSITION TO PLAINTIFF’S MOTION FOR PRELIMINARY INJUNCTION

Case No. 3:17-cv-00939-WHA 3

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

MD5 hash values to search for files on Uber’s systems that were identical to the Waymo SVN 

Files.1 

7. This extensive search of the data for the ten custodians and the Git repository 

identified a total of 5,473 files, none of which were located in the Git repository. We identified 

the overwhelming majority of these files (5,277) on the computers used by Uber hardware 

engineer Asheem Linaval. Of the 5,473 identified files, there are 2,940 unique files, 30 of which 

are MD5 hash matches with the Waymo SVN Files. We also identified two documents in Sameer 

Kshirsagar’s personal Gmail: an Excel spreadsheet entitled “ Ramp Checklist,” which 

Mr. Kshirsagar emailed from his google.com email to his Gmail on June 13, 2016, and a PDF 

entitled “All things Part 2- ,” which Mr. Kshirsagar emailed from his google.com 

email to his Gmail on June 14, 2016. 

8. To further eliminate “false positives” from these search results, Stroz Friedberg 

worked with Uber to install the electrical engineering design applications Altium and LTSpice on 

a clean, previously unused Microsoft Windows virtual machine (referred to herein as the “Test 

System”). Asheem Linaval then used the Test System to create simple mock-up Altium design 

files and my team subsequently created file metadata and hash listings of the contents. We then 

compared the hash values of the design application files and mock-up design files from the Test 

System against the responsive dataset. Stroz Friedberg found that all but 12 of the 30 unique 

Waymo SVN hash results matched the contents of the virtual machine by MD5 hash. In other 

words, there were only 12 unique files that did not match the contents of the Test System by hash 

value. These 12 files are listed in the following table: 

# Representative File Name Sources Hash

1 attrlist‐originalottodata_0B2LGXS2Qe7kYbldzUzdvUFFRWDg

Google Drive,

A. Linaval 02F218BD64549CE6A2CB7DCABC37E037

2 jdsu_rx.PRJPCBSTRUCTURE A. Linaval 1CC6FBFA75C31A8969DB237CF744D9B3

3 receiver‐1‐2‐0.PRJPCBSTRUCTURE A. Linaval 1CF14870AE2754115C6158C7A66369BF

4 805dcbe7c0e2ab799e118c189cc4fd15cba762e0.svn‐base A. Linaval 32D89BDD6407047C8F65F7CD1DF30EE2

5 attrlist‐originalottodata_0B2LGXS2Qe7kYZ3l0cDh6S0VZbmc

Google Drive,

A. Linaval 6A7702DDE1BD72C5F77AD8F1BC707076

6 attrlist_0B1YIyvARWQ82S2pCVnhiUDIta0E Google Drive, CAFE8C6A4514C13674F78C876D266E63

 

1

 A hash value is a cryptographic value that can be calculated for a file. Hash values are 

commonly used in digital forensics as “digital fingerprints” to establish the identity and/or 

integrity of digital media. 

Case 3:17-cv-00939-WHA Document 183 Filed 04/07/17 Page 4 of 5
FAULKNER DECL. ISO DEFENDANTS’ OPPOSITION TO PLAINTIFF’S MOTION FOR PRELIMINARY INJUNCTION

Case No. 3:17-cv-00939-WHA 4

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

# Representative File Name Sources Hash

A. Linaval

7 attrlist‐originalottodata_0B2LGXS2Qe7kYWEtTaW96WlRNZWs

Google Drive,

A. Linaval D23945490C03E1AE6CA646750C69F267

8 PCB_Project_0BwLeHzZBkM1wdGF5NFhBSXUwTTQ.PRJPCBSTRUCTURE Google Drive DBCB0CD246CBCFD885C5EF4C495F2BB4

9 e2d944e9d3a0b051b292272857b81973c51ae8b4.svn‐base A. Linaval E50C925CA2FA77585CD48200E482B36F

10 e3de6e50df88111d206b5a696ab3bc96c038f688.svn‐base A. Linaval FDB4E0A667677EEC7A166946B83129C8

11 attrlist A. Linaval 215C766CBBF7B55C968C16F74C38066A

12 tools

G. Lagui, A.

Linaval 374930C82AF79D6EB0ABD62EAFD83454

9. This exercise demonstrates that the Waymo SVN Files include numerous 

commonly used file names and numerous duplicative files. For these reasons, it is clear that the 

full set of Waymo SVN Files should not be used for the identification of potential Waymo 

proprietary content. 

10. I understand that Waymo’s counsel subsequently identified a subset of 50 of the 

Waymo SVN Files as priority files. For the ten Uber employees whose devices and accounts 

Stroz Friedberg has searched to date, we have identified no hash matches with these priority files 

and 21 unique files that match by file name. These files were all on computers used by Asheem 

Linaval and all have one of the following five file names; amp.SCHDOC, apd.SCHDOC, 

laser.SCHDOC, receiver.PCBDOC, and receiver.SCHDOC. 

11. Stroz Friedberg’s investigation is ongoing, and has not yet been completed. 

Accordingly, I respectfully reserve the right to revise, expand, or supplement my opinions in 

subsequent reports and prior to trial. 

I declare under the penalty of perjury under the laws of the United States of America that 

the foregoing is true and correct. Executed this 7th day of April, 2017, in Paris, France. 

 

Kevin Faulkner 

Case 3:17-cv-00939-WHA Document 183 Filed 04/07/17 Page 5 of 5