Intel Corporation v. Rivers

Filing 36

ORDER GRANTING TEMPORARY RESTRAINING ORDER signed by District Judge Morrison C. England, Jr on 2/14/19. (Kaminski, H)

1 GREGORY P. STONE (State Bar No. 78329)
[e-mail]
2 JEREMY K. BEECHER (State Bar No. 301272)
[e-mail]
3 MUNGER, TOLLES & OLSON LLP
350 South Grand Avenue, Fiftieth Floor
4 Los Angeles, California 90071-3426
Telephone:
[phone]
5 Facsimile:
[phone]
6 CAROLYN HOECKER LUEDTKE (State Bar No. 207976)
[e-mail]
7 MUNGER, TOLLES & OLSON LLP
560 Mission Street, Twenty-Seventh Floor
8 San Francisco, California 94105
Telephone:
[phone]
9 Facsimile:
[phone]
10 Attorneys for Plaintiff Intel Corporation
11
12

UNITED STATES DISTRICT COURT

13

EASTERN DISTRICT OF CALIFORNIA

14

SACRAMENTO DIVISION

15
16 INTEL CORPORATION,

Case No. 2:18-cv-03061-MCE-AC

17

ORDER GRANTING TEMPORARY
RESTRAINING ORDER AGAINST
DEFENDANT DOYLE RIVERS AND
ORDERING INSPECTION OF HOME
COMPUTER

18

Plaintiff,
vs.

19 DOYLE RIVERS, an individual, and DOES 1
through 10, inclusive,
20
Defendants.
21

Judge: Hon. Morrison C. England, Jr.
Crtrm.: 7

22
23
24
25
26
27
28
Case No. 2:18-cv-03061-MCE-AC
ORDER GRANTING TEMPORARY RESTRAINING ORDER AND ORDERING INSPECTION OF HOME
COMPUTER

1

ORDER

2

Plaintiff Intel Corporation (“Intel”) filed a motion for a preliminary injunction against

3 Defendant Doyle Rivers (“Rivers”). The Court has reviewed the parties submissions, including
4 declarations submitted in support of Intel’s motion and Rivers’ opposition, and the Court heard
5 oral argument on February 7, 2019 from counsel for both parties. Based on the submissions and
6 the argument, this Court finds and orders that a temporary restraining order as set forth below shall
7 issue and shall be in place through February 21, 2019. Further, Rivers shall make certain
8 electronic devices available for inspection to Intel’s forensics vendor as set forth below. And, the
9 parties shall submit to this Court a status report on February 21, 2019 on the inspection and the
10 need, if any, for a preliminary injunction.
11 I.

Temporary Restraining Order

12

Issuance of a temporary restraining order, as a form of preliminary injunctive relief, is an

13 extraordinary remedy, and Plaintiffs have the burden of proving the propriety of such a remedy.
14 See Mazurek v. Armstrong, 520 U.S. 968, 972 (1997). In general, the showing required for a
15 temporary restraining order and a preliminary injunction are the same. Stuhlbarg Int’l Sales Co.,
16 Inc. v. John D. Brush & Co., Inc., 240 F.3d 832, 839 n.7 (9th Cir. 2001).
17

The party requesting preliminary injunctive relief must show that “he is likely to succeed

18 on the merits, that he is likely to suffer irreparable harm in the absence of preliminary relief, that
19 the balance of equities tips in his favor, and that an injunction is in the public interest.” Winter v.
20 Natural Resources Defense Council, 555 U.S. 7, 20 (2008). The propriety of a TRO hinges on a
21 significant threat of irreparable injury that must be imminent in nature. Caribbean Marine Serv.
22 Co. v. Baldridge, 844 F.2d 668, 674 (9th Cir. 1988).
23

Alternatively, under the so-called sliding scale approach, as long as the Plaintiffs

24 demonstrate the requisite likelihood of irreparable harm and show that an injunction is in the
25 public interest, a preliminary injunction can still issue so long as serious questions going to the
26 merits are raised and the balance of hardships tips sharply in Plaintiffs’ favor. Alliance for Wild
27 Rockies v. Cottrell, 632 F.3d 1127, 1131-36 (9th Cir. 2011) (concluding that the “serious
28
Case No. 2:18-cv-03061-MCE-AC
-1ORDER GRANTING TEMPORARY RESTRAINING ORDER AND ORDERING INSPECTION OF HOME
COMPUTER

41128642.1

1 questions” version of the sliding scale test for preliminary injunctions remains viable after
2 Winter).
3

Based on the evidence submitted to the Court and the oral argument on February 7, the

4 Court finds that Intel has satisfied the requirements for a temporary restraining order and orders as
5 follows:
6

Defendant Rivers shall not possess, use, retain, keep, hold, disclose, disseminate, access, or

7 utilize any confidential, proprietary, or trade secret Intel information or documents related to 3D
8 XPoint or Intel’s Optane™ branded products, including about personnel working on those
9 products, that he acquired while working for Intel and that contain information Intel has not
10 disclosed outside of Intel (which includes information or documents shared with others under a
11 nondisclosure agreement protecting its confidentiality) (with “documents” including all electronic
12 versions of documents, data, spreadsheets, or any other hard copy or electronic stored information
13 derived from such documents or information).
14 II.

Inspection of Home Computer and Electronic Devices

15

Defendant Rivers shall make available to Intel for inspection by Intel’s forensics vendor

16 (Stroz Friedberg) the home computer that Rivers testified he used with the USB device that had
17 been used to download information from his Intel laptop (hereinafter the “Home Computer”).
18 Rivers shall also make available to Intel’s forensics vendor for inspection any and all printers that
19 have been connected to the Home Computer. For this order, the Home Computer and the printers
20 will be referred to as the “Collected Devices.” The Collected Devices shall be provided to Stroz
21 Friedberg no later than February 12, 2019.
22

(a)

Custody of the Collected Devices

23

Stroz Friedberg will retain custody of the collected devices until the analysis outlined

24 below is complete and any potential Intel documents have been remediated (i.e., removed) from
25 the devices. Stroz Friedberg should make full, forensically sound bit stream copies of each
26 physical volume present on the collected devices onto a separate storage media in the EnCase E01
27 file format using an industry standard program. This will be done to preserve evidence on the
28 Collected Devices. Stroz Friedberg should document and record:
Case No. 2:18-cv-03061-MCE-AC
-2TEMPORARY RESTRAINING ORDER AND ORDER REQUIRING INSPECTION OF HOME COMPUTER

(i) a general description of the process and tools utilized to conduct the imaging
(ii) general make and model information about the devices
(iii) the MD5 hash values of the original volumes, and
(iv) the MD5 hash value of the copies.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

(b)

Searches for Intel Documents

The Court orders that Intel, through Stroz Friedberg, be allowed to analyze the Collected
Devices for evidence that Intel confidential, proprietary, or trade secret documents have been or
are on the device or are otherwise in Rivers’ possession. Stroz Friedberg should use industry
standard practices to search for and identify any such documents on the Collected Devices. These
steps may include the following:
o Stroz Friedberg may run searches for hash values and search terms on the Collected
Devices (aimed at identifying any Intel confidential documents). The hash values
and search terms will be provided by Intel and shown to Doyle Rivers’ counsel
prior to the search. They may include, but need not be limited to, the search terms
“Intel,” “Intel Confidential,” “Intel Top Secret,” “Intel Restricted Secret,” “3D
XPoint,” “3DXP,” and “Optane.” Stroz Friedberg’s search should include a search
of all unallocated space. All hits on the hash values and search terms will be
referred to as the “Identified Documents.”
o If Stroz Friedberg finds any matches on the Collected Devices to the search terms
or hash values provided by Intel, i.e., if there are any Identified Documents, then
Stroz Friedberg will provide the file names and metadata for the Identified
Documents to outside counsel for Doyle Rivers and outside and inside counsel for
Intel for review.
o If Rivers’ counsel believes the file name for an Identified Document corresponds to
a personal document or a document belonging to another employer or party other
than Intel to whom Rivers owes a confidentiality obligation, the parties shall meet
and confer in good faith and work with Stroz Friedberg to resolve whether there is
agreement that the document should be excluded from the Identified Documents.
o For each Identified Document that is not excluded after a review of file names by
counsel, Stroz Friedberg will (a) remove that document permanently from the
Collected Devices, (b) provide the document to Intel, and (c) maintain a
preservation copy of the unremediated forensic image of the Collected Devices
prior to remediation. Stroz Friedberg will retain this preservation copy of the
Collected Devices until the litigation between Intel and Rivers is resolved or
concluded. Nobody will have access to the preservation copy of the Collected
Devices or any copy of files or data from the Collected Devices other than
personnel at Stroz Friedberg who are working on the matter.
o For each Identified Document, Stroz Friedberg will analyze the Collected Devices
to see if it can ascertain (a) how the document came to be on the Collected Device,
(b) when it came to be on the Collected Device, (c) whether it has been accessed,
Case No. 2:18-cv-03061-MCE-AC
-3TEMPORARY RESTRAINING ORDER AND ORDER REQUIRING INSPECTION OF HOME COMPUTER

edited, disseminated, or printed from that device, and (d) the dates of any activity
associated with the document.

1
2
3
4
5
6

(c)

Transfer of Intel Documents From Collected Devices

The Court orders that Intel, through Stroz Friedberg, may conduct analysis of the Collected
Devices to determine if there has been any transfer of Intel documents onto or off of the devices.
This analysis may include the following steps:
o Stroz Friedberg will identify whether any USB or other removable storage devices
or backup drives have been connected to the Collected Devices. Stroz Friedberg
will note the device make, model, serial number, volume letter, first connection
date, last connection date, and volume label. Stroz Friedberg will determine all
information available about the use of any removable storage devices on the
Collected Devices. Stroz will share all of this information with outside counsel for
Intel and Rivers.

7
8
9
10
11

o Stroz Friedberg will look to see if the USB device Intel identified as being used on
Rivers’ Intel laptop on September 9, 2018 has ever been inserted in the Collected
Devices. Stroz Friedberg will share the results of this question with Doyle Rivers’
counsel and Intel.

12
13
14

o Stroz Friedberg will analyze whether or not cloud based storage accounts have been
used or accessed from the Collected Devices and any information available about
that access, including whether files were transferred to the cloud based storage
accounts. Stroz Friedberg will share the results of this question with Doyle Rivers’
counsel and Intel.

15
16
17

o Stroz Friedberg will analyze whether or not documents have been printed from the
Collected Devices and if so, any information available about that printing. This
will include checking for printer logs on Collected Devices. Stroz Friedberg will
share the results of this question with Doyle Rivers’ counsel and Intel.

18
19
20

o Stroz Friedberg will analyze whether or not documents have been transferred off
the Collected Devices using an email account. Stroz Friedberg will share the
results of this question with Doyle Rivers’ counsel and Intel.

21
22

(d)

23

Intel, through Stroz Friedberg, may conduct analysis and look for any evidence that the

Analysis of Document Deletion or Device Tampering

24 Collected Devices, or any information or documents on a device, have been deleted, wiped,
25 destroyed, or otherwise hidden from view since September 4, 2018. Stroz will use techniques it
26 deems appropriate based on industry standards to look for evidence that documents or information
27 has been destroyed on the Collected Devices since September 4, 2018. Those techniques may
28 include the following:
Case No. 2:18-cv-03061-MCE-AC
-4TEMPORARY RESTRAINING ORDER AND ORDER REQUIRING INSPECTION OF HOME COMPUTER

1

o Stroz Friedberg will analyze all installed applications that were found on the hard
drive of the Collected Devices that have file wiping capabilities and any associated
run dates/times.

2
3

o Stroz Friedberg will record all operating system upgrades or installation dates and
times on the home computer.

4
5

o Stroz Friedberg will check for event logs that show any evidence of manipulation
of data on the home computer.

6

o Stroz Friedberg will check Internet browsing history for any evidence of searches
run for anti-forensics information. I.e. Google searches for document secure erase,
different anti forensic/file wiping tools.

7
8
9

o Stroz Friedberg will check for lnk files and associated user artifacts on the home
computer. If any are found, Stroz Friedberg will take the next appropriate steps to
follow up on that evidence.

10
11 III.

Return of Intel Confidential, Proprietary, or Trade Secret Documents

12

At the conclusion of the inspection of the Collected Devices, the Court orders that Rivers

13 shall return to Intel within 3 business days all confidential, proprietary or trade secret Intel
14 information or documents related to 3D XPoint or Intel’s Optane™ branded products, including
15 about personnel working on those products, that he acquired while working for Intel and that
16 contain information Intel has not disclosed outside of Intel except under a nondisclosure
17 agreement protecting its confidentiality. Stroz Friedberg can facilitate the return of this
18 information from the Collected Devices through the protocol above while also preserving a
19 forensic copy of the evidence for use in the litigation. Stroz Friedberg can delete any Intel
20 confidential, proprietary, or trade secret documents from Rivers’ Collected Devices and then
21 return those devices to Rivers.
22 ///
23 ///
24 ///
25 ///
26 ///
27 ///
28 ///
Case No. 2:18-cv-03061-MCE-AC
-5TEMPORARY RESTRAINING ORDER AND ORDER REQUIRING INSPECTION OF HOME COMPUTER

1

If Rivers is in possession of information or documents (electronic or hard copy) related to

2 3D XPoint or Optane™ that he acquired while working for Intel that are stored or maintained in
3 places other than the Collected Devices, Rivers should identify those documents to Intel by
4 February 19, 2019 with specificity, including the nature of the document, the location of the
5 document, and how the document came to be in Rivers’ possession. The parties shall then work
6 on a protocol to be reported in the February 21, 2019 status update to the Court for how that
7 information shall be handled going forward.
8

IT IS SO ORDERED.

9 Dated: February 14, 2019
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
Case No. 2:18-cv-03061-MCE-AC
-6TEMPORARY RESTRAINING ORDER AND ORDER REQUIRING INSPECTION OF HOME COMPUTER