Oracle Corporation et al v. SAP AG et al

Filing 363

MOTION to Remove Incorrectly Filed Document filed by SAP AG, SAP America Inc, Tomorrownow Inc. (Attachments: # 1 Proposed Order)(Wallace, Elaine) (Filed on 7/22/2009)

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

BINGHAM MCCUTCHEN LLP DONN P. PICKETT (SBN 72257) GEOFFREY M. HOWARD (SBN 157468) HOLLY A. HOUSE (SBN 136045) ZACHARY J. ALINDER (SBN 209009) BREE HANN (SBN 215695) Three Embarcadero Center San Francisco, CA 94111-4067 Telephone: [phone] Facsimile: 415.393.2286 [e-mail] [e-mail] [e-mail] [e-mail] [e-mail] DORIAN DALEY (SBN 129049) JENNIFER GLOSS (SBN 154227) 500 Oracle Parkway M/S 5op7 Redwood City, CA 94070 Telephone: [phone] Facsimile: [phone] [e-mail] [e-mail] Attorneys for Plaintiffs Oracle USA, Inc., Oracle International Corporation, and Oracle EMEA Limited UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF CALIFORNIA SAN FRANCISCO DIVISION ORACLE USA, INC., et al., No. 07-CV-1658 PJH (EDL) v. Plaintiffs, DECLARATION OF KEVIN MANDIA IN SUPPORT OF PLAINTIFFS' REPLY IN SUPPORT OF MOTION TO COMPEL PRODUCTION OF DOCUMENTS RELATED TO DAMAGES MODEL AND INTERROGATORY RESPONSES RELATED TO USE OF PLAINTIFFS' INTELLECTUAL PROPERTY Date: Time: Place: Judge: August 4, 2009 2:00 p.m. Courtroom E, 15th Floor Hon. Elizabeth D. Laporte

SAP AG, et al., Defendants.

Case No. 07-CV-01658 PJH (EDL)

DECLARATION OF KEVIN MANDIA IN SUPPORT OF ORACLE'S REPLY IN SUPPORT OF PLAINTIFFS' MOTION TO COMPEL

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

I, Kevin Mandia, declare: 1. I am CEO and president of Mandiant Corporation ("Mandiant"), a

computer forensics and information security consultation firm. Except for matters stated below on information and belief, I have personal knowledge of the matters stated in this Declaration by virtue of my retention by Oracle in this action. If called and sworn as a witness, I could and would competently testify as to such matters. 2. As part of the discovery process in this case, Defendants have produced

copies of several Lotus Notes application databases that I am informed and believe resided at the facilities of TomorrowNow, Inc. ("SAP TN"). I am informed and believe that these Lotus Notes application databases have been collectively described by Defendants as their "SAS Database." The SAS Database contains certain records of SAP TN's support activities for the PeopleSoft, J.D. Edwards, and Siebel products lines, including certain records relating to the development, testing, and delivery of SAP TN-delivered fixes, updates, patches, documentation, and other material delivered (collectively, a "fix" or "fixes"). The combined size of the copies of the SAS Database that Mandiant has received to date exceeds 30 gigabytes. 3. As part of the discovery process in this case, Mandiant has been given

access to copies of images of servers that I am informed and believe resided at SAP TN's facilities. Both the servers and the produced images or copies of servers have been described by the Parties as the "Data Warehouse" materials. The Data Warehouse materials contain SAP TN's copies of Oracle software environments and downloads of Oracle Software and Support Materials (as that term is used in the Third Amended Complaint) from Oracle's passwordprotected systems. Based on Mandiant's review, the Data Warehouse information appears to reflect some of SAP TN's daily activities, showing its continuing support of specific customers over time. As stated in my July 15, 2009, declaration filed in this matter in support of Oracle's Motion to Amend, Docket No. 349, based on all of the information available to me, I estimate that the sum decompressed size of the Data Warehouse production, once complete, could exceed 16 terabytes and 15 million files. I include in my reference to the Data Warehouse materials the separately produced server images referred to as the Delivered Updates & Fixes (though these
Case No. 07-CV-01658 PJH (EDL)

DECLARATION OF KEVIN MANDIA IN SUPPORT OF ORACLE'S REPLY IN SUPPORT OF PLAINTIFFS' MOTION TO COMPEL

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

materials were not subject to initial review and selection by Oracle prior to production). 4. Based on testimony from SAP TN witnesses and review of the SAS

Database and the Data Warehouse materials, Mandiant has identified at least six distinct steps in SAP TN's fix-delivery process for the PeopleSoft product line at which SAP TN may have used a PeopleSoft environment: replication, development, unit testing, individual fix testing, bundling, and bundle testing. See generally Exhibit A to the Parties' February 9, 2009 Joint Discovery Conference Statement (previously filed under seal). To fully understand SAP TN's use of the environments locally hosted at SAP TN as part of the code fix delivery process, one would need information identifying the environment used at the various steps described above for each fix delivered by SAP TN. 5. For the PeopleSoft product line portion of the SAS Database, certain

records related to certain SAP TN-delivered fixes are stored as "Master Fix" and related records. The Master Fix records typically provide information that allows Mandiant to link the use of specific PeopleSoft environments to the process by which particular PeopleSoft fixes were delivered. For example, each Master Fix record may contain text or attachments that names the environments used at specific points in the fix-delivery process. 6. I have reviewed the Declaration of Joshua L. Fuchs in Support of

Defendants' Opposition to Plaintiffs' Motion to Compel Production of Documents Related to Damages Model, executed July 14, 2009 ("Fuchs Decl."), Docket No. 337. 7. Based on Mandiant's analysis, the screenshot in ¶ 9 of the Fuchs Decl.

appears to be a screenshot of a portion of the Master Fix record for CSS-TN-0112069292, a fix delivered by SAP TN for the PeopleSoft product line. 8. By reviewing the Master Fix record for CSS-TN-0112069292, Mandiant

has determined that this record contains four attachments, each of which names one environment identified as having been used during individual fix testing. These four environments-- H751ACTM, HR702CSS, H831TAIM, and H881PCAO--are also listed by name in the body of the Master Fix record. A fifth environment, H801QGIS, is also referenced. Neither the Master Fix record for CSS-TN-0112069292 nor its attachments appear to provide direct information 2 Case No. 07-CV-01658 PJH (EDL)
DECLARATION OF KEVIN MANDIA IN SUPPORT OF ORACLE'S REPLY IN SUPPORT OF PLAINTIFFS' MOTION TO COMPEL