Oracle Corporation et al v. SAP AG et al

Filing 782

Declaration of Scott W. Cowan in Support of 780 MOTION Defendants' Notice of Motion and Motion to Partially Exclude Testimony of Kevin Mandia and Daniel Levy filed bySAP AG, SAP America Inc, Tomorrownow Inc. (Attachments: # 1 Exhibit A, # 2 Exhibit B, # 3 Exhibit C, # 4 Exhibit D, # 5 Exhibit E, # 6 Exhibit F, # 7 Exhibit G, # 8 Exhibit H, # 9 Exhibit I, # 10 Exhibit J, # 11 Exhibit K, # 12 Exhibit L)(Related document(s) 780 ) (Froyd, Jane) (Filed on 8/19/2010)

Oracle Corporation et al v. SAP AG et al

Doc. 782 Att. 3

EXHIBIT C

Dockets.Justia.com

KEVIN MANDIA HIGHLY CONFIDENTIAL

May 2 1 , 2 0 1 0 ATTORNEYS' EYES ONLY
Page 291

UNITED STATES D I S T R I C T COURT NORTHERN D I S T R I C T OF CALIFORNIA SAN FRANCISCO D I V I S I O N ORACLE CORPOP~TION, a Delaware corporation, ORACLE USA, I N C . , a Colorado corporation, and ORACLE INTERNATIONAL CORPORATION, a C a l i f o r n i a corporation, Plaintiffs, vs. SAP AG, a G e r m a n c o r p o r a t i o n , SAP AMERICA, INC., a Delaware c o r p o r a t i o n , TOMORROWNOW, INC., a Texas corporation, a n d DOES 1 - 5 0 , i n c l u s i v e , Defendants.
) )
)

) ) ) ) )
)

)

) No. 07-CV-1658
)

(PJH)

) ) ) ) ) ) ) )

---------------)
VIDEOTAPED DEPOSITION OF KEVIN MANDIA

VOLUME 2 ; PAGES 2 9 1 - 5 7 0 FRIDAY, MAY 2 1 , 2 0 1 0

HIGHLY

CONFIDENTIAL - ATTORNEYS' EYES ONLY

REPORTED BY:

HOLLY THUMAN, CSR N o . 6 8 3 4 ,

R~R,

CRR

(1-427384 )

Merrill Legal Solutions [phone]
a5d494d9-5dge-4705-8e49-634585badc5f

KEVIN MANDIA HIGHLY CONFIDENTIAL

May 2 1 , 2 0 1 0 ATTORNEYS' EYES ONLY
Page 304

Text Removed - Not Relevant to Motion

08:57:45 08:57:49 08:57:51 08:57:53

22 23 24

Q. question.

I sure can.

And I t h i n k I misasked t h e What

I said, through the last sentence.

I meant to say was,

through the first sentence in through that

25

paragraph 4 on page 1 of your report,

Merrill Legal Solutions [phone]
aSd494d9-Sdge-4705-8e49-63458SbadcSf

KEVIN MANDIA HIGHLY CONFIDENTIAL

May 21,

2010

ATTORNEYS' EYES ONLY
Page 305

08:57:56 08:58:00 08:58:04 08:58:09 08:58:14 08:58:17 08:58:20 08:58:24 08:58:27 08:58:29 08:58:33 08:58:36 08:58:41 08:58:45 08:58:48 08:58:49 08:58:51 08:58:56 08:58:57 08:58:59 08:59:02 08:59:02 08:59:06 08:59:08 08:59:11
5 6
7

statement, you were not attempting to imply t h a t
2

TomorrowNow never downloaded m a t e r i a l s s p e c i f i c a l l y by customer using that specific customer's log-in credentials, are you? A. In t h i s sentence, what I'm trying to do i s The mass

3

state an overall characteristic. downloading,

the reason I said "mass" instead of

8 9 10
11

j u s t "downloading" was things such as the creation of the t o o l to download t h i n g s f a s t e r than human speed when c l i c k i n g through a s i t e , the fact that I

saw s t a f f dedicated on a download team, t h a t t h e r e ' s 2 0 d e d i c a t e d d o w n l o a d s e r v e r s , DCDLI t h r o u g h 2 0 , T e x a s A&M p a r t - t i m e e m p l o y e e s o r interns, I think they were called, t h a t would do downloads. That contributed to mass downloading. i t ' s about volume. T h a t ' s what t h i s was about. So

12 13 14 15 16 17 18 19 20
21

Q.

Well, but That part of i t . I g u e s s we s h o u l d b r e a k

A.

down the sentence, because i t ' s conjunctive.
Q.
It is.

22 23 24 25

A.

On t h e i m p r o p e r a c c e s s s i d e , w h a t I ' m

doing there is applying the terms of use to the access t h a t was done. The terms of use assumption Things such as after

t h a t I was asked to make.

Merrill Legal Solutions
[phone]
a5d494d9-5dge-4705-8e49-634585badc51

KEVIN MANDIA HIGHLY CONFIDENTIAL

May 2 1 , 2 0 1 0 ATTORNEYS' EYES ONLY
Page 306

08:59:15 08:59:18 08:59:19 08:59:23 08:59:25

1

maintenance end date, having a valid license to be entitled to that. I believe t h a t was the purpose of that sentence, i s to cover the mass downloading and improper access.

2

3
4

5

Text Removed - Not Relevant to Motion

Merrill Legal Solutions [phone]
aSd494d9-5d9e-4705-8e49-634585badc5f

KEVIN MANDIA HIGHLY CONFIDENTIAL

May 2 1 , 2 0 1 0 ATTORNEYS' EYES ONLY
Page 369

Text Removed - Not Relevant to Motion

11:18:33 11:18:37 11:18:42 11:18:46 11:18:48 11:18:51 11:18:53 11:18:55 11:18:59 11:19:01 11:19:04 11:19:06 11:19:09 11:19:12 11:19:15 11:19:17 11:19:18 11:19:21 11:19:24

4

A.

To t h e b e s t o f my r e c o l l e c t i o n , a n d I ' m - -

5 6
7

I recall conversations that there were f i l e s accessed from the database - - and I'm c h a r a c t e r i z i n g someone e l s e ' s discussion with me, o r t h i s i s how I u n d e r s t o o d i t - - t h a t t h e r e w e r e f i l e s in Oracle's Customer Connection database that you c o u l d n ' t j u s t do searches on Customer Connection, and you c o u l d n ' t j u s t c l i c k on links to get to these files. Q. Did you ever do any independent analysis

8 9
10 11 12

13
14 15 16 17 18 19 20 21

to see which f i l e s those were? A. Q. I don't recall doing that. Okay. And d i d you e v e r go on Customer

Connection to see i f you could access these f i l e s by doing standard search terms through Customer Connection? MR. LEWIS: THE WITNESS: Objection. Vague.

I don't recall doing the

22

a c t i v i t y you j u s t suggested.
Text Removed - Not Relevant to Motion

Merrill Legal Solutions [phone]
a5d494d9·5d9e470S-8e49-634585badc5f

KEVIN MANDIA HIGHLY CONFIDENTIAL

May 2 1 , 2 0 1 0 ATTORNEYS' EYES ONLY
Page 454

Text Removed - Not Relevant to Motion

14:27:01 14:27:06 14:27:11 14:27:16 14:27:20 14:27:27 14:27:32 14:27:34 14:27:35 14:27:41 14:27:42

15 16
17

MR. COWAN:

Q.

Yeah.

Did you attempt a t

any point to review each of the copyright r e g i s t r a t i o n s that are l i s t e d on pages 52, 53, 54, 55, and 56 of P l a i n t i f f s ' Fourth Amended Complaint that i s Exhibit 2086 to determine whether your opinions and conclusions apply to each one of those copyrights that are l i s t e d on those pages? MR. LEWIS: compound. THE WITNESS: please? Yeah, could you r e s t a t e i t , Objection. Vague and

18 19 20 21 22 23 24 25

Merrill Legal Solutions [phone]
a5d494d9·5dge-4705-8e49-634585badc5f

KEVIN MANDIA HIGHLY CONFIDENTIAL

May 21,

2010

ATTORNEYS' EYES ONLY
Page 455

14:27:44 14:27:45 14:27:54 14:27:56 14:28:08 14:28:14 14:28:16 14:28:25 14:28:27 14:28:30 14:28:33 14:28:37 14:28:40 14:28:41 14:28:43 14:28:44 14:28:47 14:28:49 14:28:52 14:28:54 14:28:59 14:29:04 14:29:06 14:29:09 11:29:13

1 2
3

MR. COWAN:

Q.

Well, l e t ' s just s t a r t

with the f i r s t one on page 52 o f Exhibit 2086. Did you make any attempt a t a l l to determine whether the copyright registration that's l i s t e d there as Shop Floor Control Program was addressed i n any way by your r e p o r t ? MR. L E W I S : THE WITNESS: Objection. Vague.

4 5
6

7 8 9 10
11

When I a p p r o a c h e d t h e t a s k

o f i d e n t i f y i n g what TomorrowNow possessed, you know, across a l l the, you know, t e r a b y t e s of d a t a , dozens and dozens of systems, you had a t one point over 90 forensic images, the f i r s t task I t r i e d to do - - and I'm t e l l i n g you t h i s because I think i t ' l l help us get through this faster. MR. COWAN: A. Q. Okay, good.

12 13 14 15 16 17 18 19 20 21
22

The f i r s t thing I did i s t r i e d to find the

categories that are listed, meaning the information t h a t ' s l i s t e d o n T a b l e 3 5 a n d 3 6 o f my r e p o r t . I was looking for software and support materials that were l i s t e d in Table 36, and then different product lines and releases that were in Table 35. S o f r o m t h a t p e r s p e c t i v e , b a s e d o n my assumption t h a t the things i n Table 35 and 36 are covered by the copyrights Oracle asserts in t h i s a c t i o n , o n c e I g o t my h a n d s o n t h e d a t a , k i n d o f So

23 24 25

Merrill Legal Solutions
[phone]
a5d494d9-5dge-4705-8e49-634585badc5f

KEVIN MANDIA HIGHLY CONFIDENTIAL

May 2 1 , 2 0 1 0 ATTORNEYS' EYES ONLY
Page 456

14:29:16 14:29:18 14:29:19 14:29:22 14:29:25 14:29:27 14:29:35

1

f u n n e l e d i t from e v e r y t h i n g down t o t h i n g s t h a t were inside of those tables. So I always did i t I think more broadly t h a n l i n e b y l i n e , j u s t s o y o u s e e how I a p p r o a c h e d the investigation. I came very high level and put

2
3

4
5 6
7

t h i n g s i n t o t h e c a t e g o r i e s t h a t w e r e my p r o t e c t e d expression assumption.

Text Removed - Not Relevant to Motion

Merrill Legal Solutions [phone]
a5d494d9-5dge-4705-8e49-034585badc5f

KEVIN MANDIA HIGHLY CONFIDENTIAL

May 2 1 , 2 0 1 0 ATTORNEYS' EYES ONLY
Page 487

15:45:02 15:45:05 15:45:09 15:45:13 15:45:17

1

Q.

Did you ever personally inspect e i t h e r

2
3
4

TomorrowNow's actual AS/400 machine or the restored version of it? A. I did not personally inspect TomorrowNow's

5

AS/400 machine or a restored version of i t .

Text Removed - Not Relevant to Motion

Merrill Legal Solutions
[phone]
a5d494d9-5dge-4705-8e49-634585badc5f

KEVIN MANDIA HIGHLY CONFIDENTIAL

May 2 1 , 2 0 1 0 ATTORNEYS' EYES ONLY
Page 533

Text Removed - Not Relevant to Motion

17:25:37 17:25:39 17:25:45 17:25:48 17:25:52 17:25:55 17:26:00 17:26:04 17:26:09 17:26:13 17:26:19 17:26:20 17:26:21 17:26:24 17:26:28 17:26:29

10
11

Q.

Is there any analysis t h a t you conducted

in Section X or 10 of your report t h a t ' s r e f l e c t e d In paragraphs 373 through 378? MR. L E W I S : THE WITNESS: Objection. Vague.

12
13

14 15 16 17 18 19 20 21 22 23 24 25

I would categorize Section X

as t h e a p p l i c a t i o n - - t h i s i s j u s t one way t o look a t i t - - t h e a p p l i c a t i o n o f o n e o f my a s s u m p t i o n s to things I witnessed on TomorrowNow's networks. But t h a t ' s a general categorization, as to the purpose of this section, in applying protected protection assumption. MR. COWAN: Q. And t h e r e ' s nothing in

Section X of your report, paragraphs 373 through 378, that contains any hash analysis. Correct?

And I'm not t a l k i n g about a l l the o t h e r things you've done. I'm talking about what's

Merrill Legal Solutions [phone]
a5d494d9-5d9e-4705-8e49-634585badc5f

KEVIN MANDIA HIGHLY CONFIDENTIAL

May 2 1 , 2 0 1 0 ATTORNEYS' EYES ONLY
Page 534

17:26:32 17:26:33 17:26:42 17:26:43 17:26:44 17:26:45 17:26:50 17:26:55 17:26:58 17:27:04 17:27:07 17:27:12 17:27:14 17:27:16 17:27:19 17:27:25 17:27:28 17:27:30 17:27:35 17:27:42 17:27:46 17:27:47 17:27:54 17:27:56 17:27:59

1 2 3 4 5

specifically in this section. MR. LEWIS: THE WITNESS: question, please? MR. COWAN: Q. Yeah. There's nothing in Objection. Ambiguous.

Can you repeat t h a t

6
7

paragraphs 373 through 378 t h a t r e f l e c t s any hash analysis that you've done beyond what's reported elsewhere in your reports, your appendices, O-MAN-208, and your e l e c t r o n i c appendices. A. Right?

8
9 10
11

The - - a l l the things you mentioned cover

what Section X refers to in regards to the hash analysis t h a t you j u s t mentioned. Q. Okay. And the same t h i n g would apply with There's no code analysis

12

13
14 15 16 17 18 19 20 21 22 23 24 25

respect to code analysis.

discussed or analyzed in paragraphs 373 through 378 besides what you've analyzed elsewhere in your report, your appendices, your electronic appendices, and O-MAN-208. A. Right?

Mandiant's -- Mandiafit's electronic

appendices, appendices and report, and supporting materials that we've provided with the record, contain the code comparisons that we've done. Q. And t h e r e ' s no new code comparisons t h a t

are r e f l e c t e d here in paragraphs 373 through 378. Right?

Merrill Legal Solutions [phone]
a5d494d9·5d9&-4705-8e49-634585badc5f

KEVIN MANDIA HIGHLY CONFIDENTIAL

May 2 1 , 2 0 1 0 ATTORNEYS' EYES ONLY
Page 535 '

17:28:01 17:28:05 17:28:10 17:28:14 17:28:18 17:28:21 17:28:24

1
2

A.

The code comparisons referred to in

S e c t i o n X, p a r a g r a p h 3 7 3 t h r o u g h 3 7 8 , a r e d e s c r i b e d in our appendices, and the results of a l l those code comparisons are in - - and I said the word all -- are in the electronic appendices. And I t h i n k I f i n a l l y g o t t o t h e a n s w e r you were looking for.

3
4

5
6
7

Text Removed - Not Relevant to Motion

Merrill Legal Solutions
[phone]
a5d494d9·5dge-4705-8e49-634585badc5f

KEVIN MANDIA HIGHLY CONFIDENTIAL

May 2 1 , 2 0 1 0 ATTORNEYS' EYES ONLY
Page 542

Text Removed - Not Relevant to Motion
17:38:19 17:38:24 17:38:28 17:38:30 17:38:34 17:38:40 17:38:42 17:38:43 17:38:49 17:38:51 17:38:54 17:38:58
2

Q.

Did you rely on anything else other than the

3
4

your report, the appendices to your report,

electronic appendices, the things t h a t you c i t e and r e f e r e n c e i n y o u r r e p o r t , a s w e l l a s ORCLX-MAN-208, to d r a f t the paragraphs 373 to 378 on pages 100 to 102 in your report? MR. L E W I S : answered. THE W I T N E S S : As I s i t h e r e t o d a y , I can't Objection.

5
6
7

8
9

Vague,

asked and

10
11

t h i n k o f a n y t h i n g I r e l i e d o n o u t s i d e o f my r e p o r t , my e l e c t r o n i c a p p e n d i c e s , my a p p e n d i c e s , a n d t h e t h i n g s l i s t e d i n ORCLX-MAN-208.

12 13

Text Removed - Not Relevant to Motion

Merrill Legal Solutions [phone]
a5d494d9-5dge-4705-8e49-634585badc5f

1

CERTIFICATE OF REPORTER
I,

2 3 4 5 6 7
8

HOLLY THUMAN, a C e r t i f i e d S h o r t h a n d

Reporter, hereby certify that the witness in the f o r e g o i n g d e p o s i t i o n w a s b y me d u l y s w o r n t o t e l l the truth, the whole truth, and nothing but the truth in the within-entitled cause; That s a i d deposition was taken down i n shorthand me, a d i s i n t e r e s t e d person, a t the time

9 10 11 12
13

and place therein state, and that the testimony of s a i d witness was t h e r e a f t e r reduced to typewriting, b y c o m p u t e r , u n d e r my d i r e c t i o n a n d s u p e r v i s i o n ; That before completion of the deposition review of the transcript was [ ] was not requested. If

14

requested, any changes made by the deponent (and provided to the reporter) during the period allowed

16
17

are appended hereto. I further certi t h a t I am n o t o f c o u n s e l o r

18 19 20 21 22

attorney for either or any of the parties to the s a i d deposition, nor in any way i n t e r e s t e d in the e v e n t o f t h i s c a u s e , a n d t h a t I am n o t r e l a t e d t o any of the parties thereto.

---::-

23
24

DATED'

25

~

~ \ ( (f1.y_.._~'
r\OLLY THUMAN, CSR

,:-1

I

!

Lf,2JQ)

HIGHLY

KEVIN MANDIA May 2 1 , 2 0 1 0 CONFIDENTIAL - ATTORNEYS' EYES ONLY

18:31:07 18:31:0B 18:31:11

1

THE VIDEO OPERATOR:

This concludes Volume We a r e o f f

2

2 in the deposition of Kevin Mandia. the record at 6:31. (Time noted, 6:31 p.m.)

3
4

5 6

--000-I

declare under penalty of perjury that Subscribed at

7 8
9

the foregoing i s true and correct.

_fxri~:.-Q_N_'-+I--,P---.:A-,-,---, ,
T V 1-7
2010.

re 3 J.

>xP .t;:.A.i,a ,

t his

~

da y

0

f

10 11 12

KEVIN MANDIA

13
14

15 16

17
18 19 20
21
22
23

24 25

568
Merrill Legal Solutions [phone]