Levitt v. Yelp! Inc.

Filing 85

RESPONSE (re #77 MOTION to Dismiss Third Amended Class Action Complaint and to Dismiss or Strike Class Action Allegations; Memorandum of Points and Authorities ) filed byBoris Y. Levitt. (Attachments: #1 Declaration, #2 Evidentiary Objections)(Ongaro, David) (Filed on 9/2/2011)

1
2
3
4
5
6
7
8
9
10

LAWRENCE D. MURRAY, State Bar No. 77536
NOAH W. KANTER, State Bar No. 224580
MURRAY & ASSOCIATES
1781 Union Street
San Francisco, CA 94123
Telephone: [phone]
Facsimile: [phone]
DAVID R. ONGARO, State Bar No. 154698
AMELIA D. WINCHESTER, State Bar No. 257928
ONGARO BURTT & LOUDERBACK LLP
595 Market St., Suite 610
San Francisco, CA 94105
Telephone: [phone]
Facsimile: [phone]
Attorneys for Plaintiffs
BORIS Y. LEVITT et al.
UNITED STATES DISTRICT COURT

11

NORTHERN DISTRICT OF CALIFORNIA

12

SAN FRANCISCO DIVISION

13
14
15

BORIS Y. LEVITT, on behalf of himself and all
others similarly situated,
Plaintiffs,

16
17
18
19

v.
YELP! INC.; and DOES 1 through 100, inclusive,
Defendants.

20

5
3

Case No. CV 10-01231 EMC
Consolidated with CV 10-02351 EMC
DECLARATION OF RICHARD
GRALNIK IN SUPPORT OF
PLAINTIFF LEVITT’S
MEMORANDUM OF POINTS AND
AUTHORITIES IN OPPOSITION TO
DEFENDANT YELP! INC.’S MOTION
TO DISMISS THIRD AMENDED
CLASS ACTION COMPLAINT AND
TO DISMISS OR STRIKE CLASS
ACTION ALLEGATIONS

21
Date: October 14, 2011
Time: 1:30 p.m.
Place: Courtroom 15
Judge: Hon. Edward M. Chen

22
23
24
25
26
27
28
DECLARATION OF RICHARD GRALNIK
Case No. CV 10-01321 EMC

1

I, Richard Gralnik, declare as follows:

2

1.

I am a computer forensic investigator at OnlineSecurity, Inc. I have personal

3

knowledge of the matters set forth herein and if called to do so, I could and would testify

4

competently under oath.

5

RETENTION

6

2.

OnlineSecurity was retained in this matter to review the declaration of Ian

7

MacBean, User Operations Manager at Yelp! Inc. (“Yelp”) and to reply to various points in Mr.

8

MacBean’s declaration.

9

QUALIFICATIONS

10

3.

I have worked in the computer industry for over 25 years. My initial training was

11

as a programmer. I completed a one year programming course at Leeds University in England as

12

part of my undergraduate degree. This was followed by a 2 year program at El Camino College

13

in Torrance, California where I earned a Certificate of Competence in Data Processing with a 4.0

14

GPA.

15

4.

My first job in the computer industry was as a programmer. I wrote a personal

16

income tax package for the IBM PC. My next position was as a programmer/operator in which I

17

developed, maintained and ran applications on an IBM mainframe. This was followed by six

18

years as a technical consultant with Prime Computer, a billion dollar worldwide computer

19

vendor. I began working with Prime in programming languages and databases and later

20

transitioned into computer networking. For my last two years at Prime I was the networking

21

specialist for the Western United States, one of ten people in that senior position worldwide.

22

5.

I worked for the next 10 years for DeskTalk Systems, a network consulting

23

company, as a networking consultant, designer and implementer. When the company introduced

24

a network performance analysis application and changed its name to Trinagy, I consulted with

25

the company’s largest clients, wrote the original technical manuals and developed and taught

26

introductory and advanced week-long training classes. Trinagy was bought by Hewlett-Packard,

27
-128

DECLARATION OF RICHARD GRALNIK
Case No. CV 10-01321 EMC

1

where I continued to teach the technical courses and consult with large clients. After Hewlett-

2

Packard, I worked as an independent consultant in network design and information security

3

before moving into computer forensics.

4

6.

I am currently a Senior Investigator with OnlineSecurity, Inc., where I have

5

worked since June, 2004. OnlineSecurity was founded in 1997. It is a company that, among

6

other things, provides professional services in the areas of computer forensics, incident response

7

and electronic discovery. Online Security is recognized as a leader in electronic evidence

8

preservation, examination and reporting and is regularly retained to perform forensic imaging as

9

well as investigation and production of responsive computer data.

10

7.

I have performed forensic analysis on hundreds of computers, removable storage

11

media and mobile communications devices in support of civil litigation. I have worked on cases

12

involving theft of intellectual property, employment disputes including wrongful dismissal and

13

harassment claims, divorce, class action lawsuits including wage and hour disputes, breach of

14

contract and other matters. I have worked on cases on behalf of both plaintiff and defense

15

counsel. I have received over 200 hours of training in computer forensics, electronic discovery,

16

incident response, and network security.

17

8.

I have been designated as an expert witness in state and federal courts. I have

18

submitted declarations and expert reports to the court and have testified in depositions, hearings,

19

jury trials and arbitration. A true and correct copy of my Curriculum Vitae is attached to this

20

declaration as Exhibit A.

21

DISCUSSION

22

9.

23

“3. Second, I reviewed each email address provided by the users who posted these
reviews when creating their account at yelp.com to determine whether any user provided
a Yelp email address – i.e. an address with an “@yelp.com” domain. I confirmed that
none of the users who posted reviews about the named Plaintiffs provided a Yelp email
address when creating their user account, or otherwise have a Yelp email address
associated with their user account.”

24
25
26

In Paragraph 3 of his declaration, Mr. MacBean writes,

27
-228

DECLARATION OF RICHARD GRALNIK
Case No. CV 10-01321 EMC

1

10.

The fact that none of the Yelp posters used a Yelp email address in their contact

2

information does not mean that the poster was not a Yelp employee. There are hundreds of

3

email services available on the Internet from all over the world that will provide a free email

4

account to anyone regardless of their employer.1 It would be a very simple matter for a Yelp

5

employee to create one or more entirely anonymous, completely unverified and perfectly valid

6

email accounts with well known services such as yahoo.com, gmail.com or hotmail.com, or with

7

lesser known services such as thedoghousemail.com or schoolsucks.com.2 An email address with

8

any of these services would pass Mr. MacBean’s test of not being a yelp.com address.

9
10
11
12
13

11.

In Paragraph 5 of his declaration, Mr. MacBean states,

“5. Finally, I reviewed each IP address (i.e. the unique identifier associated with a
particular computer) associated with each review posted about the named Plaintiffs and
confirmed that none of these IP addresses are associated with any Yelp computer or
device.”
12.

The fact that the posted reviews about the named Plaintiffs did not originate from

14

the IP address of a computer or device at Yelp does not mean that the posts could not have come

15

from a Yelp computer or device.

16

13.

There are numerous “anonymizer” sites on the Internet designed to hide a user’s

17

actual IP address from other users such as Yelp. One way that an anonymizer operates is to act

18

as a proxy, or cutout, for the originating user. That user’s traffic is sent to the anonymizer site

19

instead of directly to the intended site (e.g. yelp.com). The anonymizer replaces the user’s actual

20

IP address with its own IP address before forwarding the user’s traffic to the intended site. The

21

intended site receives the user’s traffic but the anonymizer’s IP address is the source address in

22

the traffic it receives. The intended site processes and responds to the user’s traffic but sends its

23

responses to the anonymizer. The anonymizer then forwards the traffic to the originating user.

24
25
26

1

The Free Email Provider’s Guide (http://www.fepg.net) provides links to hundreds of
free email providers worldwide organized by domestic (US), international, Special Interests,
Supplier and other categories.
2

27
28

Recommended by The Free Email Provider’s Guide
-3-

DECLARATION OF RICHARD GRALNIK
Case No. CV 10-01321 EMC

I

14.

The search Mr. MacBean conducted of the source IP addresses of reviews posted

2

to Yelp would not have shown the poster's actual IP address if an anonymizer was involved.

J

They would show the anonymizer's IP address. The IP address of any anonymizer would pass

4

Mr. MacBean's test of not being

a

Yelp IP address.

5

6
7

I declare under the penalty of perjury under the laws of the State of California that the
foregoing is true and correct. Executed on September I,2011, in Los Angeles, California.

8

*'-(-

9

/vzRichard L. Gralnik

l0

ll
t2
13

t4
15

r6

I7
18

t9
20

2I
22
ZJ

24
25

26
27
28

i-1

DECLARATION OF RICHARD GRALNIK
Case No. CV 10-01321 EMC

EXHIBIT A

comprehensive litigation support

Richard Gralnik

Computer Forensic Investigator; Litigation Support
Consultant; Expert Witness

5870 West Jefferson Boulevard. Suite A
Los Angeles, California 90016
Phone: [phone] x.218
Cell:
310-569-5141
Email: [e-mail]
SUMMARY
Richard Gralnik is OnlineSecurity’s senior investigator. He has over 25 years of technical experience in the computer
industry including 6 years as a forensic examiner. He has submitted expert reports on various technical subjects and
has testified as an expert witness in depositions, evidentiary hearings, jury trials and arbitration. He began his career
as a computer programmer, working for 2 years in COBOL, PL/1 and Basic on IBM PC’s and mainframes. He
worked the next 6 years as a technical consultant for a minicomputer manufacturer, originally in programming
languages and relational databases, then in computer networking where he advanced to the level of senior specialist.
He was the technical liaison for the introduction of a distributed transaction processing system and won an award for
the documentation he wrote for a mainframe terminal emulation application. Mr. Gralnik next combined his
programming and networking experience to develop applications written in FORTRAN that transferred consumer
credit information from the key reporting agencies to the client’s system. Following this successful installation he
worked for 5 years as a network consultant on projects that included designing networks for an international computer
manufacturer and one of the largest law enforcement agencies in the United States. Next Mr. Gralnik developed a
series of 5-day classes on a network performance monitoring application and taught the courses in 8 countries. He
also designed user interfaces and developed prototypes of new functionality for the software and consulted with
Fortune 500 clients that used the application. Mr. Gralnik then worked in information security, implementing firewall
protected local area networks, secure wireless networks and virtual private networks. During that time Mr. Gralnik
served for 3 years as the chair of the Information and Telecommunications sector of the Los Angeles chapter of the
InfraGard National Members Alliance. During that time Mr. Gralnik developed an interest in computer forensics.
Since then he has examined data on hundreds of electronic storage devices. His analyses have included forensic
preservation of computer hard drives, cell phones, PDA’s and other electronic storage media, development of
timelines, searches for and production of responsive material and recovery of deleted data, He has consulted with
plaintiff and defense attorneys on technical issues and electronic data discovery and developed lines of questioning
for interrogatories, depositions and trials. Mr. Gralnik combines his forensic knowledge with his years of experience
in operating systems, databases, email systems, networks, computer platforms and information security to provide
clients with a comprehensive understanding of the creation, storage and use of electronic evidence.

PROFESSIONAL EXPERIENCE

OnlineSecurity, Inc. Los Angeles, CA.

2004-Present

Computer forensic investigations and litigation support
Apply forensic applications and procedures to analyze electronic evidence in support of civil litigation including theft of
intellectual property, fraud, sexual harassment, wrongful dismissal, payroll disputes (class action), willful destruction
of company property and divorce
Consult with attorneys on writing preservation letters to protect evidence, create interrogatory questions for discovery
submissions, write requests for production of various forms of electronic evidence, develop lines of questioning for
deposition of designated PMK’s, PMQ’s and opposing experts
Attend depositions of designated PMK’s, PMQ’s and opposing experts. Advise attorneys on significance of answers
to questions and suggest additional questions during proceedings
Conduct forensic acquisitions of hard disk drives, removable memory devices, cell phones, PDAs and other electronic
media, recover deleted files, search active and deleted files for responsive material, supervise electronic data
discovery processing of produced email and files.
Submit declarations and expert reports in support of litigation claims, challenges to opposing motions and findings
Project manager and case coordinator between attorneys, clients and investigators
Testify as an expert witness

I.T. System Services Studio City, CA.

2002-2004

Information Security and General Computer Consultant
Designed, implemented and supported VPN-based telecommuting networks including installation of firewall
appliances and client software
Designed, created and taught 5-day network management application course. Updated material and taught new
class on later version of the application.
Conducted security audits addressing physical and cyber-security concerns. Presented report to management on
findings and recommendations for remediation.
Conducted penetration testing and vulnerability assessments utilizing standard tools and other methods. Presented
report to management on findings and recommendations for remediation.
Installed, configured and supported secure end-user systems for SMB and SOHO users including personal firewalls,
anti-virus software, anti-spyware and spam blocking software, and operating system patching. Trained users on
security awareness and best practices.

Hewlett-Packard Company Torrance, CA.
1990 – 2002
(Acquired Trinagy, Inc. in 2001. Formerly known as DeskTalk Systems, Inc.)
Vendor of OpenView Performance Insight, a leading network management performance analysis application.

T ec hn ic a l M ar k et in g E ng i n eer / Le a d T r a i ner

1997 – 2002

Designed and built a mechanism for monitoring distributed processes and automatically activating fail-over to a
secondary system. This became the standard architecture for other implementations in the field.
Developed training curriculum, designed, created and taught five-day courses on administration and custom reporting
solution development. Trained over 400 people including employees, resellers and customers in classes in 10 states
and 8 countries. Received 2 excellence awards.
Designed and built automated capability to identify which elements to monitor or ignore based on provisioning data in
database. Dynamic element filtering reduced polling traffic up to 50%.
Wrote and installed system for linking reports based on content and automating report generation. Solution adopted
by engineering as prototype for standard report linking and automated report generation process used in TREND.
Established pre-sales support group. Assessed customer networks, demonstrated and installed application for
evaluation. Defined presentation strategies and materials and wrote standard text for RFP response library.
Presented at tradeshows including “longest demo in the history of Interop” that led to first sale to banking industry.
Wrote first user and administrator manuals for TREND. Reviewed later versions for content, accuracy and
organization.

S en i or A n a l ys t

1990 – 1997

Prior to becoming a software vendor, DeskTalk was a network consulting firm for companies in the $50,000,000 $200,000,000 range. Key projects included:
Redesigned Unix system vendor’s nation-wide network. Documented interviews, existing and proposed
architectures, IP addressing scheme, DNS configuration, migration plan. Point of contact throughout implementation.
New topology reduced traffic levels, improved response time, reduced operating costs, eliminated redundant
connections.
Completed protocol compliance testing of new TCP/IP implementation for network components vendor. Designed,
implemented and executed test scenarios. Project included use of routers, bridges, hubs, and three different protocol
decode and analysis tools. Documented setup, procedure, results of each test. Reported any bugs discovered.
Successful completion led to release of premier third-party TCP/IP suite sold for personal computers.
Designed router-based network for large law enforcement organization. Design incorporated high speed land lines,
microwave communications, integration with legacy platforms, connections to national and international law
enforcement networks and databases, and plans for migration from the existing switched network.
Managed corporate network. Obtained IP network number and vendor enterprise number, registered domain name.
Designed and implemented IP subnet addressing scheme. Setup and maintained DNS including offsite secondary
server. Established and maintained Internet link. Technical contact for networking issues.

Richard L. Gralnik

OnlineSecurity, Inc.

Page 2 of 4

Independent Consultant. Los Angeles, CA.

1989-1990

Programmer
Wrote SNA LU6.2 and BSC communications applications in FORTRAN linking credit reporting company to TRW,
TransUnion and Equifax systems for real-time queries. Automated online queries reduced credit report preparation
time from two days to five minutes.

Prime Computer, Inc. Natick, MA.

1983 – 1989

Senior Marketing Support Specialist
Promoted from local general pre-sales analyst focused on databases and programming languages to senior analyst
to data communications specialist for the Western United States.
Technical lead for introduction of TCP/IP on Prime platforms. Directed interoperability testing with other
implementations.
Technical lead on RFP response to county-wide mobile digital network implementation
Beta support and coordinator for implementation of Oracle RDBMS-based multi-platform remote transaction
processing system.
Reverse engineered a terminal emulation application and wrote user and administrator manuals for the software.
Received an Excellence Award for this project

Inquiry Processing Center. Torrance, CA.

1982-1983

Programmer/Operations Manager
Wrote and maintained software applications written in COBOL and PL/1.
Ran production processes on IBM 370-158 mainframe under MVS operating system.
Wrote and maintained JCL operation control programs.

Digitax Micro Systems, Inc. Manhattan Beach, CA.

1981-1982

Programmer
Designed and wrote interactive income tax package in BASIC on IBM PC.
Developed parameter driven process for printing IRS-compliant tax forms on blank paper.

EXPERT WITNESS TESTIMONY
Has testified, submitted declarations or expert reports to the following courts:
United States District Court, Central District of California
United States District Court, Northern District of California
United States District Court, Southern District of California
United States District Court, Northern District of Illinois
United States District Court, Eastern District of New York
Arizona Superior Court, Pima County
Arkansas Circuit Court, Pulaski County
California Superior Court, Imperial County
California Superior Court, Los Angeles County
California Superior Court, Orange County
California Superior Court, Sacramento County
California Superior Court, San Francisco County
California Superior Court, San Diego County
California Superior Court, Santa Clara County
Colorado District Court, El Paso County
South Dakota Sixth Judicial Circuit
Washington Superior Court, King County
Arbitration, Los Angeles, California
Arbitration, Houston, Texas

Richard L. Gralnik

OnlineSecurity, Inc.

Page 3 of 4

PROFESSIONAL CERTIFICATION
Encase Certified Examiner, Guidance Software. Valid through February, 2014

PROFESSIONAL TRAINING
Regional Computer Forensic Group Conference; George Mason University; Fairfax, VA. 2005, 2007
Applying Microsoft Security; QuickStart; Los Angeles, CA.
Encase Computer & Enterprise Investigations Conference; Guidance Software; Pasadena, CA.
Encase Incident Response, Forensic Analysis and Discovery; Guidance Software; Pasadena, CA.
Cisco Secure VPN; SaberTech; Glendale, CA.
Advanced Cisco Pix Firewall; SaberTech; Glendale, CA.
CISSP Preparation; CertTest; Grapevine, TX.

PROFESSIONAL ASSOCIATIONS
High Technology Crime Investigation Association Southern California Chapter
Information Systems Security Association Los Angeles Chapter
Secret Service Electronic Crimes Task Force Los Angeles Chapter
InfraGard National Members Alliance Los Angeles Chapter,
Chair of Information and Telecommunications sector 2003-2006

EDUCATION
BA, Economics (High Honors) 1981 University of California, Santa Barbara
Degree completed at University of Leeds, England
Certificate of Competence in Data Processing (4.0 G.P.A.) 1984 El Camino College, Torrance, CA.

Richard L. Gralnik

OnlineSecurity, Inc.

Page 4 of 4