Sony Computer Entertainment America LLC v. Hotz et al

Filing 94

Letter from [Joint] Plaintiff SCEA and Defendant George Hotz re Proposed Order for March 10, 2011 Hearing. (Attachments: # 1 Exhibit 1, # 2 Exhibit 2, # 3 Exhibit 3, # 4 Exhibit 4, # 5 Exhibit 5, # 6 Exhibit 6, # 7 Exhibit 7, # 8 Exhibit 8, # 9 Exhibit 9, # 10 Exhibit A)(Smith, Mehrnaz) (Filed on 3/14/2011)

Sony Computer Entertainment America LLC v. Hotz et al

Doc. 94 Att. 1

EXHIBIT 1

Dockets.Justia.com

1 KILPATRICK TOWNSEND & STOCKTON LLP
JAMES G. GILLILAND, JR. (State Bar No.1 07988)

2 TIMOTHY R. CAHN (State Bar No. 162136)
MEHRNAZ BOROUMAND SMITH (State Bar No. 197271)

3 HOLLY GAUDREAU (State Bar No. 209114)
RYAN BRICKER (State Bar No. 269100)

4 Two Embarcadero Center Eighth Floor San Francisco, CA 94111
5 Telephone: [phone]

Facsimile: [phone]
6 Email: jgilliland~kilpatricktownsend.com

tcahn~kilpatricktownsend. com 7 mboroumand~kilpatricktownsend.com hgaud reau~kilpatricktownsend. com
8 rbricker~kilpatricktownsend.com

9 Attorneys for Plaintiff
SONY COMPUTER ENTERTAINMENT AMERICA LLC
10
11

UNITED STATES DISTRICT COURT
FOR THE NORTHERN DISTRICT OF CALIFORNIA
SAN FRANCISCO DIVISION
Case No. 11-cv-00167 SI (PROPOSED) ORDER RE MARCH 10, 2011 TELEPHONIC HEARING RE JOINT LETTER ON IMPOUNDMENT ISSUES AND JOINT LETTER ON DISCOVERY

12
13

14 SONY COMPUTER ENTERTAINMENT
AMERICA LLC,
15

Plaintiff,
16
v.

17

GEORGE HOTZ; HECTOR MARTIN 18 CANTERO; SVEN PETER; and DOES
1 through 100,

19

Defendants.

20
21

22

23 On March 10,2011, the Court held a hearing on the parties' February 18, 2011 and
24 February 28, 2011 joint letters (Docket Nos. 85 and 86) on discovery and impoundment
25 disputes. Having considered all the papers and arguments, the Court enters the following

26 order:
27 (1) Plaintiff SCEA is authorized to serve third party PayPal, Inc. with a subpoena

28 seeking the following limited information relating to personal jurisdiction: documents sufficient
(PROPOSEDj ORDER RE MARCH 10,2011 TELEPHONIC HEARING
- 1 -

CASE NO. 11-cv-00167 SI

1 to identify the source of funds in California that went into any PayPal account associated with

2 geohot~gmail.com for the period of January 1, 2009 to February 1, 2011. SCEA is ordered
3 to redraft its subpoena to seek this information. SCEA is further ordered to inform PayPal,

4 Inc. and other subpoenaed parties that any information produced in response to the
5 subpoena shall be provided on an Attorneys' Eyes Only basis and that the issuance of the

6 subpoena is without prejudice to its right to file a Motion to Quash. (See Docket No. 92)
7

(2)

Mr. Hotz is ordered to sign a consent for SCEA to obtain his Twitter posts from

8 January 1, 2009 to the present.
9

(3)

Defendant George Hotz is ordered to appear in California for a deposition

10 relating solely to the question of personal jurisdiction. SCEA shall pay reasonable expenses

11 of Mr. Hotz to be deposed in California. The parties shall determine the date of the
12 deposition. Additionally, the parties have stipulated that Mr. Hotz cannot be served with
13 process by the parties to this action or the parties identified in SCEA's Certification of
14 Interested Entities or Person (Docket No. 16) when he appears at his personal jurisdiction

15 deposition in California.
16 (4) With regard to the impoundment, the Court orders that:

17 18

(a) The Intelligence Group ("TIG"), the third party neutral chosen by both parties,

shall only take steps with regard to the impounded devices that are authorized by

19

Court order.
(b) The first $7000 of TIG costs will be split equally between SCEA and Mr. Hotz.

20
21

SCEA has agreed to and shall pay any amount over the $7000.

22

(c) TIG is ordered to conduct the impoundment in the forensically sound manner as proposed in its Certification of February 27, 2011, including Exhibit A to that

23 24 25 26 27 28

certification. Attached hereto as Exhibit 1 is a true and correct copy of the
February 27, 2011 Certification and Exhibit A.

(d) Judge Illston's modified impoundment order requires the isolation, segregation

and/or removal of information related to Defendant Hotz's circumvention of the

technological protection measures in the PS3 System. The Court orders the
(PROPOSEDj ORDER RE MARCH 10, 2011 TELEPHONIC HEARING CASE NO. 11-cv-00167 SI

-2-

1

parties and TIG to meet and confer regarding what exactly is information related

2
3

to the circumvention of the technological protection measures in the PS3 System

and a procedure to isolate, segregate and remove such information. The parties
shall submit a description of the protocol to the Court for entry into an order by no
later than March 28, 2011.
(5)

4
5

6

With regard to jurisdictional discovery of the impounded devices, the Court

7 orders that:

8 (a) In order to avoid conducting discovery searches on original impounded devices
9 belonging to Mr. Hotz, TIG shall make an additional copy of both the encrypted and

10 unencrypted versions of the impounded hard drives and keep them in their

11 possession.
12 (b) TIG shall then conduct a forensically sound search of the impounded devices to

13 determine whether: (i) they contain all or portions of the development tools for the

14 PlayStation 3 System and (ii) the impounded devices have been used to access or
15 connect to the PlayStation Network. The Court orders the parties and TIG to meet

16 and confer on a protocol for TIG to perform these searches. The parties shall
17 submit a description of the protocol to the Court for entry into an order by no later

18 than March 16,2011.
19

(6)

The parties shall enter a Stipulated Protective Order for all discovery matters.

20 To the extent the parties are unable to agree on the terms, they are ordered to file a joint

21 letter no longer than 10 pages to set forth the disputed terms and the parties' respective

22 positions.
23

24 IT IS SO ORDERED.
25

26
27

DATED:

HON. JOSEPH C. SPERO UNITED STATES MAGISTRATE

JUDGE
63207604 vi
(PROPOSEDj ORDER RE MARCH 10, 2011 TELEPHONIC HEARING CASE NO. 11-cv-00167 SI

28

-3-

EXHIBIT 1

'\

CERTIFICATION OIt' MICHAEL GREl'"NIER, C.FCE, EnCE
1 Michael Grennier, CFCE EnCE, of full age anù duly sworn, does hereby state as follows:
I . On Februar 26th, 2011, .I lOl'¥ardcd the certification per both parties reqiiest and
according to the conference calt of both parties held on Februry 251/', 2011. (See attac11ed as

Exhibit

A).
2. Steward Kellar, Es., Defense counsel representing Mr. George Hotz, agreed to

the process listed in

the attached certification, as long as the bit-stream image of the drive was

wiped after the searching processes were completed. He would not agree. however to begin the

process on Monday, February 28, 2011, where Mr. Hotz would provide unencrypted access to
The Intellgence (')TOUP for purposes of creating an unencrypted bit-stream copy of his clients
hard drives, believing that a motion would be fied in order for

Plainti to maintain a preserved

copy for discovery purposes. Mr. Hotz clearly stated tbat his client would never agree to ANY
copy being created, which could be .retaned for puroses other fuan the impoundment order and

the processes mentioned in my fir.st certification.
3. After sending my

requested certification to both partes, i was advised that Mr.

Hot? will not agree to any hit-stram copies of the hard drives. It was further proposed by

Defèndants counsel that we use Mr. Hotz'g computer and operating system to conduct the
seaches and securely delete the data.
4. According to the Cyber Security Institute, Computer Forensics is defined at the

preservation, identiJ'ication, extraction, interpretation, and documentation of computer evidence,
to include the rules of evidence, legal processes, integrity of evidence, factual reporting of the

information tound, and providing expert opinion in a court of law or other legal and/or

admistrative proceeding as to what W09 found. In hiisíc terrmi, Computer lunmsics is a science

Second Certification Sony

V Hotz2l27 /2011

Pagel

in which fai:l bai;ed results of an cxamim;rs findings should achieve the same result of any oih~r

computer forensic examiner. The use of standards and controls in scientific experiments is a
fundamental axiom ofthe scientific method. No experiment can be considered "scientific" unless

they are used to ensure reliable results. An important consideration is the nature of the scientific
experiment itself a') it may require the use of multiple stadards and controls. Likewise, this
axiom holds true in forensic science. A scientific experiment is a controlled experiment.

Variahles are intentionally introduced or changed one at a time and the results .monitored.

Physical evidence is analyzed using methods and procedures that have previously been verified
or valídated with the use of appropriate stadards and controls. Therefore, all forensic science
disciplines must document in their methods and procedures specific

stadards an.d controls. They

must be used when analyzing physical evidence as a memis to demonstrate that scientific

principles and quality assuruce practices were followed. Their use wil also e;iisure that the
methods, procedures, and instrumentation are f\ctionig correctly, and that

the results obtaied

are accurte, reliable, and repeatable. 1 For these reasns, we maintain a computer forensics lab

where I test our hardware and softare to ensure that they are work properly and use only
software and hardware which is known to me and my lab personnel. In order for TIG to isolate,
segregate and/or remove the information on those devices related to Defendant's circumvention
devices, I recommend these standard principles to be applied.
5. BaSed upon the above explanations, it would be completely improper for The

Intelligence Group to lise a client's computer for anything other than

makng a bit-stream image

of

the hard drive. TIG's recommended procedures are:

1 ;rohnJ. Barbara _ Autlior. deneral Editor fbi the "Handbook of

Digital & Multiedia IMdence".!!'!fuli.tL!?

J:f.lll!)j!na Pr= in 2007Pu,ql1~ti~il.9ll.E()ri"'3"iL' J...('tm'il1~ (lJ.t12:/.iwww.foi.ci\skmali.cOi\Ù - Coniputer POJ"enic!l

S\;indurds and Controls

Second Certificati.oIl Sony V Hotz 2/27/2011

Page 2

a. Photograph and document the hardware and remove the hard drive.
b. Create a bit-stream image using a hardware device or software created and
tested for thispmpose in our lab. In this case, where the drives are encrypted

we may need to boot the OS and then create the bit-stream image (using our

software) using what is temicd a "Iìve acquisition". The bit-steam image is

placed on a hard drive purchased by TIG, wiped and Iormatted in our lab prior
to

starng the image procedure. This way 'we know that the hard drive is

working and blan prior to staing. The Intellgence Group maintains control

of the imaging process by entering all commands, passwords durg this
process.
c. We then create a backup copy ofthe bit-stream image on a second drive to be

used in the event that the onginallab drive malfunctions.
d. We then .connect the lab drive

containing the biHtream image to one of our

lab computers, where we know the operating system and programs that have
been instaled. All our forensic processes work with the bit-stream image, but
do not change that image in any way. All the results and information from the
processes

are stored in a separate directory on the same drive. To restate, the

bit-stream copy we star with is not changed in any manner. durng any of our
forensic processes.

e, We thenrn some pre-processes, which is a computer automated search for
fies that have been deleted and expand compressed files into different

evidence files. Compressed files such as ZIP, docx, and ta are :fles which
li~w be'òu tompr"'~Lied Lv lJUW liPU\:1l un the hurd drive. 'Tm¡o fioH need to be

: . _.~ ..'_ø ,", .j ..._.... '. __ aç

9'

"" . ..~_L
Page

Second Certification Sony V Hotz 2i27/2011

3

expanded so that we can conduct searches of their contents. We also search
for files and folders which are password protected.
6. In thh case, we have been provided with two hard drves and a calculator. The

hard drives, according to Mr. Ho~ are encryted. When an encrypted drive is provided our

procedure would .be to create a bit-stream copy of the had drives prior to any other actions or
imaging and then create a duplicate of each drive to be utilzed tor the un-encryption step. This
ensures that we always have an "original" bit-stream image of

the drives.

7. It is importnt to explain that a bit-stream image of

the hard drive represents a

snap shot in time of exactly what was on that hard drive at the time the image was created. This

bit-stream image is normally created by a Computer Forensic firm or e-discovery tìrm when

looking for deleted data or providing discovery. However The Intelligence Group was not
tasked with providing discovery requests or preservation of data with the exception of

documenting and maintaining a copy of any circumvention devices related to a Sony PS3 on the
hard drives.

8. The hitellgence Group is only tasked wìth finding specific data, copying that data
into an evidence file and then deleting it from the onginal hard dnve and returg that drve the
Mr. Hotz.. Nothng in the order states that we need to maintain a copy of

the entire hard dnve

for discovery or future processing of evidence. During our conference calls Mi, Hotz;s attorney
ha stated several times that there is no reason to keep the bit-stream image of the had drive as

his client is fully capable of maintaining the computer as required in the discovery order. In
addition, 'I1e Intellgence Group has offered to

hold either hold in our evidence an encrypted

copy of the bit-steam imae or allow Mr. Hotz's attorney to secure 'ts copy of the had drive in
his offce as long

a.,, wmild nul ullow 1ù:; c1icni access to that drhre. Siiii:ei Mr. Hotz's atturney

Second CertifcÐ.tíon Sony V Botz 2/27/2011

Page

4

has clearly stated that his client is capable of keeping the original hard drive in a manner that
does not violate the discovery order, it seemed to me to out of my jurisdiction since I was not
tasked with any discovery issues beyond the documentation and storage of circumvention

devices related to a Sony PS3.
9. As our role is to be neutral, we had the paries agree to the creating ofa bit-stream

image after the origina drives were placed in the original computer and allowing Mr. Hotz to

enter the password so thai it would not be known to any pary. We would then nu the proper
processes on out bit'-stream image in our lab, create the appropriate copies of the data relating to
a circumvention Devices related to a PS3 and finally delete that data off the original hard drive.

Onc.e completed we would wipe our bit-stream image ofile hard drive. Mr. Hotz's attorney was

agreeable to the process but could not allow us to sta because a motion was going to be filed
requiring The Intelligence Group to preserve the bit-stream image and he knew ilat Mr. Hotz
would not provide his password if any copies were going to be maintained.
10. On Februar 25i1, 2011, we were advised that Mr. Hotz wìl not agee to allow us
to creating any bit-stream image and in addition, we must use his computer for searchig and

processing.
1 i. For this forensic examination, I need to confirm that the hard drive does not

contain any password protected files. In addition, i need to expand compressed fies in order to

conduct searches for the circumvention devices related to a PS3. Both of these processes will

resut in the alteration of data on the original hard drive and even overwrite data that has been

previously deleted if ran on the original hard drive. My actions would cause changes and
destrction of data to the origial had dnve.

Sci.nd Certification Sony VHotz 2/27/2011

PageS

12. While we have been told that Mr. Hotz used Linux as the Operating system, I do
not how the operating system has been contìgured, changed or modified. 1 furthennore do not
have any prior knowledge of any traps that may be on the system. While 1 believe Mr. Hotz to
be an honest person and have no reason to suspect that he has made any changes, I 'Will be held

accountable if such changes occur. Therefore I am required to assume that all operating systems

contain traps and hence must use my lab computers for processing. As an example in one of my

forensic classes taught by the White Collar Cnme Center, 1 was able to change the operating

syste:r so that when a user typed in the command "copy" it was understood by the system as
"format". When any user typed in "Copy C: D:" (which would copy.fies from dnve C to D), the

they
operating system actually ran '~Fonnat C:" in such a manner that it would not ask the user if

were sure that they wanted to format the hard drive. Formating a hard dnve overwite." at least
the first twenty percent of a 20GB bard drive and removes all files and folders.
13. Therefore, i cannat conduct the searches using .the suspect's computer

system.

and operating system. In a perfect world, 1 would 'have the complete computer system with the

copies of the onginal hard drives installed along with the password so that I could un-encryted

the drive. However in .this case, Mr. Hotz only provided the hard drives, not the computer
system and reses to provide any passwords. Without the origin computer system and/or

password it is very doubtfl that 1 can un-encrypt the hard drive and proceed as .indicated in the

cour order. I would have been able to proceed with just the hard drives if they were not
encrypted.
14. According to Defense counsel, Mr. Hotz is only willng to bnng his computer to
he can enter the password and TIG will NOT m.e a copy of

our location if

the hard dove. Mr.

HOt7., "'''11 the.n point out tOLl that arc circumvention devices related to a PS3 uid then l.Upy

Second Certification Sony V Hotz 2/27/2011.

lage6

them off to another drive. Lastly, we must use his computer system and operating system and
special tools he has to delete that data off of his hard drive. According to the court order, both
pares did agree to have an independent third party conducts tbe tasks of locatig, isolating,

segregating and/or removing the information related to Circumvention Devices specific to the

Sony PS3 console. In order to accomplish these tasks, TIG will need access to the data, the
password and original computer and work in our tested, verified and secure environment.
15. If TIG is not allowed by Mr. Hotz to create a bit-stream image of the hard drive

and I am required to use his computer tor processing, I will be unable to testify in court that my
searches were conducted properly and completely.
16. 1 am available to testify in person or by phone as requested by either pary or the

cour.
I hereby ccrtifythat tle foregoing statements made by me are tre. I am aware the if any
of the foregoing statements made by me are willfully false, I .aI subject to punishment.

By:

Michael Grennier, CFCE. EnCE

iJ¿JiL---

Dated: c2 I). Î! :L C(

Second Certification Sony V Hotz 2/27/2011

Page

7

EXHIBIT A.

CERTIFICAITON of

Michael Grennier

Second Certification Sony V Hotz 2/27/2011

Page

8

CERTIFICATION OF MICHAL GRENNIER, CFCE, EnCE
I Michael Grennier, CFCE EnCE, offì.l1 age and duly sworn, does hereby state as follows:
1. i. am the Director of

Forensics and Security at The Intelligence Group (TIG), 1545

Route 206, Bedminster, NJ 07921. I have been employed with TIG since January 2008.
2. Prior to my tenure at TIG, I was employed by a computer forensic tìrm in

Princeton, NJ. I stared in May 2005 as a Senior Forensic Examiner. Prior to that, 1 retired as a
Police Captain with twenty-five (25) year of service at the South Plainfeld Police Departent

in NJ. Prior to my retirement I had the additional l'esponsibility of maintaining the local

governent's computer network. As a Police Officer, I worked as a computer forensic examiner
on cases involving fraud, theft, and internal aílairs, investigations, as well as murder, rape, and
child pornography. I have received traiing from Guidance Software, The National White Collar

Crime Center and the International Association of Computers Investigative Specialists (IACIS)

which include Certified Forensic Computer Examiner (CFCE), Electronic Evidence Collection
Specialist (CRECS) and EnCase Certified Examiner (EnCE), Access Data, and Dan Mares Inc. I

hold both a Certified Forensic Computer Examner (eFCE) with .lAClS and Encase Certified
Examiner (EnCE) certification from Guidance Software. Over the past 12 months I have
conducted well over eighty (80) digital fòrensic examinations.
3. TIG is a digital forensics fi servicing its client's needs in systematically

identifying, preserving, extracting, analyzing, and interpeting digita evidence. The finn can

uncover e-mail communcations, account information, fie copying, attempted data destruction,
account usage, and other activities performed on computers.
4. tIG has asisted clients in a wide variety of lawsuits, raging from cases
involving fraud, intellectual propert theft wroiigIì.l termination, forgery, matrimonial disputes

initial Certifcation Sony V Hotz 2/26/2011

Pagel

including child custody and other matters that involve electronically stored intòrmation. TIG
complies with all computer forensics standards as set fort by the U.S. Federal Bureau of

Investigation (FBI) and Guidance Software's Incident Response Forensic Analysis and
Discovery (JRF AD) program. The forensic technicians and examiners at TlG employ a number

of digital forensc software packages and analysis technques which include, but ar not limted
to Guidance Softares EnCase, Access Data's FTK (Forensic Toolkit) and Paraben Software's
E-Mail Examner to complete a comprehensive search of

both active and deleted :files, as well as

to provide an unbiased report of the res1.ts. These softvl'are products are also utilized by the law

enforceinerit communty worldwide. Extensive coursework in the digital forensics field along
with. hands-on, prodnct-specific training is necessar in order to use these products correctly.

Additionally, specialized knowledge and training in chain of custody and evidence handling
procedures in the field of digital forensics is necessar in

order to perform imagig and analysis

up to indllst and legal stadards Tl G' s

5. Forensic examinations are never conducted on an original media, device or drve.
TIG does not turn on a suspect computer and then search it the way a person sittg in front of

the computer might attempt. Our forensic examinations are always undertaken using a "hit-

strea" copy. A bit-stream is a copy oflle hard drve that captures every bit and byte of data
without regard to programs or applications.
6. The Defendat has agreed to bring the same computer which contaned and

worked with the hard drives that he provided to TIG so that they could be held in evidence as specified in the court order. The importce of this deals with the encrypted hard drives and the

operation system drivers which must match the computer hardware for the bootíngprocess to
successfully occur.

Initial Certifi.cation Sony V Hotz 2/26/2011

Page

2

7. In this case, the defendant has represented the hard drives contain a Linux based

File and Operating System which he has encrypted by the username and password. In order for
the computer to hoot and provide TlG access, the defendant will need to either provide TIG the
encryption password or enter the password during the boot process. Once the proper password is

entered, the data from the hard drive passes to the operating system as unencryted data. As
previously mentioned, the stadard procedure would be to create a "bi.t.stream" image of the

hard drive at this time in order for 110 to cost effectively isolate, segregate and/or remove the
.infonnation on thòse devices related to Defendant's circumvention devices. For ths process to
continue, TIG requires a bit-stream image that is verified. For ths case, the veriticatíon process
checks the MD5 hash value ofthe bit-stream image file to ensure that the data

is intact. Whie it

is extremely unlikely that the verification process fails, it does occur in a small percentage of

image creations (less tha 5%) and requires the process has to be restaed.
If

the Defendant chooses to enter the password rather than provide that password to TIG, he will,

be required to slay on~site until the process iias been completed and verified because that
password may be needed again in the event his computer crashes dunng thi.s process.

8. Based upon the requested effort, 'fIG wil need to search for and "retrieve" any
the hard
Circumvention Devicesorrelated information which may include the following areas of

drives such as;
a. Active files

b. Deleted fies (unallocated space)

c. Slack space (the area between the end of the file and the star of the next
cluster or sector)
d. Compressed files including but not limited to TAR, ZIP, TZ etc

Initial Certification Sony V Hotz 2/26/2011

Page

3

e. Password protected files or areas ofthe hard dnve
9. In order to properly conduct the searches and as the rules of evidence provide

tor, a forensic examiner must be in control of the environment in which the examnation is to

occur. They must use tàniliar hardware and softare which has been tested and validated.
Failure to use properly tested equipment may allow changes to occur to the data and therefore

may alter the results. For this reason, the Defendants had drives can bensed to create the bitstream image only and it should not be used for keyword searches and processing of data.
10. The above explanations were reviewed on a conference call with attorneys and

the following protocols were agreed to as stipulated:
a. The Detendant shall bring his computer to TIG offces for the purposes of

unencrypting the hard drives.

b. Once the hard drives are installed, the Defendant wil enter his password
which "unen(,'rpts the hard drves.

c. TIG wiU be allowed to create a bit-stream image of the hard drive tor
purposes of locating, jsolating, segregating and/or removing the information

related to Circumvention Devices specific to the Sony 1'$3 console..

d. After completion of the bit-stream image, the Defendant prior to leaving the

offices of TIG, wil show 11G the Circumvention Devices and .related fies
specific to the Sony PS3 console so that a file listing can be created.
e. In addition, the Defendant wil identify any and aU of the following items:

1. Any files, folders or data areas that are encrypted or require a
password. Examples would include but not be limited to truecryt, zip,

orrar
W."

Initial Certification Sony V Hatz 2/26/2011

Page

4

II. Identify if he used or accessed or modified any of the following drve
areas ;
1. volume slack
2. Master Boot Record f Superblock
3. Parition table

4. Hosted Protected Area

5. Drive Configution Overlay
6.Partítion slack

7. Sectors or blocks marked as Bad but used to store data
8. Disk slack

9. Unused space in the block group
i O. Directory entries
:t The original hard drive wil remain in evidence until the Circumvention

Devices and related data bas been removed.

g. TIO wìl use po.rtons of data from the Circumvention Devices relating to a
SonyPS3 console to search for these devices and/or additional references of
circumvention devices across the entire hard drve space.

h. Any Circumvention Devices relating to a Sony PS3 wí1 be documented and

stored in a separate evidence fie on a hard drive that TIG provides for ths
purpose.

I. Any code which is questionable as being a Circumvention Device relating to a

Sony PS3 console wil be reviewed by a TIG sub-contractor that has no
conficts to Sony Corporation. If after this review the code appears to be a

Initial Certifcation Sony V Hotz 2/26/2011

PageS

Circumvention Device relating to a Sony PS3 Console, the code v.ill be sent
to Mr. Hotz's attorney. Mr. Hotz's attorney wil always maintain possession

of the code and not allow it to be copied or transferred in any manner. Mr.
Hotz is being provided the code so that he can show the code to his client and
determine if they want to object to the code being designated as a

Circumvention Device. Any objections after a second review by TIG wil be
brought before th,e Judge in-camera for the purose of inaking a final

deterniination.
J. Once the process of locatig the Circumvention Devices relating to a Sony

PS3 console have been completed, TIG shall remove the identified data from

the original hard drves of Mr. Botz.

k. Once the identified data has been properly removed from the original hard
drives, they shall be. returned to Mr. Hotz. .once the process of removing the
data from Mr. Hotz's hard drves has been completed tl¡e bit-streani image of
the hard drive shall be wiped. This process wil remove all data from that hard
drive.

. I hereby certify that the foregoing statements made by me are tre. I am aware the if any
of

the foregoing statements made by me are wílfuUy false, I am subject to punishment.

BY'~.
Michael Grennier, CFCE, EnCE

D"oo J-FCt (,?l/

Initial Certifcation Sony

V Hotz 2/26/2011

Page

6