"In Re: Facebook Privacy Litigation"

Filing 63

RESPONSE to re 47 Order Relating Case by David Gould, Mike Robertson. (Attachments: # 1 Affidavit Aschenbrener Declaration)(Nassiri, Kassra) (Filed on 11/22/2010) Modified on 11/23/2010 (cv, COURT STAFF).

Gould v. Facebook, Inc.

Doc. 63 Att. 1

KASSRA P. NASSIRI (215405) 1 ([e-mail]) CHARLES H. JUNG (217909) 2 ([e-mail]) NASSIRI & JUNG LLP 3 47 Kearny Street, Suite 700 San Francisco, California 94108 4 Telephone: [phone] Facsimile: [phone] 5 EDELSON MCGUIRE LLC 6 MICHAEL J. ASCHENBRENER ([e-mail]) (pro hac vice) 7 CHRISTOPHER L. DORE ([e-mail]) (pro hac vice) 8 350 North LaSalle Street, Suite 1300 Chicago, Illinois 60654 9 Telephone: [phone] Facsimile: [phone] 10 11 Attorneys for Plaintiffs and the Putative Class 12 13 14 15 16 17 18 19 IN RE: FACEBOOK PRIVACY LITIGATION 20 21 22 23 24 25 26 27 28
DECLARATION OF MICHAEL ASCHENBRENER Case No. 5:10-CV-2389-JW
Dockets.Justia.com

UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF CALIFORNIA SAN JOSE DIVISION Case No. 10-cv-02389-JW CLASS ACTION

DECLARATION OF MICHAEL ASCHENBRENER IN SUPPORT OF PLAINTIFFS' RESPONSE TO DKT. NO. 47 REQUESTING BRIEFING ON CONSOLIDATION AND LEADERSHIP ACTION FILED: 05/28/10 Date: N/A Time: N/A Judge: Hon. James Ware

1 Pursuant to 28 U.S.C. § 1746, I hereby declare and state as follows: 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28
DECLARATION OF MICHAEL ASCHENBRENER

1. I am an attorney admitted to practice in the State of Illinois, and represent the plaintiffs in the above-titled action. I am over the age of eighteen and am fully competent to make this declaration. I make this declaration in support of Interim Class Counsel's Response to the Court's request for briefing of consolidation and leadership issues in this matter and the related cases concerning Zynga Game Network, Inc. I have personal knowledge of the matter set forth herein and, if called to testify, would be competent to do so. 2. Based on communications with counsel in the related Zynga Actions, my understanding is that plaintiffs' counsel in all related actions oppose consolidation of the Zynga Actions with In Re: Facebook Privacy Lit. 3. My co-counsel, Kassra Nassiri and I have organized the work in this case in the most efficient and productive manner possible. 4. Mr. Nassiri and I have discussed settlement options with defendant Facebook. 5. Mr. Nassiri and I have worked with Facebook to develop a discovery plan. 6. Mr. Nassiri and I filed a consolidated complaint in this matter. 7. Mr. Nassiri and I have issued dozens of subpoenas to locate, preserve, and gather potentially relevant evidence. 8. Mr. Nassiri and I have consulted extensively with recognized experts to advance the case. 9. Mr. Nassiri and I have conducted e-discovery preparation. 10. Mr. Nassiri and I have worked with Facebook to preserve potentially relevant evidence and to establish e-discovery protocols. 11. Mr. Nassiri and I have propounded written discovery. 12. Mr. Nassiri and I have communicated with counsel in the Zynga Actions to reach agreement on coordination of discovery and case relation issues. 13. Mr. Nassiri and I possess significant experience in the field of Internet privacy, having litigated some of the largest electronic privacy class actions in the country, including cases against Amazon (Gawronski, et al. v. Amazon, 09-cv-1084-JCC (W.D. Wash.)), (Microsoft

2

Case No. 5:10-CV-2389-JW

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22

and T-Mobile (In Re: T-Mobile Sidekick Litigation, 09-cv-4854-JW (N.D. Cal.)), RockYou (Claridge v. RockYou, 09-cv-6032-VRW (N.D. Cal.)), (Turner v. Storm8, 09-cv-5234-CW (N.D. Cal.)), AdZilla (Simon v. AdZilla, 09-cv-879-MMC (N.D. Cal.)), NebuAd (Valentine v. NebuAd, 08-cv-5113-TEH (N.D. Cal.)), Palm (Standiford v. Palm, 09-cv-5719-LHK (N.D. Cal.)), and Spokeo (Robins v. Spokeo, 10-cv-5306-ODW (C.D. Cal.)). 14. I was appointed Class Counsel in Turner v. Storm8, LLC, 09-cv-5234-CW (N.D. Cal.). 15. I was appointed interim co-lead counsel in In Re: T-Mobile Sidekick Lit., 09-cv-4854-JW (N.D. Cal.). 16. Edelson McGuire partner Steven Teppler serves on the Seventh Circuit's eDiscovery Committee and as co-Chair of the American Bar Association's Electronic Discovery and Digital Evidence Committee. And in May 2010, Edelson McGuire co-hosted the Electronic Discovery and Digital Evidence Practitioners' Workshop at Chicago-Kent College of Law. 17. Mr. Nassiri and I have and will continue to commit significant resources in order to effectively prosecute the matter and secure benefit for the putative class. 18. Attached as Exhibit A is a true and correct copy of a letter from Marne Levine, Facebook's Vice President, Global Public Policy, to Congressman Edward J. Mackey, dated October 29, 2010, http://republicans.energycommerce.house.gov/Media/file/News/102910_Facebook_Respo nse_Barton_Markey.pdf. (last visited November 22, 2010). 19. Attached as Exhibit B is a true and correct copy of Edelson McGuire LLC's firm resume. 20. Attached as Exhibit C is a true and correct copy of Nassiri & Jung LLP's firm resume. _____/s/ Michael J. Aschenbrener______________ MICHAEL ASCHENBRENER EDELSON MCGUIRE LLC Michael J. Aschenbrener (pro hac vice) Christopher L. Dore (pro hac vice) 350 N. LaSalle St., Ste. 1300 Chicago, IL 60654 Tel. [phone] Fax. [phone]
DECLARATION OF MICHAEL ASCHENBRENER

23 Dated: November 22, 2010 24 25 26 27 28

3

Case No. 5:10-CV-2389-JW

EXHIBIT A

October 29, 2010

The Honorable Edward J. Markey U.S. House of Representatives Co-Chairman Bi-Partisan Privacy Caucus 2125 Rayburn House Office Building Washington, DC 20515-6115 The Honorable Joe Barton U.S. House of Representatives Ranking Member Committee on Energy and Commerce 2125 Rayburn House Office Building Washington, DC 20515-6115 Re: Your Letter of October 18, 2010

Dear Chairman Markey and Chairman Barton, I write to respond to your letter regarding the October 18, 2010, Wall Street Journal article involving the presence of Facebook user IDs ("UIDs") in the referrer URL of applications provided by third parties on the Facebook Platform. In this letter we first provide important information that adds context to the issue discussed in the Wall Street Journal article. We then respond to each of the 18 questions posed in your letter. First, as a threshold matter, and notwithstanding the title of the Wall Street Journal's article, the sharing of UIDs by Facebook with third-party applications does not involve the sharing of any private user data and is in no sense a privacy "breach." On the contrary, the sharing of UIDs is critical to people's ability to use third-party applications on the Facebook Platform. The Facebook Platform is designed to enable third-party developers to create innovative, social experiences for people. As a result, a thriving ecosystem of thousands of companies delivering value to tens of millions of people has developed. When a Facebook user authorizes an application, he or she agrees to share certain information with the application ­ including his or her Facebook UID ­ so that the application can provide an innovative, social experience. As Facebook's privacy policy explains, "[w]hen you connect with an application or website it will have access to General Information about you. The term General Information includes your and your friends' names, profile pictures, gender, UIDs, connections, and any content shared using the Everyone privacy setting." Furthermore, as we discuss in more detail below, whenever a Facebook user authorizes an application, we remind 1

that person in real time what specific information the application will have access to, including the user's UID, and the user must specifically grant permission to the application to access the user's UID before using the application. Accordingly, any suggestion that the act of passing a UID to a third-party application is a "breach" of that user's privacy is false. Second, the primary issue highlighted by the Wall Street Journal article ­ which is the inadvertent sharing of UIDs, not by Facebook itself, but rather by applications ­ is a by-product of how Internet browsers work. When a Facebook user visits an application that was created using a certain type of technology (known as an "i-frame"1), the URL embedded in the i-frame for that application includes, among other information, the user's UID, as described and disclosed above. If that application, in turn, relies on a third party to supply content or services for the application, it will instruct the user's browser to ask that third-party for the information it needs to operate. In making that request, the user's browser will often include the "referrer URL" ­ i.e., the URL of the i-frame in which the application is running. Where that URL includes the UID, in turn, the party receiving that browser request may receive the UID as part of the string of information embedded in the URL. But that is not a Facebook-specific issue; on the contrary, it is simply because, in the course of its normal operation on the Internet, the browser includes the referrer URL in its request to the third party. Indeed, as many commenters observed in the wake of the article2 ­ and as the Wall Street Journal emphasized in a subsequent article3 ­ the issue is not Facebook-specific, but rather affects any number of sites and services that rely on third-parties to serve content or services. Nevertheless, we understand the reasons the inclusion of a UID in a referrer URL might make people who use Facebook uneasy, which is why we are in the process of making a technical change to address this issue, as described in more detail below. Third, a Facebook UID at most enables access only to information that a user has already chosen to share and make publicly available. No information that a user has restricted using Facebook's privacy controls is available solely with a Facebook UID, including to applications or any third parties providing services or content to applications. Furthermore, Facebook employs technical measures to prevent third parties from using UIDs to obtain even the publicly available information of significant numbers of users.

Most
applications
on
Facebook
Platform
do
not
use
i
frames
and
are
thus
not
affected
by
the
issue
discussed
in
the
Wall
Street
Journal's
article.

E.g.,
Fear
and
Loathing
at
the
Wall
Street
Journal,
http://techcrunch.com/2010/10/18/fear
and
loathing
at
the
wall
street
journal/;
Latest
Facebook
Privacy
Scare
Isn't
So
New,
http://voices.washingtonpost.com/fasterforward/2010/10/latest_facebook_privacy
news_s.html.

MySpace,
Apps
Leak
User
Data,
Wall
St.
J.,
Oct.
22,
2010
(in
a
follow
up
article,
explaining
that
"[t]he
Journal's
investigation
demonstrates
how
fundamental
Web
technologies
can
jeopardize
user
privacy.")
(emphasis
added).

3 2

1

2

Fourth, we recognize and accept our leadership position and have already announced plans for a mechanism that will prevent UIDs from being transmitted to applications via URL, and which in turn will prevent the inadvertent passing of UIDs via referrer URLs. We are actively developing this mechanism and plan shortly to deploy it. But we are not stopping there. As noted, the passing of information via referrer URLs is an industry issue. We are working to launch an industry-wide initiative to equip browsers with privacy controls that would prevent such inadvertent passing of information. This is a complex technical question that calls for a technical answer ­ principally, we believe, one that should be provided by browser manufacturers. In the coming months, we expect to work with such manufacturers to enable users to control the passage of information via referrer URLs. Fifth, although, as noted, a UID provides access only to information a user has chosen to share and make publicly available, and although we have seen no evidence to suggest that ad networks were or are using UIDs to obtain even this basic information, we see no reason for ad networks to store such UIDs. We therefore are mandating that all ad networks delete any Facebook UIDs they may have stored as a precondition to their continued ability to operate on Facebook Platform. Finally, in the course of investigating the inadvertent sharing of UIDs highlighted by the Wall Street Journal, we identified a handful of applications that were intentionally sharing UIDs with a third-party data broker. This is a direct violation of our terms, and one we take very seriously. We have taken (i) enforcement action against the applications in question, and (ii) steps to ensure the deletion of the Facebook user data that was improperly transferred. The thirdparty data broker in question has also agreed not to operate on Facebook Platform in the future. These steps are explained in the attached blog post, which we released earlier today. With this background in mind, we now address each of your questions in turn. 1. How many users were impacted by the series of privacy breaches discovered by the Wall Street Journal? As the above explanation should make clear, the sharing of UIDs with applications is not a privacy breach, but rather is necessary to enable Facebook users to enjoy various third party applications. Further, Facebook explains to users ­ both in our privacy policy and at the time a user authorizes an application ­ that the application receives their UID, and users must specifically grant permission to applications to access their UID before using an application. Beyond that, where a user's browser passes a referrer URL that includes a UID to a third-party that provides content or services to an application, the UID does not enable that third party to obtain any information beyond that which the user has shared and made publicly available, and we have technical measures in place to prevent third parties from using UIDs to obtain the publicly available information of a significant number of users.

3

2. What was the specific nature of the information transmitted from the third party application to other parties? The primary issue in question involves the transmission of a referrer URL of a third-party application from a user's browser to a third-party content or service provider for that application, with a user's UID embedded in the URL. 3. When did Facebook become aware of this series of privacy breaches? The Journal contacted Facebook regarding its article prior to the release of the online version on October 17, 2010. We first learned that an application developer might be intentionally transferring UIDs to a data broker on October 14, 2010. Upon confirmation of that fact on October 15, we immediately suspended the operation of that developer's applications and initiated the investigation that resulted in the enforcement action noted at the outset and explained in the attached blog post. 4. Did you notify your users of this series of breaches, including the specific nature of the information shared without their consent? If not, why not? We advise users ­ both in our Privacy Policy and in the disclosures we provide to users each and every time they authorize a new application ­ that applications they use will have access to their UID. We also advise users in our Privacy Policy to "review the policies of third party applications and websites to make sure you are comfortable with the ways in which they use information you share with them." Finally, we disclose to users that information that users share with "everyone" is available to everyone on the Internet. For example, in our Privacy Policy, we explain that information shared with "everyone" can "be accessed by everyone on the Internet (including people not logged into Facebook), be indexed by third party search engines, and be imported, exported, distributed, and redistributed by us and others without privacy limitations." 5. What terms contained in your privacy policy were violated by this series of privacy breaches? As explained above, the disclosure of a user's UID to an application is essential to the operation of the Facebook Platform, and we specifically inform users ­ both in the Privacy Policy and elsewhere ­ that applications they authorize will receive their UIDs. There has therefore been no breach of our Privacy Policy. In the few instances where applications intentionally transferred UIDs to a third-party data broker, those applications violated section 9.2.6 of our Statement of Rights and Responsibilities ("SRR"), which prohibits applications from transferring user data to, inter alia, data brokers.

4

6. How many third party applications were involved in this series of privacy breaches? For the reasons explained above, the sharing of UIDs with applications is disclosed both in our Privacy Policy and at the time a user authorizes an application; it is not a privacy breach. However, as noted above, in the course of our investigation, we identified fewer than a dozen developers that were intentionally sharing UIDs with a data broker, in violation of our terms. We have taken enforcement action against those developers, and we have taken steps to ensure that all Facebook user data passed to the data broker in question is deleted. 7. What procedures do you have in place to detect and/or prevent third party applications that may breach the terms of Facebook's privacy policy? Facebook requires applications to have their own privacy policies, and, in section 4 of our Privacy Policy, we encourage users to review applications' privacy policies to make sure the users are comfortable with the ways in which the applications use information shared with them. We also require applications to link to their own privacy policy when they ask users to authorize the application, so that the user can review the application's privacy policy before deciding whether to authorize the application. We do not as a matter of course investigate applications' compliance with their own privacy policies, but we do require in our terms that applications adhere to their policies, and we take enforcement action where we learn of violations. In addition, and as detailed below, Facebook employs a dedicated Platform Operations team and a suite of sophisticated tools to detect and prevent third party applications from violating Facebook's policies. 8. Have there been similar privacy breaches by third party applications in the past? If so, please describe the nature of those breaches. Please also describe any measures you may have put in place following the discovery of any such breaches to guard against future breaches and to better protect consumer privacy. The inadvertent passing of UIDs via the referrer URL of an i-frame application is not a breach of user privacy. Regarding the intentional transmission of UIDs to a data broker, this is the first instance in which we have learned of such activity, and, as noted, we have taken decisive enforcement action. 9. What guidelines does Facebook have in place for third party applications to protect its users from advertent or inadvertent privacy breaches? Facebook's SRR and its Platform Policies establish policies to which applications must adhere in order to operate on the Facebook Platform. These policies are constructed around a set of basic principles that govern the Platform, among which is the requirement to "Be Trustworthy." Consistent with that principle, Facebook requires, among other things, that application developers request only data they need to operate their application; create (and 5

adhere to) a privacy policy that informs users how the application uses user data; honor user requests to delete information; and refrain from selling user data and from transferring user data to ad networks, data brokers, and other specified entities. The full text of Facebook's SRR is available at http://www.facebook.com/terms.php, and the Platform Policies are available at http://developers.facebook.com/policy/. In addition, both documents are included with this letter. 10. Please identify the officials or offices within Facebook who are responsible for ensuring that third party applications satisfy Facebook's terms and conditions. What is Facebook's procedure for reviewing third party applications to ensure they satisfy Facebook's terms and conditions? Numerous organizations, involving potentially hundreds of people, participate in monitoring and enforcing compliance with Facebook's developer terms. Facebook's engineering team, for example, is responsible for building and maintaining the automated tools that ensure that applications are able to access only information that a user has authorized. Likewise, complaints relating to applications are handled through Facebook's dedicated Platform Operations team, which works with numerous organizations across the company ­ such as engineering, security, business development, public policy, and legal ­ as necessary depending on the issues in question. The Platform Operations team itself consists of 36 full-time employees, 23 of whom devote 100% of their time to monitoring and enforcing Facebook's policies with third-party applications. Since it was formed in 2007, this team has enforced Facebook's policies against hundreds of thousands of applications. Platform Operations employs a variety of steps and processes to monitor, test, or audit applications that are built on the Platform. Below we identify the general processes and tools utilized when performing these functions. Pre-Launch Documentation and Procedures Before a third-party developer creates and/or launches a Platform application, information about Platform and guidance is available on Facebook's developer web site, located at http://developers.facebook.com. The material on this site explains Facebook's policies, and instructs developers how to develop Facebook applications and access data in compliance with those policies. In order to launch an application on Facebook, developers must first register as Facebook users, which requires affirmative acceptance of Facebook's SRR. The SRR requirements that apply specifically to developers are set out in Section 9 of the SRR and include the requirements described above (among others). As noted, developers must also adhere to the policies set out in the Facebook Platform Policies. Facebook also uses automated tools to prevent the creation of (and to auto-delete) fake accounts, which help to ensure accountability among application developers. In addition, Facebook uses automated tools to screen each application for improper

6

content and to detect (and block) any applications associated with an extensive blacklist of malicious URLs. Ongoing Review of Applications The Platform Operations team subjects hundreds of applications each month to a detailed review. The company focuses its systematic review of individual applications on those responsible for the majority of user experiences on Platform. Depending on operational constraints, certain applications may be reviewed as often as every four to six weeks. When reviewing a specific application, Facebook relies on various tools described below, and in addition conducts a thorough review of the application's functionality and operation to assess compliance with Facebook's SRR and Platform Policies. This includes a thorough review of the application's operation and content. Investigations Based on Reports and Leads In addition to its systematic review of applications, Facebook relies on reports from users, complaints received via email, tips from Facebook employees, reports from other application developers, investigative leads uncovered by Facebook's security team, and other sources to identify potential areas of concern with specific applications. Facebook includes a "Report Application" link on the bottom of each application's page to make it easy for users or others to report concerns about a particular application. In addition, Facebook has created various automated tools that identify applications that are receiving a high volume of complaints. Platform Operations reviews applications that are reported or otherwise brought to its attention through these means in the same manner described above, and as appropriate given the nature of the complaints or concerns relating to the applications. Monitoring and Enforcement Tools In addition to manual review of specific applications, Facebook uses a series of automated reporting and enforcement tools that allow it to quickly identify and respond to potential violations of its policies. Platform Operations reviews applications flagged by these tools and, if policy violations are discovered, documents those violations and escalates the issue for resolution. Monitoring Tools. Facebook uses several automated tools to monitor a wide range of operational data and activity on Platform. Facebook personnel work in shifts to review the output from these tools and to investigate applications displaying abnormal or potentially abusive behaviors. Among other automated tools:

7

·

Facebook monitors enforcement activity through a dashboard system, which provides a real-time view of identified issues, outstanding enforcement actions, and activity by applications under review. Facebook also employs a platform enforcement tool which aggregates and displays several metrics concerning the activities of applications on Platform, including how many users they have, how many data requests they are sending, whether the application is generating any complaints or spam reports, what types of data it is requesting of users, etc. This tool also displays this data in various statistical formats, which allows identification and assessment of outlying behaviors. Facebook uses a data access tool that tracks real-time data pulls and rates and provides historical and trend information, giving Facebook a view into applications' patterns of access to user data.

·

·

Site Integrity Tools. Facebook's Site Integrity group maintains an array of tools that monitor and protect Facebook.com generally against malicious conduct. For example, Site Integrity identifies IP addresses that are the source of malicious behavior and blocks all access to Facebook from those IP addresses. Site Integrity also protects users by monitoring, and in certain instances taking action against, new, fast-growing applications that match characteristics indicative of improper behavior. While these tools are not application specific, they assist in the protection of the Platform user experience. Escalation and Enforcement Facebook addresses policy violations through measures that take into account the nature of the violation, the application's history and usage, additional violations, and other factors. Facebook's approach to enforcement is intended to establish a consistent approach to applications that fail to comply with Facebook's policies. As a general matter, the initial response for minor policy violations is to inform the developer and set a deadline for the application to be brought into compliance. For more serious violations, repeated violations, or where the compliance deadline has not been met, Facebook typically will place the application under one or more moratoriums. For example, an application that exhibits a serious policy violation may receive a moratorium on its use of Facebook's communication channels ­ i.e., the mechanisms that applications use to communicate with Facebook users. Because the use of communication channels is critical to the success of applications built on the Facebook Platform, the imposition of such moratoriums has a significant deterrent effect on policy violations. Applications that present the most serious issues are disabled entirely, as are applications that fail to establish compliance after notification and moratoriums. In a few cases, Facebook has banned developers from participating on Platform altogether. In addition, where appropriate, Facebook has taken legal action in response to Platform policy violations.

8

11. Please provide copies of any agreements between Facebook and its third party application developers. We have attached to this letter a copy of our SRR and Platform Policies. We have also included a copy of our Privacy Policy. We have separate stand-alone agreements with certain individual developers, but with respect to the transfer and use of user data, the terms in those agreements generally mirror our standard terms. 12. Does Facebook receive any remuneration, financial or otherwise, as a result of the sharing of information between third party applications and internet tracking or advertising companies? If so, please disclose the nature and amount of the remuneration paid to Facebook. Facebook does not receive any remuneration, financial or otherwise, as a result of any sharing of information between third-party applications and Internet tracking or advertising companies. On the contrary, Facebook expressly prohibits application developers from selling user data and from transferring user data to such companies. 13. For each application, please provide a copy of the terms and conditions or notice that was presented to the user before using the application. If multiple versions have been used, please provide all versions and note their dates of use. Please also identify any specific terms violated in this series of breaches. As noted above, Facebook's Privacy Policy informs users that, when they authorize an application, the application will have access to their UID (among other information). We have included a copy of our Privacy Policy with this letter. In addition, as also noted above, at the time of application authorization, Facebook provides users a disclosure making clear that the application will obtain access to user information it needs to work, and requiring the user to grant permission for the application to access that information before the application may do so. This disclosure has changed over time. Currently, each application presents a dialogue box containing the categories or items of data the application is requesting access to, as well as a hyperlink to the application's privacy policy (and, in many cases, its terms of service). An example of this disclosure is set out below:

9

Prior to the development and deployment of the current permissions model shown above, applications provided a more general disclosure (though one that also made clear to users that the application, if authorized, would receive user information). An example of that disclosure is shown below:

10

14. Will Facebook seek the deletion of its users' personal information from data bases of the internet or advertising companies who received it as a result of this series of privacy breaches? If yes, when? If not, why not? Yes, we are currently taking steps to ensure that all ad networks and data brokers that may have stored UIDs obtained from applications as a result of the issues discussed in this letter delete those UIDs. More generally, as part of our normal course of business, Facebook investigates allegations of third-party access to Facebook user information and takes aggressive action where it determines that third parties have obtained and are using Facebook user information in violation of Facebook's terms. 15. To what extent has Facebook determined that data relating to minors 17 years of age and under were breached? We do not believe that data relating to any user, including minors, was breached via the passing of referrer URLs. Moreover, a UID cannot be used to obtain information about a user's age or birthday or other information that would identify the user as a minor. Minors can and do use applications on Facebook, and, consistent with our Privacy Policy and other disclosures, their UIDs are shared with applications when they do. Facebook does, however, have in place certain measures that limit sharing of minors' information, even where that minor makes that information available to everyone. First, minors do not have a public search listing created for them that would enable their public profile information to be found on search engines. Second, content that minors share using the "everyone" setting is in fact shared with a more limited audience (friends, friends of friends, and verified networks) until the user turns 18. Accordingly, a UID would not enable access to such information until the user turns 18. 16. To what extent has Facebook determined that personal financial or medical data were breached? No private information was shared through the issues discussed in this letter. 17. Please describe any policy or procedure changes Facebook plans to adopt to ensure that users have better control over how their information is shared and with whom their information is shared when using third party applications. Facebook is always innovating to build tools that give users greater control over how their information is shared, including with third party applications. Earlier this year, we deployed an extended applications permissions model which gave users greater granularity in the approval process that is required before they can share their information with applications. Likewise, Facebook recently announced an audit feature that enables users to see which 11

applications they have previously approved to receive information about them, the specific types of information users have authorized Facebook to share with the application, and the most recent dates the application has requested this information. We also offer an immediate mechanism for users to remove the authorization if based on the audit trail they no longer wish to share information with the application. More recently, as discussed in the attached blog posts, we are developing a technical mechanism to prevent browsers from inadvertently passing UIDs to thirdparty content or service providers operating on Facebook Platform; we are launching an industry-wide effort to equip browsers with tools that will give users more control over what they share when they travel the Internet; we have reminded application developers of their obligation not to share Facebook user information in a way that is inconsistent with our terms or their own policies; and we have built a tool to help developers accomplish that goal while still delivering innovative and valuable social experiences for users. 18. Please describe any changes Facebook plans to adopt in the terms and conditions or notices presented to users before using third party applications. Facebook currently informs users ­ both in our Privacy Policy and at the time of application authorization by a user ­ that using an application involves sharing certain information with the application, including the user's UID, and users must specifically grant permission to an application to access that information before using an application. We also encourage users to review application's privacy policies to ensure they are comfortable with how the application uses the user's information, and we monitor applications to ensure that they display clear and functioning links to their privacy policies to users. At the same time, we are communicating with our application developer community in order to make unmistakably clear that transferring any user information to data brokers of any kind is not allowed, and that the intentional sharing of UIDs is likewise impermissible. I have attached a blog post we released today that communicates these and other related points to our developers. **** Thank you for your inquiry. If we can provide any additional information, please do not hesitate to contact us. Sincerely, /s/ Marne Levine Vice President, Global Public Policy

12

Attachments: FB DPP 10302010.pdf Facebook Platform Policies (Updated ­ 10/20/2010) FB-PP.pdf Facebook Privacy Policy FB-SRR.pdf Facebook Statement of Rights and Responsibilities FBdevblog-EncryptingUIDs 102110.pdf Facebook Developer Blog Post, "Encrypting Facebook UIDs" FBdevblog-UIDupdate 102910.pdf Facebook Developer Blog Post, "An Update on Facebook UIDs" TechCrunch-FearAndLoathing.pdf TechCrunch, "Fear And Loathing At The Wall Street Journal" WaPo-LatestFBPrivacy.pdf The Washington Post, Faster Forward, "Latest Facebook privacy scare isn't so new" WSJ-MySpaceAppsLeak.pdf The Wall Street Journal, "MySpace, Apps Leak User Data"

13

EXHIBIT B

EDELSON MCGUIRE, LLC FIRM RESUME
EDELSON MCGUIRE, LLC is a commercial litigation and legal consulting firm with attorneys in Illinois, New York, California, and Florida. The firm has five primary practice groups: plaintiffs' class action litigation (with a particular emphasis on technology cases), ediscovery and information technology, general commercial litigation, entertainment law, and legal and political consulting. Our attorneys have been recognized as leaders in these fields by state and federal legislatures, national and international media groups, the courts, and our peers. Our reputation for leadership in class action litigation has led state and federal courts to appoint us lead counsel in many high-profile class action suits, including the recent Thomas the Tank Engine lead paint class actions, the AT&T mobile content class actions, the home equity credit reduction cases, and privacy class actions involving T-Mobile and Microsoft. We have testified before the United States Senate on class action issues and have repeatedly been asked to work on federal and state legislation involving cellular telephony, and other issues. Our attorneys have appeared on dozens of national and international television and radio programs to discuss our cases and class action and consumer protection issues more generally. Our attorneys speak regularly at seminars on consumer protection and class action issues, lecture on class actions at law schools and are asked to serve as testifying experts in cases involving class action and consumer issues.

PLAINTIFFS' CLASS AND MASS ACTION PRACTICE GROUP
EDELSON MCGUIRE is a leader in plaintiffs' class and mass action litigation, with a particular emphasis on technology class actions, and has been called a "class action `super firm'" by a national organization. (Decalogue Society of Lawyers, Spring 2010.) As has been recognized by federal courts, our firm has an "extensive histor[y] of experience in complex class action litigation, and [is a] well-respected law firm[] in the plaintiffs' class action bar." In re Pet Food Prod. Liab. Litig., MDL Dkt. No. 1850, No. 07-2867 (NLH) (D.N.J. Nov. 18, 2008). A leading arbitrator concurred: "The proof of [the firm's] experience, reputation, and abilities is extraordinary. . . . Each [of their cases] elaborates on the experience and unique success [they] have had in achieving leading roles in the area of 'technology consumer protection class actions.'" (Arbitration award in mobile content class action settlement, August 6, 2009) In appointing Edelson McGuire interim co-lead in one of the most high profile cases in the country, a federal court pointed to our ability to be "vigorous advocates, constructive problem-solvers, and civil with their adversaries." -In Re JPMorgan Chase Home Equity Line of Credit Litig., No. 10 C 3647 (N.D. Ill., July 16, 2010). We have several sub-specialties within our plaintiffs' class and mass action practice group: Consumer Technology Class Actions: We have settled the only class actions to date alleging text message spam under the Telephone Consumer Protection Act, including a $10,000,000 settlement with Simon & Schuster and a $7,000,000 settlement with Timberland Co. We have prosecuted over 100 cases involving mobile content, settling numerous nationwide class actions, including against industry leader AT&T Mobility, and an injunctive settlement against Facebook, Inc., collectively worth over a hundred million dollars.

EDELSON MCGUIRE Firm Resume as of November 2010

Representative Settlements: Paluzzi v. Cellco Partnership, No. 07 CH 37213 (Cook County, Illinois): Lead counsel in class action settlement involving 27 related cases alleging unauthorized mobile content charges. Case settled for $36 million. McFerren v. AT&T Mobility, LLC, No. 08-CV-151322 (Fulton County Sup. Ct., GA): Lead counsel class action settlement involving 16 related cases against largest wireless service provider in the nation. "No cap" settlement provided virtually full refunds to a nationwide class of consumers who alleged that unauthorized charges for mobile content were placed on their cell phone bills. Satterfield v. Simon & Schuster, No. C 06 2893 CW (N.D. Cal.). Co-lead counsel in class action alleging that defendants violated federal law by sending unsolicited text messages to cellular telephones of consumers. Case settled for $10,000,000. Gray v. Mobile Messenger Americas, Inc., No. 08-CV-61089 (S.D. Fla.): Lead counsel in case alleging unauthorized charges were placed on cell phone bills. Case settled for $12,000,000. Parone v. m-Qube, Inc. No. 08 CH 15834 (Cook County, Illinois): Lead counsel in class action settlement involving over 2 dozen cases alleging unauthorized mobile content charges. Case settled for $12,254,000. VanDyke v. Media Breakaway, LLC, No. 08 CV 22131 (S.D. Fla.): Lead counsel in class action settlement alleging unauthorized mobile content charges. Case settled for $7,600,000. Weinstein, et al. v. Airit2me, Inc., Case No. 06 C 0484 (N.D. Ill): Co-lead counsel in class action alleging that defendants violated federal law by sending unsolicited text messages to cellular telephones of consumers. Case settled for $7,000,000. Gresham v. Cellco Partnership, No. BC 387729 (Los Angeles Sup. Ct.): Lead counsel in case alleging unauthorized charges were placed on cell phone bills. Settlement provided class members with full refunds. In Re: ATI Technologies HDCP Litigation, No. 06-cv-1303 JW (N.D. Cal.): Co-Lead Counsel in a class action alleging deceptive trade practices against a graphics card manufacturer resulting in an $11 million settlement. Duffy v. Nevis Mobile, LLC, No. 08 CH 21376 (Cir. Ct. Cook County, IL): Class counsel in certified class action against mobile content provider for unauthorized mobile content charges resulting in default judgment over $10,000,000.

EDELSON MCGUIRE Firm Resume as of November 2010

Shen v. Distributive Networks LLC. No. 06 C 4403 (N.D. Ill.): Co-lead counsel in a class action alleging that defendant violated federal law by sending unsolicited text messages to the cellular telephones of consumers nationwide. The settlement ­ the first of its kind in the country ­ provided each class member with up to $150 in cash. Zurakov v. Register.com, No. 01-600703 (New York County, NY): Colead counsel in a class action brought on behalf of an international class of over one million members against Register.com for its deceptive practices in registering Internet domain names. Settlement required Register.com to fully disclose its practices and provided the class with relief valued in excess of $17,000,000.

Products Liability Class Actions: We have been appointed lead counsel in state and federal products liability class settlements, including a $30,000,000 settlement resolving the "Thomas the Tank Engine" lead paint recall cases and a $32,000,000 settlement involving the largest pet food recall in the history of the United States and Canada. Representative Settlements: Barrett v. RC2 Corp., No. 07 CH 20924 (Cir. Ct. Cook County, IL): Colead counsel in lead paint recall case involving Thomas the Tank toy trains. Settlement is valued at over $30,000,000 and provides class with full cash refunds and reimbursement of certain costs related to blood testing. In re Pet Food Products Liability Litig., No. 07-2867 (D. N.J.): Part of mediation team in class action involving largest pet food recall in United States history. Settlement provided $24,000,000 common fund and $8,000,000 in charge backs.

Banking Class Actions: Edelson McGuire has been at the forefront of class action litigation arising in the aftermath of the federal bailouts of the banks. Its suits include claims that the certain banks unlawfully suspended home credit lines based on pre-textual reasons, and that certain banks have failed to honor loan modification programs. Representative Cases: In re JP Morgan Chase Bank Home Equity Line of Credit Litig., 10-cv3647 (N.D. Ill.): Court appointed interim co-lead counsel in nationwide putative class action alleging illegal suspensions of home credit lines. Levin v. Citibank, N.A., C-09-0350 MMC (N.D. Cal.): Court appointed interim co-lead counsel in nationwide putative class action alleging illegal suspensions of home credit lines.

EDELSON MCGUIRE Firm Resume as of November 2010

Testified or slated to testify at town halls and/or state hearings in Florida and California on banks' suspensions of home credit lines. Settled numerous consumer class actions alleging fraud or other unconscionable behavior by banks and other lenders.

General Consumer Protection Class Actions: We have successfully prosecuted countless class action suits against health clubs, dating agencies, phone companies, debt collectors, and other businesses on behalf of consumers. Representative Settlements: Pulcini v. Bally Total Fitness Corp., No. 05 CH 10649 (Cir. Ct. Cook County, Ill.): Co-lead counsel in four class action lawsuits brought against two health clubs and three debt collection companies. A global settlement provided the class with over $40,000,000 in benefits, including cash payments, debt relief, and free health club services. Kozubik v. Capital Fitness, Inc., 04 CH 627 (Cir. Ct. Cook County, Ill.): Co-lead counsel in state-wide suit against a leading health club chain, which settled in 2004, providing the over 150,000 class members with between $11,000,000 and $14,000,000 in benefits, consisting of cash refunds, full debt relief, and months of free health club memberships. Kim v. Riscuity, No. 06 C 01585 (N.D. Ill.): Co-lead counsel in suit against a debt collection company accused of attempting to collect on illegal contracts. The case settled in 2007, providing the class with full debt relief and return of all money collected. Jones v. TrueLogic Financial Corp., No. 05 C 5937 (N.D. Ill): Co-lead counsel in suit against two debt collectors accused of attempting to collect on illegal contracts. The case settled in 2007, providing the class with approximately $2,000,000 in debt relief. Fertelmeyster v. Match.com, No. 02 CH 11534 (Cir. Ct. Cook County, Ill.): Co-lead counsel in a state-wide class action suit brought under Illinois consumer protection statutes. The settlement provided the class with a collective award with a face value in excess of $3,000,000. Cioe v. Yahoo!, Inc., No. 02 CH 21458 (Cir. Ct. Cook County, Ill.): Colead counsel in a state-wide class action suit brought under state consumer protection statutes. The settlement provided the class with a collective award with a face value between $1,600,000 and $4,800,000.

Insurance Class Actions: We have prosecuted and settled multi-million dollar suits against J.C. Penney Life Insurance for allegedly illegally denying life insurance

EDELSON MCGUIRE Firm Resume as of November 2010

benefits under an unenforceable policy exclusion and against a Wisconsin insurance company for terminating the health insurance policies of groups of selfinsureds. Representative Settlements: Holloway v. J.C. Penney, No. 97 C 4555, (N.D. Ill.): One of the primary attorneys in a multi-state class action suit alleging that the defendant illegally denied life insurance benefits to the class. The case settled in or around December of 2000, resulting in a multi-million dollar cash award to the class. Ramlow v. Family Health Plan (Cir. Ct., Wis.): Co-lead counsel in a class action suit challenging defendant's termination of health insurance to groups of self-insureds. The plaintiff won a temporary injunction, which was sustained on appeal, prohibiting such termination and eventually settled the case ensuring that each class member would remain insured.

Privacy/Data loss Class Actions: We have litigated numerous class actions against Facebook, Sears, Storm 8, Google, T-Mobile, Microsoft and others involving the failure to protect customers' private information, some resulting from security breaches. Representative Settlements: In re Sidekick Litig., No. C 09-04854-JW (N.D. Cal.): Co-lead counsel in cloud computing data loss case against T-Mobile and Microsoft. Abrams v. Facebook, Inc., No. 07-05378 (N.D. Cal.): Lead counsel in injunctive settlement concerning the transmission of allegedly unauthorized mobile content. Desantis v. Sears, 08 CH 00448 (Cir. Ct. Cook County, Ill.): Lead counsel in injunctive settlement alleging national retailer allowed purchase information to be publicly available through the internet.

Mass/Class Tort Cases: Our attorneys were part of a team of lawyers representing a group of public housing residents in a suit based upon contamination-related injuries, a group of employees exposed to second-hand smoke on a riverboat casino, and a class of individuals suing a hospital and national association of blood banks for failure to warn of risks related to blood transfusions.

Representative Cases:

EDELSON MCGUIRE Firm Resume as of November 2010

Aaron v. Chicago Housing Authority, 99 L 11738, (Cir. Ct. Cook County, Ill.): Part of team representing a group of public housing residents bringing suit over contamination-related injuries. Case settled on a mass basis for over $10,000,000. Januszewski v. Horseshoe Hammond, No. 2:00-CV-352JM (N.D. Ind.): Part of team of attorneys in mass suit alleging that defendant riverboat casino caused injuries to its employees arising from exposure to secondhand smoke.

The firm's cases regularly receive attention from local, national, and international media. Our cases and attorneys have been reported in the Chicago Tribune, USA Today, the Wall Street Journal, the New York Times, the LA Times, by the Reuters and UPI news services, and BBC International. Our attorneys have appeared on numerous national television and radio programs, including ABC World News, CNN, Fox News, NPR, and CBS Radio, as well as television and radio programs outside of the United States. We have also been called upon to give congressional testimony and other assistance in hearings involving our cases.

GENERAL COMMERCIAL LITIGATION
Our attorneys have handled a wide range of general commercial litigation matters, from partnership and business-to-business disputes, to litigation involving corporate takeovers. We have handled cases involving tens of thousands of dollars to "bet the company" cases involving up to hundreds of millions of dollars. Our attorneys have collectively tried hundreds of cases, as well as scores of arbitrations and mediations. All of our attorneys have regularly practiced in state and federal trial and appellate courts.
E-DISCOVERY AND INFORMATION TECHNOLOGY

Led by nationally-recognized eDiscovery expert Steven Teppler, our firm has taken the lead on eDiscovery issues including data protection, information technology, document management and retrieval, loss or destruction of information, and authentication and admissibility issues uniquely inherent to computer generated information. This includes spoliation allegations arising from acts of unauthorized or illegal data manipulation or alteration.

ENTERTAINMENT LAW
Led by legendary attorney Barry Reiss, EDELSON MCGUIRE represents producers, actors, writers, financiers in negotiations, creative matters, and related transactional and litigation matters.

LEGAL AND POLITICAL CONSULTING
Legal and political consulting is an area of practice that sets EDELSON MCGUIRE apart from other law firms. The firm advises on governmental and consumer issues and has helped its clients formulate business and legislative strategies, revise contractual and advertising material,

EDELSON MCGUIRE Firm Resume as of November 2010

and implement consumer protection strategies more generally. Our clients range from small Internet start-ups, to bricks and mortar companies, to one of the most trafficked Internet marketers, content and commerce firms in the country.

OUR ATTORNEYS
JAY EDELSON is the founder and managing partner of Edelson McGuire. He has been recognized as a leader in class actions, technology law, corporate compliance issues and consumer advocacy by his peers, the media, state and federal legislators, academia and courts throughout the country. Jay has been appointed lead counsel in numerous state, federal, and international class actions, resulting in hundreds of millions of dollars for his clients. He is regularly asked to weigh in on federal and state legislation involving his cases. He testified to the U.S. Senate about the largest pet food recall in the country's history and is advising state and federal politicians on consumer issues relating to the recent federal bailouts, as well as technology issues, such as those involving mobile marketing. Jay also counsels companies on legal compliance and legislative issues in addition to handling all types of complex commercial litigation. Jay has litigated class actions that have established precedent concerning the ownership rights of domain name registrants, the applicability of consumer protection statutes to Internet businesses, and the interpretation of numerous other state and federal statutes. As lead counsel, he has also secured settlement in cases of first impression involving Facebook, Microsoft, AT&T and countless others, collectively worth hundreds of millions of dollars. In addition to technology based litigation, Jay has been involved in a number of high-profile "mass tort" class actions and product recall cases, including cases against Menu Foods for selling contaminated pet food, a $30 million class action settlement involving the Thomas the Tank toy train recall, and suits involving damages arising from second-hand smoke. Adding to the diversity of his practice, Edelson also advises major labor unions and Hollywood financiers and serves as a consultant on several film, television, and radio deals. In 2009, Jay was named one of the top 40 Illinois attorneys under 40 by the Chicago Daily Law Bulletin. In giving Jay that award, he was heralded for his history of bringing and winning landmark cases and for his "reputation for integrity" in the "rough and tumble class action arena." In the same award, he was called "one of the best in the country" when it "comes to legal strategy and execution." Also in 2009, Jay was included in the American Bar Association's "24 hours of Legal Rebels" program, where he was dubbed one of "the most creative minds in the legal profession" for his views of associate training and firm management. In 2010, he was presented with the Annual Humanitarian Award in recognition of his "personal integrity, professional achievements, and charitable contributions" by the Hope Presbyterian Church. Jay is frequently asked to participate in legal seminars and discussions regarding the cases he is prosecuting, including serving as panelist on national symposium on tort reform and, separately, serving as a panelist on litigating high-profile cases. He has also appeared on dozens of television and radio programs to discuss his cases. He has taught classes on class action law at

EDELSON MCGUIRE Firm Resume as of November 2010

Northwestern Law School and The John Marshall Law School, and has co-chaired a 2-day national symposium on class action issues. He is currently teaching a seminar on class action litigation at Chicago-Kent College of Law. Jay is a graduate of Brandeis University and the University of Michigan Law School. MYLES MCGUIRE is a partner at EDELSON MCGUIRE. His practice concentrates on consumer protection law, class actions, and legal and political consulting to technology companies. Prior to entering private practice, Myles spent several years operating an Internet advertising company, which was later sold, in addition to counseling high-tech companies on legal issues. Since turning to plaintiffs' advocacy, Myles has had principal control over many nationwide and multi-state class actions. Drawing on his technological background, his specific area of emphasis is on emerging technology class actions, including those involving electronic commerce, cellular telephony and wireless media, among others. He has served in leadership positions in groundbreaking settlements involving Facebook, Verizon, Sprint, and T-Mobile. Due to his diverse legal and business expertise, Myles has been asked by members of Congress to comment on proposed legislation in the mobile content industry and has worked with state regulatory bodies in related efforts. Myles graduated from Marquette University Law School in 2000 and is admitted to practice in Wisconsin and Illinois. He is a member of the National Association of Consumer Advocates and the Chicago Bar Association. MICHAEL J. MCMORROW is a partner at EDELSON MCGUIRE. His practice focuses on commercial litigation and class action law, and his recent experience includes representation of consumer classes in litigation under the federal Telephone Consumer Protection Act, the California Unfair Competition Law, several common law claims, and additionally, representation of corporate clients in the mobile telephone content industry in commercial and trade secret litigation. Mike is an experienced trial and appellate commercial litigator who has represented clients in court and at trial across a full spectrum of issues, including trade secret litigation, commercial contracts, airplane leasing, airport construction, automotive manufacturing, commercial and consumer lending, product liability, and has represented clients in heavily-regulated industries including insurance, defense contracting, health care and energy. Prior to joining the firm, Mike was Senior Counsel at Foley & Lardner LLP, practicing commercial and energy regulatory litigation. Mike graduated magna cum laude from the University of Illinois College of Law in 2000, where he was Associate Editor of the UNIVERSITY OF ILLINOIS LAW REVIEW, a Harno Scholarship recipient, and President of the Prisoners' Rights Research Project. Mike received his B.A. in Political Science from Yale University in 1994. Mike has been a member of the Trial Bar for the Northern District of Illinois since 2005 and the Chicago Bar Association Judicial Evaluation Committee since 2003. His pro bono representations have included asylum applicants and prisoners' rights issues.

EDELSON MCGUIRE Firm Resume as of November 2010

STEVEN W. TEPPLER is a partner at EDELSON MCGUIRE. Steven concentrates his practice on data protection and information technology law, including electronic discovery, loss or destruction of information, authentication and admissibility issues uniquely inherent to computer generated information, including spoliation issues arising from unauthorized or illegal data manipulation or alteration. He is the Co-Vice-Chair of the American Bar Association Information Security Committee as well as the Florida Bar's Professional Ethics Committee. Steven has authored over a dozen articles relating to information technology law and routinely presents his work at conferences. Steven's recent publications include: Spoliation in the Digital Universe, The SciTech Lawyer, Science and Technology Law Section of the American Bar Association, Fall 2007; Life After Sarbanes-Oxley ­ The Merger of Information Security and Accountability (co-author), 45 JURIMETRICS J. 379 (2005); Digital Signatures Are Not Enough (co-author), Information Systems Security Association, January 2006; State of Connecticut v. Swinton: A Discussion of the Basics of Digital Evidence Admissibility (co-author), Georgia Bar Newsletter Technology Law Section, Spring 2005; The Digital Signature Paradox (co-author), IETF Information Workshop (The West Point Workshop) June 2005; Observations on Electronic Service of Process in the South Carolina Court System, e-filing Report, June 2005. Steven is also a contributing author to an American Bar Association book with the working title "Foundations of Digital Evidence" (publication expected March 2009). Steven graduated from the Benjamin N. Cordozo School of Law in 1980 after earning his B.A., summa cum laude, from the City College of New York in 1977. Steven is admitted to the bars of New York, the District of Columbia and Florida. BARRY REISS is Of Counsel to EDELSON MCGUIRE. After a short stint as a labor attorney representing the Teamsters, Barry entered the music business as a junior partner in the firm representing such artists as Herman's Hermits, Led Zeppelin and Jimi Hendrix. After five years, Barry was lured out of private practice by the legendary Clive Davis to join him at CBS Records where he became Vice President of Talent Contracts. When Clive left CBS he asked Barry to join him to help form Arista Records where he served as Administrative Vice President from its inception for its first five years. When MCA Records decided to start an east coast record label ("Infinity Records") Barry moved from Arista to MCA as Executive Vice President of Infinity Records. When Infinity was merged into MCA Records, MCA asked him to stay on to help form its "ancillary" entertainment divisions. In that capacity Barry served as Vice President for Legal and Business Affairs from their inception of MCA Home Video, Universal Pay Television and MCA Video Disc. He also served as Vice President of Merchandising Corporation of America (the studio's merchandising arm) and of MCA's Trademark and Copyright division as well as continuing to service MCA Records' east coast operations. In 1986, Barry was additionally appointed East Coast General Counsel for MCA, Inc. responsible for all east coast legal matters for MCA Inc. including its corporate matters, feature film & television, book publishing, toy and Spencer Gifts divisions. In that capacity Barry helped guide MCA's acquisition of Grosset and Dunlap, Playboy Books and LJN Toys. In 1989, Barry left MCA to re-enter private practice representing such clients as U2, Valient Comics, The Allman Brothers Band and Universal Television. In January of 1995, Barry returned to the corporate world as Senior Vice President of Business

EDELSON MCGUIRE Firm Resume as of November 2010

and Consumer Affairs for The ColumbiaHouse Company responsible for Business, Consumer and Government Affairs which included negotiating the Company's major licensing agreements, as well as representing the company's interests in federal and state legislative matters, postal issues consumer relations activities and the Company's launching of its two internet sites. In March of 2000 Barry left ColumbiaHouse to return to the private practice of law. Barry has served as a member of the Motion Picture Association of America (MPAA) and Record Industry Association of America (RIAA) Labor Negotiation and Anti-Piracy Committees, the RIAA Copyright Law Revision Committee, as a member of the Board of Directors of the Association for Postal Commerce and on the Government Affairs and Privacy Committees of the Direct Marketing Association. He is currently an Executive Committee member of the Music For Youth Foundation, serves as a mentor for Volunteer Lawyers for the Arts and was recently featured on Sky Radio's "Americas Best Lawyers". Barry is a graduate of Columbia College and received a Bachelor of Law Degree, cum laude, from Columbia Law School. SEAN P. REIS is Of Counsel to EDELSON MCGUIRE. Sean is an experience trial attorney and business litigator. Sean has experience in a wide-range of litigation matters, including those involving trade secrets, real estate fraud, employment, and consumer issues. Sean has tried sixteen cases, including several multi-week jury trials. Prior to joining Edelson McGuire, Sean was trained at an international law firm and later founded his own practice. In 1993, Sean graduated from University of California at San Diego with a degree in quantative economics. Following that Sean graduated from Rutgers University School of Law, Newark where he was the business editor of the Rutgers Law Review and where he received a graduation award for appellate advocacy. EVAN M. MEYERS is Senior Counsel at EDELSON MCGUIRE. Evan is an experienced trial and appellate litigator and has handled a broad range of complex litigation matters, including contract disputes, securities and consumer fraud, employment discrimination, insurance coverage, antitrust, shareholder and tax disputes, business torts and other matters. Evan has managed all aspects of the litigation process, including evaluation and strategic analysis, drafting pleadings in state and federal trial and appellate courts, taking and defending depositions, arguing motions, and representing clients in mediations and settlement conferences. He has also successfully tried cases in state court. Prior to joining Edelson McGuire, Evan worked at Drinker Biddle & Reath LLP, where he was an associate in the firm's commercial litigation practice group and represented a wide range of clients in federal and st