Campbell et al v. Facebook Inc.

Filing 184

EXHIBITS re 181 Administrative Motion to Seal Documents Accompanying Class Certification Briefs and Evidentiary Objections filed by Facebook Inc.. (Attachments: # 1 Exhibit 53 (Redacted), # 2 Exhibit 54 (Unredacted), # 3 Exhibit 55 (Redacted), # 4 Exhibit 56 (Unredacted), # 5 Exhibit 57 (Redacted), # 6 Exhibit 58 (Unredacted), # 7 Exhibit 59 (Redacted), # 8 Exhibit 60 (Unredacted), # 9 Exhibit 61 (Redacted), # 10 Exhibit 62 (Unredacted), # 11 Exhibit 63 (Redacted), # 12 Exhibit 64 (Unredacted), # 13 Exhibit 65 (Redacted), # 14 Exhibit 66 (Unredacted), # 15 Exhibit 67 (Redacted), # 16 Exhibit 68 (Unredacted), # 17 Exhibit 69 (Redacted), # 18 Exhibit 70 (Unredacted), # 19 Exhibit 71 (Redacted), # 20 Exhibit 72 (Unredacted), # 21 Exhibit 73 (Redacted), # 22 Proof of Service)(Related document(s) 181 ) (Chorba, Christopher) (Filed on 3/28/2016) Modified on 3/29/2016 (kcS, COURT STAFF).

1
2
3
4
5
6
7

Michael W. Sobol (State Bar No. 194857)
[e-mail]
David T. Rudolph (State Bar No. 233457)
[e-mail]
Melissa Gardner (State Bar No. 289096)
[e-mail]
LIEFF CABRASER HEIMANN & BERNSTEIN, LLP
275 Battery Street, 29th Floor
San Francisco, CA 94111-3339
Telephone: [phone]
Facsimile: 415.956.1008

12

Hank Bates (State Bar No. 167688)
[e-mail]
Allen Carney
[e-mail]
David Slade
[e-mail]
CARNEY BATES & PULLIAM, PLLC
11311 Arcade Drive
Little Rock, AR 72212
Telephone: [phone]
Facsimile: 501.312.8505

13

Attorneys for Plaintiffs and the Proposed Class

8
9
10
11

14

UNITED STATES DISTRICT COURT

15

NORTHERN DISTRICT OF CALIFORNIA

16
17
18

MATTHEW CAMPBELL and MICHAEL
HURLEY, on behalf of themselves and all
others similarly situated,

19

Plaintiffs,

20

FACEBOOK, INC.,

REBUTTAL REPORT OF DR. JENNIFER
GOLBECK IN SUPPORT OF
PLAINTIFFS’ MOTION FOR CLASS
CERTIFICATION
_______________

v.

21

Case No. C 13-05996 PJH (MEJ)

22
23

Defendant.

HEARING
Date: March 16, 2016
Time: 9:00 a.m.
Place: Courtroom 3, 3rd Floor
|
The Honorable Phyllis J. Hamilton

24
25
26
27
28
REBUTTAL REPORT OF DR. GOLBECK IN SUPPORT
OF PLAINTIFFS’ MOTION FOR CLASS
CERTIFICATION C 13-05996 PJH (MEJ)

1

TABLE OF CONTENTS

2

Page

3
4
5
6

I.
II.
III.

7
8

IV.

9
10
11

V.
VI.

12

VII.

SCOPE OF ENGAGEMENT ................................................................................. 1
METHODOLOGY.................................................................................................. 1
ASCERTAINABILITY .......................................................................................... 2
A.
Class Members are Ascertainable from Facebook’s Records ..................... 2
FACEBOOK’S INTERCEPTION OF PRIVATE MESSAGE CONTENT........... 9
A.
EntShares Are not Necessary for Message Delivery .................................. 9
B.
Logging in
.............................................................................. 11
ALLEGED “VARIABILITY” .............................................................................. 13
WHETHER PRIVATE MESSAGE CONTENT WAS INTERCEPTED IN
TRANSIT OR IN STORAGE............................................................................... 15
FACEBOOK’S USE OF PRIVATE MESSAGE CONTENT IN THE
SOCIAL GRAPH AND TARGETED ADVERTISING ...................................... 15

13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
-i-

REBUTTAL REPORT OF DR. GOLBECK IN SUPPORT
OF PLAINTIFFS’ MOTION FOR CLASS
CERTIFICATION C 13-05996 PJH (MEJ)

1

I.

SCOPE OF ENGAGEMENT
1.

2

I have been asked by the Plaintiffs through their counsel to respond to the

3

conclusions expressed in the Expert Report of Dr. Benjamin Goldberg submitted with Defendant

4

Facebook Inc.’s Opposition to Plaintiffs’ Motion for Class Certification (“Goldberg Report”),

5

statements made by Facebook Engineering Manager Alex Himel in his declaration submitted in

6

support of Facebook’s Opposition, and characterizations of my testimony made by Facebook in

7

its Opposition to Plaintiffs’ Motion for Class Certification.

8

II.

9

METHODOLOGY
2.

My rebuttal opinions, as well as the evidence I rely upon to support them, are set

10

forth in detail in this rebuttal report. The contents of the various exhibits that I identify by name

11

are meant to be incorporated, in their entirety, by such reference.

12

3.

As with my opening report submitted in connection with Plaintiffs’ Motion for

13

Class Certification (“Golbeck Opening Report”), in preparing this report, I have employed

14

methods and analyses of a type reasonably relied upon by experts in my field in forming opinions

15

or inferences on the subject. The opinions expressed are based upon a reasonable degree of

16

computer science certainty.

17

4.

Between now and such time that I may be asked to testify before the Court, I

18

expect to continue my review, evaluation, and analysis of information generated during

19

discovery, as well as of relevant evidence presented before and/or at trial. I also expect to review

20

any further reports submitted by Facebook’s experts. I reserve the right to amend or supplement

21

this rebuttal report, as necessary and as acceptable to the Court. I also reserve the right to develop

22

materials and exhibits as appropriate for use in helping to demonstrate and explain my opinions in

23

the event that I am asked to testify at trial.

24

5.

In forming my opinions, I have reviewed source code which I understand was

25

provided by Facebook’s counsel and which was represented as containing the relevant source

26

code between some time in 2009 and December 2012.

27
28

6.

Additionally I have reviewed internal Facebook documents produced in this

litigation, the Goldberg Report, the transcript of the deposition of Dr. Goldberg, the declarations
-1-

REBUTTAL REPORT OF DR. GOLBECK IN SUPPORT
OF PLAINTIFFS’ MOTION FOR CLASS
CERTIFICATION C 13-05996 PJH (MEJ)

1

of various Facebook employees submitted in in support of Facebook’s Opposition to Plaintiffs’

2

Motion for Class Certification, the deposition transcripts of those employees, as well as certain

3

public materials. The list of documents I have considered in forming my opinions in this rebuttal

4

report is attached to this report as Appendix A.

5

III.

ASCERTAINABILITY

6

A.

Class Members are Ascertainable from Facebook’s Records

7

7.

Facebook has a database called Titan which stores information about Private

8

Messages. I understand that Facebook produced the Titan records for 19 of the Plaintiffs’ Private

9

Messages, and that these records are identified in the column marked “Titan Info” in Exhibit A to

10

Facebook’s Second Supplemental Responses and Objections to Plaintiffs’ Narrowed Second Set

11

of Interrogatories (the “Titan Records”).1 An example of a Titan Record is FB000005575.2 As

12

can be seen at the bottom of that page, the URL

13

“https://our.intern.facebook.com/intern/titan/message/?user=

14

d.1909393642 94311&dr=O” points to the "titan" system and includes information about the user

15

and message ID.

16

8.

&threadid&messageid=i

The contents of the page include many data fields accessible in Titan, including:

17

a.

message sender;

18

b.

message recipient;

19

c.

a timestamp that includes the date and time of the message; and

20

d.

information about attachments (including whether or not a URL attachment

21

and corresponding EntShare are associated with the message).

22

9.

The Titan database can be used to access information about Class members. The

23

Titan Records reveal that they are built on a query for a user ID and message ID. By starting with

24

a list of all message IDs, a database query could be written that would identify the senders and

25

recipients of Private Messages sent during the Class Period with URL attachments (and

26

corresponding EntShares) by doing the following:

27
28

1
2

Facebook Appendix (“App.”) at 1534-1555.
Ex. 7 to the Declaration of David Slade (“Slade Decl.”)
-2-

REBUTTAL REPORT OF DR. GOLBECK IN SUPPORT
OF PLAINTIFFS’ MOTION FOR CLASS
CERTIFICATION C 13-05996 PJH (MEJ)

1

a.

iterate through each message;

2

b.

check the timestamp to ensure it is within the Class period;

3

c.

check the attachment information that points to an EntShare ID to see if an

4

EntShare was, in fact, created from a URL attachment; and

5

d.

6
7

10.

Specifically, the query would involve identifying the following information related

to the Class Definition:

8
9

retrieve a sender and recipient ID.

a.

Private Messages within the Class Period based upon that date and time

denoted in the “timestamp” field (highlighted in yellow in Slade Decl. Ex. 7);

10

b.

Within that time period, Private Messages that contain a URL Attachment

11

based upon the “gigaboxxMessageID” field containing an “attachmentBlob” with an “fbid”

12

number that points to a specific EntShare that represents the URL Attachment included in the

13

message content (highlighted in red in Slade Decl. Ex. 7);

14

c.

Sender of each Class-qualifying message based upon the Facebook user

15

ID(s) in the “fbUserID” field associated with the “from:MessaginglnternetAddress” field

16

(highlighted in blue in Slade Decl. Ex. 7); and

17

d.

Recipient(s) of each Class-qualifying message based upon the Facebook

18

user ID(s) in the “fbUserID” field associated with the “toList” field (highlighted in green in Slade

19

Decl. Ex. 7).

20

11.

Focusing on the above-described fields also addresses an issue raised by Facebook

21

in its brief: the fact that 7 of the 19 messages identified by Plaintiffs do not have a corresponding

22

“share object” (EntShare).3 In discovery, I understand that Facebook was able to produce the

23

Titan Records for all 19 of Plaintiffs’ messages (meaning that Titan Records were successfully

24

created for each message), but could not identify EntShares for 7 of those Titan Records, marked

25

as FB000005577, FB000005800, FB000005882, FB000006007, FB000006088, FB000012006,

26
27
28

3

Opp. at 12:11.
-3-

REBUTTAL REPORT OF DR. GOLBECK IN SUPPORT
OF PLAINTIFFS’ MOTION FOR CLASS
CERTIFICATION C 13-05996 PJH (MEJ)

1

and FB000012557.4 Reviewing each of these Titan Records, it appears from the

2

gigaboxxMessageID field (described in subsection d of the preceding paragraph) that an EntShare

3

was never formed:

4

a.

FB0000055775 shows that the “gigaboxMesageID_DEPRECATED” value

5

is “<unset>,” and no corresponding “attachmentBlob” has been created. The absence of these

6

data demonstrate that no EntShare was created in the course of the transmission of this Private

7

Message, and the above-describe query I articulate would exclude such a message, accordingly.

8
9

b.

FB0000058006 presents a similar case in that, while an “attachmentBlob”

exists, the “gigaboxMesageID_DEPRECATED” value is “<unset>,” explaining why no EntShare

10

was created. Accordingly, my above-described query would exclude this Titan Record, as this

11

message would be between Facebook users who were outside of the proposed Class.

12

c.

FB000005882,7 like FB000005577, shows that the

13

“gigaboxMesageID_DEPRECATED” value is “<unset>,” and no corresponding

14

“attachmentBlob” has been created.

15

d.

FB000006007,8 like FB000005577, shows that the

16

“gigaboxMesageID_DEPRECATED” value is “<unset>,” and no corresponding

17

“attachmentBlob” has been created.

18

e.

FB000006088,9 like FB000005577, shows that the

19

“gigaboxMesageID_DEPRECATED” value is “<unset>,” and no corresponding

20

“attachmentBlob” has been created.

21

f.

FB000012006,10 like FB000005577, shows that the

22

“gigaboxMesageID_DEPRECATED” value is “<unset>,” and no corresponding

23

“attachmentBlob” has been created.

24
25
26
27
28

4

This understanding is based upon the table represented in Exhibit A To Defendant Facebook,
Inc.’s Second Supplemental Responses And Objections To Plaintiffs’ Narrowed Second Set Of
Interrogatories (App. 1534-1555).
5
Slade Decl. Ex. 14.
6
Slade Decl. Ex. 15.
7
Slade Decl. Ex. 16.
8
Slade Decl. Ex. 17.
9
Slade Decl. Ex. 18.
10
Slade Decl. Ex. 19.
-4-

REBUTTAL REPORT OF DR. GOLBECK IN SUPPORT
OF PLAINTIFFS’ MOTION FOR CLASS
CERTIFICATION C 13-05996 PJH (MEJ)

1

g.

FB00001255711 displays a “gigaboxMesageID_DEPRECATED” value of

2

“0,” and the value of the “attachmentBlob” is “<unset>.” Accordingly, my above-described

3

query would exclude this Titan Record, as this message would be between Facebook users who

4

were outside of the proposed Class.

5

12.

The above query identifies the relevant fields within Titan Records to determine if

6

an EntShare was created. As I describe in paragraphs 98-105 of my Opening Report, Entshares

7

can be queried to determine whether they were created from URLs sent in Private Messages, and

8

thus, combined with the query related to Titan described above which returns the IDs of

9

Entshares associated with specific Private Messages, Class members can be readily identified.

10

The above query addresses what I understand to be the relevant inquiry for identifying Class

11

members: that is, whether or not an EntShare was created from a Private Message sent with a

12

URL attachment. The presence or absence of data within these fields will be evaluated in my

13

query, and will separate Class members from non-Class members .

14

13.

If the names of specific fields or structure of the database that Facebook uses for

15

Titan-related data structures have subsequently changed, this query could be modified

16

accordingly to address any changes in Facebook’s record structure.

17

14.

It appears that Dr. Goldberg’s and Facebook’s criticism of my methods described

18

in my opening report and my deposition are based on an assumption that the Titan database does

19

not exist. Of course it does, it is Facebook’s database-of-record for its Private Message

20

service. Although I did not mention Titan by name in my Opening Report, I specifically

21

referenced using a database query to make these identifications, even offering an example query

22

(though it may need some tweaking after I have the opportunity to test it in practice).

23

15.

As I state in my Opening Report, the queries I offered were not intended to

24

retrieve a final list of Class members. As a preface to the sample code, I stated, “[a] database

25

query could be used to select the Facebook user IDs of everyone whose actions had created an

26

EntShare from a private message” (¶ 103). I never suggested that everyone who created an

27

EntShare was equivalent to the complete list of the Class members.

28

11

Slade Decl. Ex. 20.
-5-

REBUTTAL REPORT OF DR. GOLBECK IN SUPPORT
OF PLAINTIFFS’ MOTION FOR CLASS
CERTIFICATION C 13-05996 PJH (MEJ)

1

16.

Dr. Goldberg and Mr. Himel both argue my example code will be both under- and

2

over- inclusive of Class members, without acknowledging that the parameters necessary to

3

identify the Class are readily available.

4

17.

At ¶¶ 66-77 of his report Dr. Goldberg argues that the method that I propose would

5

“would return a list of people that is both under- and over-inclusive of the proposed class” (id. ¶

6

67). However, the examples that he provides are cases which either 1) take the user out of Class

7

definition or, 2) are due to system failures, the frequency of which is likely very low. I respond to

8

each of these cases below:

9

a.

¶ 68: “This query will be under-inclusive in that it will not reflect recipients

10

of messages with URL attachments.” Recipients are accessible and identifiable through the Titan

11

messaging system, as described in above.

12

b.

¶ 69: “This query will be under-inclusive in that it will not identify senders

13

and recipients whose messages with URL attachments were deleted.” I have not seen any

14

evidence or documentation supporting Dr. Goldberg’s underlying assumption that if one user (or

15

even all users) associated with a message as either sender or recipient deletes the message from

16

her inbox or outbox, Facebook conducts a corresponding deletion of the data from the Titan

17

database and the EntShare record.

18

c.

¶ 70: “This query will be under-inclusive in that it will not identify senders

19

and recipients whose accounts were deleted.” I have not seen any evidence or documentation

20

supporting Dr. Goldberg’s underlying assumption that if one user (or even all users) associated

21

with a message as either sender or recipient deletes her account, Facebook conducts a

22

corresponding deletion of the data from the Titan database and the EntShare record related to any

23

message in the deleted account.

24

d.

¶ 71: “This query will be under-inclusive in that it will not identify senders

25

whose messages were blocked for site integrity purposes.” If the message was blocked, it would

26

not be sent. The method I propose is not designed to query messages that were not successfully

27

sent or that do not contain URL attachments, because I accepted the assumption that those users

28

who did not successfully send or received Private Messages containing URL attachments would
-6-

REBUTTAL REPORT OF DR. GOLBECK IN SUPPORT
OF PLAINTIFFS’ MOTION FOR CLASS
CERTIFICATION C 13-05996 PJH (MEJ)

1

not be in the Class. Accordingly, a query excluding unsent/undelivered messages would not be

2

under-inclusive.

3

e.

¶ 72: “This query will be under-inclusive in that it will not identify senders

4

whose URL attachment did not result in the creation of an EntShare object for any reason.” This

5

is a system error which is not the intended functionality of the Facebook system. While Facebook

6

was unable to provide data about the frequency with which these errors occur, they are likely very

7

rare.

8
9

f.

¶ 73: “This query will be under-inclusive in that it will not identify senders

that deleted a URL attachment before it was sent.” If the user deleted a URL attachment before

10

sending the message, then the message, as sent and received, would not include a URL

11

Attachment. Accordingly, a query excluding such messages without URL Attachments would

12

not be under-inclusive.

13

g.

¶ 74: “This query will be over-inclusive in that it will include senders

14

whose messages did not contain URLs in their text.” This appears to be referencing a scenario

15

where a user includes a URL that precipitates the generation of a URL preview (URL

16

Attachment), but then deletes the original URL text, leaving on the URL attachment. As I

17

understand the Class definition, these messages would still qualify because the URL is still part of

18

the message in the form of the URL Attachment. Accordingly, a query capturing these messages

19

would not be over-inclusive.

20

h.

¶ 75: “This query will be over-inclusive in that it will include senders who

21

never typed a URL into a message, and instead merely chose to “Share” a URL through a

22

“Share” button on a third-party website.” As with the case described in ¶ 74, in this case URL is

23

still part of the message, in the attachment, even if the user never directly typed the URL into the

24

message composer but instead used the “Share” button. Accordingly, a query that captured these

25

messages would not be over-inclusive.

26

i.

¶ 76: “This query will be over-inclusive in that it will include senders and

27

recipients outside the United States.” Facebook knows if users are within the United States and

28

could check this for senders and recipients whose messages were intercepted. Facebook states on
-7-

REBUTTAL REPORT OF DR. GOLBECK IN SUPPORT
OF PLAINTIFFS’ MOTION FOR CLASS
CERTIFICATION C 13-05996 PJH (MEJ)

1

its website that this data is collected for advertising purposes.12 They also determine user location

2

with the code

3

to determine where the user is. Useful for suggesting locations, for example. First checks profile

4

settings current city, then falls back to address from contact info. If both of these are not

5

populated, we'll just see where they log in from." For the latter option, the code looks at the city

6

where the user logs in most often.

7

.13 This file begins with the comment "Attempt

j.

¶ 77: “This query will be over-inclusive in that it will include senders of

8

messages outside the Class Period.” As explained above, Titan has the date and time for each

9

message, so messages can be checked to determine if they are in the Class period.

10

18.

At ¶¶ 78-86 of his report, Dr. Goldberg argues that my proposed methods are

11

“overbroad in that [they] will identify senders that were not subject to the challenged ‘uses.’”

12

However, the Facebook code is written such that private message shares are treated consistently

13

in how they are used, and they would not need to be analyzed on a case-specific basis. Once a

14

URL is detected within a message and a URL attachment is created, when the message is sent

15

Facebook’s source code operates to intercept and redirect the user’s Private Message content for

16

the uses described in my opening report.

17

19.

At ¶ 78 of his report, Dr. Goldberg states: “Dr. Golbeck’s query is overbroad in

18

that it will identify senders that were not subject to the challenged ‘uses.’ In her deposition, Dr.

19

Golbeck conceded each of these flaws in her proposed query and said that identifying those that

20

were subject to the challenged ‘uses’ would be ‘case-specific.’” This is a misstatement of my

21

deposition testimony. I was asked specifically if my query for EntShares that contain private

22

URLs would uniquely identify URLs shown in the Insights Dashboard, not if it was possible to

23

identify senders subject to uses.14

24
25
26
27
28

12

See https://www.facebook.com/business/help/133609753380850 (“How does Facebook know
when people are in the locations I’m targeting? Facebook uses information from multiple
sources such as current city from profile, IP address, data from mobile devices if location services
are enabled, and aggregated information about the location of friends.”).
13
FB000027191.
14
App. 1337 (Golbeck Depo. 344:7-19).
-8-

REBUTTAL REPORT OF DR. GOLBECK IN SUPPORT
OF PLAINTIFFS’ MOTION FOR CLASS
CERTIFICATION C 13-05996 PJH (MEJ)

1

20.

At ¶ 79 of his report, Dr. Goldberg states: “This query cannot identify senders

2

subject to Nectar logging.” Nectar logging is a separate redirection from the EntShare creation.

3

While it is sampled so only a percentage of events are logged, all users are subject to the

4

interception even if they are not randomly selected for any given message.

5

21.

Similarly, the “uses” Dr. Goldberg identifies at ¶¶ 80-8615 of his report are all

6

instances where Facebook’s source code was designed to make users’ Private Message content

7

available either internally within Facebook for non-messaging related purposes or externally to

8

third parties. As stated above, the Facebook code is written to handle all shares in a consistent

9

way. Whether their data was displayed is irrelevant; it was made available to all these

10

applications, which constitutes a use.

11

IV.

12

FACEBOOK’S INTERCEPTION OF PRIVATE MESSAGE CONTENT
A.

13

EntShares Are not Necessary for Message Delivery
1.

14
22.

Entshares Stored In Databases Are Not “Objects” In Object-Oriented
Programming

Dr. Goldberg argues that creating objects in object-oriented programming

15
languages is common practice. This is true. However, objects are not side effects of object16
oriented programming. They are data structures that people create and that are explicitly
17
programmed to record information. Thus, if data is stored in an object, it is because a programmer
18
made an explicit decision to record that information. If a system intercepts content from
19
communications, it is not part of the ordinary course of business simply because the intercepted
20
content is stored in an object.
21
23.

Dr. Goldberg argues that EntShares are "objects" in object-oriented programming

22
languages. While there is an EntShare class which allows a programmer to create an EntShare
23
object within PHP code, the data stored in a database is not an object from an object-oriented
24
25
26
27
28

15

“[S]enders whose shares incremented the
table” (¶ 80); “senders whose share data
was utilized by Taste”(¶ 81); “senders whose share data was displayed in any Recommendations
plugin” (¶ 82); “senders whose share data was displayed in any Activity Feed” (¶ 83); “identify
senders whose share data was displayed in any API made available to third parties” (¶ 84);
“senders whose share data was displayed in Insights data made available to third parties” (¶ 85);
“people whose share data resulted in an increment in a social plugin count on a third-party
website” (¶ 86).
-9-

REBUTTAL REPORT OF DR. GOLBECK IN SUPPORT
OF PLAINTIFFS’ MOTION FOR CLASS
CERTIFICATION C 13-05996 PJH (MEJ)

1

perspective. Object-oriented programming objects are part of the code.16 Information stored in a

2

database is not part of the code. While the stored data may map to what is implemented in objects

3

in the code, it is not an object-oriented programming object itself.

4

2.

5
6

24.

Alternative methods of rendering previews

There are alternative methods for rendering a URL preview within Facebook’s

Private Message system that do not require the creation of EntShares to function.

7

a.

For example, rather than pointing to the EntShare object that then points to

8

the EntGlobalShare object, the message structure could point directly to the EntGlobalShare

9

object and achieve the same benefits of use of the EntGlobalShare object that Dr. Goldberg

10

opines on in paragraph 38 of his report.

11
12

b.

Additionally, the URL preview could be attached directly to the message in

a standard data format, like JSON.

13

c.

The fact that these alternative methods of rendering URL previews do not

14

require individualized, user-specific EntShares suggests that part of the purpose of the creation of

15

EntShares within Facebook’s system is not to render URL previews, but instead to redirect

16

content for other uses. For example, EntShares contain the Facebook ID of the user associated

17

with the creation of the URL attachment, but that information is not needed (and is not used) to

18

render the URL preview. In fact, based on my review of the code, the user ID recorded in the

19

EntShare record is not used for any purpose related to message delivery. However, the user ID

20

and the URL associated with the URL attachment were logged in the

21

table Alex Himel and Dan Fechete have admitted was used to deliver Recommended links.17

22

3.

23

25.

table, which

Code-Based Devices

Dr. Goldberg argues that he has never heard the term "code-based device" before

24

(¶ 8). However, code-based or software devices are quite common, and just because Dr. Goldberg

25

has not heard the term does not mean they cannot exist.

26
27
28

16

See, e.g. section “Dissection of an Object” in Hasin Hayder, Object-Oriented Programming
with PHP5(Packt Publishing Ltd, 2007) .
17
See App. 1522-23 (Himel Decl. ¶ 44); App. 1697-98, 1699-1700, 1702 (Fechete Decl. ¶¶ 1314, 18, 26).
- 10 -

REBUTTAL REPORT OF DR. GOLBECK IN SUPPORT
OF PLAINTIFFS’ MOTION FOR CLASS
CERTIFICATION C 13-05996 PJH (MEJ)

1

26.

For example, one domain where the public is hearing a lot about code-based

2

devices now is in the Volkswagen emissions controversy.18 Indeed, a Google News search for

3

“Volkswagen 'software device'” returned about 37,400 results.19 I understand that the

4

Environmental Protection Agency has stated that software can constitute a “device” as that term

5

is used in government regulations. 20

6
7

27.

The term "software device" has also appeared in US patents21 and publications

from NASA.22

8

B.

Logging in

9

28.

I understand that Mr. Himel claims that the

table was deleted.23 Based

10

on my analysis of the latest version Facebook’s code that was available for my review, Facebook

11

is still intercepting and logging URLs sent in Private Messages in a log called

12

“s

13
14

29.

understand to be current as of December 31, 2012.

15
16

30.

31.

18

22
23
24
25
26
27
28

In the code, we can see data about private URL shares being logged into
with indicators that it relates to the

19

21

Based upon my analysis of this code, information about URL shares in private

messages is being logged.

17

20

I analyzed the latest version of the source code produced by Facebook, which I

table.24 This begins with the

. That makes a series of additional calls. For brevity, I have
traced out the function names here with “->” indicating one function calls another:
18

See Slade Decl. Ex 12 (Goldberg Depo. Tr. at 171:10-177:22.)
Slade Decl. Ex 13.
20
See id.; see also “EPA, California Notify Volkswagen of Clean Air Act Violations / Carmaker
allegedly used software that circumvents emissions testing for certain air pollutants,” available at
http://yosemite.epa.gov/opa/admpress.nsf/a883dc3da7094f97852572a00065d7d8/dfc8e33b5ab16
2b985257ec40057813b!OpenDocument (“As described in the [Notice of Violation], a
sophisticated software algorithm on certain Volkswagen vehicles detects when the car is
undergoing official emissions testing, and turns full emissions controls on only during the test . . .
The software produced by Volkswagen is a “defeat device,” as defined by the Clean Air Act.”)
21
See, e.g. , U.S Patent No. 6,032,223.
22
See, e.g., V. Kreinovich, A. Bernat, E. Villa, Y. Mariscal, “Parallel computers estimate errors
caused by imprecise data,” Interval Computations, 1991, No. 2, pp. 31–46. (available at
http://ntrs.nasa.gov/search.jsp?R=19930068753).
23
See App. 1522-23 (Himel Decl. ¶ 44).
24
See, e.g., FB000014213; FB000027011; FB000027015; FB000027018.
19

- 11 -

REBUTTAL REPORT OF DR. GOLBECK IN SUPPORT
OF PLAINTIFFS’ MOTION FOR CLASS
CERTIFICATION C 13-05996 PJH (MEJ)

1
2
3
4

32.

This creates a data stream report, which is an object, that has data which is logged.

5

', is an instance created with the attribute

6

. Related to this is a '

7

instance that is also

created which, at the time it is used, has attributes:

8
9
10
11
12

33.

These show data about the private URL shares being logged in Facebook.

13

34.

Even if this information is not going to the table that was called

” it

14

would be highly unusual to log all this data and then not use it for anything. I have not yet been

15

able to discern how these logs are being used in the Facebook code (and in fact it appears the

16

relevant code might be missing from the code produced by Facebook), but as a computer

17

scientist, I would be surprised if Facebook is dedicating storage and resources to logging

18

information that is never used.

19

on the Facebook code computer and found no evidence of it.26 However, I performed

20
21

Dr. Goldberg stated in his deposition that he performed a “grep”25 search for

35.

the same “grep” search that he described, and found many results related to

22
23

My search used the command
occurrences.27

24

36.

25
26
27
28

, and I found many

I note that, in the context of Facebook’s logging of Private Message content in the
table, Dr. Goldberg states in his report that “logging events and storing activity data

are processes performed by nearly all software systems to track error rates, resource usage or
25

The “grep” command is used in UNIX systems to search the contents of files.
Slade Decl. Ex. 12 (Goldberg Depo. Tr. at 139:10-143:6).
27
FB000027190.
26

- 12 -

REBUTTAL REPORT OF DR. GOLBECK IN SUPPORT
OF PLAINTIFFS’ MOTION FOR CLASS
CERTIFICATION C 13-05996 PJH (MEJ)

1

congestion, and security concerns, among other things.”28 However, neither Dr. Goldberg, nor

2

Mr. Himel, nor any other Facebook employee, has provided any explanation of how the logging

3

in “

4

concerns.”

5

37.

6

data logged in the

7

described in my opening report.29

8

V.

9

was used “to track error rates, resource usage or congestion, [or] security

Indeed, the only use Dr. Goldberg or any Facebook employee has pointed to of the
table was to target “Recommendations” to Facebook users, as

ALLEGED “VARIABILITY”
38.

At paragraphs 60 and 63 of his report, Dr. Goldberg argues that alleged

10

“variability” in what he calls “interceptions” and “uses” of Private Message content would require

11

a “a message-by-message analysis” to determine “whether such alleged interceptions” or “uses”

12

occurred. Mr. Himel addresses these same “variabilities” in his declaration.30 However, most of

13

these “variabilities” simply track the same scenarios that Dr. Goldberg incorrectly argues makes

14

identification of Class members impossible. As I explain in Section III of the this rebuttal report,

15

these scenarios are all cases that are either outside of the Class definition or are the result of rare

16

system errors.

17

39.

I note that while Dr. Goldberg claims that such system errors would happen a

18

“substantial” portion of the time, he was unable or unwilling to provide any quantification of

19

what he meant by “substantial” (other than “substantial” meaning “not insubstantial”31).

20

Additionally, Dr. Goldberg had no data on how frequently what he terms “implementation issues”

21

such as race conditions, database failures, or database corruption actually occur within

22

Facebook’s systems.32

23
24
25
26
27
28

28

App. 1943 (Goldberg Report, ¶ 9).
See App. 1964 (Goldberg Report ¶ 44); App. 1697-98, 1699-70, 1702 (Fechete Decl. ¶¶ 13-14,
18, 26); Golbeck Opening Report ¶¶ 44-54.
30
See, generally App. 1508-33 (Himel Decl.)
31
Slade Decl. Ex. 12 (Goldberg Depo. Tr. at 80:21-23) (“I don't know how to quantify that for
you other than ‘substantial’ meaning not ‘insubstantial’”).
32
Slade Decl. Ex. 12 (Goldberg Depo. Tr. at 81:8-86:17).
29

- 13 -

REBUTTAL REPORT OF DR. GOLBECK IN SUPPORT
OF PLAINTIFFS’ MOTION FOR CLASS
CERTIFICATION C 13-05996 PJH (MEJ)

1

40.

Several of these additional variabilities do not overlap with the scenarios Dr.

2

Goldberg incorrectly argues makes identification of Class members impossible. I address each as

3

follows:

4

a.

If a user composes a private message on a computer where JavaScript is

5

not installed or has been disabled, then there is no capability of creating a URL preview within a

6

message that includes a URL. Under this scenario, there would be no URL attachment

7

associated with a Private Message and therefore the message would not be within the Class

8

definition.

9

b.

If a user types or inserts a URL in a private message but does not include a

10

space directly after the URL, then the functionality does not detect the presence of the URL and a

11

URL preview is not created. Under this scenario, there would be no URL attachment associated

12

with a Private Message and therefore the message would not be within the Class definition.

13

c.

As Mr. Himel points out, it is possible (but a very rare occurrence) that the

14

user sends a private message “too quickly” after including the URL for the functionality to create

15

the URL attachment prior to the message being sent. Under this scenario, there would be no URL

16

attachment associated with a private message and therefore the message would not be within the

17

Class definition.

18

d.

Mr. Himel also points out that Facebook’s mobile application does not

19

generate URL attachments when users include URL content in their private messages. Therefore,

20

private messages composed within the mobile application do not include URL attachments and

21

are not relevant to this action.

22

e.

In summary, these “variabilities” are relevant to a technical understanding

23

of the functionality related to the generation of URL attachments. Also, Dr. Goldberg and Mr.

24

Himel are correct that not all Private Messages, or even all Private Messages that include URLs,

25

are included within the Class. However, these “variabilities” do not cause any complexities

26

related to identifying Class members or resolving issues related to Class members because each

27

of these “variabilities” turn on one common variable that is straightforward to detect based on

28

Facebook’s EntShare and Titan data – whether the Private Message contains a URL attachment.
- 14 -

REBUTTAL REPORT OF DR. GOLBECK IN SUPPORT
OF PLAINTIFFS’ MOTION FOR CLASS
CERTIFICATION C 13-05996 PJH (MEJ)

1

VI.

2
3
4
5

41.

8
9

Goldberg argues that messages that are in memory are in “storage” and that he has never heard of
the two being distinguished in any context. However, the distinction is commonly made.
42.

12

As a few examples, Microsoft distinguishes the two on their Windows website34 as

does PC Magazine35 and numerous other websites.36 Page 370 of the textbook, “Discovering
Computers,” by Misty E. Vermaat, et al. distinguishes them.37 While Dr. Goldberg may be
unaware that these are treated differently, such a distinction does in fact exist.

10
11

Messages are in transit when they are intercepted. They are delivered when they

are placed into the HBase storage system, which is after all the interceptions occur.33 Dr.

6
7

WHETHER PRIVATE MESSAGE CONTENT WAS INTERCEPTED IN
TRANSIT OR IN STORAGE

43.

Indeed, if Dr. Goldberg's position were correct, it would be impossible for a

computer-based violation of wiretap law, since computers must have data in memory in order to
operate on it.

13
14

VII.

FACEBOOK’S USE OF PRIVATE MESSAGE CONTENT IN THE SOCIAL
GRAPH AND TARGETED ADVERTISING

15

44.

I note that Facebook states the following concerning my deposition testimony:

16

“ . . . Plaintiffs’ ‘technical’ expert (Dr. Golbeck), . . . conceded that she was not aware of any

17

evidence that URL attachments went into the Social Graph or were used for ‘targeted advertising’ (id.

18

1215-16).”38

19
20
21
22
23
24
25
26
27
28

33

See Golbeck Opening Report ¶¶ 30-31.
See “Memory and storage,” available at http://windows.microsoft.com/enus/windows7/memory-and-storage.
35
See “Definition of: storage vs. memory,”
http://www.pcmag.com/encyclopedia/term/63352/storage-vs-memory (“The difference between
storage and memory is that non-volatile storage is used to hold programs and data until purposely
changed or removed by the user, while volatile memory is a temporary workspace for retrieving
programs and processing data. Storage consists of drives (hard, optical, USB, solid state).
Memory consists of RAM chips that lose their content when power is removed.”)
36
See, e.g., “THE DIFFERENCE BETWEEN MEMORY AND STORAGE” available at
http://www.technick.net/public/code/cp_dpage.php?aiocp_dp=guide_umg_01_003 (“People often
confuse the terms memory and storage, especially when describing the amount they have of each.
The term memory refers to the amount of RAM installed in the computer, whereas the term
storage refers to the capacity of the computer’s hard disk.”); “What's the Difference Between
Memory and Storage?,” available at http://www.tucows.com/article/593.
37
Vermaat, M., Sebok, S., Freund, S., Campbell, J. and Frydenberg, M., “Discovering
Computers” Cengage Learning (2016).
38
Opp. at 25:2-4.
34

- 15 -

REBUTTAL REPORT OF DR. GOLBECK IN SUPPORT
OF PLAINTIFFS’ MOTION FOR CLASS
CERTIFICATION C 13-05996 PJH (MEJ)

1

45.

My testimony cited is taken grossly out of context in two ways. First, I never

2

stated that I was not aware of evidence of URL attachments being present in the social graph. My

3

exchange was asking for a clarification of the term "social graph" as a general concept or a

4

technical concept. It was never clarified.39 It is my opinion that the URL shares in Private

5

Messages are stored in the TAO database that is generally part of a social graph.

6

46.

Secondly, I opined that URL shares in Private Messages were used for targeted

7

advertising.40 Only after Facebook's attorney asked a follow-up question in which he re-defined

8

targeted advertising to mean advertising products for purchase did I respond the URL shares were

9

not used in that type of advertising.41 As I stated in my deposition, recommending pages is a type

10

of targeted advertising, is considered such in my technical community, and was practiced by

11

Facebook.42

12
13
14

Dated: February 19, 2016

15
16

__________________

17

Jennifer Golbeck

18
19
20
21
22
23
24
25
26
27
28

39

App. 1096–1101 (Golbeck Depo. Tr. at 103:13-108:16).
App. 1209-1210 (Golbeck Depo. Tr. at 216:7-217:5) (“Q. Do you have -- have you seen any
evidence that Facebook ever used URLs shared in private messages to develop user profiles for
the purpose of deliver -- delivering targeted advertising? . . . A. So, you know, I'd say we have,
for example, Facebook recommending URLs to people based on data gathered from private
message shares. I think that can be considered a form of targeted advertising, that Facebook is
advertising these URLs to users.”)
41
App. 1210-1216 (Golbeck Depo. Tr. at 217:6-223:6).
42
App. 1209-1212 (Golbeck Depo. Tr. at 216:7-219:3).
40

- 16 -

REBUTTAL REPORT OF DR. GOLBECK IN SUPPORT
OF PLAINTIFFS’ MOTION FOR CLASS
CERTIFICATION C 13-05996 PJH (MEJ)

Appendix A: List of Materials Relied On
I relied on the following documents and materials in forming my opinions:
Documents from Campbell et al. v. Facebook, Inc.:
Facebook’s Second Supplemental Responses and Objections to Plaintiffs’ Narrowed Second Set
of Interrogatories, and Exhibit A thereto
Expert Report of Dr. Benjamin Goldberg submitted with Defendant Facebook Inc.’s Opposition
to Plaintiff’s Motion for Class Certification
Declaration of Alex Himel in Support of Defendant Facebook, Inc.’s Opposition to Plaintiffs’
Motion for Class Certification
Declaration of Dan Fechete in Support of Defendant Facebook, Inc.’s Opposition to Plaintiffs’
Motion for Class Certification
Defendant Facebook, Inc.’s Opposition to Plaintiffs’ Motion for Class Certification
Deposition of Dr. Jennifer Golbeck (Dec. 16, 2015)
Deposition of Dr. Benjamin Goldberg (Feb. 2, 2016)
Report of Dr. Jennifer Golbeck in Support of Plaintiffs’ Motion for Class Certification
Plaintiffs’ Motion for Class Certification
FB000005575
FB000005577
FB000005800
FB000005882
FB000006007
FB000006088
FB000012006
FB000012557
FB000014213
FB000027011
FB000027015
FB000027018
FB000027190
FB000027191
Source Code Produced by Facebook

Other Materials:
https://www.facebook.com/business/help/133609753380850
Hasin Hayder, Object-Oriented Programming with PHP5 (Packt Publishing Ltd, 2007)
www.google.com (search for “Volkswagen ‘software device’”)
“EPA, California Notify Volkswagen of Clean Air Act Violations / Carmaker allegedly used
software that circumvents emissions testing for certain air pollutants,” available at
http://yosemite.epa.gov/opa/admpress.nsf/a883dc3da7094f97852572a00065d7d8/dfc8e33b5ab16
2b985257ec40057813b!OpenDocument
U.S Patent No. 6,032,223
V. Kreinovich, A. Bernat, E. Villa, Y. Mariscal, “Parallel computers estimate errors caused by
imprecise data,” Interval Computations, 1991, No. 2, pp. 31–46. (available at
http://ntrs.nasa.gov/search.jsp?R=19930068753)
http://windows.microsoft.com/en-us/windows7/memory-and-storage
http://www.pcmag.com/encyclopedia/term/63352/storage-vs-memory
http://www.technick.net/public/code/cp_dpage.php?aiocp_dp=guide_umg_01_003
http://www.tucows.com/article/593
Vermaat, M., Sebok, S., Freund, S., Campbell, J. and Frydenberg, M., “Discovering Computers”
Cengage Learning (2016).