Campbell et al v. Facebook Inc.

Filing 206

MOTION to Compel Production of Source Code filed by Matthew Campbell, Michael Hurley. Responses due by 8/9/2016. (Attachments: # 1 Proposed Order)(Sobol, Michael) (Filed on 8/2/2016)

1
2
3
4
5
6
7

Michael W. Sobol (State Bar No. 194857)
[e-mail]
David T. Rudolph (State Bar No. 233457)
[e-mail]
Melissa Gardner (State Bar No. 289096)
[e-mail]
LIEFF CABRASER HEIMANN & BERNSTEIN, LLP
275 Battery Street, 29th Floor
San Francisco, CA 94111-3339
Telephone: [phone]
Facsimile: 415.956.1008

12

Hank Bates (State Bar No. 167688)
[e-mail]
Allen Carney
[e-mail]
David Slade
[e-mail]
CARNEY BATES & PULLIAM, PLLC
2800 Cantrell Road, Suite 510
Little Rock, AR 72202
Telephone: [phone]
Facsimile: 501.312.8505

13

Attorneys for Plaintiffs and the Class

8
9
10
11

14

UNITED STATES DISTRICT COURT

15

NORTHERN DISTRICT OF CALIFORNIA

16
17
18
19

MATTHEW CAMPBELL and MICHAEL
HURLEY, on behalf of themselves and all
others similarly situated,

Case No. C 13-05996 PJH (SK)
PLAINTIFFS’ MOTION TO COMPEL
SOURCE CODE

Plaintiffs,

20

Date:
21

v.

22

FACEBOOK, INC.,

23

Time:
Judge:
Place:

Telephonic Hearing to be set
by Court
To be Set by Court
Hon. Phyllis J. Hamilton
Courtroom 3, 3rd Floor

Defendant.

24
25
26
27
28
PLAINTIFFS’ MOTION TO COMPEL SOURCE CODE
CASE NO. 13-CV-05996-PJH (SK)

1

NOTICE OF MOTION AND MOTION

2

TO ALL PARTIES AND THEIR COUNSEL OF RECORD:

3

PLEASE TAKE NOTICE that pursuant to this Court’s Order dated June 30, 2016 (Dkt.

4

203), the undersigned Plaintiffs will and hereby do move the Court for an order compelling

5

Defendant Facebook, Inc. to produce relevant source code for the entire class period in this litigation.

6

This motion is based upon this Notice of Motion; the accompanying Memorandum of Points and

7

Authorities; the Declaration of David T. Rudolph filed herewith; the argument of counsel, if

8

requested; and such other matters as the Court may consider.

9
10

STATEMENT OF ISSUES TO BE DECIDED
Whether, consistent with the requirements of Federal Rule of Civil Procedure 26(b),

11

Defendant Facebook, Inc. should be compelled to produce relevant source code for the entire

12

class period in this litigation, by supplementing its current source code production, which ended

13

in December 2012, through the full class period, ending May 18, 2016.

14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
-i-

PLAINTIFFS’ MOTION TO COMPEL SOURCE CODE
CASE NO. 13-CV-05996-PJH (SK)

1

I.

INTRODUCTION
This motion is one of three contemporaneously-filed motions addressing three discovery

2
3

disputes to be resolved by this Court pursuant to the June 30, 2016 Order. Dkt. 203. Through all

4

three motions, Plaintiffs seek discovery squarely within the scope of this Court’s Class

5

Certification Order (Dkt. 192) and the Second Amended Complaint (“SAC,” Dkt. 196).

6

Specifically, the discovery sought relates to Facebook’s continued interception of Private

7

Message URL content for the following purposes, identified by the Court in the Class

8

Certification Order and alleged in the SAC: (1) generation, redirection and use of EntShares and

9

EntGlobalShares and related derivative data; (2) generation of recommendations; and (3) making

10

Private Message content available to third parties.1 Plaintiffs require the discovery sought

11

through these motions for two purposes: first, to investigate Facebook’s ongoing conduct with

12

respect to the three challenged practices during the full class period; and second, to evaluate

13

Facebook’s representations that certain challenged practices have ceased. Plaintiffs seek nothing

14

more than the properly proportional discovery required for these purposes pursuant to Fed. R.

15

Civ. P. 26(b), and have narrowly tailored their requests accordingly.
Facebook has repeatedly asserted that certain, but not all, of the practices identified in the

16
17

Class Certification Order and the SAC have ceased. Facebook does not deny that it continues to

18

create EntShare and EntGlobalShare objects or that it continues to log URLs in Private Message

19

content for subsequent use, but has provided virtually no discovery at all into its ongoing uses of

20

the data it derives from these ongoing interceptions. As this court determined in the Class

21

Certification Order, Facebook’s creation and use of EntShare and EntGlobalShare objects and

22

logging of private message content is at the core of Plaintiffs’ allegations.2 Plaintiffs require

23

source code, configuration tables, and technical documentation for the full class period to

24

determine the technical aspects of Facebook’s ongoing interception and redirection of Private

25

Message URL content up through the date of class certification.

26

1

27
28

Dkt. 192 (Class Certification Order), at 3-6.
See Dkt. 192, at 4 (discussing the role of EntShares and EntGlobalShares in Plaintiffs’
allegations); see also SAC, ¶¶ 44-55 (alleging Facebook’s creation and used of EntShares and
EntGlobalShares to stockpile and use intercepted Private Message content).
2

-1-

PLAINTIFFS’ MOTION TO COMPEL SOURCE CODE
CASE NO. 13-CV-05996-PJH (SK))

1

Facebook’s assertions that certain practices challenged in the SAC have ceased provide no

2

basis to deny the core proportional discovery Plaintiffs seek. First, Facebook has admitted it

3

continues to intercept and log Private Message content, but has consistently refused to provide

4

virtually any document discovery (and no source code discovery at all) related to these

5

interceptions past December 2013. There can be no good-faith objection to providing discovery

6

into Facebook’s technical implementation of these ongoing interceptions and its subsequent use

7

and redirection of users’ private data gleaned from these interceptions. Second, evidence that has

8

come to light after Plaintiffs filed their Second Amended Complaint regarding the practices

9

alleged in the SAC demonstrates that Facebook continues to make Private Message content

10

available to third parties in ways that have not been disclosed to—let alone consented to by—

11

users. Plaintiffs require the requested discovery to understand the scope and functioning of this

12

manifestation of Facebook’s ongoing interception and redirection of Private Message content.

13

Third, as Facebook’s own recent filings and admissions demonstrate, the Court cannot take at

14

face value Facebook’s representations regarding when certain practices may or may not have

15

“ceased,” as those representations have subsequently proven to be false by Facebook’s own

16

technical discovery. The documentary evidence underlying the claims here must be produced to

17

evaluate the veracity of Facebook’s representations, and that is the evidence Plaintiffs seek

18

through these motions.

19

As discussed in prior pleadings, Facebook has engaged in a non-stop, concerted effort to

20

stonewall discovery at every turn, including an outright refusal to engage in the court-ordered

21

joint discovery briefing process.3 As described in in the accompanying motions, much of the

22

discovery Plaintiffs currently seek is discovery Facebook should have already produced months

23

ago in response to Plaintiffs’ initial discovery requests. Through these motions, Plaintiffs seek to

24

rectify Facebook’s prior discovery gamesmanship, and also seek properly constrained and

25

proportional discovery for the class period, as expanded in the Court’s order, to investigate the

26

extent of Facebook’s ongoing conduct as alleged in the SAC.

27

3

28

See, e.g, Dkt. 186; 187 (describing Facebook’s refusal to engage in the court-ordered joint-letter
process and refusal to produce configuration tables that it subsequently relied on in opposition to
class certification).
-2-

PLAINTIFFS’ MOTION TO COMPEL SOURCE CODE
CASE NO. 13-CV-05996-PJH (SK))

1

II.

2

ARGUMENT
Plaintiffs respectfully request that the Court compel Facebook to produce relevant source

3

code for the entire class period. Because Facebook—after initially refusing to do so—already has

4

produced the relevant source code for the September 2009 to December 2012 timeframe,

5

Plaintiffs simply request that the Court order Facebook to update its current source code

6

production to cover the remainder of the class period, i.e., January 2013 to May 18, 2016. This

7

update is critical to Plaintiffs’ obligation to protect the interests of the entire Class, to prove

8

Facebook’s liability, and to fashion the appropriate prospective, injunctive relief.

9

A.

10
11

Plaintiffs’ Source Code Request is Confined to the Scope of the Issues as
Defined in this Court’s Orders and the Second Amended Complaint.

Plaintiffs seek nothing more than an update of the source code Facebook already agreed to

12

produce, and has admitted is relevant to Plaintiffs’ claims.4 The Court has determined that

13

Plaintiffs allege the following three practices by Facebook: (1) “Facebook scans the users’

14

messages, and when a URL was included, it would increase the “Like” counter for that URL;”

15

(2) “Facebook scans users’ messages, and when a URL is included, it uses that data to generate

16

recommendations,” and (3) “Facebook scans the messages, and when a URL is included, it shares

17

that data with third parties so that they can generate targeted recommendations.” Dkt. 192, at 3-4.

18

The Court held that practices (1) and (2) had been alleged in the Complaint, but that (3) had not,

19

and ordered Plaintiffs to amend the Complaint accordingly, which Plaintiffs did (Dkt. 196).

20

As articulated both in the Class Certification Order and the SAC, Plaintiffs’ review of

21

Facebook’s source code for the September 2009 to December 2012 timeframe revealed that

22

Facebook implemented these practices using data structures called “EntShares” and

23

“EntGlobalShares.”5 By intercepting Private Messages while in transit, Facebook uses these data

24

4

25
26
27
28

Declaration of David T. Rudolph (“Rudolph Decl.”), Ex. 2 (June 24, 2015 email from defense
counsel) (“Per our discussions, and subject to the entry of an amended protective order, we are
amenable to making the relevant source code available during the period discussed in the Himel
declaration (September 2009 to December 2012).”). Unless otherwise specified, all Exhibits cited
herein are to the Rudolph Declaration.
5
See Dkt. 192, at 4 (discussing the role of EntShares and EntGlobalShares in Plaintiffs’
allegations); SAC at ¶¶ 44-55 (alleging Facebook’s creation and used of EntShares and
EntGlobalShares to stockpile and use intercepted Private Message content).
-3-

PLAINTIFFS’ MOTION TO COMPEL SOURCE CODE
CASE NO. 13-CV-05996-PJH (SK))

1

structures to redirect Message content for multiple uses unrelated to the transmission of the

2

message. It is undisputed that Facebook continues to create and exploit EntShares and

3

EntGlobalShares, and they remain available to be exploited through future uses in perpetuity.6

4

As this Court noted, the proper scope of Plaintiffs’ discovery is set by the Court’s rulings

5

in the Class Certification Order, and the allegations of the SAC. Accordingly, Plaintiffs are

6

entitled to discovery related to Facebook’s scanning of Private Messages for purposes of

7

acquiring Private Message URL content including, but not limited to the creation of, and relation

8

between, EntShares and EntGlobalshares. This discovery is related to the manner in which

9

Facebook catalogs and stores intercepted Private Message URL content, as well as to how

10

Facebook redirects and uses that content (and the data objects created therefrom).

11

The code that Facebook has already produced is commensurate with these areas of

12

inquiry, and Plaintiffs seek nothing more than to have that code updated to include code from the

13

entire class period. Specifically, Facebook agreed to, and appears to have produced for the 2009-

14

2012 timeframe, “all source code related to the private message function from creation through

15

end storage, including any scanning or acquisition of private message content and any data

16

structures that connect or associate users to messages or message content, and messages to

17

attachments or URLs.”7 Given that Facebook has already agreed that this is the relevant scope of

18

discovery, Plaintiffs seek nothing more than for Facebook to update the current code production

19

to extend through the end of the class period. Given the centrality of the source code to this case

20

and the limited scope of code that Plaintiffs request, production of this source code is proportional

21

to the needs of the case pursuant to Fed. R. Civ. P. 26(b)(1). The parties have already

22

implemented extensive source code protocols, and Facebook need only deposit updated code on

23

the existing review computer. Facebook has ample resources to do so, and Plaintiffs have no

24

other means of accessing this information, and thus the benefit of this discovery outweighs the

25

relative burden or expense, pursuant to Fed. R. Civ. P. 26(b)(2).

26

6

27
28

See, e.g., Dkt. 184-11 (Jan. 14, 2016 Himel Decl.), ¶¶ 10-19.
Specifically, Facebook agreed to produce “all source code articulated in, and related to, Request
For Production Nos. 4-11, 13-14, 16-17 & 19.” See Ex. 2. These Requests, and Defendant’s
responses, are attached as Exs. 3-4.
7

-4-

PLAINTIFFS’ MOTION TO COMPEL SOURCE CODE
CASE NO. 13-CV-05996-PJH (SK))

1

B.

2

The source code for the entire class period must be produced in order for Plaintiffs to

3

understand and analyze the full scope of Facebook’s interception and use of URLs in Private

4

Messages during the entire class period . Contrary to Facebook’s representations, these practices

5

have not ceased and instead appear to continue to the present day.

6

The Source Code for the Entire Class Period Must Be Produced.

1.

Facebook’s Ongoing Use of Private Message Content to Generate
EntShares and EntGlobalShares

7
As Plaintiffs allege in the SAC, Facebook continues to intercept Private Message content

8
9

via EntShares and EntGlobalShares.8 Consistent with these detailed allegations and the Court’s

10

Class Certification Order, Plaintiffs require the source code to understand Facebook’s ongoing

11

generation and use of EntShare and EntGlobalShare objects for the purposes of generating

12

recommendations, or for the purposes of providing third parties with information concerning

13

users’ Private Message content, during the entire class period.
Facebook does not deny that it continues to generate EntShares and EntGlobalShares.9

14
15

Nor does Facebook deny that discovery into these objects for the entire class period is

16

appropriate.10 Moreover, the Class is specified as users from whose Private Message content

17

Facebook has generated EntShares.11 There can be no legitimate dispute that the source code

18

related to the generation of EntShares from URLs intercepted in Private Messages (and their

19

connection to EntGlobalShares) must be produced for the entire class period. Further document

20

discovery regarding EntShares and EntGlobalShares, while also necessary, is not a substitute for

21
8

22
23
24
25
26
27
28

See SAC, ¶¶ 45-55.
Facebook has represented that Facebook no longer increments the “Like” counter corresponding
to a URL intercepted from a Private Message. However, Facebook does not deny that it
continues to intercept URLs and create, catalog and tally the EntShare objects that it used as the
basis for that incrementing; rather it only removed the public-facing proof of that interception,
cataloging and tallying once it was revealed in the press.
10
See Plaintiffs’ concurrently-filed Motion to Compel Production of Documents. Indeed, in its
proposals for document searches, Facebook agreed to search for documents containing those
terms for the entire class period.
11
Dkt. 192, at 10 (“All natural-person Facebook users located within the United States who have
sent, or received from a Facebook user, private messages that included URLs in their content (and
from which Facebook generated a URL attachment), from within two years before the filing of
this action up through the date of the certification of the class.”)
9

-5-

PLAINTIFFS’ MOTION TO COMPEL SOURCE CODE
CASE NO. 13-CV-05996-PJH (SK))

1

examination of Facebook’s source code. First, Facebook’s own chief witness, Engineering

2

Director Alex Himel, testified

3

.12 Second, even to the extent that Facebook has

4

agreed to produce documents related EntShares and EntGlobalShares, it has only agreed to do so

5

with excessive and inappropriate restrictions unlikely to capture the full scope of Facebook’s use

6

of these objects, a topic addressed in Plaintiffs’ concurrently-filed motion. Additionally,

7

Facebook’s offer, made during meet and confers, to “stipulate” as to Facebook’s current

8

functionality with respect to generating EntShares and EntGlobalShares, does not address

9

Facebook’s ongoing uses or redirection of them. Plaintiffs have repeatedly asked for, but have

10

not received, an explanation of how Facebook continues to use and redirect EntShares and

11

EntGlobalShares for purposes beyond Private Message delivery. That Facebook may be willing

12

to stipulate as to its ongoing generation of these objects during the remainder of the class period

13

in no way relieves it of its duty to produce discovery going to its ongoing uses and redirection.

14

2.

15
16

Facebook’s Ongoing Use of Private Message Content To Generate
Recommendations

The Court noted that Plaintiffs allege that “Facebook scans users’ messages, and when a

17

URL is included, it uses that data to generate recommendations.”13 As explained in the class

18

certification briefing, Plaintiffs determined, and Facebook admitted, that Facebook intercepts

19

URLs in Private Messages by logging them using various source code devices that redirect the

20

content for use in recommendations.14 As an example, Plaintiffs, through review of Facebook’s

21

code, determined that certain source code devices intercepted and deposited Private Message

22

content into a table referred to as

23

12

.”15 Plaintiffs’ expert also determined that identical

Ex. 5 (Himel Dep.), at 255:5-10

24
13

25
26
27
28

Dkt. 192, at 3.
Dkt. 199-1 (Mot. For Class Cert.), at 5 (arguing Facebook uses data logged from Private
Messages to fuel recommendations, including data from the
); Dkt. 184-11 (Jan.
14, 2016 Himel Decl.), ¶ 44 (admitting
informed “Recommendations Feed”);
Dkt. 184-17 (Golbeck Rebuttal Report), ¶¶ 28-37 (discussing
and
logging); Dkt. 184-21 (Feb. 26, 2016 Himel Decl.), ¶¶ 7-9 (same).
15
See Dkt. 199-2 (Golbeck Report), ¶ 44-54.
14

-6-

PLAINTIFFS’ MOTION TO COMPEL SOURCE CODE
CASE NO. 13-CV-05996-PJH (SK))

1

logging appears to be ongoing, as of the final date of Facebook’s source code production

2

(December 2012), through a logging function referred to as “

3

Facebook was at pains to argue (as it turns out, incorrectly) that the “

4

deleted prior to the class period, Facebook has never argued that the

5

functionality did not continue to log Private Message content and use it for purposes unrelated to

6

Message delivery. Plaintiffs owe a duty to the certified Class to determine the extent of

7

Facebook’s ongoing logging of Private Message content in order to effectuate full relief from

8

Facebook’s conduct for the Class by crafting appropriate injunctive relief.

9

”16 While
” was
”

Additionally, Facebook admits that its “Recommendations Feed plugin,” which Plaintiffs

10

identified as an example of one way in which Facebook used Private Message content to generate

11

targeted recommendations for users, used Private Message content well after December 2012.17

12

In fact, this system was only discontinued in June 2015, long after this lawsuit was filed.18

13

Plaintiffs are entitled to understand the details and scope of the Recommendations Feed plugin’s

14

use of Private Message content through an examination of its source code.

15

3.

16
17

Facebook’s Ongoing Sharing Private Message Content with Third
Parties

The Court further noted that Plaintiffs allege that “Facebook scans the messages, and

18

when a URL is included, it shares that data with third parties so that they can generate targeted

19

recommendations.”19 Contrary to Facebook’s representations, Facebook’s sharing of URLs in

20

Private Messages with third parties appears to be ongoing. Shortly after Plaintiffs amended their

21

complaint, a security researcher revealed one manifestation of this ongoing practice. As recently

22

disclosed in a blog post by the researcher (a self-described “[e]thical hacker & bug bounty

23

hunter”20), Facebook makes the specific URLs shared in Private Messages freely available to any

24

16

25
26
27
28

Dkt. 184-17 (Golbeck Rebuttal Report), ¶¶ 28-37. As its name implies,
“writes” pertinent Private Message attributes to logs, acting like a giant vacuum within
Facebook’s system, sucking up immense volumes of Private Message data for future use. See id.,
¶¶ 12, 34.
17
See Dkt. 184-13 (Fechete Decl.), ¶ 28.
18
Id., ¶ 10.
19
Dkt. 192 (Cert. Order), at 4.
20
See https://twitter.com/securinti (last visited August 1, 2016).
-7-

PLAINTIFFS’ MOTION TO COMPEL SOURCE CODE
CASE NO. 13-CV-05996-PJH (SK))

1

developer with access to the Facebook API.21 The researcher was able to access URLs sent in

2

Private Messages by implementing simple code that randomly generated ID numbers for

3

Facebook EntShare and/or EntGlobalShare objects, which then revealed specific URLs that users

4

had shared through Private Messages. The researcher was able to locate confidential user

5

information sent through Private Messages, “allowing a total stranger to gain personal

6

information about you.” 22 The researcher was so surprised by this practice that he believed it was

7

a bug, and reported it to Facebook.

8

Facebook ultimately admitted to this practice, only, on June 8, 2016—the day after

9

Plaintiffs filed the SAC—but contended that, rather than a bug, Facebook’s providing third-parties

10

with access to URL content in Private Messages is “intentional.”23 This revelation provides

11

further evidence supporting Plaintiffs’ allegations of Facebook’s ongoing practice of making

12

Private Message content available to third parties. 24 This precise type of conduct is one that

13

Plaintiffs seek to enjoin through their allegations and claims for relief in the SAC, and require up-

14

to-date source code to investigate. Facebook never disclosed this practice through discovery, and

15

analysis of Facebook’s up-to-date source code is necessary to understand how this functionality

16

operates, the scope of Facebook’s ongoing sharing of users’ Private Message content with third

17

parties, and the appropriate injunctive relief associated with this practice.

18

C.

19
20
21

Facebook’s Selective Document Production and Self-Serving, Occasionally
False Witness Testimony Cannot Substitute for Source Code Analysis.

Facebook initially asserted in this case that document production and employee testimony
were a sufficient substitute for source code production. However, Facebook’s own key witness

22
21

23
24
25
26
27
28

See Ex. 6 (Why you shouldn’t share links on Facebook, Quartz (June 29, 2016)).
Id. As the researcher explained: “In this small set of extracted URL’s, I’ve already found some
interesting info: Names: . . . Location or language . . . Attachments or pictures from the
[Facebook content delivery network] . . . Application or game data . . Secret links or hidden
keys: such as the editable Google Drive links or links to hidden pages, websites and beta
environments . . . and these aren’t mutually exclusive, some URLs includes multiple parameters
types listed above in one single link thereby allowing a total stranger to gain personal information
about you. Hello NSA?”
23
Id.
24
See, e.g., SAC ¶¶ 45-49 (describing Facebook’s practice of making Private Message content
available to third-party developers through its APIs).
22

-8-

PLAINTIFFS’ MOTION TO COMPEL SOURCE CODE
CASE NO. 13-CV-05996-PJH (SK))

1

confirmed that the functionality at issue could only be understood through examination of the

2

source code.25 Facebook’s suggestion that document production related to the functioning of

3

EntShares and EntGlobalShares relieves it of the duty to produce further source code contradicts

4

its own employees’ sworn testimony
.26 Thus, consistent with Rule 26(b)(2), the requested source

5
6

code is appropriate; it is neither cumulative nor duplicative, nor can this information be obtained

7

from some other source.

8

Indeed, Facebook has previously resisted any further document production on the grounds

9

that its source code is the fundamental evidence Plaintiffs require to prove their claims, obviating

10

other forms of discovery. As the Court noted, Facebook’s primary objection to producing further

11

technical documentation in response to earlier motions to compel was that “‘Facebook has in fact

12

already produced the information that is relevant to Plaintiffs’ claims’ in the form of the source

13

code, which demonstrates how Facebook scans users’ messages . . . [it is Facebook’s] position

14

that it has already produced the source code and therefore does not need to produce anything

15

more” (Dkt. 130 at 5, 15). In fact, virtually every Facebook witness has heavily relied on

16

Facebook’s source code to answer fundamental merits questions demonstrating, despite all

17

posturing by Facebook, that source code analysis for the entire class period is necessary to

18

understand the interception and use of Private Message content for the full class period.
Finally, as Facebook’s own recent filings demonstrate,27 the self-serving testimony of

19
20

Facebook’s employees (and related representations by counsel) as to which practices may have

21

ceased cannot be taken at face value. After claiming in sworn declarations, deposition testimony,

22

and representations to the Court that the “

23

logged for use in generating recommendations was deleted prior to the class period,28 in the midst

24

25

25

” table in which Private Message content was

Dkt. 184-1 (June 1, 2015 Himel Decl.), passim (citing to specific lines of code to explain the
functionality at issue).
26
Ex. 5 (Himel Dep.), at 255:5-10

26
27
28

27

Dkt. 185 (Errata); see also Dkt. 187 (Plaintiffs’ Objections thereto).
See, e.g., Dkt. 183-12 (Goldberg Report), ¶¶ 9, 44, 56; Dkt. 178-4 (Defs.’ Objection to Evid.),
at 2:21-23; Dkt. 177 (Mar. 16, 2016 Hrg. Tr.), at 87:16-20; Dkt. 184-11 (Jan. 14, 2016 Himel
Footnote continued on next page
28

-9-

PLAINTIFFS’ MOTION TO COMPEL SOURCE CODE
CASE NO. 13-CV-05996-PJH (SK))

1

of a dispute regarding the production of Facebook’s configuration tables, Facebook admitted that,

2

based upon “re-review” of the data Plaintiffs sought, that table had not been deleted prior to the

3

class period. Contrary to Facebook’s subsequent attempts to minimize its reliance on this claim,29

4

it figured heavily in Facebook’s class certification arguments.30 Plaintiffs, and the trier of fact,

5

are entitled to test Facebook’s assertions through examination of Facebook’s source code.

6

III.

7

CONCLUSION
Facebook’s source code has taken center stage in this case and it is inconceivable that the

8

claims and defenses can be litigated, or that injunctive relief can be tailored, without detailed

9

evidence of the code’s functioning for the full class period; thus its production is both

10

proportional and necessary in this case. Both experts relied heavily on Facebook’s source code in

11

rendering their opinions on the issues presented at class certification.31 Facebook’s employees

12

repeatedly stated under oath that the best (or only) way to understand Facebook’s systems is to

13

examine the source code.32 The Court,33 the experts, and Facebook’s witnesses have made clear

14

that examining Facebook’s source code is necessary to understand the claims and defenses at

15

issue. Plaintiffs respectfully request that the Court compel Facebook to produce all relevant code

16

from January 2013 to May 18, 2016.

17
18
19
20
21
22
23
24
25
26
27
28

Footnote continued from previous page
Decl.), ¶¶ 44-50; Dkt. 184-21 (Feb. 26, 2016 Himel Decl.), ¶¶ 7-9; Ex. 5 (Himel Dep.), at 203:1018, 204:16-17.
29
See, e.g., Dkt. 191.
30
See Dkt. 177, at 87:16-20 (“And they spent a lot of time on the share stats table. That was
deleted in 2011 before the class period. So I don’t even know why we’re talking about it. It was
deleted before. It had nothing to do with this case. It was deleted beforehand.”).
31
Dr. Golbeck analyzed Facebook’s source code and identified three distinct types of code-based
devices the intercept Private Message content: devices that “process[s]the attachment to create
share objects,” that “Lo[g] data about the private message share for later use,” and that
“Incremen[t] counters that track private message activities.” Dkt. 199-2 (Golbeck Report), ¶ 55;
Dkt. 183-12 (Goldberg Report), ¶¶ 33-42 (detailed analysis of code related to URL previews).
32
See, e.g., Ex. 5 (Himel Dep.), at 254:17-255:4; Ex. 7 (Himel Dep.), at 371:22-372:17; Ex. 9 (He
Dep.), at 74:11-15; 165:20-23; 227:18-228:7; 251:2-9; Ex. 9 (Vernal Dep.), at 128:8-18; Dkt.
140-1 (Oct. 6, 2015 Harrison Decl.), at 6 (“[T]he comprehensive record of Facebook functions
that used any given Object or Association type at any given time is Facebook’s source code.”).
33
See, e.g., Dkt. 43 (Order on Mot. to Dismiss), at 12:21-28 (“The fact that Facebook can
configure its code to scan message content for certain purposes, but not for others, leaves open
the possibility that the challenged practice constitutes a separate ‘interception.’ Simply put, the
application of the ‘ordinary course of business’ exception to this case depends upon the details of
Facebook’s software code . . .”) Id. (emphasis added).
- 10 -

PLAINTIFFS’ MOTION TO COMPEL SOURCE CODE
CASE NO. 13-CV-05996-PJH (SK))

1

Dated: August 2, 2016

By:

/s/ Michael W. Sobol
Michael W. Sobol

2
3
4
5
6
7

Michael W. Sobol (State Bar No. 194857)
[e-mail]
David T. Rudolph (State Bar No. 233457)
[e-mail]
Melissa Gardner (State Bar No. 289096)
[e-mail]
LIEFF CABRASER HEIMANN & BERNSTEIN, LLP
275 Battery Street, 29th Floor
San Francisco, CA 94111-3339
Telephone: [phone]
Facsimile: 415.956.1008

8
9
10
11
12

Rachel Geman
[e-mail]
Nicholas Diamand
[e-mail]
LIEFF CABRASER HEIMANN & BERNSTEIN, LLP
250 Hudson Street, 8th Floor
New York, NY 10013-1413
Telephone: [phone]
Facsimile: 212.355.9592

13
14
15
16
17
18

Hank Bates (State Bar No. 167688)
[e-mail]
Allen Carney
[e-mail]
David Slade
[e-mail]
CARNEY BATES & PULLIAM, PLLC
2800 Cantrell Road, Suite 510
Little Rock, AR 72202
Telephone: [phone]
Facsimile: 501.312.8505

19
Attorneys for Plaintiffs and the Class
20
21
22
23
24
25
26
27
28
- 11 -

PLAINTIFFS’ MOTION TO COMPEL SOURCE CODE
CASE NO. 13-CV-05996-PJH (SK))