Dunstan et al v. comScore, Inc.

Filing 176

DECLARATION of Robyn Bowland regarding memorandum in opposition to motion 175 (Attachments: # 1 Exhibit A, # 2 Exhibit B, # 3 Exhibit C, # 4 Exhibit D, # 5 Exhibit E, # 6 Exhibit F, # 7 Exhibit G, # 8 Exhibit H, # 9 Exhibit I, # 10 Errata J, # 11 Exhibit K, # 12 Exhibit L, # 13 Exhibit M, # 14 Exhibit N, # 15 Exhibit O, # 16 Exhibit P, # 17 Exhibit Q, # 18 Exhibit R, # 19 Exhibit S, # 20 Exhibit T, # 21 Exhibit U, # 22 Exhibit V, # 23 Exhibit W)(Bowland, Robyn)

EXHIBIT N

HARRIS & DUSTAN v. COMSCORE, INC.

September 13, 2012

MICHIKO

CHAND

Page 1
IN THE UNITED STATES DISTRICT COURT
FOR THE NORTHERN DISTRICT OF ILLINOIS, EASTERN DIVISION
______________________________
MIKE HARRIS and JEFF DUNSTAN,
individually and on behalf of
a class of similarly situated
individuals,
Plaintiffs,

x
:
:
:
:
:
:
:
:
:
:
x

vs.
COMSCORE, INC., a Delaware
corporation,

Case No. 1:11-5807
Hon. James F. Holderman

Defendant.
______________________________

Thursday, September 13, 2012
Reston, Virginia
DEPOSITION OF:
MICHIKO AVANTIKA CHAND,
a witness, called for oral examination by counsel for
plaintiffs in the above-captioned matter, pursuant to
Notice and agreement of the parties as to time and date,
held at the offices of comScore, Inc., 11950 Democracy
Drive, Suite 600, Reston, Virginia 20191, beginning at
approximately 9:30 o'clock, a.m., before Patricia Klepp,
RMR, a court reporter and Notary Public in and for the
Commonwealth of Virginia, when were present on behalf of
the respective parties:

CAROL J. THOMAS STENOTYPE REPORTING SERVICES, INC.

800-322-9221

www.carolthomasreporting.com

19ab106e-9469-4e88-afda-87a7ffa0f8be

HARRIS & DUSTAN v. COMSCORE, INC.

September 13, 2012
Page 2

1 APPEARANCE OF COUNSEL:
2
For the Plaintiffs:
3
EDELSON McGUIRE, LLC
4
BY: CHANDLER R. GIVENS, ESQUIRE
5
BEN THOMASSEN, ESQUIRE
6
350 North LaSalle, Suite 1300
7
Chicago, Illinois 60654
8
[phone]
9
E-Mail: [e-mail]
10
[e-mail]
11
For the Defendant:
12
QUINN, EMANUEL, URQUHART & SULLIVAN, LLP
13
BY: ROBYN M. BOWLAND, ESQUIRE
14
500 West Madison Street, Suite 2450
15
Chicago, Illinois 60661
16
[phone]
17
E-Mail: [e-mail]
18
--continued-19
20
21
22

APPEARANCE OF COUNSEL: (cont)
For the Defendant:
THOMAS S. CUSHING III, ESQUIRE
Deputy General Counsel and Privacy Officer
comScore, Inc.
11950 Democracy Drive, Suite 600
Reston, Virginia 20190-5624
[phone]
E-Mail: [e-mail]
-0I-N-D-E-X
Witness:
Page:
MICHIKO AVANTIKA CHAND
Examination by Mr. Givens
-0Exhibits:
(Included in transcript)
Deposition Exhibit No. 1
Deposition Exhibit No. 2
-0-

4

Page:
31
35

CHAND

Page 4
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22

PROCEEDINGS
Thereupon,
MICHIKO AVANTIKA CHAND,
a witness, was called for examination by counsel for the
plaintiffs, and after having first been duly sworn by
the Notary Public, was examined and testified as
follows:
EXAMINATION BY COUNSEL FOR PLAINTIFFS
BY MR.GIVENS:
Q. Good morning.
A. Good morning.
Q. Is this your first time sitting for a
deposition, Michiko?
A. Yes.
Q. Fine. Well, just a couple of quick ground
rules. This is just a conversation, but unlike most
conversations, Patricia is going to be typing everything
we say, so everything that you respond to my questions
has to be verbal. So you can't shrug your shoulders, or
nod your head, or stick out your tongue at me, because
that won't get picked up. So if you can, please try to
remember to do that. If not, I'll try to remind you.

Page 3

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22

MICHIKO

Page 5

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22

I'm going to presume you understand all my
questions. If not, just ask me to verify, and I'm happy
to do that anytime.
If you ever want to take a break, get a glass
of water, go to the restroom, just let me know, that's
fine; I only ask that if I have a question pending, that
you answer the question that's pending first, and then
we'll take break.
Is there any reason why this morning you can't
give full, truthful testimony? Are you on any
medications?
A. No.
Q. Okay. So just to start with, can you tell me
what your role is, here at comScore?
A. I am a quality assurance manager.
Q. How long have you been the QA manager?
A. Since April this year.
Q. April of this year?
A. Yes.
Q. And what is your job description?
A. I work on the Windows meter, CPROXY, and I
also oversee the automation of some of the testing that

2 (Pages 2 to 5)
CAROL J. THOMAS STENOTYPE REPORTING SERVICES, INC.

800-322-9221

www.carolthomasreporting.com

19ab106e-9469-4e88-afda-87a7ffa0f8be

HARRIS & DUSTAN v. COMSCORE, INC.

September 13, 2012

MICHIKO

Page 22

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22

A. Yes.
Q. Can you explain to me in general, if a user is
browsing the internet, how that information is
collected?
A. It's collected in XML format, and it depends
on what the user is doing on the internet.
Q. Can you elaborate?
A. If he visits a page, like CNN.com, we log that
he visited CNN.com.
Q. You log the URL?
A. Yes.
Q. And that information is sent to comScore
servers?
A. Yes.
Q. How is it sent to comScore servers?
A. It's posted by OSSProxy.
Q. XML post?
A. Yes.
Q. Does that happen in realtime?
A. Yes.
Q. How about page data; how is that collected?
A. It's collected for some pages.

Page 24

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22

type, it will be collected.
Q. Thank you. When that key word is detected and
the information is collected, the page data, is certain
personally identifiable information fuzzified before
it's sent to comScore servers?
A. Yes.
Q. How do you parse through the page data to
figure out what's personally identifiable information?
MS. BOWLAND: Objection.
A. It's done in the code somewhere; I'm not sure
how.
BY MR. GIVENS:
Q. You didn't develop the code?
A. No.
Q. If I said that comScore uses regular
expressions to find those strings, does that sound
right?
A. Yes.
Q. Do you know of any instances where comScore
has known that personally identifiable information was
not being fuzzified and being sent to comScore servers?
A. Yes.

Page 23

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22

Q. How do you determine which pages information
is collected from?
A. It's based on key words, and if it's a secure
page, then we collect the page data.
Q. What if it's not secure?
A. Only if there is a key word match would we
collect the page.
Q. How do you determine the key words?
A. It comes from requirements.
Q. If OSSProxy detects a predefined key word,
what information is then collected?
A. The page data.
Q. All of the page data?
A. Yes.
Q. What if it's a different MIME type? What if
it's ASP or CSS? There's a question coming.
(Whereupon, a discussion was held off the
record.)
BY MR. GIVENS:
Q. Do the same rules apply? Key words are
detected, and then information is collected?
A. If there is a key word for that specific MIME

CHAND

Page 25

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22

Q. Do you know of any instances where comScore
has known that personally identifiable information is
being collected and not fuzzified, and it's continuing
to let that happen?
A. No.
Q. Are you familiar with the Mystery Shopper
program?
A. Not much.
Q. What are comScore's procedures for determining
whether or not personally identifiable information is
correctly being fuzzified?
A. Like ...
MS. BOWLAND: Objection; vague.
A. Yes, a little more details, please.
BY MR. GIVENS:
Q. You don't make the objections; just to be
clear.
Within comScore, how do employees determine
whether or not personally identifiable information is
being correctly fuzzified that's collected from HTTP
HTML page data?
A. From a QA perspective?

7 (Pages 22 to 25)
CAROL J. THOMAS STENOTYPE REPORTING SERVICES, INC.

800-322-9221

www.carolthomasreporting.com

19ab106e-9469-4e88-afda-87a7ffa0f8be

HARRIS & DUSTAN v. COMSCORE, INC.

September 13, 2012

MICHIKO

Page 26

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22

Q. Yes.
A. We do tests every time a build is put out.
Q. What do those tests entail?
A. We visit secure sites, we make what the user
would do and then check that the data is being
fuzzified.
Q. And if it's not being fuzzified, then what do
you do?
A. We take steps to correct it.
Q. What steps do you take to correct it?
A. We check if it's a code change that's needed,
or is it a rule change, and then we accordingly take the
steps to correct it.
Q. In what scenarios would a rule change be
needed?
A. If something on the site changed
significantly, and then we -- sometime it's a rule
change.
Q. In what situations would a code change be
needed?
A. If it's a new MIME type or something which is
new to Proxy.

Page 28
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22

Q. The discussion we've just had about the
collection of HTTP HTML page data, do the same rules
apply if it's HTTPS HTML page data?
MS. BOWLAND: Objection; vague.
BY MR. GIVENS:
Q. You just described the process of how
personally identifiable information is fuzzified and
then sent to comScore servers in situations when a user
is on an HTTP HTML website. Do those rules apply
equally if the user is on a secure site, HTTPS?
A. Do you mean the rules of fuzzification?
Q. Yes.
A. Yes.
Q. Okay. Let's talk about the process for
capturing HTTP HTML post data.
How does OSSProxy want HTTP HTML post data to
collect?
MS. BOWLAND: Objection.
A. Yes, a little more detail.
BY MR. GIVENS:
Q. What HTTP HTML post data does OSSProxy
collect?

Page 27

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22

Q. If a code change is needed to fuzzify
personally identifiable information, how long would it
take to implement that change?
MS. BOWLAND: Objection; vague.
THE WITNESS: Yes.
BY MR. GIVENS:
Q. You've determined that personally identifiable
information is not being correctly fuzzified, but it
requires a code change to fix.
How long would it take to implement that code
change?
A. It depends on the extent of the code change.
Q. On average, how long would it take?
A. I cannot -- I mean, cannot say it like that;
it really depends on the extent of the code change.
Q. Could it be changed in a day?
A. No.
Q. Could it be changed in a week?
A. Yes.
Q. Could it be changed and then deployed to
panelists in a week?
A. Yes.

CHAND

Page 29

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22

A.
Q.
A.
Q.
A.
Q.
A.
route.
Q.

If it's typed text HTML, it will collect it.
It will collect all post data?
Yes.
Does it fuzzify all post data?
Yes.
Is there any post data that's not fuzzified?
All post data goes through a fuzzification

That didn't answer my question.
So is all post data fuzzified?
A. Yes.
Q. All right.
MR. GIVENS: Let's take a quick five-minute
break.
(Whereupon, a recess was taken.)
MR. GIVENS: Back on.
BY MR. GIVENS:
Q. Okay. Before we took a break, we were
discussing fuzzification of post data, and you said that
all post data is fuzzified.
A. Yes.
Q. Are there -- there's no instances when post

8 (Pages 26 to 29)
CAROL J. THOMAS STENOTYPE REPORTING SERVICES, INC.

800-322-9221

www.carolthomasreporting.com

19ab106e-9469-4e88-afda-87a7ffa0f8be