SiteLock LLC v. GoDaddy.com LLC

Opinion

1 WO 2 3 4 5 6 IN THE UNITED STATES DISTRICT COURT 7 FOR THE DISTRICT OF ARIZONA

9 SiteLock LLC, No. CV-19-02746-PHX-DWL

10 Plaintiff, ORDER

11 v.

12 GoDaddy.com LLC,

13 Defendant. 14 15 Pending before the Court are (1) GoDaddy’s Rule 37(c)(1) motion to exclude one 16 of SiteLock’s damages theories based on late disclosure (Doc. 306), and (2) SiteLock’s 17 cross-motion for additional discovery in lieu of exclusion (Doc. 320). For the following 18 reasons, GoDaddy’s motion is granted and SiteLock’s motion is denied. 19 RELEVANT BACKROUND 20 This contentious lawsuit has been filled with discovery disputes, the details of which 21 have been discussed ad nauseum in earlier orders. (See, e.g., Docs. 36, 80, 87, 160, 176, 22 248, 291, 315.) Here, the dispute concerns the timing of the disclosure of one of SiteLock’s 23 damages theories. The relevant background details bearing on that issue are as follows. 24 On April 30, 2019, SiteLock initiated this action by filing the complaint. (Doc. 1.) 25 As summarized in earlier orders, the gist of the complaint is that “SiteLock and GoDaddy 26 entered into a contract under which GoDaddy agreed to market and sell SiteLock’s website 27 security services. When a GoDaddy customer would purchase a SiteLock subscription and 28 then take the additional step of activating that subscription, GoDaddy would remit a portion 1 of the sale proceeds to SiteLock. When a GoDaddy customer would purchase a SiteLock 2 subscription but then fail to activate it, GoDaddy would not remit any of the sale proceeds 3 to SiteLock. One of the disputed issues in this case is whether GoDaddy was required by 4 the parties’ contract to remit payment to SiteLock in this latter circumstance—SiteLock 5 says yes, GoDaddy says no.” (Doc. 248 at 4.) In addition to this contract-based claim, the 6 complaint also asserts Lanham Act and state-law unfair competition claims premised on 7 the allegation that GoDaddy misused SiteLock’s trademark. (Doc. 1 ¶¶ 72-85.) 8 Because it was filed in April 2019, this case was (and remains) subject to the District 9 of Arizona’s Mandatory Initial Discovery Pilot Project (“MIDP”), which applies to most 10 civil cases filed between May 1, 2017 and May 1, 2020. Under the MIDP, SiteLock was 11 required to “[p]rovide a computation of each category of damages [it] claimed . . . and a 12 description of the documents or other evidentiary material on which it is based, including 13 materials bearing on the nature and extent of the injuries suffered.” See D. Ariz. G.O. 17- 14 08 ¶ B.5. 15 On August 9, 2019, SiteLock served its initial MIDP disclosures. (Doc. 308-2.) On 16 the issue of damages, SiteLock’s disclosures provided as follows: 17 Plaintiff has conducted limited discovery concerning damages, and therefore 18 is presently unable to accurately compute damages. However, Plaintiff has calculated that it is entitled to no less than $25,640,309 in damages, not 19 including pre-judgment and post-judgment interest on these amounts at the 20 maximum rate permitted by law, and not including attorney’s and other fees. This number is based on (1) the total estimated dollar value of SiteLock 21 orders for which SiteLock did not receive payment ($13,361,139), and (2) 22 the total estimated dollar value of the harm to SiteLock based on GoDaddy’s use of SiteLock’s trademark ($12,279,170). Plaintiff is entitled to receive its 23 actual, consequential, and incidental damages sustained in an amount to be determined at trial, as well as prejudgment and post-judgment interest and 24 attorney’s fees. Discovery is ongoing and Plaintiff reserves the right to 25 supplement its damages computation as discovery progresses and based on consultation with expert(s). Plaintiff also reserves the right to supplement 26 the categories of damages based on its continuing investigation and 27 discovery in this action. Plaintiff also reserves its right to supplement these initial responses accordingly. 28 1 (Id. at 3, emphasis added.) In other words, in its MIDP disclosures, SiteLock computed its 2 breach-of-contract damages at around $13.3 million and explained that this sum consisted 3 solely of the “estimated dollar value of SiteLock orders for which SiteLock did not receive 4 payment.” Although SiteLock also stated in generic fashion that it was seeking “actual, 5 consequential, and incidental damages,” it did not identify any such damages apart from 6 the two specific categories of damages (contract and trademark) elsewhere identified in its 7 disclosures. SiteLock did not, for example, disclose that it would also be seeking damages 8 based on the theory that GoDaddy had interfered with its ability to make additional sales 9 to customers, let alone provide any computation of such lost-profit damages. 10 Upon receipt of SiteLock’s MIDP disclosures, GoDaddy sought more information 11 about how, precisely, SiteLock had arrived at its damage computations. (See, e.g., Doc. 12 308-4 at 11 [GoDaddy’s December 2019 discovery letter: “GoDaddy notes that SiteLock 13 failed to abide by its obligations under the Federal Rules to adequately disclose the 14 calculation for its damages in its initial disclosures.”].) 15 On February 28, 2020, after the parties’ meet-and-confer efforts on this issue proved 16 unsuccessful, GoDaddy sought judicial intervention by filing a notice of discovery dispute. 17 (Doc. 34.) In this notice, GoDaddy asserted that “[t]en months into this litigation, SiteLock 18 has yet to provide a thorough statement of damages, whether in conjunction with its MIDP 19 obligations or in response to straightforward written discovery. . . . SiteLock must be 20 compelled to meet its basic discovery obligations, and to provide evidence related to its 21 claimed damages.” (Id. at 1, citations omitted.) In response, SiteLock stated: “SiteLock 22 has . . . provided a specific damages estimate . . . and has explained the components of that 23 estimate. The remainder of the documents necessary to calculate damages are in 24 GoDaddy’s exclusive possession: To calculate contract damages, SiteLock must discover 25 from GoDaddy how many ‘orders’ of SiteLock’s services were made through GoDaddy’s 26 website but not reported to SiteLock.” (Id. at 2.) In other words, SiteLock again suggested 27 that its sole theory of contract damages was that it didn’t receive payment for all of the 28 orders made through GoDaddy’s website—there was no mention of additional contract- 1 based damages arising from lost sales to customers. 2 On March 5, 2020, the Court held a hearing to address this and other discovery 3 disputes. (Doc. 36 [minute entry]; Doc. 90 [transcript].) As relevant here, SiteLock’s 4 counsel argued that SiteLock’s efforts to disclose its damages computations should be 5 deemed sufficient because:

6 [T]he vast majority of the documents necessary to calculate damages are in GoDaddy’s exclusive possession and have not been produced yet by 7 GoDaddy. That would include things like documents showing the numbers of orders and activations through GoDaddy’s website of SiteLock’s services. 8 We need those to figure out what the delta is in what GoDaddy owed us and what GoDaddy paid us. We’ve done the best we can estimating that dollar 9 value based on the sliver of information that we have. But until we have that information, we can’t get a more precise answer to that question. 10 11 (Doc. 90 at 64.) In other words, SiteLock once again suggested that the entirety of its 12 contract-based damages arose from GoDaddy’s failure to pay for subscriptions that were 13 purchased but not activated—in SiteLock’s words, “the delta” between those two figures— 14 and made no suggestion that SiteLock was also seeking damages based on lost sales to 15 customers. 16 The parties’ squabbling over the adequacy of SiteLock’s damages disclosures 17 continued after the March 2020 discovery hearing. (See, e.g., Doc. 70-3 at 4 [GoDaddy’s 18 June 2020 discovery letter: “GoDaddy is entitled to a showing as to how SiteLock 19 calculated the damages, and if we aren’t going to get a meaningful, robust production 20 showing that calculation in some detail, along with internal communications from SiteLock 21 stating, for example, exactly what they thought they would get in the way of damages from 22 this lawsuit, then we’re going to move to compel. To be clear, all documents regarding 23 SiteLock’s calculation of damages must be produced, including all communications with 24 counsel regarding those calculations, and counsel’s own calculations of damages and they 25 must be produced.”].) 26 On June 23, 2020, after the parties’ further meet-and-confer efforts on this issue 27 proved unsuccessful, GoDaddy sought judicial intervention by filing another notice of 28 discovery dispute. (Doc. 70.) In this notice, GoDaddy argued that “[m]ore than a year into 1 this litigation, and after losing [in its opposition to] a motion to compel that also sought 2 information regarding its damages, SiteLock still has not produced meaningful documents, 3 or provided a thorough statement of damages, whether in conjunction with its MIDP 4 obligations or in response to straightforward written discovery.” (Id. at 1, citations 5 omitted.) In response, SiteLock argued that it “has nothing more to produce” because 6 “nearly all of the documents necessary to calculate damages remain in GoDaddy’s 7 exclusive possession; only GoDaddy knows the SiteLock services it sold, and it refuses to 8 produce accurate and complete sales information.” (Id. at 2.) In other words, SiteLock 9 seemed to affirm, for at least the fourth time, that the entirety of its contract-based damages 10 arose from GoDaddy’s failure to pay for subscriptions that were ordered but not activated. 11 On July 14, 2020, the Court held a hearing to address this and other discovery 12 disputes. (Doc. 87 [minute entry]; Doc. 91 [transcript].) During this hearing, GoDaddy 13 argued that SiteLock’s damages-related disclosures were inadequate because “we still 14 don’t have a viable theory or even an articulated theory of damages from SiteLock 15 regarding any of its claims. . . . All we have basically is a number.” (Doc. 91 at 6.) In 16 response, SiteLock argued that “[w]e produced our best estimate of damages based on the 17 information that we have. The documents that we cite . . . are spreadsheets that lay out on 18 a month-by-month basis the numbers that show the delta between our best estimate of what 19 GoDaddy paid us and what GoDaddy should have paid us. And so the documents that we 20 cite do lay out the methodology for these numbers.” (Id. at 9-10.) SiteLock further argued 21 that GoDaddy was responsible for any lack of clarity, because “we have been completely 22 stymied in our ability to provide our damages numbers” and “GoDaddy has sole possession 23 of the evidence that shows what orders were made by customers . . . of SiteLock services 24 through GoDaddy that GoDaddy never reported to [SiteLock]. That’s what the whole 25 lawsuit is about.” (Id. at 10.) These comments were consistent with SiteLock’s previous 26 statements concerning the nature of its contract damages (i.e., all of the damages were 27 based on the “delta” between sales and activations). However, near the end of the relevant 28 portion of the hearing, SiteLock’s counsel also made the following statement: “Final point 1 is, this is all going to be subject to expert testimony, which we have also told [GoDaddy]. 2 We need to get from them the actual numbers of how many orders they sold and pocketed 3 the money and didn’t tell us about so that we can calculate what they owe us based on what 4 those services were, what the revenue share was on those services, et cetera, et cetera.” (Id. 5 at 12.) This appears to be the first time SiteLock mentioned, in a non-generic way, that it 6 might be seeking additional damages based on lost sales to customers. 7 At the conclusion of the July 2020 discovery hearing, the Court granted GoDaddy’s 8 motion to compel in part. (Doc. 87.) Specifically, the Court required SiteLock to 9 supplement its disclosures by spelling out how it reached the damages computations set 10 forth in the disclosures. (Doc. 91 at 14.) The Court added that SiteLock’s oral analysis at 11 the hearing wasn’t “actually reflected in the discovery responses,” which merely included 12 “black box bottom line figures about what the contract damages are and what the trademark 13 damages are.” (Id. at 15.) 14 On August 28, 2020, SiteLock provided amended MIDP disclosures to GoDaddy. 15 (Doc. 308 ¶ 9; Doc. 308-6.) Critically, in the portion of those disclosures providing more 16 information concerning its methodology for calculating its contract-based damages (as 17 ordered during the July 14, 2020 discovery hearing), SiteLock did not increase its damages 18 estimate and did not add any language suggesting it was seeking additional damages based 19 on lost sales to customers. (Doc. 308-6 at 4 [“The first component of SiteLock’s damages 20 estimate ($13,361,139) is based on GoDaddy’s failure to pay SiteLock for all orders of 21 SiteLock subscriptions.”].) Instead, SiteLock merely provided more information about 22 how it had calculated the number of subscriptions that had been ordered but not activated. 23 (Id. at 4-7 [“This spreadsheet shows that, from January 2015 through June 2015, . . . the 24 total number of SiteLock units that were ‘activated’ (and that GoDaddy thus paid SiteLock 25 for) were approximately 38.5% of the total number of SiteLock units that GoDaddy sold. 26 . . . By multiplying the average percentage delta from January 2015 through June 2015 by 27 the total of each invoice, SiteLock calculated that GoDaddy failed to pay it at least 28 $13,361,139 for orders of SiteLock subscriptions.”].) 1 In September 2020, SiteLock retained its damages expert, Dr. Steven Kursh. (Doc. 2 319-9 ¶ 6.) 3 In December 2020, Dr. Kursh began his damages analysis. (Id. ¶ 9.) 4 In mid-January 2021, Dr. Kursh “determined that GoDaddy’s conduct during its 5 relationship with SiteLock had likely caused economic harm to SiteLock by diminishing 6 the revenue that SiteLock earned from direct sales (or ‘upsells’) to customers who 7 originally purchased SiteLock products from GoDaddy.” (Id. ¶ 10.) 8 On February 5, 2021—the deadline for the completion of written discovery (Doc. 9 250)—GoDaddy deposed SiteLock’s Rule 30((b)(6) representative, Neill Feather. (Doc. 10 319-3.) During this deposition, Feather was asked whether SiteLock was seeking “any 11 other damages in this action” beyond “the licensing fees that SiteLock is seeking for 12 products that were not activated” and beyond certain other categories of previously 13 disclosed damages. (Id. at 3.) In response, Feather stated:

14 I believe we’re still in the midst of having experts kind of analyze the damages. I would say there are a few categories that are still kind of open- 15 ended as far as getting to a final comprehensive damages assessment. One of those would be around our ability—you know, the customers that we were 16 deprived of under the endeavor-to-promote claim, you know, have a lifetime value that is beyond the, you know—the term of the time they may be with 17 GoDaddy or the time that, you know, their original subscription lasts, so things like upgrades and cross-promotions and things like that are within the 18 scope of what I believe we’re looking at there. 19 (Id. at 3-4.) In response to follow-up questioning about the “steps SiteLock has taken to 20 quantify that category of damages,” Feather elaborated: “I think we’re still in the process 21 of performing some of that analysis. I know we’ve looked at some internal metrics around 22 lifetime value and up-sells to provide, but I know that that assessment is ongoing.” (Id. at 23 4-5.) 24 The deadline for the completion of all fact discovery was February 26, 2021—that 25 is, three weeks after SiteLock’s Rule 30(b)(6) deposition. (Doc. 250.) At no point during 26 this three-week period did SiteLock made any effort to amend its MIDP disclosures to add 27 (let alone quantify) the lost-profit damages theory that Feather had briefly mentioned 28 during the Rule 30(b)(6) deposition. Thus, as of the close of fact discovery, SiteLock’s 1 MIDP disclosures continued to state that it was seeking approximately $13.3 million in 2 contract-based damages, which figure was “based on GoDaddy’s failure to pay SiteLock 3 for all orders of SiteLock subscriptions.” (Doc. 308-6 at 4-7.) 4 The deadline for the disclosure of SiteLock’s expert reports was March 19, 2021. 5 (Doc. 250.) One of the reports disclosed on this deadline was from Dr. Kursh. (Doc. 308- 6 9.) As for the dollar value of the SiteLock subscriptions that GoDaddy sold but did not 7 report or pay for, Dr. Kursh concluded that SiteLock’s damages (before interest) were 8 $1,804,247 for “standalone” subscriptions and $1,373,802 for “bunded” subscriptions. (Id. 9 ¶¶ 165, 172.) These figures are, of course, far lower than the $13.3 million estimate set 10 forth in SiteLock’s MIDP disclosures. However, Dr. Kursh’s report also included a 11 calculation of SiteLock’s damages arising from “Lost Profits from Direct Sales to 12 Customers.” (Id. ¶¶ 175-205.) These damages are based on the “assum[ption] that 13 GoDaddy’s failure to report a SiteLock subscription effectively deprived SiteLock of the 14 ability to make a direct sale to the customer who owned that domain.” (Id. ¶ 176.) After 15 identifying an array of different methodologies for calculating such damages, Dr. Kursh 16 concluded that “SiteLock’s damages based on loss of direct sale profits from GoDaddy’s 17 failure to report and pay for all subscriptions, including interest, was between $10,499,527 18 and $18,381,514, depending on the method and interest rate used.” (Id. ¶ 205.) Dr. Kursh 19 also opined that SiteLock would have earned additional profits from its customers via 20 upsells had GoDaddy met its contractual obligation to promote SiteLock’s products and 21 calculated the value of those lost profits as “between $2,274,632 and $6,291,795, including 22 interest.” (Id. ¶ 223.) In short, using his high-end estimates, Dr. Kursh identified nearly 23 $25 million in lost-profit damages, separate and apart from the damages associated with 24 non-payment for subscriptions. 25 On April 19, 2021, GoDaddy disclosed the report of one of its experts, Jeffrey 26 George. (Doc. 319-5.) Among other things, George’s report contains opinions about why 27 Dr. Kursh’s lost-profit calculations are flawed. (Id.) 28 On May 7, 2021, GoDaddy filed the pending Rule 37(c)(1) motion and supporting 1 memorandum. (Docs. 306, 307.) 2 On May 21, 2021, SiteLock filed its response to GoDaddy’s motion. (Doc. 319.) 3 That same day, SiteLock filed the pending cross-motion for additional discovery in lieu of 4 exclusion. (Doc. 320.) 5 On June 1, 2021, GoDaddy filed a combined reply in support of its motion and 6 response to SiteLock’s cross-motion. (Doc. 325,) 7 On June 4, 2021, SiteLock filed a reply in support of its cross-motion. (Doc. 328.) 8 Neither side requested oral argument. 9 DISCUSSION 10 I. Legal Standard 11 Both parties contend that GoDaddy’s request for sanctions is governed by Rule 12 37(c)(1) of the Federal Rules of Civil Procedure. (Doc. 307 at 7; Doc. 319 at 9.) It is 13 unclear whether this is correct. As noted, the MIDP required each party to “[p]rovide a 14 computation of each category of damages [it] claimed . . . and a description of the 15 documents or other evidentiary material on which it is based, including materials bearing 16 on the nature and extent of the injuries suffered.” D. Ariz. G.O. 17-08 ¶ B(5).4. Notably, 17 “[t]he discovery obligations [created by the MIDP] supersede the disclosures required by 18 Rule 26(a)(1) and are framed as court-ordered mandatory initial discovery pursuant to the 19 Court’s inherent authority to manage cases.” Id. at 1 (emphasis added). See also id. ¶ A(2) 20 (“The responses are called for by the Court, not by discovery requests actually served by 21 an opposing party.”); Doc. 22 at 2 n.1 (“Parties that fail to timely disclose relevant 22 information will be precluded from using it in the case and may be subject to other 23 sanctions. Parties that unreasonably postpone disclosure of relevant information to the end 24 of the discovery period also will be subject to sanctions.”). Accordingly, a request for 25 sanctions based on failure to disclose information required by the MIDP is arguably 26 governed by Rule 37(b)(2)(A), which authorizes the imposition of sanctions for “fail[ing] 27 to obey [a court] order to provide or permit discovery,” rather than Rule 37(c)(1), which 28 authorizes the imposition of sanctions against “a party [that] fails to provide information 1 . . . as required by Rule 26(a) or (e).”1 2 If anything, GoDaddy’s invocation of Rule 37(c)(1), rather than Rule 37(b)(2)(A), 3 is beneficial to SiteLock. Although both provisions expressly authorize the exclusion of 4 the challenged matter based on late disclosure,2 which is the sole remedy that GoDaddy 5 seeks here, the provisions also differ in certain other respects—for example, Rule 37(b)(2) 6 more readily authorizes the imposition of more severe sanctions, creates a presumptive 7 right to fee-shifting, and doesn’t (at least as a textual matter) include a safe harbor for 8 violations that were “substantially justified or harmless.” See, e.g., Lair for Estate of Lair 9 v. Reyes, 2020 WL 9718813, *7 (S.D. Ill. 2020) (“[A] harmless analysis is not relevant to 10 whether there has been a violation of a discovery order under Rule 37(b)(2)(A). The term 11 ‘harmless’ is not present in Rule 37(b)(2)(A). Rather, the term ‘harmless’ is present for 12 sanctions sought under Rule 37(c)(1) for a failure to disclose or supplement.”) (citation 13 omitted). 14 At any rate, the Court would reach the same outcome here regardless of whether 15 Rule 37(b)(2)(A) or Rule 37(c)(1) were applicable. Thus, as contemplated by both parties, 16 the Court will analyze GoDaddy’s request for sanctions under Rule 37(c)(1)’s standards. 17 As noted by the Ninth Circuit, the purpose of Rule 37(c)(1) is to “‘give[] teeth’ to Rule 18 26’s disclosure requirements by forbidding the use at trial of any information that is not 19 properly disclosed.” Goodman v. Staples The Office Superstore, LLC, 644 F.3d 817, 827 20 (9th Cir. 2011), superseded by rule on other grounds as recognized in Shrader v. Papé 21 Trucks, Inc., 2020 WL 5203459, *2 n.2 (E.D. Cal. 2020). Thus, a party’s failure to properly 22

23 1 Rule 26(a)(1)(A)(iii) requires the disclosure of “a computation of each category of damages claimed by the disclosing party—who must also make available for inspection 24 and copying . . . the documents or other evidentiary material, unless privileged or protected from disclosure, on which each computation is based.” Thus, a failure to disclose damages 25 computations is ordinarily (i.e., in cases not governed by the MIDP) treated as a violation of Rule 26(a) that is sanctionable under Rule 37(c)(1). 26 2 Rule 37(b)(2)(A) sets forth a non-exhaustive list of sanctions that may be imposed for failing to comply with a discovery order, including “prohibiting the disobedient party 27 from supporting or opposing designated claims or defenses, or from introducing designated matters into evidence.” Rule 37(c)(1) provides that the presumptive sanction for non- 28 disclosure is that “the party is not allowed to use that information or witness to supply evidence on a motion, at a hearing, or at a trial.” 1 or timely disclose its damages computations may result in exclusion of the undisclosed 2 matters. Hoffman v. Construction Protective Servs., Inc., 541 F.3d 1175, 1179-80 (9th Cir. 3 2008) (affirming district court’s exclusion of damage claims as to 64 of 66 plaintiffs due 4 to late disclosure, because “[d]isclosure of damage calculations was mandated under Rule 5 26(a) and the . . . failure to disclose was not substantially justified . . . [or] harmless,” and 6 emphasizing that “the district court was [not] required to make a finding of willfulness or 7 bad faith to exclude the damages evidence”). 8 “The party requesting sanctions [under Rule 37(c)(1)] bears the initial burden of 9 establishing that the opposing party failed to comply with the [applicable] disclosure 10 requirements.” Silvagni v. Wal-Mart Stores, Inc., 320 F.R.D. 237, 241 (D. Nev. 2017). If 11 the movant makes this showing, “[t]he party facing sanctions bears the burden of proving 12 that its failure to disclose the required information was substantially justified or is 13 harmless.” R&R Sails, Inc. v. Ins. Co. of Penn., 673 F.3d 1240, 1246 (9th Cir. 2012). 14 When evaluating substantial justification and harmlessness, courts often consider (1) 15 prejudice or surprise to the other party, (2) the ability of that party to cure the prejudice, 16 (3) the likelihood of disruption of trial, and (4) willfulness or bad faith. Silvagni, 320 17 F.R.D. at 242. 18 “Rule 37(c)(1) is an ‘automatic’ sanction that prohibits the use of improperly 19 disclosed evidence,” such that “litigants can escape the ‘harshness’ of exclusion only if 20 they prove that the discovery violations were substantially justified or harmless.” 21 Merchant v. Corizon Health, Inc., 993 F.3d 733, 740 (9th Cir. 2021) (citation omitted). 22 Nevertheless, “[t]he automatic nature of the rule’s application does not mean that a district 23 court must exclude evidence that runs afoul of Rule 26(a) or (e) . . . . Rather, the rule is 24 automatic in the sense that a district court may properly impose an exclusion sanction 25 where a noncompliant party has failed to show that the discovery violation was either 26 substantially justified or harmless.” Id. (citation omitted). The “party facing sanctions 27 under [Rule 37(c)(1)] bears the burden of showing that a sanction other than exclusion is 28 better suited to the circumstances.” Id. at 741. “[A] noncompliant party must ‘avail himself 1 of the opportunity to seek a lesser sanction’ by formally requesting one from the district 2 court.” Id. (citation omitted). 3 II. The Parties’ Arguments 4 GoDaddy moves under Rule 37(c)(1) to preclude SiteLock from pursuing the “lost 5 profits from direct sales” theory of damages set forth in Dr. Kursh’s report. (Doc. 307.) 6 First, GoDaddy argues this theory wasn’t properly disclosed because “[n]either SiteLock’s 7 Initial nor Amended MIDP disclosures, not its damages-related discovery responses 8 suggest—let alone assert—a damages theory based on lost profits from SiteLock’s direct 9 sales.” (Id. at 11-12.) GoDaddy contends the first disclosure of this theory didn’t come 10 until March 2021, when Dr. Kursh issued his report, and argues this disclosure was 11 inadequate and untimely because (1) it occurred after the close of fact discovery and (2) 12 SiteLock has not, in any event, ever amended its disclosures or discovery responses to 13 include Dr. Kursh’s lost-profit theory. (Id.) Second, GoDaddy argues the disclosure 14 violation wasn’t substantially justified because the new damages theory is based on 15 SiteLock’s internal information (i.e., “the total monthly revenue purportedly earned by 16 SiteLock from direct sales to GoDaddy customers between 2014 and 2017”), and thus 17 SiteLock has “had custody of the information necessary” to develop and disclose its lost- 18 profit theory since the outset of the case. (Id. at 12-14.) GoDaddy also emphasizes that 19 the new theory would increase its exposure by $25 million. (Id.) Third, GoDaddy argues 20 the disclosure violation wasn’t harmless because “permitting SiteLock to proceed on its 21 previously undisclosed theory would require the re-opening of discovery and delay of the 22 Court’s schedule.” (Id. at 6, 14-17.) More specifically, GoDaddy argues that all of 23 SiteLock’s claims about the revenue earned from existing customers (which provide the 24 foundation for Dr. Kursh’s lost-profit calculations) are based on a made-for-litigation 25 summary document that was produced by SiteLock for the first time on January 29, 2021; 26 that GoDaddy would have pursued far more discovery related to this issue had it been on 27 notice of the issue’s relevance to SiteLock’s damages theories; that SiteLock has 28 previously (and successfully) demanded additional discovery material, including granular 1 transaction-level receipts, when presented with made-for-litigation summary documents 2 prepared by GoDaddy (which underscores why GoDaddy would have been entitled to 3 conduct additional discovery had this issue been properly raised); and that SiteLock took 4 various steps to thwart GoDaddy’s earlier efforts to obtain discovery related to SiteLock’s 5 upsells. (Id.) Finally, GoDaddy argues, in the alternative, that the Court should reopen 6 fact and expert discovery and require SiteLock to pay the attorneys’ fees and costs 7 associated with these reopened processes. (Id. at 17.) 8 SiteLock opposes GoDaddy’s motion. (Doc. 319.) First, SiteLock argues it “fully 9 complied with its disclosure obligations” because (1) in its MIDP disclosures, it “flagged” 10 that possibility that it would be seeking consequential damages in addition to the other 11 contract-damaged damages it had calculated and also “flagged” the possibility that its 12 damages calculations might change once it obtained expert analysis; (2) it provided more 13 information about its lost-profit theory during its Rule 30(b)(6) deposition in February 14 2021 (which occurred less than 30 days after its expert, Dr. Kursh, first “determined . . . 15 that the consequential harm to SiteLock from GoDaddy’s breach of contract likely included 16 harm to SiteLock’s upsells”); and (3) it fully disclosed Dr. Kursh’s analysis of the lost- 17 profit issue by the expert disclosure deadline set forth in the scheduling order. (Id. at 10- 18 14.) Second, SiteLock argues any disclosure error was substantially justified because it 19 “disclosed what it knew about its damages at the outset of the case (making clear it would 20 need expert help), then promptly disclosed the upsell theory within three weeks of its expert 21 identifying that theory, during fact discovery.” (Id. at 14.) Third, SiteLock argues any 22 disclosure error was harmless because (1) “GoDaddy’s expert was able to fully analyze 23 and respond to Dr. Kursh’s analysis of upsell damages” and GoDaddy “can continue to 24 probe Dr. Kursh’s analysis during upcoming expert depositions,” (2) GoDaddy was 25 allowed to conduct extensive discovery concerning upsells, including 12 requests for 26 production and extensive Rule 30(b)(6) questioning on the topic, and had a motive to 27 conduct such discovery irrespective of Dr. Kursh’s damages opinion because GoDaddy has 28 asserted a set-off affirmative defense based on SiteLock’s failure to pay for upsells, and 1 (3) GoDaddy “cannot identify any specific additional discovery that it would have pursued 2 had SiteLock disclosed its upsell damages earlier).” (Id. at 14-17.) Finally, SiteLock 3 contends that “GoDaddy’s unexplained three-month delay in bringing [its] motion 4 independently warrants its denial.” (Id. at 17.) 5 SiteLock also cross-moves, in the alternative, to allow GoDaddy to conduct 6 additional discovery in lieu of the remedy of exclusion. (Doc. 320.) SiteLock contends it 7 “has a reasonable explanation for the timing of its disclosures” and thus argues that, even 8 if it erred, the absence of willful, bad-faith conduct means the Court should exercise its 9 discretion under Rule 37(c)(1) to impose the “more limited sanction of targeted discovery” 10 instead of “the extreme remedy of excluding approximately half of [its] damages.” (Id. at 11 3.) In support of this argument, SiteLock largely elaborates upon the discussion of 12 substantial justification and harmlessness that appears in its opposition to GoDaddy’s 13 motion. (Id. at 3-7.) 14 In its combined reply and response, GoDaddy first argues that Feather’s testimony 15 during the Rule 30(b)(6) deposition did not constitute adequate disclosure of SiteLock’s 16 lost-profit theory of damages because his testimony was vague (i.e., he never used the 17 phrase “lost profits from direct sales”) and he didn’t provide a computation. (Doc. 325 at 18 1-4.)3 Next, GoDaddy argues that SiteLock’s arguments regarding substantial justification 19 miss the mark because (1) even if SiteLock needed an expert to provide a precise 20 calculation of its lost-profit damages, it was still required to provide an initial computation 21 at the outset of the case; (2) SiteLock never supplemented its MIDP disclosures and 22 discovery responses before the fact-discovery deadline to include the lost-profit claim; and 23 (3) SiteLock has not submitted any evidence explaining its “years-long failure to issue spot 24 lost profit damages” or its failure to mention the issue at any point between January 11, 25 2021 and March 19, 2021, when the parties exchanged 70 items of correspondence on other 26

27 3 GoDaddy also objects to SiteLock’s proffered evidence, on the ground that the accompanying declaration of counsel was not signed under penalty of perjury (Doc. 325 at 28 2-3), but SiteLock subsequently addressed that oversight (Doc. 328 at 1 n.1; Doc. 328-1 ¶ 3). 1 issues. (Id. at 5-6.) As for SiteLock’s arguments regarding harmlessness, GoDaddy argues 2 that they, too, miss the mark because (1) although GoDaddy’s affirmative defense happens 3 to “overlap” in some respects with SiteLock’s new damages theory, the two claims are 4 “very different things as a matter of law” and would require different forms of discovery, 5 and (2) GoDaddy has identified specific categories of discovery it would need to defend 6 against SiteLock’s new theory, including “granular transaction date for every product 7 SiteLock sold to a GoDaddy customer from 2014-present,” “the products SiteLock 8 allegedly would have sold to GoDaddy customers, the prices of those products from 2014- 9 present, and the expenses avoided by not having sold these products,” “the costs associated 10 with the sale and provision of those products from 2014-present,” “changes to SiteLock’s 11 direct sales platform and strategies, including . . . any decision to halt direct sales between 12 2014-present,” and “the impact to SiteLock’s direct sales from external market forces, 13 competition, other contracts, and acquisitions from 2014-present.” (Id. at 6-9.) As for 14 SiteLock’s claim that the exclusion motion was filed too late, GoDaddy responds that the 15 case on which SiteLock relies is inapposite (it dealt with Rule 37(b)) and that SiteLock 16 made a settlement offer in late February 2021 that suggested SiteLock wasn’t seeking lost- 17 profit damages—which, in turn, explains why GoDaddy was justified in not seeking relief 18 until Dr. Kursh’s report was disclosed three weeks later. (Id. at 9-10.) Finally, GoDaddy 19 opposes SiteLock’s cross-motion because SiteLock’s disclosure failures were not the 20 product of good faith and reasonable explanations and, instead, were the product of 21 unjustifiable “delay in retaining an expert witness to investigate its damages despite 22 knowing it needed help.” (Id. at 10-11.) 23 In its reply in support of its cross-motion, SiteLock reiterates its previous argument 24 that, because it “made clear in its initial disclosures that it was seeking consequential 25 damages and that its damages would be subject to expert analysis,” its subsequent efforts 26 to disclose that theory (first by Feather during the Rule 30(b)(6) deposition testimony, then 27 in Dr. Kursh’s report) are proof that it acted in good faith. (Doc. 328 at 1.) SiteLock also 28 disputes GoDaddy’s contention that Feather’s testimony was vague and inadequate, 1 arguing that he “disclosed the substance of SiteLock’s upsell damages theory” and was 2 unable to provide a computation only because “its expert was still working on those 3 calculations” at the time of the deposition (id. at 1-3), and argues it was permissible for Dr. 4 Kursh to begin his analysis in December 2020 because that was still three months before 5 the close of fact discovery (id. at 3). As for the timing of GoDaddy’s motion, SiteLock 6 argues it came three months after the relevant disclosure (the Feather deposition) and 7 criticizes GoDaddy for enclosing a settlement-related communication, which SiteLock 8 characterizes as prejudicial and a violation of Rule 408. (Id. at 3-4.) Finally, SiteLock 9 argues that authorizing additional discovery wouldn’t be disruptive because it “can perform 10 a reasonable search for an appropriately narrowed set of documents responsive to 11 GoDaddy’s five categories” and “produce any additional documents it identifies from these 12 searches within 14 days of this Court’s order.” (Id. at 4-5.) 13 III. Analysis 14 As explained below, SiteLock did not timely and adequately disclose its “lost profits 15 from direct sales” theory of damages, the disclosure violation was not substantially justified 16 or harmless, the remedy of exclusion (rather than additional discovery) is appropriate here, 17 and SiteLock’s other grounds for opposing GoDaddy’s motion lack merit. Accordingly, 18 GoDaddy’s Rule 37(c)(1) motion is granted and SiteLock’s cross-motion is denied. 19 A. Adequacy And Timeliness Of Disclosure 20 SiteLock’s efforts to disclose its lost-profit theory of damages did not comply with 21 the letter or spirit of the MIDP. SiteLock’s initial MIDP disclosures suggested it was 22 seeking a total of $13.3 million in contract-based damages, consisting solely of unpaid fees 23 for SiteLock subscriptions that GoDaddy sold but customers never subsequently activated. 24 (Doc. 308-2 at 3.) This was the only contract-related damage figure for which a 25 computation was provided. Although SiteLock did mention, in passing, that it was seeking 26 “actual, consequential, and incidental damages” and “reserve[d] the right to supplement its 27 damages computation . . . based on consultation with expert(s),” no reasonable reader 28 would have inferred from these seemingly boilerplate, throwaway phrases that SiteLock 1 was actually seeking another $25 million in contract damages based on an entirely different 2 theory related to lost profits. 3 SiteLock’s subsequent statements—during hearings, in court filings, and in meet- 4 and-confer correspondence with GoDaddy—reaffirmed this understanding. Time and 5 again, when pressed by GoDaddy (and the Court) for more information about its theory of 6 damages, SiteLock only mentioned the unpaid fees for sold-but-not-activated subscriptions 7 and didn’t mention anything about a separate claim for $25 million in lost profits from 8 hypothetical future sales. For example, in the February 2020 notice of joint summary 9 dispute, SiteLock took umbrage with GoDaddy’s suggestion that its damages disclosures 10 were inadequate, stating that it had “provided a specific damages estimate” and had 11 “explained the components of that estimate” and explaining that the only additional 12 computational step was to “discover from GoDaddy how many ‘orders’ of SiteLock’s 13 services were made through GoDaddy’s website but not reported to SiteLock.” (Doc. 34 14 at 2.) Not only did this statement fail to mention that SiteLock was seeking a separate $25 15 million in lost-profit damages, but it gave the impression that the previously disclosed 16 categories of damages were exclusive. 17 The first fleeting mention of a potential claim for lost profits came during the July 18 2020 discovery hearing. To be clear, most of the discussion during that hearing concerned 19 SiteLock’s “methodology” for calculating its contract damages related to unactivated 20 subscriptions, i.e., “the delta between [SiteLock’s] best estimate of what GoDaddy paid 21 [SiteLock] and what GoDaddy should have paid,” which SiteLock’s counsel characterized 22 as “what the whole lawsuit is about.” (Doc. 91 at 9-14.) This statement is impossible to 23 reconcile with SiteLock’s current arguments about its disclosure efforts—it would make 24 no sense to characterize a damages theory valued (at the time) at $13.3 million as “what 25 the whole lawsuit is about” if SiteLock had a different damages theory valued at more than 26 $25 million. 27 It is true that, after making these statements, SiteLock’s counsel went on to suggest 28 that SiteLock’s expert might be conducting an analysis of “the revenue share” related to 1 ordered-but-never-activated subscriptions. (Id.) But this comment did not fairly apprise 2 GoDaddy of SiteLock’s intent to pursue $25 million in lost-profit damages. Critically, 3 when SiteLock issued an amended version of its MIDP disclosures in August 2020, as it 4 had been ordered to do at the conclusion of the July 2020 discovery hearing, SiteLock did 5 not increase its contract-damages calculation beyond the original estimate of $13.3 million 6 and did not add any language suggesting it was seeking additional damages based on lost 7 sales. Instead, it merely provided more information about how it had calculated the number 8 of subscriptions that had been ordered but not activated. (Doc. 308-6 at 4-7.) Again, the 9 only reasonable interpretation of this disclosure was that SiteLock’s claim for contract- 10 based damages was limited to the $13.3 million for purchased-but-not-activated 11 subscriptions. 12 SiteLock did not further amend its damages-related disclosures after issuing the 13 August 2020 version. Indeed, even after January 2021 (when Dr. Kursh began developing 14 the lost-profit theory) and February 2021 (when SiteLock’s Rule 30(b)(6) deposition took 15 place), the relevant disclosures remained unchanged. Thus, as of the close of fact discovery 16 on February 26, 2021 (Doc. 250)—nearly two years after SiteLock filed this action (Doc. 17 1)—GoDaddy still had not been provided adequate notice that SiteLock was seeking $25 18 million in lost-profit damages, let alone a computation of those damages or a specification 19 of the documents on which the damages computation was based. On this record, the Court 20 easily concludes that SiteLock did not properly or timely disclose that theory of damages, 21 in violation of the MIDP. Cf. Oracle USA, Inc. v. SAP AG, 264 F.R.D. 541, 556-57 (N.D. 22 Cal. 2009) (“Plaintiffs’ discovery responses failed without substantial justification for over 23 two years to inform Defendants that Plaintiffs were seeking [certain] lost profit 24 damages . . . . Further, Plaintiffs failed to timely supplement their initial disclosures to 25 update their damages theory until May 2009, even though facts supporting such damages 26 were known to Plaintiffs before filing this lawsuit . . . . In addition, expanding the damages 27 case significantly as Plaintiffs belatedly attempt to do would severely prejudice the Court’s 28 ability to manage this case to resolution in anything approaching a just, speedy, and 1 inexpensive manner. Thus, Rule 37 mandates preclusion sanctions . . . .”). 2 In a related vein, the Court rejects SiteLock’s contention that it adequately and 3 timely disclosed the challenged theory during its Rule 30(b)(6) deposition. The proper way 4 for SiteLock to disclose its damages theories and computations was through MIDP 5 disclosures, not deposition testimony. Cf. Ollier v. Sweetwater Union High Sch. Dist., 768 6 F.3d 843, 862-63 (9th Cir. 2014) (affirming exclusion of witnesses who were never 7 formally disclosed in a party’s Rule 26 disclosures but were mentioned during a 8 deposition). Formal disclosure was particularly necessary in this case, where the adequacy 9 of SiteLock’s damages disclosures had been repeatedly challenged. At any rate, although 10 it is true that the MIDP sometimes permits disclosure via deposition instead of via formal 11 supplemental response, this exception applies only when the “new information is revealed 12 in a . . . deposition in a manner that reasonably informs all parties of the information.” See 13 D. Ariz. G.O. 17-08 ¶ A.8. Here, Feather’s Rule 30(b)(6) deposition testimony did no such 14 thing—it was vague, equivocal, and did not include even a rough estimate of the amount 15 of damages being sought. Moreover, SiteLock overlooks that the Rule 30(b)(6) deposition 16 occurred on the same day as the deadline for the completion of written discovery. Thus, 17 even if Feather had unspooled SiteLock’s new damages theory in a crisp, understandable 18 manner and provided comprehensible computations (which didn’t happen), GoDaddy 19 wouldn’t have had any practical ability to follow up on this belated disclosure by pursuing 20 additional written discovery related to it. And without such discovery, any efforts by 21 GoDaddy to notice and conduct additional fact-witness depositions in the remaining three- 22 week period before the close of all fact discovery would have been fruitless. 23 B. Substantially Justified Or Harmless 24 Because GoDaddy has met its burden of establishing that a disclosure violation 25 occurred, the burden shifts to SiteLock to establish that the violation was substantially 26 justified or harmless. SiteLock has not met that burden. 27 As for substantial justification, this isn’t a case where SiteLock only discovered its 28 ability to pursue a new damages theory after it obtained documents from GoDaddy during 1 the discovery process. To the contrary, SiteLock could have developed the challenged 2 theory even before this case began—the complaint is premised on the notion that GoDaddy 3 committed a contractual breach by failing to pay for subscriptions that were sold but never 4 activated, and the challenged theory simply represents Dr. Kursh’s opinion as to the 5 additional profit that SiteLock could have earned from such customers (via future upsells) 6 had SiteLock been aware of them. To be sure, SiteLock needed to rely on the discovery 7 process to develop information concerning one of the variables in this theory (i.e., the 8 number of customers who purchased but didn’t activate subscriptions). But the theory 9 itself has always been ripe for development and disclosure. Cf. Ocean Garden Prods. Inc. 10 v. Blessings Inc., 2018 WL 6133773, *2 (D. Ariz. 2018) (“Even if [a party is] unable to 11 provide precise computations without first commissioning an expert, [it] must provide 12 initial computations based on all information that is currently reasonable available to [it].”). 13 Notwithstanding this, SiteLock waited until September 2020 (more than a year after the 14 case was filed) to retain its damages expert; didn’t bother to amend its MIDP disclosures 15 in January 2021, when its expert first developed the theory; and didn’t disclose any 16 computations associated with the theory until March 2021, well after the close of fact 17 discovery. Contrary to SiteLock’s argument (Doc. 319 at 10-11), a party cannot drag its 18 heels when it comes to expert retention and then argue that, because it was dependent on 19 that expert to develop a damages theory, its own delay in the retention process serves as 20 substantial justification for a disclosure violation. To hold otherwise would create perverse 21 and bizarre incentives.4

22 4 The case cited by SiteLock in support of this supposed principle, Myers for Myers v. United States, 2003 WL 27375939 (S.D. Cal. 2003), is easily distinguishable. There, 23 the plaintiff’s initial disclosures specifically stated that she was seeking “substantial special damages, possibly exceeding $5 million, from medical bills, psychological bills, 24 neuropsychological bills, bills for educational assistance, loss and/or reduction in future wages and/or earning capacity, loss and/or reduction in her ability to care for herself and 25 the cost of obtaining care for herself” and further explained that “these special damages will most likely be the subject of expert testimony in this case and a complete breakdown 26 of special damages will be provided at the appropriate stage in the litigation consistent with Rule 26.” Id. at *1 (internal quotation marks omitted). Given this backdrop, the court 27 rejected the defendant’s challenge to the sufficiency of the plaintiff’s disclosures, holding that she was not required “to provide a more particularized calculation of her damages at 28 this stage of the litigation” in part because “[m]ost of the damages claimed by Plaintiff in this case fall into this category because they are dependent on information in the possession 1 Nor was the violation harmless. GoDaddy has identified specific categories of 2 evidence it would have pursued via the discovery process had it been aware of SiteLock’s 3 intent to pursue the lost-profit theory of damages. Thus, to even the playing field, the Court 4 would be required to reopen fact discovery. This would be an expensive and delay- 5 inducing outcome in a case that is already over two years old. Courts have not hesitated to 6 reject claims of harmlessness under analogous circumstances. See, e.g., Hoffman, 541 F.3d 7 at 1180 (late disclosure of damages computations was not harmless because it “would have 8 most likely required the court to create a new briefing schedule and perhaps re-open 9 discovery, rather than simply set a trial date”); Ollier, 768 F.3d at 862-63 (“Orderly 10 procedure requires timely disclosure so that trial efforts are enhanced and efficient, and the 11 trial process is improved. The late disclosure of witnesses throws a wrench into the 12 machinery of trial. A party might be able to scramble to make up for the delay, but last- 13 minute discovery may disrupt other plans. And if the discovery cutoff has passed, the party 14 cannot conduct discovery without a court order permitting extension. This in turn threatens 15 whether a scheduled trial date is viable. And it impairs the ability of every trial court to 16 manage its docket.”); Dayton Valley Investors, LLC v. Union Pacific R. Co., 2010 WL 17 3829219, *6 (D. Nev. 2010) (“Multiple courts within the Ninth Circuit have found that the 18 failure to provide a computation of damages . . . within the discovery period is not harmless 19 for purposes of Rule 37(c) precisely because it results in the need to reopen discovery.”) 20 (citations omitted). Moreover, SiteLock’s new computations are based, in part, on a made- 21 for-litigation summary exhibit. Just as GoDaddy was required to provide additional 22 documentation in support of a made-for-litigation summary exhibit it had previously 23 compiled and disclosed because that exhibit was important to the issue of damages (Doc. 24 291 at 16-18), the Court would likely require SiteLock to produce additional 25 documentation related to its summary exhibit were discovery reopened. This, too, would 26

27 of another party—Plaintiff’s expert witnesses.” Id. at *2. Here, of course, SiteLock’s initial disclosures did not state that SiteLock was seeking approximately $25 million in 28 lost-profit damages arising from upsells, subject to further refinement by SiteLock’s expert. The theory wasn’t mentioned at all. 1 add to the delay and expense. 2 Notwithstanding all of this, SiteLock argues that any disclosure violation was 3 harmless because GoDaddy’s expert was able to issue a rebuttal report concerning Dr. 4 Kursh’s lost-profit opinions. (Doc. 319 at 14-15.) This argument fails because it overlooks 5 that GoDaddy’s expert was hamstrung by an undeveloped record. It is true, as SiteLock 6 notes, that “GoDaddy’s expert had the same information that Dr. Kursh considered” (id.), 7 but the point is that the information on which Dr. Kursh relied consisted (at least in 8 GoDaddy’s view) of overly rosy and undeveloped data concerning the future profits that 9 SiteLock would have earned from customers via upsells. GoDaddy should have been given 10 the opportunity to test that data via the discovery process. And GoDaddy would have made 11 a more strenuous effort to do so had it been aware the data was providing the foundation 12 for a $25 million damage claim. Cf. Apple, Inc. v. Samsung Elecs. Co., Ltd., 2012 WL 13 3155574, *5 (N.D. Cal. 2012) (late disclosure not harmless, even though it occurred 14 “before the close of expert discovery,” because “the experts were in effect locked-in to the 15 factual record as of the time fact discovery closed and could not test the factual basis for 16 the newly amended contentions by conducting additional discovery”). 17 C. Additional Discovery In Lieu Of Exclusion 18 SiteLock argues in its cross-motion that, even if the conditions for exclusion under 19 Rule 37(c)(1) are otherwise satisfied, the Court should exercise its discretion to order 20 additional discovery in lieu of exclusion. (Doc. 320.) Although the Court acknowledges 21 that it possesses discretion to go that route, Merchant, 993 F.3d at 740-41, it declines to do 22 so. The sanction being imposed here is not case-dispositive—SiteLock has still disclosed 23 millions of dollars’ worth of other damages theories—and, as discussed in Part III.B above, 24 the justification for SiteLock’s disclosure violation is weak, particularly given the hard- 25 fought nature of this case and the many prior inquiries into the adequacy of SiteLock’s 26 disclosures. 27 D. Remaining Arguments 28 SiteLock’s final argument is that GoDaddy’s motion should be denied because 1 GoDaddy waited too long before filing it. (Doc. 319 at 17.) This argument fails. As an 2 initial matter, it is unclear what sort of deadline, if any, applies to Rule 37(c)(1) motions. 3 See, e.g., White v. Deere & Co., 2016 WL 525911, *1 (D. Colo. 2016) (“Plaintiff cites no 4 authority for the proposition that . . . a party’s failure to [seek a witness-exclusion order 5 under Rule 37(c)(1)] until shortly before trial somehow waives that party’s right to object. 6 The Court finds that defendants have not waived their ability to object to plaintiff’s late 7 disclosure of these witnesses under the discovery rules.”). No deadline is set forth in the 8 text of Rule 37(c)(1) and, although some districts appear to have adopted such deadlines 9 by local rule,5 the District of Arizona has not. 10 Moreover, even assuming some sort of reasonableness standard applies in this 11 context, GoDaddy did not wait an unreasonable amount of time before seeking relief. As 12 noted, Feather’s testimony during the Rule 30(b)(6) deposition was vague, equivocal, and 13 didn’t include any computations. It wasn’t until March 19, 2021, when the Kursh report 14 was disclosed, that GoDaddy finally received fair notice of SiteLock’s new $25 million 15 damages theory. The exclusion motion—which is comprehensive, supported by hundreds 16 of pages of exhibits, and clearly required a substantial amount of time to draft, edit, and 17 finalize (during a period when GoDaddy’s counsel was tied up with many other case- 18 related tasks)—was filed just over six weeks later. There was nothing unreasonable about 19 the amount of time it took for GoDaddy to file its motion. 20 … 21 … 22 … 23 … 24 … 25 … 26 5 See, e.g., Democratic Republic of Congo v. Air Capital Grp., 2013 WL 2285542, 27 *2 (S.D. Fla. 2013) (“Under the Local Rules of this Court, all motions related to discovery must be filed within thirty days of the occurrence of grounds for the motion. Failure to file 28 a timely discovery motion within thirty days ‘may constitute a waiver of the relief sought.’”) (citations omitted). 1 Accordingly, IT IS ORDERED that: 2 (1) GoDaddy’s motion for Rule 37(c)(1) sanctions (Doc. 306) is granted. 3 (2) SiteLock’s cross-motion for additional discovery (Doc. 320) is denied. 4 Dated this 9th day of July, 2021. 5 6 Lm ee” 7 f t _ oc Dominic W, Lanza 8 United States District Judge 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

-24 -