1 2 3 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA 6 7 LAWRENCE OLIN, et al., Case No. 18-cv-01881-RS (TSH)
8 Plaintiffs, DISCOVERY ORDER 9 v. Re: Dkt. No. 110 10 FACEBOOK, INC., 11 Defendant.
12 13 The parties have filed a joint discovery statement concerning whether Plaintiffs Lawrence 14 Olin, et al., may disclose Defendant Facebook, Inc.’s source code to their proposed experts, Dr. 15 Istvan Jonyer and Dr. Jae young Bang. ECF No. 110. The Court continued the hearing on this 16 dispute pending a ruling on Facebook’s motion to dismiss. On October 31, 2019, the parties filed 17 a status report concerning this dispute, ECF No. 144, and the Court heard oral argument today. 18 By way of background, Plaintiffs are suing Facebook for its alleged exploitation of a 19 vulnerability in the permission setting for the Facebook Messenger1 smartphone application that 20 existed in prior versions of the Android operating system. Sec. Am. Compl. ¶ 1, ECF No. 88. 21 When users install the app, they are prompted to grant Facebook access to their contacts and then 22 are given the choice to allow or deny. But when they made that choice, the app scraped users’ call 23 and text logs, which Facebook then monetized for advertising purposes. Id. Or at least that’s the 24 allegation. Plaintiffs say this conduct ended in October 2017, when the Android OS fully 25 deprecated this vulnerability in all versions of the Android SDK. Id. ¶ 22. They now purport to 26 sue on behalf of a nationwide class for violations of the California Computer Data Access and 27 1 Fraud Act, violations of the California right to privacy, and for intrusion upon seclusion, unjust 2 enrichment and fraud. Id. ¶¶ 36-65. 3 On April 3, 2019, Plaintiffs provided Facebook with a list of their proposed experts to 4 whom they intend to show Facebook’s source code. Facebook objected to two of them, Jonyer 5 and Bang. As to Jonyer, Facebook objected that he “worked for Facebook competitor Google 6 from August 2010 to February 2012.” ECF No. 110-1, Ex. A. In addition, Facebook objected that 7 Jonyer has an “active consulting business working with a variety of technology companies, 8 including NearMe, NimbleVR, and startups coming out of Stanford and in the ‘ex-Google 9 network.’” Id. As to Bang, Facebook objected that he “worked for Kakao Corporation for three- 10 and-a-half years until just two months ago when he left to work for Quandry Peak Research. As 11 Dr. Bang’s resume discloses, he designed and implemented the user identity platform used by over 12 100 million people who use Kakao services, including KakaoTalk, which is a messaging app 13 available on Android devices.” Id. 14 The Protective Order in this action, ECF No. 91, states that “the Party opposing disclosure 15 to the Expert shall bear the burden of proving that the risk of harm that the disclosure would entail 16 (under the safeguards proposed) outweighs the Receiving Party’s need to disclose the Protected 17 Material to its Expert.” Id. ¶ 7.5 (unnumbered subparagraph). But it also defines an expert as “a 18 person with specialized knowledge or experience in a matter pertinent to the litigation who (1) has 19 been retained by a Party or its counsel to serve as an expert witness or as a consultant in this 20 action, (2) is not a past or current employee of a Party or of a Party’s competitor, and (3) at the 21 time of retention, is not anticipated to become an employee of a Party or of a Party’s competitor.” 22 Id. ¶ 2.6 (emphasis added). Facebook argues that Jonyer and Bang do not come within the 23 definition of an “expert” and therefore are per se disqualified under the Protective Order, and thus 24 Facebook has no burden to prove risk of harm under paragraph 7.5. In other words, as Facebook 25 reads the Protective Order, the definition of an “expert” screens out certain groups of people who 26 are categorically unqualified from being an expert, and then leaves a subset of people who are 27 presumptively qualified, and the burden under paragraph 7.5 only applies to people in that subset. 1 Facebook’s interpretation of the Protective Order and additionally argue that no showing of risk of 2 harm has been made here. 3 As an initial matter, it is factually true that both Jonyer and Bang are past employees of a 4 competitor of Facebook’s. Jonyer worked for Google in 2010-12. ECF No. 110-1, Ex. B. Google 5 competes with Facebook for advertising revenue, as Plaintiffs themselves allege. Sec. Am. 6 Compl. ¶ 17 (“the online advertising industry has formed into a duopoly between Facebook and 7 Google”). Also, Gmail and Google’s messaging applications are services that compete with 8 Facebook Messenger. Jonyer’s work at Google focused on Google TV, the predecessor to 9 Chromecast, ECF No. 110-1, Ex. B, and no one contends that product was or is in competition 10 with Facebook.2 Bang worked for Kako from 2015-2019. ECF No. 110-1, Ex. C. Kakao makes a 11 messaging app that competes with Facebook Messenger. Plaintiffs assert that Bang’s work was 12 limited to the app’s user authentication platform and that he did not participate in the development 13 of KakaoTalk (the messaging app). 14 The Protective Order in this action is based on the District’s model order. As Facebook 15 observes, at least one court in this district has rejected an attempt to modify the model order in a 16 way that would have allowed the plaintiffs to hire former employees of a defendant’s competitors 17 as experts, noting the “unnecessary risk of competitive harm if the court permitted Plaintiffs to 18 hire the former employees of [Defendant’s] competitors as experts.” Corley v. Google, Inc., 2016 19 WL 3421402, at *2 (N.D. Cal. June 22, 2016). In TVIIM, LLC v. McAfee, Inc., 2014 WL 2768641 20 (N.D. Cal. June 18, 2014), the Court explained that “[t]his district clearly requires that an ‘expert’ 21 under the Protective Order may not be ‘a past or current employee of a Party or of a Party’s 22 competitor,’” id. at *2. In that case, the plaintiff’s proposed expert was then-currently employed 23 by ImmuneSoft, which defendant McAfee claimed was a competitor. Id. When the plaintiff failed 24 to address that issue head on, the Court took that as a concession and found that the proposed 25 expert “is not an ‘expert’ as defined by the Protective Order.” That section of the Court’s order 26 2 As to Jonyer’s ongoing consulting business, Facebook does not identify any particular client that 27 was or is a competitor. Further, paragraph 2.6 of the Protective Order states that the expert cannot 1 did not go on to assess the risk of harm in determining whether to allow that person to serve as an 2 expert. In isolation, that section of the order therefore seems to support Facebook’s view that 3 paragraph 2.6 of the protective order categorically excludes certain people from the definition of 4 an expert, so no further analysis of risk of harm is needed. On the other hand, the proposed expert 5 in TVIIM was also a named inventor of the patent at issue, and in the next section of the order the 6 Court held that this was an additional reason not to allow him to have access the defendant’s 7 confidential information, and the Court included an analysis of risk of harm in that section of the 8 order. Accordingly, this case does not cleanly support Facebook’s argument that being outside of 9 the definition of “expert” is the end of the matter, since the Court did end up doing an analysis of 10 risk of harm, albeit in the next section of the order. 11 Plaintiffs cite to Codexis, Inc v. EnzymeWorks, Inc., 2017 WL 5992130 (N.D. Cal. Dec.
Free access — add to your briefcase to read the full text and ask questions with AI
1 2 3 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA 6 7 LAWRENCE OLIN, et al., Case No. 18-cv-01881-RS (TSH)
8 Plaintiffs, DISCOVERY ORDER 9 v. Re: Dkt. No. 110 10 FACEBOOK, INC., 11 Defendant.
12 13 The parties have filed a joint discovery statement concerning whether Plaintiffs Lawrence 14 Olin, et al., may disclose Defendant Facebook, Inc.’s source code to their proposed experts, Dr. 15 Istvan Jonyer and Dr. Jae young Bang. ECF No. 110. The Court continued the hearing on this 16 dispute pending a ruling on Facebook’s motion to dismiss. On October 31, 2019, the parties filed 17 a status report concerning this dispute, ECF No. 144, and the Court heard oral argument today. 18 By way of background, Plaintiffs are suing Facebook for its alleged exploitation of a 19 vulnerability in the permission setting for the Facebook Messenger1 smartphone application that 20 existed in prior versions of the Android operating system. Sec. Am. Compl. ¶ 1, ECF No. 88. 21 When users install the app, they are prompted to grant Facebook access to their contacts and then 22 are given the choice to allow or deny. But when they made that choice, the app scraped users’ call 23 and text logs, which Facebook then monetized for advertising purposes. Id. Or at least that’s the 24 allegation. Plaintiffs say this conduct ended in October 2017, when the Android OS fully 25 deprecated this vulnerability in all versions of the Android SDK. Id. ¶ 22. They now purport to 26 sue on behalf of a nationwide class for violations of the California Computer Data Access and 27 1 Fraud Act, violations of the California right to privacy, and for intrusion upon seclusion, unjust 2 enrichment and fraud. Id. ¶¶ 36-65. 3 On April 3, 2019, Plaintiffs provided Facebook with a list of their proposed experts to 4 whom they intend to show Facebook’s source code. Facebook objected to two of them, Jonyer 5 and Bang. As to Jonyer, Facebook objected that he “worked for Facebook competitor Google 6 from August 2010 to February 2012.” ECF No. 110-1, Ex. A. In addition, Facebook objected that 7 Jonyer has an “active consulting business working with a variety of technology companies, 8 including NearMe, NimbleVR, and startups coming out of Stanford and in the ‘ex-Google 9 network.’” Id. As to Bang, Facebook objected that he “worked for Kakao Corporation for three- 10 and-a-half years until just two months ago when he left to work for Quandry Peak Research. As 11 Dr. Bang’s resume discloses, he designed and implemented the user identity platform used by over 12 100 million people who use Kakao services, including KakaoTalk, which is a messaging app 13 available on Android devices.” Id. 14 The Protective Order in this action, ECF No. 91, states that “the Party opposing disclosure 15 to the Expert shall bear the burden of proving that the risk of harm that the disclosure would entail 16 (under the safeguards proposed) outweighs the Receiving Party’s need to disclose the Protected 17 Material to its Expert.” Id. ¶ 7.5 (unnumbered subparagraph). But it also defines an expert as “a 18 person with specialized knowledge or experience in a matter pertinent to the litigation who (1) has 19 been retained by a Party or its counsel to serve as an expert witness or as a consultant in this 20 action, (2) is not a past or current employee of a Party or of a Party’s competitor, and (3) at the 21 time of retention, is not anticipated to become an employee of a Party or of a Party’s competitor.” 22 Id. ¶ 2.6 (emphasis added). Facebook argues that Jonyer and Bang do not come within the 23 definition of an “expert” and therefore are per se disqualified under the Protective Order, and thus 24 Facebook has no burden to prove risk of harm under paragraph 7.5. In other words, as Facebook 25 reads the Protective Order, the definition of an “expert” screens out certain groups of people who 26 are categorically unqualified from being an expert, and then leaves a subset of people who are 27 presumptively qualified, and the burden under paragraph 7.5 only applies to people in that subset. 1 Facebook’s interpretation of the Protective Order and additionally argue that no showing of risk of 2 harm has been made here. 3 As an initial matter, it is factually true that both Jonyer and Bang are past employees of a 4 competitor of Facebook’s. Jonyer worked for Google in 2010-12. ECF No. 110-1, Ex. B. Google 5 competes with Facebook for advertising revenue, as Plaintiffs themselves allege. Sec. Am. 6 Compl. ¶ 17 (“the online advertising industry has formed into a duopoly between Facebook and 7 Google”). Also, Gmail and Google’s messaging applications are services that compete with 8 Facebook Messenger. Jonyer’s work at Google focused on Google TV, the predecessor to 9 Chromecast, ECF No. 110-1, Ex. B, and no one contends that product was or is in competition 10 with Facebook.2 Bang worked for Kako from 2015-2019. ECF No. 110-1, Ex. C. Kakao makes a 11 messaging app that competes with Facebook Messenger. Plaintiffs assert that Bang’s work was 12 limited to the app’s user authentication platform and that he did not participate in the development 13 of KakaoTalk (the messaging app). 14 The Protective Order in this action is based on the District’s model order. As Facebook 15 observes, at least one court in this district has rejected an attempt to modify the model order in a 16 way that would have allowed the plaintiffs to hire former employees of a defendant’s competitors 17 as experts, noting the “unnecessary risk of competitive harm if the court permitted Plaintiffs to 18 hire the former employees of [Defendant’s] competitors as experts.” Corley v. Google, Inc., 2016 19 WL 3421402, at *2 (N.D. Cal. June 22, 2016). In TVIIM, LLC v. McAfee, Inc., 2014 WL 2768641 20 (N.D. Cal. June 18, 2014), the Court explained that “[t]his district clearly requires that an ‘expert’ 21 under the Protective Order may not be ‘a past or current employee of a Party or of a Party’s 22 competitor,’” id. at *2. In that case, the plaintiff’s proposed expert was then-currently employed 23 by ImmuneSoft, which defendant McAfee claimed was a competitor. Id. When the plaintiff failed 24 to address that issue head on, the Court took that as a concession and found that the proposed 25 expert “is not an ‘expert’ as defined by the Protective Order.” That section of the Court’s order 26 2 As to Jonyer’s ongoing consulting business, Facebook does not identify any particular client that 27 was or is a competitor. Further, paragraph 2.6 of the Protective Order states that the expert cannot 1 did not go on to assess the risk of harm in determining whether to allow that person to serve as an 2 expert. In isolation, that section of the order therefore seems to support Facebook’s view that 3 paragraph 2.6 of the protective order categorically excludes certain people from the definition of 4 an expert, so no further analysis of risk of harm is needed. On the other hand, the proposed expert 5 in TVIIM was also a named inventor of the patent at issue, and in the next section of the order the 6 Court held that this was an additional reason not to allow him to have access the defendant’s 7 confidential information, and the Court included an analysis of risk of harm in that section of the 8 order. Accordingly, this case does not cleanly support Facebook’s argument that being outside of 9 the definition of “expert” is the end of the matter, since the Court did end up doing an analysis of 10 risk of harm, albeit in the next section of the order. 11 Plaintiffs cite to Codexis, Inc v. EnzymeWorks, Inc., 2017 WL 5992130 (N.D. Cal. Dec. 4, 12 2017).3 In that case the protective order had a different definition of an expert, stating in relevant 13 part that an expert is someone who “does not have a current business relationship with a Party or 14 Party’s competitor,” and it defined a business relationship to mean “being a current employee, 15 being a current consultant pursuant to a consulting agreement, and/or being a current member of 16 the Board of Directors or Scientific Advisory Board of a Party or of a Party’s competitor. Id. at *6 17 n.11. The plaintiff Codexis moved to disclose confidential information to its expert witness, 18 David Dodds. The defendants objected “on the basis that he consults for three biological 19 companies.” Id. at *6. The Court concluded that “defendants have failed to meet their burden to 20 establish that the companies with which Dr. Dodds has an ongoing relationship directly compete 21 with them.” But it also went on to say that “even if the companies were found to be competitors, 22 the technology at issue here is clearly different than the subjects of ‘competition’ identified by 23 defendants, and, as a result, none of their disclosures pertain to those potentially problematic 24 areas.” Id. at *8 (emphasis added). Thus, this passage in Codexis, while dicta, does stand for the 25 proposition that falling technically outside the definition of an “expert” because of work for a 26 competitor (there, a current consulting relationship; here, a past employment relationship) does not 27 1 moot the inquiry into risk of harm. 2 To the same effect is Verigy US, Inc. v. Mayder, 2008 WL 4183493 (N.D. Cal. Sept. 8, 3 2008). In that case the defendants objected to two proposed plaintiff experts stating that they 4 previously were employed by a competitor of the defendants. The Court did not make a finding 5 regarding competitor status but instead noted that the two proposed experts had retired from the 6 other company and neither had an ongoing relationship with it and therefore there was no risk of 7 harm. Id. at *1. Thus, this case also shows that falling outside the definition of an expert because 8 of an affiliation with a competitor is not categorically disqualifying in the way that Facebook 9 asserts. Accordingly, in line with Codexis and Verigy, the Court finds that even for a proposed 10 expert who used to be an employee for a competitor of the defendant’s, the Court must still 11 conduct the risk of harm analysis referred to in the last sentence of paragraph 7.5 of the Protective 12 Order. 13 Performing this analysis, the Court finds that disclosure of Facebook’s source code to 14 Jonyer does not pose a risk of harm. Jonyer ceased working for Google seven years ago, and his 15 prior work for that company was wholly unrelated to the technology at issue in this case. If he 16 signs the acknowledgment and agreement to be bound that is attached as Exhibit A to the 17 Protective Order, there is no reason to think there is a risk of harm from disclosure. See Verigy, 18 2008 WL 4183493, at *1. 19 But Bang is a different situation. Until nine months ago, he worked at Kakao in South 20 Korea. ECF No. 110-1, Ex. C. KakaoTalk is a messaging app that allows users to send messages, 21 photos, videos, voice notes and their location for free. ECF No. 110-2 ¶ 10. It’s available in the 22 United States for Android and Apple devices. Id. It is the largest competitor to Facebook’s 23 Messenger app in South Korea. Id. ¶ 11. Although Plaintiffs state in the discovery statement that 24 Bang’s work was limited to the user authentication program, Bang’s resume states that his 25 “[r]esponsible systems include[ed]” – in addition to “user authentication system for all Kakao 26 services” – “[t]he anti-abuser and anti-spammer system” and “[t]he personal information 27 protection system.” ECF No. 110-1, Ex. C (emphasis added). Indeed, in the October 31, 2019 1 this case because he “has several years of experience in software development practice focused on 2 security and privacy-protection systems.” ECF No. 144 at 2-3. Looking at his resume, this must 3 || be areference, at least in part, to his time at Kakao — a fact Plaintiffs acknowledged at the hearing. 4 || This experience at Kakao working on privacy protection is concerning, rather than reassuring, 5 || because this lawsuit is about Facebook Messenger’s access to users’ personal information. In 6 short, Bang was employed very recently at a company whose services include the biggest 7 || competitor in South Korea to Facebook Messenger, he worked on that competing service, and it 8 appears that some of his work there concerned a subject matter that is at the heart of this lawsuit. 9 Bang is not today employed by Kakao, but he did work there for almost four years, could go back 10 || there, and certainly still knows people there. The fact that this work was in a foreign country 11 means that enforcement of the acknowledgment and agreement to be bound by the Protective 12 Order would be impracticable if Bang did go back to work at Kakao, armed with knowledge of 5 13 Facebook’s source code. 14 Plaintiffs argue that they would be prejudiced if they were unable to use Bang as an expert. 3 15 He has a Ph.D. in computer science from University of Southern California, and his areas of 16 || expertise include software design and architecture of Android apps and software version control 3 17 technology, which they say are essential in analyzing how a software system has evolved and was 18 developed over time. They assert, as noted above, that he also has several years of experience in 19 software development practice focused on security and privacy-protection systems. Bang does 20 sound highly qualified, but given the technology industry in the Bay Area and Silicon Valley, 21 there are a multitude of people nearby who have similar qualifications. Plaintiffs have articulated 22 || no reason why they need Bang in particular. 23 Facebook’s objection under paragraph 7.5 of the Protective Order to Plaintiffs’ disclosure 24 || of its source code to Bang is SUSTAINED and as to Jonyer is OVERRULED. 25 IT IS SO ORDERED. 26 Dated: November 7, 2019 27 TAA. Lf-y _ 28 THOMAS S. HIXSON United States Magistrate Judge