Case 3:17-cv-00939-WHA Document 24-2 Filed 03/10/17 Page 1 of 7

1

UNITED STATES DISTRICT COURT

2

NORTHERN DISTRICT OF CALIFORNIA, SAN FRANCISCO DIVISION

3 WAYMO LLC,
Plaintiff,
4
vs.
UBER TECHNOLOGIES, INC.;
5 OTTOMOTTO LLC; OTTO TRUCKING
LLC,
6
Defendants.

CASE NO. 3:17-cv-00939
DECLARATION OF GARY BROWN
REDACTED VERSION OF DOCUMENT
SOUGHT TO BE SEALED

7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
Case No.3:17-cv-00939
DECLARATION OF GARY BROWN

 Case 3:17-cv-00939-WHA Document 24-2 Filed 03/10/17 Page 2 of 7

1

I, Gary Brown, hereby declare as follows.

2

1.

I have been employed by Google Inc. (“Google”) since August 2013. I currently

3 hold the position of Security Engineer, Forensics. I make this declaration in support of Waymo’s
4 Motion for a Preliminary Injunction and have personal knowledge of the facts stated herein.
5

2.

I received an M.S. in Enterprise Computing and a B.S. in Cybersecurity from the

6 Stevens Institute of Technology.
7

3.

In my role as a Security Engineer in Forensics, I am responsible for gathering

8 evidence, from logs and hosts, to confirm or refute suspected compromise or abuse. I am familiar
9 with Google’s secure networks and with logs of activity on those networks that are maintained by
10 Google in the ordinary course of its business.
11

4.

It is Google’s policy to assign unique identifiers to devices issued to employees for

12 work purposes, such as work laptops. Among other functions, these unique identifiers help
13 maintain the security of Google’s secure networks. When an employee’s device interacts with a
14 Google service or is active on a Google network, those interactions and activities can be recorded
15 in logs that identify the device (by its unique identifiers) and/or the interaction or activity (for
16 example, downloading files from a secure repository).
17

5.

18
19
20

6.

21
22
23
24

7.

25
26
27
28

-2-

Case No. 3:17-cv-00939
DECLARATION OF GARY BROWN

 Case 3:17-cv-00939-WHA Document 24-2 Filed 03/10/17 Page 3 of 7

1

8.

2
3
4

9.

5
6
7
8

10.

9
10
11
12
13

11.

14

.

15

Anthony Levandowski

16

12.

Google issued a work laptop to Anthony Levandowski in July 2013 that was

17 assigned the asset inventory tag
18

13.

Based on my review of

(“the Levandowski work laptop”).
host metadata, an installed Windows operating system

19 on the Levandowski work laptop made no check-ins to
20 November 25, 2015, despite the

between March 2, 2015 and

agent being configured to do so every 15 minutes when an

21 internet connection is present. Based on my review of Google corporate network logs, the
22 Levandowski work laptop’s network interfaces appeared on the Google network a total of three
23 times between March 2, 2015 and November 25, 2015: for a period of approximately two hours on
24 October 22, 2015, approximately two hours on November 20, 2015, and then briefly on November
25 25, 2015.
26

14.

Based on my review of

host and

metadata, the Windows operating

27 system on the Levandowski work laptop was re-installed on November 26, 2015.
28

-3-

Case No. 3:17-cv-00939
DECLARATION OF GARY BROWN

 Case 3:17-cv-00939-WHA Document 24-2 Filed 03/10/17 Page 4 of 7

1

15.

Based on my review of

log data, the Levandowski work laptop ran a

2 MoMA search for the strings “chauffeur svn login” and “chauffeur svn eee setup” on December 3,
3 2015. “Chauffeur” was the name of Google’s self-driving car project, and “SVN” refers to a
4 repository used by that project which contains Waymo's design files, schematics and other
5 confidential information.
6

16.

Based on my review of logs of Google corporate network traffic and

log data,

7 the Levandowski work laptop downloaded and installed TortoiseSVN, which is software that can
8 access the self-driving car project’s SVN repository, on December 11, 2015.
9

17.

Based on my review of logs from the SVN repository and of Google corporate

10 network traffic, the Levandowski work laptop then downloaded over 14,000 files from the SVN
11 repository, also on December 11, 2015. Based on my review of logs from the SVN repository,
12 that download totaled 9.7 GBs of data, including 2 GBs from LiDAR subdirectories.
13

18.

Based on my review of

log data, a Transcend RDF5 USB 3.0 card reader was

14 attached to the Levandowski work laptop for a period of approximately eight hours on December
15 14, 2015.
16

19.

Based on my review of host metadata in

and a timeline of the hard drive of

17 the Levandowski work laptop, the Levandowski work laptop was reformatted from a Windows
18 operating system to a Linux operating system (Goobuntu, Google’s custom version of Ubuntu
19 Linux) on December 18, 2015.
20

20.

Based on my review of Google machine certificate logs, Google network logs,

21 Google host logs, and

host metadata, the Levandowski work laptop maintained a consistent

22 connection on Google’s network from the time of reformat on December 18th through its last
23 check-in to

, and obtention of a machine certificate, on December 21, 2015. The final

24 appearance of the Levandowski work laptop on Google’s corporate network occurs approximately
25 one minute after it obtained the machine certificate on December 21, 2015. From that point on,
26 there is no further appearance of the Levandowski work laptop on Google’s corporate network,
27 nor any check-ins to

despite the

agent being configured to do so every 15 minutes

28 when an internet connection is present.

-4-

Case No. 3:17-cv-00939
DECLARATION OF GARY BROWN

 Case 3:17-cv-00939-WHA Document 24-2 Filed 03/10/17 Page 5 of 7

1

21.

When a Google employee uses his or her corporate account credentials to log onto

2 Google Drive, those interactions can also be recorded even if the Google employee is accessing
3 Google Drive from a personal device. For example, if a Google employee “exports” (i.e., saves a
4 local copy of) a document from Google Drive, that interaction will be recorded in a Drive log,
5 identifying (among other things) the Google employee’s GAIA ID (a unique identification number
6 assigned by Google, resolvable to a username and domain on Google’s services), the unique ID of
7 the document exported, the operating system and browser in use, and the time and date of the
8 export.
9

22.

Based on my review of Drive log data, the Google GAIA ID

10 resolves to “

which

@google.com” – assigned to Anthony Levandowski – exported five

11 documents from Google Drive to a personal device (i.e., one that was not issued by Google) on
12 January 4, 2016, over an approximately three minute period. The names of those files are:
13

●

14

●

Extrinsic Calibration

15

●

and

Intensity Calibration

tuning Instructions

16
17
18
19

●

Assembly Flowchart SOP

●

TESTING STATION
23.

20

Based on my review of Drive log data, on January 11, 2016, the Google GAIA ID
– assigned to Anthony Levandowski – exported another document from Google

21 Drive to a personal device. The name of this file is:
22

● Chauffeur TL weekly updates - Q4 2015

23
Sameer Kshirsagar
24
25
26
27
28

24.

Based on my review of Drive log data, the Google GAIA ID

–

assigned to Sameer Kshirsagar – exported a document from Google Drive on June 3, 2016. The
name of this file is:
● Laser questions

-5-

Case No. 3:17-cv-00939
DECLARATION OF GARY BROWN

 Case 3:17-cv-00939-WHA Document 24-2 Filed 03/10/17 Page 6 of 7

1

25.

Based on my review of Drive log data, the Google GAIA ID

–

2 assigned to Sameer Kshirsagar – exported another document from Google Drive on June 14, 2016.
3 The name of this file is:
4

Ramp Checklist

●

5

26.

Based on my review of Drive log data, the Google GAIA ID

–

6 assigned to Sameer Kshirsagar – exported another document from Google Drive on June 21, 2016.
7 The name of this file is:
8

and Packaging

●

9
27.

Based on my review of Drive log data, the Google GAIA ID

–

10
assigned to Sameer Kshirsagar – exported another document from Google Drive on June 22, 2016.
11
The name of this file is:
12
13
14

-Lens Placement-01

●
28.

Based on my review of Drive log data, the Google GAIA ID

–

15 assigned to Sameer Kshirsagar – exported another document from Google Drive on July 12, 2016.
16 The name of this file is:
17

● All things

Part 3-

mode

-

18
Radu Raduta
19
29.

Based on my review of Drive log data, the Google GAIA ID

–

20
assigned to Radu Raduta – exported, over an approximately ten minute period, three documents
21
from Google Drive on July 28, 2016. The names of those files are:
22
23
24
25
26

● Die - wire bonding houses
● External Vendors and Consultants List
● automation vendors
I declare under penalty of perjury that the foregoing is true and correct. Executed in San

27 Jose, California, on March 9, 2017.
28

-6-

Case No. 3:17-cv-00939
DECLARATION OF GARY BROWN

 Ix)

 

 

Case Document 24-2 Filed 03/10/17 Page 7 of 7

DATED: March 9. 2017 A

Gary Brown/

-7- Case No. 
OF GARY BROWN