Case 4:19-cv-07123-PJH Document 55-2 Filed 04/23/20 Page 1 of 2 1 2 3 4 5 6 7 8 9 10 COOLEY LLP MICHAEL G. RHODES (116127) (rhodesmg@cooley.com) TRAVIS LEBLANC (251097) (tleblanc@cooley.com) KYLE C. WONG (224021) (kwong@cooley.com) JOSEPH D. MORNIN (307766) (jmornin@cooley.com) 101 California Street, 5th floor San Francisco, CA 94111-5800 Telephone: (415) 693-2000 Facsimile: (415) 693-2222 DANIEL J. GROOMS (D.C. Bar No. 219124) (admitted pro hac vice) (dgrooms@cooley.com) 1299 Pennsylvania Avenue, NW, Suite 700 Washington, DC 20004-2400 Telephone: (202) 842-7800 Facsimile: (202) 842-7899 Attorneys for Plaintiffs WHATSAPP INC. and FACEBOOK, INC. 11 UNITED STATES DISTRICT COURT 12 NORTHERN DISTRICT OF CALIFORNIA 13 14 15 16 WHATSAPP INC., a Delaware corporation, and FACEBOOK, INC., a Delaware corporation, Plaintiffs, 17 18 19 20 21 v. NSO GROUP TECHNOLOGIES LIMITED and Q CYBER TECHNOLOGIES LIMITED, Case No. 4:19-cv-07123-PJH DECLARATION OF CLAUDIU GHEORGHE IN SUPPORT OF PLAINTIFFS’ OPPOSITION TO DEFENDANTS’ MOTION TO DISMISS Date: May 27, 2020 Time: 9:00 a.m. Courtroom: 3 Judge: Hon. Phyllis J. Hamilton Defendants. 22 23 24 25 26 27 28 COOLEY LLP ATTORNEYS AT LAW SAN FRANCISCO GHEORGHE DECL. ISO OPP. MTD CASE NO. 4:19-CV-07123-PJH Case 4:19-cv-07123-PJH Document 55-2 Filed 04/23/20 Page 2 of 2 1 I, Claudiu Gheorghe, declare: 2 1. I submit this declaration in support of Plaintiffs Facebook Inc. and WhatsApp, Inc.’s 3 Opposition to Defendants’ Motion to Dismiss the Complaint in the above-captioned matter. The 4 information in this declaration is based on my personal knowledge of this matter and information I 5 obtained following a reasonable investigation of the events described below. If called as a witness, I 6 could competently testify to the truth of each statement. 7 2. I am a Software Engineering Manager on the WhatsApp Inc. Security team located in 8 Menlo Park, California. I have been employed by Facebook Inc. or WhatsApp, Inc. since July 30, 9 2012. I was involved in investigating the attack described in the Complaint. At least ten engineers 10 based in WhatsApp Inc. and Facebook, Inc.'s California offices worked on investigation and 11 remediation for this attack. There were additional engineers working on this investigation and 12 remediation located in the United States, as well as other locations. 13 3. I have reviewed the malicious code sent during the attack described in the Complaint. 14 That malicious code was designed to cause a WhatsApp user’s mobile device to connect to a remote 15 server not associated with WhatsApp. The IP address of the remote server was included in the 16 malicious code. 17 4. In 720 instances of the attack, the remote server’s IP address was 104.223.76.220. 18 5. In 3 instances of the attack, the remote server’s IP address was 54.93.81.200. 19 I declare under penalty of perjury under the laws of the United States that the foregoing is 20 true and correct. Executed at San Mateo, California, on the 23rd day of April, 2020. 21 ___________________________________ Claudiu Gheorghe 22 23 24 25 26 27 28 COOLEY LLP ATTORNEYS AT LAW SAN FRANCISCO 1 GHEORGHE DECL. ISO OPP. MTD CASE NO. 4:19-CV-07123-PJH