Forensic Investigation

Breaking Code Silence’s Investigation

According to BCS’s Complaint, in early March 2022, one of BCS’s board members was making changes to BCS’s website. The board member searched for BCS’s website on Google Search to see how the changes looked. However, when she searched for the website on Google, she could not find it. BCS then launched an improper forensic investigation as to why the website was not appearing on Google Search and failed to preserve the necessary evidence to determine who was responsible for the deindexing.

The first primary investigator was a self-taught webmaster who admitted to having no qualifications relevant to forensic investigations. The second primary investigator was Jesse Jensen.

From Mr. Whiteley’s Motion for Summary Judgment:

“Jensen is a purported “forensic data privacy analyst,” a technology position that Defendants’ expert has never heard of. (Walton Decl., ¶¶35-37; Ex. 48, pp. 31:10-45:3.) Jensen also lacks the qualifications to do a forensic investigation. (Walton Decl., ¶¶35-37.) 

Jensen began his investigation on March 11, 2022. (Ex. 48, pp. 90:6-91:4.) Like Beauregard, Jensen looked at the Google Search Console to see that requests to temporarily remove the .Org Domain from Google Search were made on March 8 and 9. (Id., p. 93:8-13.) Jensen also saw that when he signed on to the Google Tools on March 11 (two days after the request was allegedly submitted), Whiteley had ownership access. Based on these facts and, having been told that Defendants were known to be “hostile” to BCS, Jensen concluded that it must have been Defendants who submitted the deindex request. (Id., pp. 100:16-101:10; 154:16-25.)

On March 12, Jensen was able to cause the website to appear on Google Search again. (UMF 53.) Jensen produced a one-page report attaching no evidence and containing no discernable analysis, accusing Defendants of using the Google Search Console to deindex the website. (Walton Decl., ¶¶9, 38-41; Ex. 48, pp. 81:13-82:21; Ex. 65.)

In conducting its “investigation,” BCS failed to take the necessary steps to collect and preserve the digital evidence necessary to determine whether someone accessed a BCS account without authorization and, if so, who. (UMF 5.) While speaking to Google support, Jensen did not even ask who made the deindexing request because he already presumed it was Defendants. (Ex. 48, pp. 100:16-101:10.)”

After his investigation, Jensen produced this one-page report without any additional attached evidence or analysis.

Jensen admitted the following during his deposition:

  • Jensen possesses no cybersecurity or forensic certifications
  • Jensen never took a class on cybersecurity for either of his degrees
  • Jensen never received any formal education on cybersecurity
  • Jensen never attended a seminar on cybersecurity
  • Jensen never gave any outside presentations on cybersecurity
  • Jensen never published any publications on cybersecurity
  • Jensen does not belong to any professional organizations related to cybersecurity
  • Jensen does not have a background in law or law enforcement related to cybersecurity
  • Jensen never has been formerly employed as a forensic investigator

To review Jensen’s deposition on the matter, see Page 31 Line 10 through Page 39 Line 3.

Note: Despite initially identifying Jesse Jensen as a “forensic data privacy expert” in their Complaint and subsequent discovery responses, Breaking Code Silence chose not to designate Jensen as an expert witness or even retain any expert witness in this action.

McNamara and Whiteley’s Forensic Expert

In March 2023, Mrs. McNamara and Mr. Whiteley’s counsel retained Clark Walton, Esq to investigate the allegations in Breaking Code Silence’s complaint. Mr. Walton’s professional experience includes:

  • Intelligence Analyst/Cyber Threat Subject Matter Expert for the Central Intelligence Agency (CIA)
  • Honors Intern for the Federal Bureau of Investigation (FBI)
  • Homeland Security Staff for the White House
  • Senior Civil Enforcement Attorney for the North Carolina Department of Justice, Attorney General’s Office
  • Assistant District Attorney for the State of North Carolina 26th Prosecutorial District
  • Taught courses in Evidence and Cyber Crime at the Charlotte School of Law
  • Currently teaches digital forensic coursework at the National Computer Forensics Institute
  • Managing Director of Reliance Forensics, LLC
  • Conducted or oversaw over 1,750 digital investigations on behalf of legal counsel, corporate entities, and individuals.

In this case, Mr. Walton reviewed evidence provided by Breaking Code Silence as well as conducted an expert review of their systems. He submitted the following declaration in support of Mr. Whiteley’s Motion for Summary Judgment:

Evidentiary Standard

From Whiteley’s Motion for Summary Judgment:

“Thus, BCS’s entire case rests on the belief that (1) only a handful of people had the administrative access necessary to submit a deindex request, and (2) of those people, Defendants are the most likely persons in that group to have done it. As shown in the preceding section, BCS’s argument falls apart because Whiteley did not have administrative permissions at the time of the deindexing. (UMFs 44-45.) However, even if Whiteley did have administrative permissions at the time of the deindexing (which he did not), BCS’s evidence is thinly circumstantial at best and insufficient to overcome summary judgment.”

To quote a motion from a largely cited case (LVRC Holdings LLC vs Brekka):

“18 U.S.C. § 1030(a)(4), requires a plaintiff to present evidence on four elements: (1) defendant has accessed a “protected computer;” (2) has done so without authorization or by exceeding such authorization as was granted; (3) has done so “knowingly” and with “intent to defraud”; and (4) as a result has “further[ed] the intended fraud and obtain[ed] anything of value.” P.C. Yonkers, Inc. v. Celebrations the Party and Seasonal Superstore, LLC., 428 F.3d 504, 508 (3rd Cir. 2005) (quoting statute). Proving a violation of the CCFA requires a detailed examination of hard evidence, and, as a practical matter, proving civil liability under the CCFA will mirror the standard for proving criminal liability. See id. at 509. In P.C. Yonkers, it was uncontroverted that defendants had accessed plaintiffs’ computer system after leaving plaintiffs’ employment. Id. The Third Circuit, however, affirmed the district court’s decision to deny plaintiffs’ request that defendants be enjoined from using plaintiffs’ trade secrets to operate competing stores because plaintiffs could not prove defendants had obtained anything of value through the unauthorized access. Id. Plaintiffs urged the court to draw inferences of intent and that the defendants obtained valuable information from the mere fact that unauthorized access had been shown. Id. The court rejected that invitation, holding, “the elements of the claims asserted are part of a plaintiff’s burden. That information was taken does not flow logically from mere access.” Id. (emphasis added). Similarly, in this case, plaintiff must prove that it was defendants who used LVRC’s administrative function to access Load’s computer system.”

The Brekka case, widely considered to be one of the leading authorities on the CFAA in the Ninth Circuit, drives this point home. In Brekka, an employee was accused of logging into his employer’s website after his termination. Specifically, two months after the employee’s termination, the company’s marketing consultant saw that someone was logged into the website using the employee’s email address. The consultant was also able to see the IP address of the login as well as the location of the internet service provider from which the access occurred, and noted that the location matched the employee’s known location. Notwithstanding this evidence, the court granted summary judgment finding that the employer failed to raise a genuine issue of material fact.  The Brekka court found that the evidence of the employee’s email and password being used was insufficient because someone other than the employee may have used the employee’s email credentials. The court further found that the location of the internet service provider was insufficient because it did not necessarily show where the person accessing the website was physically located.

The parallels between Brekka and the instant case are plain. In Brekka, there was insufficient evidence to survive summary judgment even though the plaintiff was able to definitively show that the unauthorized access was made by someone using the employee’s credentials. Here, BCS cannot even demonstrate that Mr. Whiteley or Mrs. McNamara’s permissions were used to access the Google Search Console and deindex its website, but rather, assumes that Mr. Whiteley or Mrs. McNamara’s permissions were used because Mrs. McNamara and Mr. Whiteley are “known hostiles.” Like the employer in Brekka, BCS has not eliminated the possibility that someone else accessed the Google Search Console. Critically, BCS cannot eliminate the possibility that its own volunteers inadvertently deindexed the website.

Further, unlike Brekka, BCS did not identify the IP address or the internet service provider location which supposedly accessed the Google Console. As Clark Walton observed, BCS has put forward nothing beyond mere speculation.

To quote the Order granting the motion for summary judgment in the Brekka case:

“The moving party bears the initial burden of showing the absence of a genuine issue of material fact. See Celotex, 477 U.S. at 323. The burden then shifts to the nonmoving party to set forth specific facts demonstrating a genuine factual issue for trial. See Matsushita Elec. Indus. Co. v. Zenith Radio Corp., 475 U.S. 574, 587 (1986); Fed. R. Civ. P. 56(e). 

All justifiable inferences must be viewed in the light must favorable to the nonmoving party. See Matsushita, 475 U.S. at 587. However, the nonmoving party may not rest upon the mere allegations or denials of his or her pleadings, but he or she must produce specific facts, by affidavit or other evidentiary materials as provided by Rule 56(e), showing there is a genuine issue for trial. See Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 256 (1986). The court need only resolve factual issues of controversy in favor of the non-moving party where the facts specifically averred by that party contradict facts specifically averred by the movant. See Lujan v. Nat’l Wildlife Fed’n., 497 U.S. 871, 888 (1990); see also Anheuser-Busch, Inc. v. Natural Beverage Distribs., 69 F.3d 337, 345 (9th Cir. 1995) (stating that conclusory or speculative testimony is insufficient to raise a genuine issue of fact to defeat summary judgment). Evidence must be concrete and cannot rely on “mere speculation, conjecture, or fantasy. O.S.C. Corp. v. Apple Computer, Inc., 792 F.2d 1464, 1467 (9th Cir. 1986). “[U]ncorroborated and self-serving testimony,” without more, will not create a “genuine issue” of material fact precluding summary judgment. Villiarimo v. Aloha Island Air Inc., 281 F.3d 1054, 1061 (9th Cir. 2002).”

Like this post? Read more here: A Plot to Sue? 

January 2, 2024
I ‘
1 Dirk 0. Julander, Bar No. 132313
doj(a)Jbblaw. com
2 Catnerine A. Close, Bar No. 198549
cac(ci),jbblaw.com
3 M. Aciam Tate, Bar No. 280017
adam(ci),j bblaw. com
4 JULANDER, BROWN & BOLLARD
9110 Irvine Center Drive
5 Irvine, Califmnia 92618
Telephone: (949) 477-2100
6 Facsimile: (949) 477-6355
7 Attorneys for Defendants
KATHERINE MCNAMARA and
8 JEREMY WHITELEY
9
10
11
12
UNITED STATES DISTRICT COURT
CENTRAL DISTRICT OF CALIFORNIA
13 BREAKING CODE SILENCE, a
California 501(c)(3) nonprofit,
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
Plaintiff,
vs.
KATHERINEMCNAMARA an
Individual; JEREMY WHITELEY, an
individual; and DOES 1 through 50,
inclusive,
Defendants.
Case No. 2:22-cv-002052-SB-MAA
DECLARATION OF CLARK C.
WALTON, ESQ. IN SUPPORT OF
MOTION FOR SUMMARY
JUDGMENT OR IN THE
ALTERNATIVE PARTIAL
SUMMARY JUDGMENT
Date:
Time : 10:00 a.m.
Crtrm: 690[Assigned to the Hon. Maria A. Audero] WALTON DECL. RE: MOTION FOR SUMMARY JUDGMENT
Case 2:22-cv-02052-MAA Document 152-7 Filed 11/22/23 Page 1 of 16 Page ID #:4440
1
2
3
4
5
DECLARATION OF CLARK C. WALTON, ESQ.
I, CLARK C. WAL TON, ESQ., hereby declare and state under penalty of
perjury the following facts and opinions:
1. I am over the age of eighteen and not a party to the within action. I
6 submit this Declaration in support of the Motion for Summary Judgment filed on
7 behalf of Defendant JEREMY WHITELEY (“Whiteley”). I have personal knowledge
8 of the following facts and, if called upon to testify, I can and will truthfully testify
9 thereto.
10 2. I am the principal digital forensics expert for Reliance Forensics, LLC,
11 based in Charlotte, North Carolina. Reliance Forensics is a highly experienced,
12 specialized digital investigation and cybersecurity consulting firm (referred to herein
13 as “Reliance Forensics” or “Reliance”). As its principal, I have conducted or overseen
14 well over 1,750 digital investigations on behalf of legal counsel, corporate entities
15 and individuals.
16 3. I was formerly employed as a cyber-threat analyst and technical project
17 manager for the Central Intelligence Agency from 2000 through 2005. I currently
18 teach digital forensic coursework several time per year to state and tribal judges and
“I -•,11111. 19 law enforcement officers at the National Computer Forensics Institute in Hoover,
20 Alabama. I previously taught courses in Evidence and Cyber Crime at the Charlotte
21 School of Law, and I have served as a graduate thesis adviser in the UNC Charlotte
22 Department of Criminology. I have also taught computer forensics coursework at
23 Champlain College based in Burlington, Vermont, as well as to U.S. military assets
24 and federal law enforcement. I have an undergraduate degree from the University of
25 North Carolina at Chapel Hill in Mathematical Sciences (Computer Science Option),
26 and a law degree from Georgetown University Law Center. A true and correct copy
27 ofmy current CV is included in the Index of Exhibits as Ex. 95.
28 4. I am a licensed North Carolina attorney in good standing. I am certified
2
WAL TON DECL. RE: MOTION FOR SUMMARY JUDGMENT
Case 2:22-cv-02052-MAA Document 152-7 Filed 11/22/23 Page 2 of 16 Page ID #:4441
I
1 by the North Carolina State Bar as a specialist in Privacy and Information Security
2 Law and am a Certified Information Privacy Professional (CIPP/US). I was named
3 the American Bar Association (“ABA”) National Outstanding Young Lawyer for the
4 2012 bar year. I have substantial digital forensic, electronic discove1y and evidentiaiy
5 experience in both government and private practice, and I hold four current industry
6 certifications in digital forensics.
7 5. On or about March 1, 2023, Reliance was contacted, and subsequently
8 retained, by counsel to Defendants Katherine McNamara (“McNamara”) and Jeremy
9 Whiteley (“Whiteley”) in this matter.
10 6. Reliance was initially provided with copies of the Complaint and Answer
11 in the Matter and asked to provide digital forensic consulting services on behalf of
12 McNamara and Whiteley (together, the “Clients”) in respect of the allegations levied
13 in the Complaint by the Plaintiff against the Clients.
14 7. I have been provided with documents bearing Bates stamps (beginning
15 with one of these prefixes: “BCS,” “CTRL,” “DEF,” and “DEFEXP”) that I
16 understand have been produced in this Matter, as well as various discovery responses
17 I understand have been produced to Clients’ counsel by BCS.
18 8. I also understand that there was an expectation, created in part by
Z\ 19 documents already produced, that BCS would produce to Clients’ counsel additional
20 documents containing what they will present as proof of the various digital intrusions
21 alleged in the Complaint. Examples of some types of documents that may be
22 produced, without limitation, are listed in a document that I have been provided titled
23 “Appendix A to Plaintiff Breaking Code Silence’s Response to Defendant Katherine
24 McNamara’s First Set of Interrogatories”. Based on the evidence I have reviewed,
25 Plaintiff has in fact, not produced such evidence.
26 9. I have also been provided with what is labeled as the “Jensen Forensic
27 Report” and produced by BCS, Ex. 65 in the Index of Exhibits. This document does
28 not appear to be a digital forensic report containing conclusions to a reasonable degree
3
WAL TON DECL. RE: MOTION FOR SUMMARY JUDGMENT
Case 2:22-cv-02052-MAA Document 152-7 Filed 11/22/23 Page 3 of 16 Page ID #:4442
~I
00
~~ ~<
~~
~ ~ oO
z~
<~
e_ I
00
I ‘
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
of forensic certainty, as its title may imply, rather it contains a one-page narrative
written by an employee of Plaintiff and dated March 14, 2022. Subsequent discovery
has shown that this employee, while an IT professional, has no digital forensic training
or experience. It is unclear if this is the reporting of the “forensic data privacy experts”
whom BCS alleges that they engaged in paragraph 40 of the Complaint, or if there is
other reporting and/or supplemental forensic data, separate and apart from the items
discussed in paragraph 8 above in this Declaration, that was expected to have been
produced but was not, bearing on the digital forensic investigation in the Matter.
Typical data in that regard could include access logs, screen shots, forensic examiner
notes, original emails, documents or text messages (including associated metadata, in
each instance) bearing on access, results of any investigation such as IP (Internet
Protocol) address tracing and/or correlation that occurred, and the like.
10. Generally speaking, evidence supporting allegations of exceeding
authorized access or unathorized access to a data system may take the form of
technical logs or other data collected and bearing on access to the system, as well as,
if necessary, data such as IP address information potentially tying access logs to a
person, subscriber, physical address, and so forth at a point in time. Such technical
data collected would be critical to forming opinions regarding who accessed a
particular system and when, as well as what actions that person potentially took when
accessing such asset. For almost all of Plaintiff’s allegations, no data in this regard
21 appears to have been produced yet.
22
23
Examination of Plaintiff’s Online Accounts Purported to be at Issue
11 . Under the observation of Plaintiff’s counsel, Clients’ counsel, and
24 Clients, I was pe1mitted with appropriate authority via Zoom to conduct an online
25 review of various Plaintiff digital assets that they claim ( or at least claimed at the
26 time) were compromised by one or both Clients. This examination occurred remotely
27 on June 26, 2023. The meeting was recorded by Zoom, and I have provided the
28 entirety of such video to Clients’ counsel, whom I understand have provided a copy
4
WALTON DECL. RE: MOTfON FOR SUMMARY JUDGMENT
Case 2:22-cv-02052-MAA Document 152-7 Filed 11/22/23 Page 4 of 16 Page ID #:4443
1 to counsel for Plaintiff.
2 12. In addition to the video recording, I also took over 340 screenshots of
3 various account information, histories, and associated metadata to document my work
4 (partly in the event the video recording failed, as the video file is only compiled as a
5 file at the end of Zoom meetings) and, where possible, I downloaded “native” copies
6 of various logs in the accounts to the extent such were available.
7 13. Plaintiffs online assets/accounts I examined on June 26, 2023 include,
8 among others: (a) Google Search Console (a.k.a. Webmaster Central); (b) Google
9 Ad.min Console; and ( c) Google Analytics.
10
11
Google Search Console (a.k.a., Webmaster Central)
14. I examined Google Search Console on June 26, 2023 , by logging in using
12 various administrative accounts of Plaintiff and examining the “properties” (i.e., a
13 term of art here describing web domains or URLs) to which each account had access
14 and the data retrievable for each property. (Google Search Console was previously
15 known as Google Webmaster Central.)
16 15. My examination of Google Search Console for
17 admin@breakingcodesilence.org showed that this account no longer has access to any
18 of Plaintiffs properties, or for that matter any properties at all.
16. Mr. Jensen’s account Gjensen) had access to only two prope11ies,
20 https://breakingcodesilence.org and https://www.breakingcodesilence.org.
21 17. Ms. Magill’s account (Gmagill) had no access to Plaintiff properties in
22 the Google Search Console.
23 18. Megan Hurwitt’s account (mhurwitt) had access to one Plaintiff property
24 Google Search Console, that was https://breakingcodesilence.org.
25 19. ‘s account (n) had access to four BCS
26 properties, https:/ /breakingcodesilence.org, https ://www.breakingcodesilence.org,
27 http://breakingcodesilence.organdhttp://www.breakingcodesilence.org. Her account
28 was the only one that at the time of inspection had access to all four properties at the
5
WALTONDECL. RE: MOTION FOR SUMMARY JUDGMENT
Case 2:22-cv-02052-MAA Document 152-7 Filed 11/22/23 Page 5 of 16 Page ID #:4444
~I
oo
~~ ~<
~….:l
~~ oO
z~
<~
e1
00
‘ ‘
2
3
4
5
6
7
1 same time m Google Search Console. See Ex. 84 in the Index of Exhibits
(2.png). Upon infonnation and belief, it also appears that the access to the
various properties has likely changed among the Plaintiffs administrative accounts
since March 2022. I am further informed that Ms. is no longer a volunteer
for Plaintiff, although her administrative account continues to exist. is a
self-taught webmaster who admits having no qualifications relevant to forensic
investigations.
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
20. The logs I observed in Google Search Console show that on March 12,
2022, iristheangel@gmail.com (the known Google account of Client McNamara)
delegated ownership of two prope1ties, https://breakingcodesilence.org and
https://www.breakingcodesilence.org to jeremy@medtexter.com (the known email
account of Client Whiteley). See Exs. 85-89 in the Index of Exhibits. Exhibits 85
(Jensen2.png), 86 (Jensen3.png), 87 (Jensen4.png), 88 (Jensen5.png), and 89
(Jensen6.png) are true and correct copies of screenshots that I personally took during
my examination of Plaintiffs digital assets on June 26, 2023. Upon information and
belief, this March 12, 2022 set of activity by McNamara occwred because she
received a notification of unexpected activity on the breakingcodesilence.org domain
indicating someone was attempting to take control of the breakingcodesilence.org
domain on her Hover account, both of which I am informed she purchased and owns.
As she did not want to lose control of the site, she then delegated access to Whiteley
as a precautionary measure (which, as the logs show, Plaintiff subsequently removed)
so that, upon information and belief, Whiteley could witness any alterations to the
breakingcodesilence.org domain or the Hover account. Other than the delegation of
authority to Whiteley the logs show no other actions by Whiteley or McNamara
during that time period. No evidence exists that other than browsing into the Google
Search Console webpage to view the strange additions and removals of permissions,
Whiteley took any other actions with respect to the breakingcodesilence.org domain
28 or BCS ‘s website.
6
WALTON DECL. RE: MOTION FOR SUMMARY JUDGMENT
Case 2:22-cv-02052-MAA Document 152-7 Filed 11/22/23 Page 6 of 16 Page ID #:4445
~
, 00
~~ ~<
~~
~ ~ oO
z~
< a’?S
e_ I
00
I ‘
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
21. Upon my examination of the logs for these properties, logs were not
available prior to March 11, 2022. During my investigation, I noted that some of that
earlier activity was captured as a screenshot and uploaded to Slack by
. But for such screenshots, we do not know to what extent Plaintiff had
access to and/or properly preserved historical logs (i.e., for the trailing year) prior to
that timeframe. Such logs may have been available at an earlier time when litigation
was either contemplated or pencling and were permitted to spoil by Plaintiff.
22. Beyond my inspection and review, I am aware of several “fuzzy”
screenshots submitted by Plaintiff bearing on the allegations related to the Google
Search Console for the breakingcodesilence.org domain – and the allegation by
Plaintiff that one or more Clients somehow submitted a de-indexing request for the
Plaintiff web site on or about March 9 or 10, 2022. One such screenshot,
BCS_0573687, is difficult to read, but appears to document numerous errors with
indexing Plaintiff web pages submitted to Google, presumably legitimately by
Plaintiff, including two URL’ s marked “noindex” – meaning the party submitting the
site to Google specified that such website not be indexed by Google. The submitting
party could have specified the main BCS web page was not to be indexed, which
would effectively have prevented the entire site from being indexed in Google. This
would amount to more likely an “unforced error” by Plaintiff in administering their
property as opposed to any nefarious activity by Clients.
23. Beyond Plaintiffs own speculation, I am unaware of any proof that
Plaintiff has put forward showing who may have submitted the alleged Google
deindexing request or has refuted that the de-indexing was possibly triggered
automatically due to issues with Plaintiffs web site. Notably, in my review of the
property https://www.breakingcodesilence.org, I learned that on March 7, 2022,
several “broken” site maps were submitted to Google that could not be fetched. See
Exs. 90 and 91 in the Index of Exhibits. Exhibits 90 (Jensen60.png) and 91
( J ensen6 l .png) are true and co1rect copies of screenshots that I personally took during
7
WAL TON DECL. RE: MOTION FOR SUMMARY JUDGMENT
Case 2:22-cv-02052-MAA Document 152-7 Filed 11/22/23 Page 7 of 16 Page ID #:4446
I
1 my examination of Plaintiffs digital assets on June 26, 2023.
2 24. As I understand it, these submissions were made a day or two prior to
3 the alleged de-indexing request. Broken sitemaps can cause substantial issues in
4 attempting to index a web site and may have triggered an automated Google response.
5 The sitemap issues do not appear to have been corrected until March 12, 2022.
6 25. Issues seem to persist with Plaintiffs web site. In fact, as of July 10,
7 2023, there appeared to be no sitemap in the publicly available “robots.txt” file in the
8 property web site, which would tell a search engine “bof’ ( an automated piece of code
9 crawling the Internet for purposes of search engine indexing) how to index the
10 website. My examination on June 26, 2023, showed over 40 “alerts” for the property,
11 the majority of which appeared to be unread or unopened until the time of my
12 examination, dating back to the time period of the alleged de-indexing. I make the
13 observation, based on the foregoing, that Plaintiff seemed and seems to put a low level
14 of effort into properly maintaining its web site’s search engine optimization (“SEO”)
15 and investigating issues associated with SEO.
16 26. Finally, related to Plaintiffs allegation that Clients submitted the
17 deindexing request, it is unclear whether Plaintiff attempted to obtain additional
18 information regarding the de-indexing request from Google, such as the login IP
1′ 19 address of the account associated with the request, that could have provided more
20 information about the identity of the requestor. If they indeed failed to collect that
21 information, it has almost certainly spoiled with the passage of time (now well over
22 one year ago).
23
24
Google Admin Console
27. Here again there is a vague accusation by Plaintiff that one or more
25 Clients may have accessed Plaintiffs Google Admin console on or before March 31,
26 2022. Upon information and belief, after McNamara’s resignation in December 2021 ,
27 only Vanessa Hughes and Jenny Magill had administrative access to the Google
28 Admin Console. If Plaintiffs current accusation is that one or more Clients “hacked”
8
WAL TON DECL. RE: MOTION FOR SUMMARY JUDGMENT
Case 2:22-cv-02052-MAA Document 152-7 Filed 11/22/23 Page 8 of 16 Page ID #:4447
~I
00
~~ ~<
~~
~~
oO
z~
<&.S
21
I
~ ‘
1 one of those two administrative accounts, I have seen no evidence bearing on such
2 allegation produced by Plaintiff, and my review of the Google Admin Console did
3 not show any proof thereof.
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
28. I did download and review the available administrative event log
(“Google Admin Log Events.csv”, a true and correct copy is Ex. 102 in the Index of
Exhibits and bears the Bates stamp DEFEXP-000008) and user log (“User log
events.csv”, a true and correct copy is Ex. 103 in the Index of Exhibits and bears the
Bates stamp DEFEXP-000087). In each case these only go back six months from the
time period of my examination. It is unknown whether Plaintiff properly collected
and preserved these logs that would cover the relevant time period (prior to March 31 ,
2022), or if Plaintiff allowed those records to spoil. To my knowledge, Plaintiff has
not separately produced any such logs or records in this litigation.
29. It is possible that Plaintiff is conflating access to the Google Admin
Console with Google Drive. I am aware of the document BCS_0751998 (Ex. 100 in
the Index of Exhibits), which shows that a valid Plaintiff Google account shared a
folder with McNamara’s personal Google account on December 13, 2021 , after
McNamara’s separation from Plaintiff, and McNamara downloaded it. This appears
to be a series of valid Google transactions, however, unless there is some allegation
by Plaintiff that Client McNamara “hacked” the valid Plaintiff account shown.
3 0. I am aware of one other document, BCS _ 07 51994 (Ex. 101 in the Index
of Exhibits), which shows McNamara viewing a publicly available document in
Google Drive after her separation. Note that I only state the above two examples of
what appear to be McNamara’s valid access to Google Drive assets for completeness.
To be clear, and to a reasonable degree of technical certainty, I am truly at a loss for
what Plaintiff is claiming is unauthorized access or exceeding authorized access to
either its Google Admin Console or Google Drive.
Google Analytics
31. I also examined the Plaintiffs Google Analytics (a.k.a., Google Site Kit)
9
WALTON DECL. RE: MOTION FOR SUMMARY JUDGMENT
Case 2:22-cv-02052-MAA Document 152-7 Filed 11/22/23 Page 9 of 16 Page ID #:4448
I
1 account. I examined the change history in the account for potential actions taken by
2 Clients after their separation from Plaintiff. I took over 25 screenshots documenting
3 these logs, for ease of the reader I do not attach all here, but rather summarize the
4 entries relevant to Clients:
5 a. June 30, 2021 – Whiteley granted access to McNamara as he was
6 resigning; and
7 b. August 18, 2021 – Client McNamara removed Whiteley’s access,
8 and also granted access to fellow board members Vanessa Hughes and Jenny Magill.
9 32. Approximately three months after McNamara resigned from Plaintiff, on
10 March 6, 2022, Magill’s account removed McNamara’s access to Google Analytics.
11 33. There appear to be no accesses by either Client after their separation. As
12 with other accounts, it is unclear exactly what Plaintiff is claiming was accessed
13 without, or in excess of, authorizations, but in my professional opinion to a reasonable
14 degree of forensic certainty there is no evidence of access to this asset by either Client
15 post-separation.
16 34. Notably, in my review of the Google Analytics account, there appears to
17 be no tracked web traffic listed on the Plaintiff web site between early March to March
18 31, 2022. This would be indicative of some type of issue interfering with the website’s
1′ 19 ability to send tracking information to Google Analytics. I am aware of the existence
20 of an email dating to April 13, 2022, where admits to Jensen that she
21 accidentally deactivated a Google plugin on the Plaintiffs WordPress website (which
22 may have caused the issue). See Exs. 92-94 in the Index of Exhibits. Exhibits 92
23 (Jensen158.png), 93 (Jensen159.png), 94 (Jensen160.png) are each true and correct
24 copies of screenshots that I personally took during my examination of Plaintiffs
25 digital assets on June 26, 2023.
26 35. I have reviewed the deposition testimony of Jesse Jensen in this matter,
27 which upon infmmation and belief occurred on Friday, April 14, 2023 (the “Jensen
28 Deposition”) (Ex. 48 in the Index of Exhibits). Page and line references to the Jensen
10
WAL TON DECL. RE: MOTION FOR SUMMARY JUDGMENT
Case 2:22-cv-02052-MAA Document 152-7 Filed 11/22/23 Page 10 of 16 Page ID #:4449
I
1 Deposition herein refer to Ex. 48.
2 36. From a technical perspective, many of Mr. Jensen’s assertions are
3 concerning. Jensen appears to confidently assert that he is qualified to be a ”forensic
4 data privacy expert” (See, e.g., Jensen Deposition at page 31 , line 20 through page 32
5 line 6).
6 3 7. Respectfully, there is no such thing as a “forensic data privacy expert”. I
7 have been involved in infonnation security for over twenty years, including as a
8 “digital forensic expert” and as a “data privacy expert”. I have never heard of a
9 “forensic data privacy expert” during my career, and indeed a Google search for the
10 phrase at the time yielded zero results across the entire Internet.
11 38. It is possible either Mr. Jensen or Plaintiffs counsel has conflated these
12 two concepts in styling this designation. As someone who has been designated and
13 credentialed as an expert in both fields, this is concerning regarding whether the
14 individual has such expertise in either field.
15 39. More accurately I believe what Mr. Jensen believes he conducted in this
16 Matter would be characterized as “incident response”, i.e., the response of information
17 security professionals to a security incident or a “breach”. This is typically geared
18 toward halting and remediating infonnation security issues, rather than performing a
il\ 19 forensic investigation of an incident. I see nothing in Mr. Jensen’s responses in this
20 Matter, nor his stated training, experience or certifications that would qualify as true
21 digital forensic or data privacy work.
22 40. Mr. Jensen does not appear to have any formal training or certifications
23 in either field and appears to be ignorant of the training and certification options and
24 frameworks available to obtain knowledge and expertise. Moreover, when questioned
25 on the subject he tended to belittle any such training or certifications as already
26 “obsolete” when presented, and not “credible” (see pages 35-37 of Jensen Deposition).
27 41. His statements here are simply untrue. In the digital forensic field, there
28 are numerous “vendor specific” (related to certain forensic tools) and “vendor
11
WALTON DECL. RE: MOTION FOR SUMMARY JUDGMENT
Case 2:22-cv-02052-MAA Document 152-7 Filed 11/22/23 Page 11 of 16 Page ID #:4450
I
1 agnostic” certifications that enjoy widespread credibility and demonstrate capability
2 in expe11ise (for example I presently hold four such “vendor specific” certifications).
3 There are likewise several international organizations, and numerous conferences,
4 dedicated to developing expertise, knowledge sharing and improving the field. For
5 one such forensic tool vendor, Cellebrite, I am an instructor for judicial courses at the
6 National Computer Forensics Institute in Hoover, Alabama (outside of Birmingham).
7 42. In the data privacy field, there is, for example and without limitation, the
8 International Association of Privacy Professionals (www.iapp.org), that is a
9 recognized authority in credentialing and training for proficiency in a variety of
10 privacy disciplines both in the United States and internationally. My own state bar in
11 North Carolina recognizes the JAPP’ s Certified Information Privacy Professional/US
12 (a certification in US data privacy and cross-border regulatory concepts) as a predicate
13 to obtaining the North Carolina State Bar’s “specialist” designation in Privacy and
14 Information Secw·ity Law. In the interest of full disclosure, I am a member of the
15 JAPP, hold a current CIPP/US certification, and sit on the board for the NC State Bar
16 Privacy and Information Law specialization.
17 43. The document bearing Bates stamp DEFEXP-000132, Ex. 79 in the
18 Index of Exhibits, is a true and correct copy of a screenshot I personally captured
Z\ 19 during my inspection of BCS ‘s digital assets on June 26, 2023. It shows part of the
20 ownership history (specifically events on March 11, 2022) of the Google Search
21 Console for the “property” https://breakingcodesilence.org. By way of guiding the
22 reader how to review such history, this exhibit shows verification of the “mhurwitt”
23 user account, a failure to delete verification of “iristheangel@gmail.com” (Client
24 McNamara), and ownership delegation of such property by “jeremy” (Client
25 Whiteley).
26 44. The document bearing Bates stamp DEFEXP-000169, Ex. 80 in the
27 Index of Exhibits, is a true and correct copy of a screenshot I personally captured
28 during my inspection ofBCS’s digital assets on June 26, 2023. Similar to Exhibit 79,
12
WALTON DECL. RE: MOTION FOR SUMMARY JUDGMENT
Case 2:22-cv-02052-MAA Document 152-7 Filed 11/22/23 Page 12 of 16 Page ID #:4451
I
1 it shows part of the ownership history (events from September 25, 2021 through
2 March 11 , 2022) of the Google Search Console for a different “property”,
3 https://www.breakingcodesilence.org. It shows various actions of users Hurwitt and
4 Client Whiteley.
5 45. The document bearing Bates stamp DEFEXP-000170, Ex. 81 in the
6 Index of Exhibits, is a true and correct copy of a screenshot I personally captured
7 during my inspection of BCS ‘s digital assets on June 26, 2023. It shows a
8 continuation of the history described in paragraph 44 for the “property”
9 https://www.breakingcodesilence.org, but for May 25, 2021, through September 22,
10 2021. Each of these entries represent actions/entries regarding Client Whiteley’s
11 account.
12 46. The document bearing Bates stamp DEFEXP-000181 , Ex. 82 in the
13 Index of Exhibits, is a true and correct copy of a screenshot I personally captured
14 during my inspection of BCS’s digital assets on June 26, 2023. It shows a listing of
15 the “sitemaps” submitted in the Google Search Console for the “property”
16 https://www.breakingcodesilence.org. All sitemaps depicted in this screen shot where
17 submitted to Google between March 7 and March 12, 2022 ( only one of them was
18 submitted after March 7).
‘ 19 47. I am aware that around the time of the alleged deindexing, BCS
20 requested that Google not “index” certain pages of its website. In connection with
21 BCS ‘s investigation, took a screenshot of a “submitted URL marked
22 noindex” error. That screenshot (which appears in the Memorandum of Points and
23 Authorities and is Ex. 1 in the Index of Exhibits)) is reproduced below, and I
24 understand that it has been authenticated by as she is the one who captured
25 the image.
26
27
28
13
WALTON DECL. RE: MOTION FOR SUMMARY JUDGMENT
Case 2:22-cv-02052-MAA Document 152-7 Filed 11/22/23 Page 13 of 16 Page ID #:4452
~I
00
~~ ~<
~ ~ ~~ oO z r:Q
< o?.S
21
00
I ‘
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
;:;ii.n.
11 0 ()36
1- ~
,.
I
Details
I I . .
0 <.I • od
0
48. The error shown in Ex. 1 indicates that someone at BCS had submitted
a W ordPress command that was marking webpages as “noindex” while making
changes to the website. Similar to a deindex request, marking a webpage as “no index”
through WordPress also tells Google not to include certain webpages on Google
Search.
49. The only people that could have inserted an HTML “no index” tag on a
page of BCS’ s website are people with access to BCS’ s WordPress account.
14
WALTON DECL. RE: MOTION FOR SUMMARY JUDGMENT
Case 2:22-cv-02052-MAA Document 152-7 Filed 11/22/23 Page 14 of 16 Page ID #:4453
~I
00
~~ ~<
~H
~H oO
z~
<~
e1
Ee
I ‘
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
I hereby declare under penalty of perjury under the laws of the United States of
America that the foregoing is true and correct.
DATED this JO~ ay of November 2023 and executed in the State of North
Carolina and under the laws of the State of California.
CLARK C. WALTON, ESQ. !? , __/ 1W.v””-C.(__,
15
WALTON DECL. RE: MOTION FOR SUMMARY JUDGMENT
~~ n1
uCase 2:22-cv-02052-MAA Document 152-7 Filed 11/22/23 Page 15 of 16 Page ID #:4454
22
1
2
3
4
5
6
7
8
~I 9
10
00
~~ 11
~< 12 ~~
~~ 13 oO
z~ 14 < d?J
2- I 15
16
~ 17
18
I ‘
19
20
21
22
23
24
25
26
27
28
CERTIFICATE OF SERVICE
I hereby certify that on this_ of November, 2023, I electronically filed the
foregoing paper(s) with the Clerk of the Court using the ECF system which will
send notification to all parties of record or persons requiring notice.
Isl Helene Saller
Helene Saller
16
WALTON DECL. RE: MOTION FOR SUMMARY JUDGMENT
Case 2:22-cv-02052-MAA Document 152-7 Filed 11/22/23 Page 16 of 16 Page ID #:4455