Contract analysis

From: James Underwood <junderwood@calderwoodharkness.com> To: Meredith Lau <mlau@blackhallsoren.com> Cc: Bernard Crawford <bcrawford@calderwoodharkness.com> Date: Wed, 02 Apr 2025 03:18:00 -0000 Subject: CRH v. Rathore et al. (C.A. No. 2025-0198-MTZ) – Data Destruction Protocol and Forensic Audit Mechanics (Exhibit B)

I hope you're well. I'm writing to follow up on our call yesterday regarding the open items in Exhibit B (Data Return and Destruction Protocol) to the second draft of the Standstill and Settlement Agreement circulated on March 31. Bernard has asked me to memorialize CRH's position on the remaining issues related to data destruction and the independent forensic audit so that we can work toward closing these items in t

I've organized our positions below by topic.

**A. Data Return and Destruction Timeline**

Consistent with the revised term sheet dated March 20, 2025, CRH's position remains that all exfiltrated CRH data must be returned or certified destroyed within 10 business days of execution of the Settlement Agreement. Assuming an April 14 execution date, that places the compliance deadline at approximately April 28, 2025.

CRH requires that each of the eight individual defendants — Priya Rathore, Derek Linden, Sonia Kaczmarek, Amara Osei, Brent Halvorsen, Lucia Fernandez-Gill, Nathan Tsao, and Kira Johansson — execute an individual certification of data return and destruction, under penalty of perjury, confirming that he or she has returned or destroyed all CRH confidential information in his or her possession, custody, or control. The

In addition, Verdana must provide a corporate certification signed by an authorized officer — we would suggest Helen Tsoi, General Counsel — confirming that Verdana has conducted a reasonable and diligent search of its systems and has returned or destroyed all CRH data in Verdana's possession, custody, or control.

The scope of these certifications covers, at a minimum, the 14,327 files (approximately 2.8 GB) identified in the Pinnacle Forensics report as having been downloaded from CRH's Aldermere Systems and Pinnacle Health IT environments between January 10 and February 4, 2025, as well as any other CRH confidential information or trade secrets, including but not limited to Project Ridgeline materials, vendor negotiation ter

CRH's position is that "destruction" must mean forensic-level wiping — not merely deletion to a recycle bin or trash folder — and that the protocol should specify compliance with the NIST Special Publication 800-88 standard (or equivalent) for media sanitization. We have reflected this requirement in the attached redline.

**B. Independent Forensic Audit by Pinnacle Forensics LLC**

Per the agreed settlement framework, Verdana has consented to an independent forensic audit of Verdana's systems conducted by Pinnacle Forensics LLC (Dr. Rajiv Anand, Engagement Lead) at Verdana's expense, subject to a cost cap of $175,000. We propose the following mechanics:

*Timing.* The audit should commence within 5 business days after Verdana delivers its corporate certification of data destruction. This sequencing allows Pinnacle to verify the completeness and accuracy of the certifications while the process is still fresh.

*Scope.* Pinnacle would have access to Verdana's relevant IT systems, servers, email systems (including hosted email and archival systems), cloud storage environments, and any devices assigned to or used by the eight former CRH employees during or after their employment with CRH, for the purpose of verifying that no CRH confidential data remains on those systems.

*Access Protocols.* We recognize Verdana's legitimate concerns about the protection of its own proprietary business information and do not seek a wholesale review of Verdana's systems. Rather, we propose that Pinnacle operate under a forensic audit protocol that limits its review to identifying CRH-origin files, using hash values and metadata derived from the original exfiltration analysis that Pinnacle conducted for

*On-Site vs. Remote.* CRH's preference is for on-site access at Verdana's Wilmington headquarters (400 Christiana Gateway, Suite 700), which we believe is the most efficient and reliable method for conducting the audit. That said, we are open to discussing whether certain discrete elements of the review — for example, analysis of cloud-hosted environments — could be conducted remotely, provided adequate access and da

*Duration.* Based on Pinnacle's preliminary assessment, we estimate the audit would require 5 to 7 business days, depending on the complexity of Verdana's IT environment and the volume of systems and devices in scope.

*Reporting.* Pinnacle would produce a written forensic audit report to be shared simultaneously with counsel for all parties — Calderwood & Harkness (for CRH), Blackhall & Soren (for Verdana), and Whitfield, Nygaard & Doyle (for the individual defendants). The report would confirm whether CRH-origin data was found or not found on Verdana's systems and would detail the methodology employed.

*Cost Cap.* The $175,000 cap is to be borne entirely by Verdana. If Pinnacle's costs are trending above the cap, Pinnacle will notify counsel for all parties and the parties will confer in good faith regarding next steps. CRH's position is that any cost overruns attributable to Verdana's lack of cooperation, delay, or obstruction of the audit process should not count against the cap. We have included language to that

**C. Cooperation and Access Obligations**

The protocol should include an express cooperation obligation requiring Verdana to provide reasonable cooperation with Pinnacle's requests for system access, IT personnel availability, network architecture documentation, and device inventories. Verdana should be required to designate an IT point of contact within 3 business days of execution of the Settlement Agreement to serve as the primary liaison with Pinnacle's

In the event of any dispute regarding the scope of access or adequacy of cooperation, the dispute should be referred in the first instance to the compliance monitor, Aldwyn Compliance Solutions LLC, for informal resolution. If unresolved within 5 business days, either party may seek relief from Vice Chancellor Zhao under the retained jurisdiction provisions of the proposed Consent Order.

**D. Interaction with Compliance Monitor**

I want to flag that the forensic audit under Exhibit B is distinct from the ongoing 12-month compliance monitoring to be conducted by Aldwyn Compliance Solutions LLC under Exhibit D. However, we believe Pinnacle's forensic audit report should be made available to Aldwyn as baseline documentation for the monitoring period — it will provide Aldwyn with a verified starting point for its work. The information-sharing let

I have attached a proposed revised redline of Exhibit B incorporating the positions outlined above. This redline is keyed to the second draft of the Settlement Agreement (March 31). We intend to circulate the third full draft of the Agreement separately, targeted for Friday, April 4.

Could you please review the attached redline with Gavin and revert with Verdana's comments by end of day Friday, April 4? Our goal is to have the Exhibit B issues fully resolved in the third draft so that we can focus the final round of negotiations on any remaining open points and stay on track for the April 14 execution date.

Separately, I am coordinating with Catherine Nygaard and Travis Beaumont at Whitfield Nygaard on the individual certification forms for the Rathore Group members and expect to have those in reviewable form early next week.

I'm happy to schedule a call with you — and with Gavin if helpful — early next week to work through any remaining issues on Exhibit B. Please let me know what works on your end. Given the April 14 target, I'd like to keep this workstream moving promptly.

Thank you, Meredith. I look forward to hearing from you.

James Underwood Calderwood & Harkness LLP 1301 K Street NW, Suite 1200 Washington, DC 20005 Direct: (202) 555-0147 Email: junderwood@calderwoodharkness.com Matter Ref: 1038-00006

CONFIDENTIALITY NOTICE: This email and any attachments are privileged and confidential, and are intended solely for the use of the individual or entity to whom they are addressed. This communication may contain information protected by the attorney-client privilege, the attorney work product doctrine, or other applicable privileges. If you are not the intended recipient, or have received this message in error, please