1008-00005 · Lumos Analytics Inc · Closing & Remediation

letter-crestview-remediation-protocol.docx DOCUMENT Litigation

1 / 35 → ✕

CALDERWOOD & HARKNESS LLP Attorneys at Law

555 California Street, 40th Floor San Francisco, California 94104

125 Broad Street New York, New York 10004

October 3, 2023

VIA ELECTRONIC MAIL AND FIRST-CLASS MAIL

Dr. Irene Chow Managing Director & Lead Forensic Examiner Brindoval Digital Forensics LLC 1901 Harrison Street, Suite 600 Oakland, California 94612

Re: Forensic Remediation Protocol and Scope — Lumos Analytics Inc. v. NovaSpark Technologies Inc., Rajiv Anand, Serena Mallick, and Derek Yun, Case No. 23-CV-004871, Superior Court of the State of California, County of Santa Clara

C&H Matter No.: 1008-00005

Dear Dr. Chow:

I. Purpose and Authorization

This firm represents Lumos Analytics Inc. ("Lumos") in the above-captioned action. We write to formally outline the forensic remediation protocol and scope of work to be undertaken by Brindoval Digital Forensics LLC ("Brindoval") as the neutral forensic examiner in this matter.

As you are aware, on September 22, 2023, Lumos, NovaSpark Technologies Inc. ("NovaSpark"), Rajiv Anand, Serena Mallick, and Derek Yun (Mr. Anand, Ms. Mallick, and Mr. Yun are referred to collectively with NovaSpark as "Defendants") executed a Settlement Agreement and Mutual Release (the "Settlement Agreement"), a copy of which is enclosed for your reference. The Settlement Agreement resolved all claims asserted in this litigation, including Lumos's claims for misappropriation of trade secrets under the California Uniform Trade Secrets Act (Cal. Civ. Code §§ 3426–3426.11), breach of confidentiality and non-disclosure agreements, and related causes of action.

Pursuant to the terms of the Settlement Agreement, the Honorable David Rutherford entered a Stipulated Permanent Injunction (Injunction-by-Consent) on October 4, 2023, permanently enjoining Defendants from possessing, using, disclosing, copying, distributing, or in any way exploiting any Lumos trade secrets or proprietary materials, as those terms are defined in the Settlement Agreement and the Stipulated Permanent Injunction. A copy of the Stipulated Permanent Injunction, as entered by the Court, is also enclosed herewith.

We further note that Brindoval was appointed as the neutral forensic examiner in this matter by stipulation of the parties and court order dated March 8, 2023. In that capacity, Brindoval conducted forensic imaging of the relevant systems, devices, and accounts from March 22 through April 14, 2023, and thereafter issued its Preliminary Forensic Report on May 1, 2023 (the "Preliminary Forensic Report"), which identified the nature, extent, and location of Lumos proprietary materials on Defendants' systems, devices, and cloud accounts. A copy of the Preliminary Forensic Report is enclosed for ease of reference.

Critically, the Settlement Agreement requires NovaSpark and each individual Defendant to complete a full forensic remediation—defined as the verified deletion and destruction of all Lumos proprietary materials from all systems, devices, and accounts—under the direct supervision and certification of Brindoval. This letter sets forth the detailed protocol and scope for that forensic remediation process.

II. Scope of Remediation — Lumos Proprietary Materials to Be Identified and Destroyed

Brindoval shall identify, verify the deletion of, and certify the destruction of all Lumos proprietary materials falling within the following categories of trade secrets and confidential information, as identified in the Verified Complaint filed on January 9, 2023, the Preliminary Injunction Order entered by Judge Rutherford on February 17, 2023, and the Stipulated Permanent Injunction entered on October 4, 2023. The categories are described in detail below.

A. LumosEdge Ensemble ML Model Architecture

The first category of proprietary materials subject to remediation encompasses the proprietary neural-network topology and hyperparameter configurations forming the core of the LumosEdge signal-generation engine, which Lumos developed over a period of approximately four years at a cost exceeding $12 million in research and development expenditures. Brindoval shall identify and destroy all model architecture specifications and hyperparameter configuration files, including, without limitation, the approximately 3.2 gigabytes of files that the Preliminary Forensic Report confirmed were transferred by Rajiv Anand from Lumos's internal development environment to a personal Hollowell Health IT account on or about September 26, 2022. This transfer was documented in detail in Section 4.1 of the Preliminary Forensic Report and represents one of the most significant exfiltration events identified in the forensic examination.

Brindoval should ensure that any copies, fragments, cached versions, or derivative iterations of the LumosEdge model architecture files are included within the scope of remediation, regardless of the file format in which they may have been saved or the system on which they may currently reside.

B. Proprietary Feature-Engineering Libraries

The second category encompasses Lumos's proprietary feature-engineering libraries, which contain 2,847 individual engineered features for financial signal generation. These libraries represent a substantial and highly valuable component of Lumos's intellectual property, as the identification, testing, and validation of each feature required significant analytical effort and access to proprietary data sources.

Brindoval shall specifically identify and destroy the forty-seven (47) proprietary Jupyter notebooks containing feature-engineering code and model-training scripts that the Preliminary Forensic Report confirmed were downloaded by Derek Yun to a personal Larkspur Technologies account on or about October 18, 2022. As documented in Section 4.3 of the Preliminary Forensic Report, these notebooks contained executable code, inline documentation, and annotated output cells that collectively embodied Lumos's trade secret feature-engineering methodologies. All copies, partial copies, modified versions, and derivatives of these notebooks and the underlying feature-engineering libraries shall be subject to remediation.

C. DataStream ETL Pipeline Codebase and Data-Schema Definitions

The third category consists of the proprietary "DataStream" extract, transform, load ("ETL") pipeline codebase and the associated data-schema definitions developed by Lumos to manage and process data ingestion from forty-three (43) alternative-data vendors. The DataStream pipeline represents a critical element of Lumos's technological infrastructure and competitive advantage, as the pipeline's architecture, transformation logic, error-handling protocols, and schema definitions were designed to process and harmonize data from disparate sources with minimal latency and maximum fidelity.

Brindoval shall specifically identify and destroy the complete DataStream ETL pipeline repository, which the Preliminary Forensic Report confirmed was approximately 780 megabytes in size, and which Serena Mallick copied to a personal external USB drive bearing the serial number WD-4837291 on or about October 10, 2022. This exfiltration event was documented in Section 4.2 of the Preliminary Forensic Report and was corroborated by USB device-connection logs recovered from Ms. Mallick's Lumos-issued workstation. All copies, fragments, or derivatives of the DataStream codebase and schema definitions, wherever located, shall be subject to remediation.

D. Curated and Labeled Training Dataset

The fourth category encompasses approximately 14.6 terabytes of historical financial and alternative data constituting Lumos's proprietary curated and labeled training dataset. This dataset was assembled over a period of more than three years and represents the product of extensive data acquisition, cleaning, normalization, feature annotation, and quality-assurance processes. The curated and labeled nature of the dataset makes it exceptionally valuable and not readily replicable through publicly available means.

Brindoval shall identify and destroy any portions, subsets, derivatives, samples, or copies of this dataset residing on any target system, device, or account within the remediation scope. Given the size of the full dataset, Brindoval should be particularly attentive to the possibility that compressed, sampled, or partial copies of the dataset may exist on devices with more limited storage capacity.

E. Confidential Product Roadmap Materials

The fifth category consists of confidential product roadmap documents for the period 2023–2025, including, without limitation, the unreleased "LumosEdge 3.0" specifications. These documents contain sensitive strategic, technical, and business-planning information regarding Lumos's product development trajectory, planned feature releases, competitive positioning analyses, and market-entry strategies.

Brindoval shall specifically identify and destroy the thirty-seven (37) page document titled "LumosEdge 3.0 Product Roadmap" in PDF format, which the Preliminary Forensic Report confirmed was forwarded by Rajiv Anand to his personal email address (r.anand.personal@vaultmail.com) on or about September 28, 2022. All copies, printouts, screenshots, excerpts, or derivatives of this document, as well as any other confidential product roadmap materials, shall be subject to remediation.

F. Derivative Works and Compilations

In addition to the five specific categories enumerated above, the remediation scope extends to any and all derivative works, modified versions, compilations, summaries, abstracts, annotations, presentations, memoranda, or other materials that incorporate, are based upon, or were created using any of the Lumos proprietary materials described in Subsections A through E above. This includes, without limitation, any materials created by Defendants or NovaSpark personnel that draw upon, reference, or were informed by any Lumos proprietary materials, to the extent such materials can be identified through forensic analysis.

Brindoval should apply the file-signature hashes, metadata correlation techniques, and content-similarity analysis methods documented in the Preliminary Forensic Report to identify derivative works and compilations that may not bear obvious file names or metadata tags linking them to Lumos proprietary materials.

III. Target Systems, Devices, and Accounts

Brindoval shall conduct the forensic remediation on the following systems, devices, and accounts, which are consistent with the inventory established during the forensic imaging phase conducted from March 22 through April 14, 2023, and documented in Appendix A to the Preliminary Forensic Report.

A. NovaSpark Corporate Systems

Brindoval shall conduct remediation on all NovaSpark Technologies Inc. servers, workstations, development environments, code repositories (including Git-based repositories), and cloud infrastructure located at or associated with NovaSpark's offices at 88 Bluxome Street, Floor 4, San Francisco, California 94107, as well as any remote or cloud-hosted environments (including, without limitation, Ridgeway Industries, Aldermere Technologies, Crestline Systems, or similar cloud computing and storage environments) used by NovaSpark in the course of its operations.

The remediation shall also encompass NovaSpark corporate email systems (including all email archives and backup stores), file-sharing systems (including, without limitation, any instances of Ashbury Data Systems, Aldermere Systems, Meridian Solutions file repositories, or similar collaboration platforms), and code repositories (including, without limitation, Aldermere Data Systems, Aldermere Software, Strathmore Solutions, or any self-hosted version-control systems).

B. Personal Devices of Individual Defendants

Brindoval shall conduct remediation on the following personal devices belonging to the individual Defendants, all of which were previously forensically imaged during the March–April 2023 forensic examination:

1. Three (3) personal laptop computers — one each belonging to Rajiv Anand, Serena Mallick, and Derek Yun — as identified and imaged during the forensic examination phase;

2. Two (2) personal mobile phones belonging to individual Defendants, as previously imaged during the forensic examination phase; and

3. Two (2) external storage drives, including the USB drive bearing serial number WD-4837291, which is associated with Serena Mallick and was identified in the Preliminary Forensic Report as the device onto which the DataStream ETL pipeline repository was copied on or about October 10, 2022.

C. Personal Cloud Storage Accounts

Brindoval shall conduct remediation on the following personal cloud storage and email accounts:

1. Rajiv Anand's personal Hollowell Health IT account — specifically, the account to which approximately 3.2 gigabytes of LumosEdge model architecture files were transferred on or about September 26, 2022, as documented in the Preliminary Forensic Report;

2. Rajiv Anand's personal email account at r.anand.personal@vaultmail.com — specifically, the account to which the thirty-seven (37) page "LumosEdge 3.0 Product Roadmap" PDF was forwarded on or about September 28, 2022, as documented in the Preliminary Forensic Report;

3. Derek Yun's personal Larkspur Technologies account — specifically, the account to which forty-seven (47) proprietary Jupyter notebooks were downloaded on or about October 18, 2022, as documented in the Preliminary Forensic Report; and

4. Any other personal cloud storage or email accounts identified during the forensic imaging phase as containing Lumos proprietary materials, as documented in Appendix B to the Preliminary Forensic Report.

For each cloud account, Brindoval shall ensure that all Lumos proprietary materials, including any files in trash, archive, or version-history repositories, are identified and permanently removed.

IV. Remediation Procedures and Standards

A. Identification and Verification

Prior to commencing any deletion or destruction activities, Brindoval shall re-scan all target systems, devices, and accounts using the file-signature hashes (MD5 and SHA-256), metadata profiles, and keyword search terms that were established during the initial forensic examination and documented in Appendix C to Brindoval's Preliminary Forensic Report of May 1, 2023. The purpose of this re-scan is to identify any Lumos proprietary materials that may have been moved, copied, renamed, modified, or otherwise altered since the forensic imaging was completed in April 2023, as well as to confirm the continued presence of materials identified during the initial examination.

Any Lumos proprietary materials or derivative works identified during the re-scan shall be fully cataloged and documented prior to deletion. The catalog shall include, at a minimum, the information specified in Subsection C below. No deletion or destruction activity shall commence until the identification and cataloging process for the relevant device or account has been completed and the catalog has been made available to Meridian Cybersecurity Advisors Inc. for review, as described in Section V below.

B. Deletion and Destruction Protocol

The following deletion and destruction methods shall be employed, depending on the type of media or account at issue:

1. Electronic files on servers, laptops, and external drives. Brindoval shall perform secure deletion using industry-standard methods consistent with the National Institute of Standards and Technology Special Publication 800-88, Revision 1 ("NIST SP 800-88 Rev. 1"), Guidelines for Media Sanitization. Specifically, Brindoval shall employ a "Clear" or "Purge" level sanitization method, as appropriate for the media type, ensuring that data is rendered unrecoverable by state-of-the-art forensic recovery techniques. For solid-state drives (SSDs), Brindoval shall use manufacturer-provided secure-erase commands or cryptographic-erase methods, as recommended by NIST SP 800-88 Rev. 1 for flash-based media.

2. Cloud-hosted files. For files residing in cloud storage accounts, Brindoval shall perform permanent deletion from all cloud storage accounts, including removal from "trash," "recently deleted," "archive," and any backup or versioning repositories maintained by the cloud provider. Brindoval shall verify that the cloud provider's deletion process has been completed by confirming that the files are no longer recoverable through the provider's user interface, API, or administrative tools. Where the cloud provider offers a mechanism for requesting expedited permanent deletion (as opposed to the provider's standard retention and deletion cycle), Brindoval shall utilize such mechanism.

3. USB drive (serial number WD-4837291). For the external USB drive bearing serial number WD-4837291, Brindoval shall, at its discretion, either (a) perform a full secure wipe of the drive in accordance with NIST SP 800-88 Rev. 1, or (b) arrange for physical destruction of the drive. In either case, Brindoval shall thoroughly document the method employed and the results obtained. If physical destruction is selected, Brindoval shall photograph the drive before and after destruction and retain the photographs as part of the remediation record.

C. Documentation Requirements

Brindoval shall maintain a detailed chain-of-custody log for each device and account accessed during the remediation process. The chain-of-custody log shall document the date and time of each access, the identity of the Brindoval personnel conducting the access, the location of the access (on-site or remote), and any transfers of physical custody of devices.

For each item of Lumos proprietary material identified and destroyed during the remediation, Brindoval shall document the following:

(a) the file name and full file path (or, for cloud-hosted files, the account identifier and folder path);

(b) the device, server, repository, or account on which the file was found;

(d) the timestamp of deletion or destruction, recorded in UTC; and

(e) the method of destruction employed (e.g., NIST Clear, NIST Purge, cryptographic erase, cloud permanent deletion, or physical destruction).

This documentation shall be compiled into a comprehensive remediation log that will form a core component of the Final Forensic Remediation Certification described in Section X below.

V. Oversight by Meridian Cybersecurity Advisors Inc.

Pursuant to Section 7.4 of the Settlement Agreement, the forensic remediation shall be conducted with oversight from Naveen Kapoor, Senior Consultant, of Meridian Cybersecurity Advisors Inc. ("Meridian"), located at 2100 Geng Road, Suite 210, Palo Alto, California 94303. Meridian has been retained by Calderwood & Harkness LLP on behalf of Lumos to independently verify the completeness and thoroughness of the forensic remediation process and to provide an independent assessment of whether the remediation has been conducted in accordance with the protocols set forth in this letter and the terms of the Settlement Agreement.

To facilitate Meridian's oversight role, Brindoval shall provide Meridian with real-time access to all remediation logs, including the chain-of-custody logs and the file-identification and destruction documentation described in Section IV above. Brindoval shall coordinate the scheduling of all remediation activities to permit Meridian's on-site or remote observation, as Meridian may elect. Brindoval shall provide Meridian with reasonable advance notice (no less than forty-eight (48) hours) of scheduled remediation sessions to allow Meridian to arrange for personnel to observe.

Meridian may, in the exercise of its independent professional judgment, request additional scans, verification steps, or supplemental analyses that Meridian deems necessary or appropriate to confirm the completeness of the remediation. Brindoval shall accommodate such requests in good faith, provided that such requests fall within the scope of the Settlement Agreement and do not unreasonably delay the remediation timeline. In the event of any disagreement between Brindoval and Meridian regarding the scope or necessity of a requested verification step, the parties shall confer in good faith to resolve the disagreement, and, if necessary, the matter may be referred to this firm for resolution in consultation with Defendants' counsel.

VI. Cooperation of Defendants

Pursuant to Section 7.2 of the Settlement Agreement and Paragraph 5 of the Stipulated Permanent Injunction, NovaSpark Technologies Inc. and each individual Defendant—Rajiv Anand, Serena Mallick, and Derek Yun—are obligated to cooperate fully and in good faith with Brindoval's remediation activities. This obligation of cooperation is a material term of the Settlement Agreement, and any failure to cooperate may constitute a breach thereof, entitling Lumos to seek enforcement of the Stipulated Permanent Injunction and such other remedies as may be available under the Settlement Agreement and applicable law.

Specifically, Defendants shall provide Brindoval with complete and unrestricted access to all target systems, devices, and accounts within the remediation scope, including, without limitation, all necessary login credentials, passwords, encryption keys, multi-factor authentication tokens, and administrative-level access permissions. Defendants shall make themselves and their personnel available to answer questions from Brindoval regarding file locations, system configurations, and data-management practices, and shall promptly respond to any requests for information or assistance from Brindoval during the remediation process.

Defendants' counsel, Patricia Whitfield and Samuel Gerber of Whitfield, Raines & Gerber LLP, 235 Montgomery Street, Suite 1800, San Francisco, California 94104, has been notified of this forensic remediation protocol and has confirmed Defendants' agreement to cooperate fully with Brindoval in connection with the remediation. We have provided a copy of this letter to Ms. Whitfield and request that any questions or concerns from Defendants regarding the remediation process be communicated through Defendants' counsel.

VII. Timeline

The forensic remediation is to commence on October 4, 2023, which is the date of entry of the Stipulated Permanent Injunction by the Court. Brindoval shall use commercially reasonable efforts to complete all remediation activities within approximately four (4) weeks following commencement, targeting completion by no later than October 31, 2023.

We recognize that the remediation timeline may be affected by factors outside of Brindoval's direct control, including, without limitation, the responsiveness of cloud service providers to deletion-verification requests and the availability of individual Defendants' personal devices for remediation. Brindoval shall promptly notify this firm and Meridian of any circumstances that may delay the anticipated completion date, and we will work with Defendants' counsel to address any such issues expeditiously.

Upon completion of all remediation activities and all associated verification steps, Brindoval shall issue a Final Forensic Remediation Certification confirming that all Lumos proprietary materials, as described in Section II above, have been verified as deleted and destroyed from all target systems, devices, and accounts within the remediation scope, as described in Section III above. The requirements for the Final Forensic Remediation Certification are set forth in detail in Section X below.

VIII. Cost Allocation

Consistent with Section 9.1 of the Settlement Agreement and the Court's prior order dated March 8, 2023, regarding allocation of forensic examination costs, Brindoval's fees for the forensic remediation shall be allocated as follows:

• Defendants/NovaSpark (60%): One Hundred Thirty-One Thousand One Hundred Sixty Dollars ($131,160.00), based on total Brindoval fees of Two Hundred Eighteen Thousand Six Hundred Dollars ($218,600.00), inclusive of both the initial forensic examination phase and the remediation phase.

• Lumos (40%): Eighty-Seven Thousand Four Hundred Forty Dollars ($87,440.00), based on total Brindoval fees of Two Hundred Eighteen Thousand Six Hundred Dollars ($218,600.00), inclusive of both the initial forensic examination phase and the remediation phase.

Brindoval should submit invoices for Defendants' sixty percent (60%) share to Whitfield, Raines & Gerber LLP, 235 Montgomery Street, Suite 1800, San Francisco, California 94104, Attention: Patricia Whitfield. Invoices for Lumos's forty percent (40%) share should be submitted to Calderwood & Harkness LLP, 555 California Street, 40th Floor, San Francisco, California 94104, Attention: Catherine Bloom, Billing Partner. Payment terms shall be net thirty (30) days from the date of invoice, consistent with the terms of Brindoval's engagement letter.

IX. Audit Rights

The Settlement Agreement provides, in Section 8.1, that NovaSpark's continued business operations are subject to audit rights exercisable by Brindoval, at Lumos's request, for a period of eighteen (18) months from the effective date of the Settlement Agreement, i.e., from September 22, 2023, through March 22, 2025.

During this eighteen-month period, NovaSpark may continue its business operations, including the development of products in the financial analytics and machine-learning space. However, the Settlement Agreement expressly requires that any competing product developed by NovaSpark during or after the audit period must be created using only independently created or publicly available technology, data, and methodologies, without any reliance upon or derivation from Lumos proprietary materials.

This letter confirms Lumos's expectation that Brindoval will remain available to conduct follow-up audits of NovaSpark's systems and operations during the eighteen-month audit period should Lumos have reasonable grounds to request such audits. The scope, procedures, and cost allocation for any such follow-up audits will be addressed at the time of any such request, consistent with the terms of the Settlement Agreement.

X. Final Certification Requirements

Upon completion of the forensic remediation, Brindoval shall prepare and issue a Final Forensic Remediation Certification (the "Certification"). The Certification shall include, at a minimum, the following components:

1. A comprehensive inventory of all Lumos proprietary materials identified during the remediation process across all target systems, devices, and accounts, organized by category (corresponding to the categories set forth in Section II above) and by target system, device, or account (corresponding to the targets set forth in Section III above);

2. Confirmation of the secure deletion and/or destruction of each identified item, including the methodology employed for each deletion or destruction event and the verification data (including hash values, timestamps, and confirmation receipts from cloud service providers, as applicable) supporting the completeness of the deletion;

3. A statement, rendered to a reasonable degree of forensic certainty, that no Lumos proprietary materials—including derivative works, modified versions, compilations, or materials based upon Lumos proprietary materials—remain on any of the target systems, devices, or accounts within the remediation scope; and

4. Any observations, caveats, or qualifications that Brindoval deems necessary or appropriate to include in the interest of forensic accuracy and completeness.

The Certification shall be signed by Dr. Irene Chow, in her capacity as Managing Director and Lead Forensic Examiner of Brindoval Digital Forensics LLC, and by Kevin Barr, Senior Forensic Analyst, who, we understand, served as the lead analyst on this engagement during the forensic imaging phase.

A copy of the Final Forensic Remediation Certification shall be provided to each of the following:

(a) Calderwood & Harkness LLP, Attention: Wendy Schultz, 555 California Street, 40th Floor, San Francisco, California 94104;

(b) Whitfield, Raines & Gerber LLP, Attention: Patricia Whitfield, 235 Montgomery Street, Suite 1800, San Francisco, California 94104; and

(c) Meridian Cybersecurity Advisors Inc., Attention: Naveen Kapoor, 2100 Geng Road, Suite 210, Palo Alto, California 94303.

XI. Contact Information and Coordination

For purposes of coordinating the remediation activities, the primary contacts at Calderwood & Harkness LLP are as follows:

Wendy Schultz, Lead Associate Calderwood & Harkness LLP 555 California Street, 40th Floor San Francisco, California 94104 Telephone: (415) 555-7200

Email: wschultz@calderwoodharkness.com

Omar Siddiqui, Working Associate Calderwood & Harkness LLP 555 California Street, 40th Floor San Francisco, California 94104 Telephone: (415) 555-7215

Email: osiddiqui@calderwoodharkness.com

The contact at Meridian Cybersecurity Advisors Inc. for oversight coordination is:

Naveen Kapoor, Senior Consultant Meridian Cybersecurity Advisors Inc. 2100 Geng Road, Suite 210 Palo Alto, California 94303 Telephone: (650) 555-4100

Email: nkapoor@meridiancyber.com

The contact for Defendants' cooperation is:

Patricia Whitfield, Partner Whitfield, Raines & Gerber LLP 235 Montgomery Street, Suite 1800 San Francisco, California 94104 Telephone: (415) 555-3300

Email: pwhitfield@wrglaw.com

We ask that Brindoval direct all substantive communications regarding the remediation to the Calderwood & Harkness contacts identified above, with copies to Mr. Kapoor at Meridian and Ms. Whitfield at Whitfield, Raines & Gerber, as appropriate.

XII. Reservation of Rights

Nothing in this letter is intended to modify, amend, waive, or supersede the terms of the Settlement Agreement and Mutual Release dated September 22, 2023, or the Stipulated Permanent Injunction entered by the Court on October 4, 2023. This letter is intended solely to provide Brindoval with an operational protocol for the forensic remediation contemplated by those governing documents. In the event of any conflict or inconsistency between the terms of this letter and the terms of the Settlement Agreement or the Stipulated Permanent Injunction, the terms of those governing documents shall control in all respects.

Lumos expressly reserves all rights and remedies available to it under the Settlement Agreement, the Stipulated Permanent Injunction, the California Uniform Trade Secrets Act (Cal. Civ. Code §§ 3426–3426.11), the Defend Trade Secrets Act (18 U.S.C. § 1836 et seq.), and all other applicable federal and state law. Nothing in this letter shall be construed as a waiver, release, or limitation of any such rights or remedies.

We kindly request that you confirm receipt of this letter and provide written acknowledgment that Brindoval accepts and will comply with the forensic remediation protocol and scope of work described herein. Should you have any questions regarding the protocol or require clarification on any point, please do not hesitate to contact the undersigned or Mr. Siddiqui at the contact information provided above.

We appreciate Brindoval's continued professionalism, diligence, and expertise in this matter, and we look forward to the successful completion of the remediation process.

Very truly yours,

CALDERWOOD & HARKNESS LLP

By: ________

Wendy Schultz Lead Associate 555 California Street, 40th Floor San Francisco, California 94104 Telephone: (415) 555-7200

Email: wschultz@calderwoodharkness.com

cc:

Marcus Delgado, Responsible Partner, Calderwood & Harkness LLP Catherine Bloom, Billing Partner, Calderwood & Harkness LLP Omar Siddiqui, Working Associate, Calderwood & Harkness LLP Naveen Kapoor, Senior Consultant, Meridian Cybersecurity Advisors Inc. Kevin Barr, Senior Forensic Analyst, Brindoval Digital Forensics LLC Patricia Whitfield, Whitfield, Raines & Gerber LLP (Defendants' counsel)

Enclosures:

1. Settlement Agreement and Mutual Release (executed September 22, 2023)

2. Stipulated Permanent Injunction (entered October 4, 2023)

3. Brindoval Preliminary Forensic Report (dated May 1, 2023) (for reference)

CALDERWOOD & HARKNESS LLP Attorneys at Law
555 California Street, 40th Floor San Francisco, California 94104
125 Broad Street New York, New York 10004
October 3, 2023
VIA ELECTRONIC MAIL AND FIRST-CLASS MAIL
Dr. Irene Chow Managing Director & Lead Forensic Examiner Brindoval Digital Forensics LLC 1901 Harrison Street, Suite 600 Oakland, California 94612
Re: Forensic Remediation Protocol and Scope — Lumos Analytics Inc. v. NovaSpark Technologies Inc., Rajiv Anand, Serena Mallick, and Derek Yun, Case No. 23-CV-004871, Superior Court of the State of California, County of Santa Clara
C&H Matter No.: 1008-00005
Dear Dr. Chow:
I. Purpose and Authorization
This firm represents Lumos Analytics Inc. ("Lumos") in the above-captioned action. We write to formally outline the forensic remediation protocol and scope of work to be undertaken by Brindoval Digital Forensics LLC ("Brindoval") as the neutral forensic examiner in this matter.
As you are aware, on September 22, 2023, Lumos, NovaSpark Technologies Inc. ("NovaSpark"), Rajiv Anand, Serena Mallick, and Derek Yun (Mr. Anand, Ms. Mallick, and Mr. Yun are referred to collectively with NovaSpark as "Defendants") executed a Settlement Agreement and Mutual Release (the "Settlement Agreement"), a copy of which is enclosed for your reference. The Settlement Agreement resolved all claims asserted in this litigation, including Lumos's claims for misappropriation of trade secrets under the California Uniform Trade Secrets Act (Cal. Civ. Code §§ 3426–3426.11), breach of confidentiality and non-disclosure agreements, and related causes of action.
Pursuant to the terms of the Settlement Agreement, the Honorable David Rutherford entered a Stipulated Permanent Injunction (Injunction-by-Consent) on October 4, 2023, permanently enjoining Defendants from possessing, using, disclosing, copying, distributing, or in any way exploiting any Lumos trade secrets or proprietary materials, as those terms are defined in the Settlement Agreement and the Stipulated Permanent Injunction. A copy of the Stipulated Permanent Injunction, as entered by the Court, is also enclosed herewith.
We further note that Brindoval was appointed as the neutral forensic examiner in this matter by stipulation of the parties and court order dated March 8, 2023. In that capacity, Brindoval conducted forensic imaging of the relevant systems, devices, and accounts from March 22 through April 14, 2023, and thereafter issued its Preliminary Forensic Report on May 1, 2023 (the "Preliminary Forensic Report"), which identified the nature, extent, and location of Lumos proprietary materials on Defendants' systems, devices, and cloud accounts. A copy of the Preliminary Forensic Report is enclosed for ease of reference.
Critically, the Settlement Agreement requires NovaSpark and each individual Defendant to complete a full forensic remediation—defined as the verified deletion and destruction of all Lumos proprietary materials from all systems, devices, and accounts—under the direct supervision and certification of Brindoval. This letter sets forth the detailed protocol and scope for that forensic remediation process.
II. Scope of Remediation — Lumos Proprietary Materials to Be Identified and Destroyed
Brindoval shall identify, verify the deletion of, and certify the destruction of all Lumos proprietary materials falling within the following categories of trade secrets and confidential information, as identified in the Verified Complaint filed on January 9, 2023, the Preliminary Injunction Order entered by Judge Rutherford on February 17, 2023, and the Stipulated Permanent Injunction entered on October 4, 2023. The categories are described in detail below.
A. LumosEdge Ensemble ML Model Architecture
The first category of proprietary materials subject to remediation encompasses the proprietary neural-network topology and hyperparameter configurations forming the core of the LumosEdge signal-generation engine, which Lumos developed over a period of approximately four years at a cost exceeding $12 million in research and development expenditures. Brindoval shall identify and destroy all model architecture specifications and hyperparameter configuration files, including, without limitation, the approximately 3.2 gigabytes of files that the Preliminary Forensic Report confirmed were transferred by Rajiv Anand from Lumos's internal development environment to a personal Hollowell Health IT account on or about September 26, 2022. This transfer was documented in detail in Section 4.1 of the Preliminary Forensic Report and represents one of the most significant exfiltration events identified in the forensic examination.
Brindoval should ensure that any copies, fragments, cached versions, or derivative iterations of the LumosEdge model architecture files are included within the scope of remediation, regardless of the file format in which they may have been saved or the system on which they may currently reside.
B. Proprietary Feature-Engineering Libraries
The second category encompasses Lumos's proprietary feature-engineering libraries, which contain 2,847 individual engineered features for financial signal generation. These libraries represent a substantial and highly valuable component of Lumos's intellectual property, as the identification, testing, and validation of each feature required significant analytical effort and access to proprietary data sources.
Brindoval shall specifically identify and destroy the forty-seven (47) proprietary Jupyter notebooks containing feature-engineering code and model-training scripts that the Preliminary Forensic Report confirmed were downloaded by Derek Yun to a personal Larkspur Technologies account on or about October 18, 2022. As documented in Section 4.3 of the Preliminary Forensic Report, these notebooks contained executable code, inline documentation, and annotated output cells that collectively embodied Lumos's trade secret feature-engineering methodologies. All copies, partial copies, modified versions, and derivatives of these notebooks and the underlying feature-engineering libraries shall be subject to remediation.
C. DataStream ETL Pipeline Codebase and Data-Schema Definitions
The third category consists of the proprietary "DataStream" extract, transform, load ("ETL") pipeline codebase and the associated data-schema definitions developed by Lumos to manage and process data ingestion from forty-three (43) alternative-data vendors. The DataStream pipeline represents a critical element of Lumos's technological infrastructure and competitive advantage, as the pipeline's architecture, transformation logic, error-handling protocols, and schema definitions were designed to process and harmonize data from disparate sources with minimal latency and maximum fidelity.
Brindoval shall specifically identify and destroy the complete DataStream ETL pipeline repository, which the Preliminary Forensic Report confirmed was approximately 780 megabytes in size, and which Serena Mallick copied to a personal external USB drive bearing the serial number WD-4837291 on or about October 10, 2022. This exfiltration event was documented in Section 4.2 of the Preliminary Forensic Report and was corroborated by USB device-connection logs recovered from Ms. Mallick's Lumos-issued workstation. All copies, fragments, or derivatives of the DataStream codebase and schema definitions, wherever located, shall be subject to remediation.
D. Curated and Labeled Training Dataset
The fourth category encompasses approximately 14.6 terabytes of historical financial and alternative data constituting Lumos's proprietary curated and labeled training dataset. This dataset was assembled over a period of more than three years and represents the product of extensive data acquisition, cleaning, normalization, feature annotation, and quality-assurance processes. The curated and labeled nature of the dataset makes it exceptionally valuable and not readily replicable through publicly available means.
Brindoval shall identify and destroy any portions, subsets, derivatives, samples, or copies of this dataset residing on any target system, device, or account within the remediation scope. Given the size of the full dataset, Brindoval should be particularly attentive to the possibility that compressed, sampled, or partial copies of the dataset may exist on devices with more limited storage capacity.
E. Confidential Product Roadmap Materials
The fifth category consists of confidential product roadmap documents for the period 2023–2025, including, without limitation, the unreleased "LumosEdge 3.0" specifications. These documents contain sensitive strategic, technical, and business-planning information regarding Lumos's product development trajectory, planned feature releases, competitive positioning analyses, and market-entry strategies.
Brindoval shall specifically identify and destroy the thirty-seven (37) page document titled "LumosEdge 3.0 Product Roadmap" in PDF format, which the Preliminary Forensic Report confirmed was forwarded by Rajiv Anand to his personal email address (r.anand.personal@vaultmail.com) on or about September 28, 2022. All copies, printouts, screenshots, excerpts, or derivatives of this document, as well as any other confidential product roadmap materials, shall be subject to remediation.
F. Derivative Works and Compilations
In addition to the five specific categories enumerated above, the remediation scope extends to any and all derivative works, modified versions, compilations, summaries, abstracts, annotations, presentations, memoranda, or other materials that incorporate, are based upon, or were created using any of the Lumos proprietary materials described in Subsections A through E above. This includes, without limitation, any materials created by Defendants or NovaSpark personnel that draw upon, reference, or were informed by any Lumos proprietary materials, to the extent such materials can be identified through forensic analysis.
Brindoval should apply the file-signature hashes, metadata correlation techniques, and content-similarity analysis methods documented in the Preliminary Forensic Report to identify derivative works and compilations that may not bear obvious file names or metadata tags linking them to Lumos proprietary materials.
III. Target Systems, Devices, and Accounts
Brindoval shall conduct the forensic remediation on the following systems, devices, and accounts, which are consistent with the inventory established during the forensic imaging phase conducted from March 22 through April 14, 2023, and documented in Appendix A to the Preliminary Forensic Report.
A. NovaSpark Corporate Systems
Brindoval shall conduct remediation on all NovaSpark Technologies Inc. servers, workstations, development environments, code repositories (including Git-based repositories), and cloud infrastructure located at or associated with NovaSpark's offices at 88 Bluxome Street, Floor 4, San Francisco, California 94107, as well as any remote or cloud-hosted environments (including, without limitation, Ridgeway Industries, Aldermere Technologies, Crestline Systems, or similar cloud computing and storage environments) used by NovaSpark in the course of its operations.
The remediation shall also encompass NovaSpark corporate email systems (including all email archives and backup stores), file-sharing systems (including, without limitation, any instances of Ashbury Data Systems, Aldermere Systems, Meridian Solutions file repositories, or similar collaboration platforms), and code repositories (including, without limitation, Aldermere Data Systems, Aldermere Software, Strathmore Solutions, or any self-hosted version-control systems).
B. Personal Devices of Individual Defendants
Brindoval shall conduct remediation on the following personal devices belonging to the individual Defendants, all of which were previously forensically imaged during the March–April 2023 forensic examination:
1. Three (3) personal laptop computers — one each belonging to Rajiv Anand, Serena Mallick, and Derek Yun — as identified and imaged during the forensic examination phase;
2. Two (2) personal mobile phones belonging to individual Defendants, as previously imaged during the forensic examination phase; and
3. Two (2) external storage drives, including the USB drive bearing serial number WD-4837291, which is associated with Serena Mallick and was identified in the Preliminary Forensic Report as the device onto which the DataStream ETL pipeline repository was copied on or about October 10, 2022.
C. Personal Cloud Storage Accounts
Brindoval shall conduct remediation on the following personal cloud storage and email accounts:
1. Rajiv Anand's personal Hollowell Health IT account — specifically, the account to which approximately 3.2 gigabytes of LumosEdge model architecture files were transferred on or about September 26, 2022, as documented in the Preliminary Forensic Report;
2. Rajiv Anand's personal email account at r.anand.personal@vaultmail.com — specifically, the account to which the thirty-seven (37) page "LumosEdge 3.0 Product Roadmap" PDF was forwarded on or about September 28, 2022, as documented in the Preliminary Forensic Report;
3. Derek Yun's personal Larkspur Technologies account — specifically, the account to which forty-seven (47) proprietary Jupyter notebooks were downloaded on or about October 18, 2022, as documented in the Preliminary Forensic Report; and
4. Any other personal cloud storage or email accounts identified during the forensic imaging phase as containing Lumos proprietary materials, as documented in Appendix B to the Preliminary Forensic Report.
For each cloud account, Brindoval shall ensure that all Lumos proprietary materials, including any files in trash, archive, or version-history repositories, are identified and permanently removed.
IV. Remediation Procedures and Standards
A. Identification and Verification
Prior to commencing any deletion or destruction activities, Brindoval shall re-scan all target systems, devices, and accounts using the file-signature hashes (MD5 and SHA-256), metadata profiles, and keyword search terms that were established during the initial forensic examination and documented in Appendix C to Brindoval's Preliminary Forensic Report of May 1, 2023. The purpose of this re-scan is to identify any Lumos proprietary materials that may have been moved, copied, renamed, modified, or otherwise altered since the forensic imaging was completed in April 2023, as well as to confirm the continued presence of materials identified during the initial examination.
Any Lumos proprietary materials or derivative works identified during the re-scan shall be fully cataloged and documented prior to deletion. The catalog shall include, at a minimum, the information specified in Subsection C below. No deletion or destruction activity shall commence until the identification and cataloging process for the relevant device or account has been completed and the catalog has been made available to Meridian Cybersecurity Advisors Inc. for review, as described in Section V below.
B. Deletion and Destruction Protocol
The following deletion and destruction methods shall be employed, depending on the type of media or account at issue:
1. Electronic files on servers, laptops, and external drives. Brindoval shall perform secure deletion using industry-standard methods consistent with the National Institute of Standards and Technology Special Publication 800-88, Revision 1 ("NIST SP 800-88 Rev. 1"), Guidelines for Media Sanitization. Specifically, Brindoval shall employ a "Clear" or "Purge" level sanitization method, as appropriate for the media type, ensuring that data is rendered unrecoverable by state-of-the-art forensic recovery techniques. For solid-state drives (SSDs), Brindoval shall use manufacturer-provided secure-erase commands or cryptographic-erase methods, as recommended by NIST SP 800-88 Rev. 1 for flash-based media.
2. Cloud-hosted files. For files residing in cloud storage accounts, Brindoval shall perform permanent deletion from all cloud storage accounts, including removal from "trash," "recently deleted," "archive," and any backup or versioning repositories maintained by the cloud provider. Brindoval shall verify that the cloud provider's deletion process has been completed by confirming that the files are no longer recoverable through the provider's user interface, API, or administrative tools. Where the cloud provider offers a mechanism for requesting expedited permanent deletion (as opposed to the provider's standard retention and deletion cycle), Brindoval shall utilize such mechanism.
3. USB drive (serial number WD-4837291). For the external USB drive bearing serial number WD-4837291, Brindoval shall, at its discretion, either (a) perform a full secure wipe of the drive in accordance with NIST SP 800-88 Rev. 1, or (b) arrange for physical destruction of the drive. In either case, Brindoval shall thoroughly document the method employed and the results obtained. If physical destruction is selected, Brindoval shall photograph the drive before and after destruction and retain the photographs as part of the remediation record.
C. Documentation Requirements
Brindoval shall maintain a detailed chain-of-custody log for each device and account accessed during the remediation process. The chain-of-custody log shall document the date and time of each access, the identity of the Brindoval personnel conducting the access, the location of the access (on-site or remote), and any transfers of physical custody of devices.
For each item of Lumos proprietary material identified and destroyed during the remediation, Brindoval shall document the following:
(a) the file name and full file path (or, for cloud-hosted files, the account identifier and folder path);
(b) the device, server, repository, or account on which the file was found;
(c) the cryptographic hash value of the file (both MD5 and SHA-256, to the extent feasible);
(d) the timestamp of deletion or destruction, recorded in UTC; and
(e) the method of destruction employed (e.g., NIST Clear, NIST Purge, cryptographic erase, cloud permanent deletion, or physical destruction).
This documentation shall be compiled into a comprehensive remediation log that will form a core component of the Final Forensic Remediation Certification described in Section X below.
V. Oversight by Meridian Cybersecurity Advisors Inc.
Pursuant to Section 7.4 of the Settlement Agreement, the forensic remediation shall be conducted with oversight from Naveen Kapoor, Senior Consultant, of Meridian Cybersecurity Advisors Inc. ("Meridian"), located at 2100 Geng Road, Suite 210, Palo Alto, California 94303. Meridian has been retained by Calderwood & Harkness LLP on behalf of Lumos to independently verify the completeness and thoroughness of the forensic remediation process and to provide an independent assessment of whether the remediation has been conducted in accordance with the protocols set forth in this letter and the terms of the Settlement Agreement.
To facilitate Meridian's oversight role, Brindoval shall provide Meridian with real-time access to all remediation logs, including the chain-of-custody logs and the file-identification and destruction documentation described in Section IV above. Brindoval shall coordinate the scheduling of all remediation activities to permit Meridian's on-site or remote observation, as Meridian may elect. Brindoval shall provide Meridian with reasonable advance notice (no less than forty-eight (48) hours) of scheduled remediation sessions to allow Meridian to arrange for personnel to observe.
Meridian may, in the exercise of its independent professional judgment, request additional scans, verification steps, or supplemental analyses that Meridian deems necessary or appropriate to confirm the completeness of the remediation. Brindoval shall accommodate such requests in good faith, provided that such requests fall within the scope of the Settlement Agreement and do not unreasonably delay the remediation timeline. In the event of any disagreement between Brindoval and Meridian regarding the scope or necessity of a requested verification step, the parties shall confer in good faith to resolve the disagreement, and, if necessary, the matter may be referred to this firm for resolution in consultation with Defendants' counsel.
VI. Cooperation of Defendants
Pursuant to Section 7.2 of the Settlement Agreement and Paragraph 5 of the Stipulated Permanent Injunction, NovaSpark Technologies Inc. and each individual Defendant—Rajiv Anand, Serena Mallick, and Derek Yun—are obligated to cooperate fully and in good faith with Brindoval's remediation activities. This obligation of cooperation is a material term of the Settlement Agreement, and any failure to cooperate may constitute a breach thereof, entitling Lumos to seek enforcement of the Stipulated Permanent Injunction and such other remedies as may be available under the Settlement Agreement and applicable law.
Specifically, Defendants shall provide Brindoval with complete and unrestricted access to all target systems, devices, and accounts within the remediation scope, including, without limitation, all necessary login credentials, passwords, encryption keys, multi-factor authentication tokens, and administrative-level access permissions. Defendants shall make themselves and their personnel available to answer questions from Brindoval regarding file locations, system configurations, and data-management practices, and shall promptly respond to any requests for information or assistance from Brindoval during the remediation process.
Defendants' counsel, Patricia Whitfield and Samuel Gerber of Whitfield, Raines & Gerber LLP, 235 Montgomery Street, Suite 1800, San Francisco, California 94104, has been notified of this forensic remediation protocol and has confirmed Defendants' agreement to cooperate fully with Brindoval in connection with the remediation. We have provided a copy of this letter to Ms. Whitfield and request that any questions or concerns from Defendants regarding the remediation process be communicated through Defendants' counsel.
VII. Timeline
The forensic remediation is to commence on October 4, 2023, which is the date of entry of the Stipulated Permanent Injunction by the Court. Brindoval shall use commercially reasonable efforts to complete all remediation activities within approximately four (4) weeks following commencement, targeting completion by no later than October 31, 2023.
We recognize that the remediation timeline may be affected by factors outside of Brindoval's direct control, including, without limitation, the responsiveness of cloud service providers to deletion-verification requests and the availability of individual Defendants' personal devices for remediation. Brindoval shall promptly notify this firm and Meridian of any circumstances that may delay the anticipated completion date, and we will work with Defendants' counsel to address any such issues expeditiously.
Upon completion of all remediation activities and all associated verification steps, Brindoval shall issue a Final Forensic Remediation Certification confirming that all Lumos proprietary materials, as described in Section II above, have been verified as deleted and destroyed from all target systems, devices, and accounts within the remediation scope, as described in Section III above. The requirements for the Final Forensic Remediation Certification are set forth in detail in Section X below.
VIII. Cost Allocation
Consistent with Section 9.1 of the Settlement Agreement and the Court's prior order dated March 8, 2023, regarding allocation of forensic examination costs, Brindoval's fees for the forensic remediation shall be allocated as follows:
• Defendants/NovaSpark (60%): One Hundred Thirty-One Thousand One Hundred Sixty Dollars ($131,160.00), based on total Brindoval fees of Two Hundred Eighteen Thousand Six Hundred Dollars ($218,600.00), inclusive of both the initial forensic examination phase and the remediation phase.
• Lumos (40%): Eighty-Seven Thousand Four Hundred Forty Dollars ($87,440.00), based on total Brindoval fees of Two Hundred Eighteen Thousand Six Hundred Dollars ($218,600.00), inclusive of both the initial forensic examination phase and the remediation phase.
Brindoval should submit invoices for Defendants' sixty percent (60%) share to Whitfield, Raines & Gerber LLP, 235 Montgomery Street, Suite 1800, San Francisco, California 94104, Attention: Patricia Whitfield. Invoices for Lumos's forty percent (40%) share should be submitted to Calderwood & Harkness LLP, 555 California Street, 40th Floor, San Francisco, California 94104, Attention: Catherine Bloom, Billing Partner. Payment terms shall be net thirty (30) days from the date of invoice, consistent with the terms of Brindoval's engagement letter.
IX. Audit Rights
The Settlement Agreement provides, in Section 8.1, that NovaSpark's continued business operations are subject to audit rights exercisable by Brindoval, at Lumos's request, for a period of eighteen (18) months from the effective date of the Settlement Agreement, i.e., from September 22, 2023, through March 22, 2025.
During this eighteen-month period, NovaSpark may continue its business operations, including the development of products in the financial analytics and machine-learning space. However, the Settlement Agreement expressly requires that any competing product developed by NovaSpark during or after the audit period must be created using only independently created or publicly available technology, data, and methodologies, without any reliance upon or derivation from Lumos proprietary materials.
This letter confirms Lumos's expectation that Brindoval will remain available to conduct follow-up audits of NovaSpark's systems and operations during the eighteen-month audit period should Lumos have reasonable grounds to request such audits. The scope, procedures, and cost allocation for any such follow-up audits will be addressed at the time of any such request, consistent with the terms of the Settlement Agreement.
X. Final Certification Requirements
Upon completion of the forensic remediation, Brindoval shall prepare and issue a Final Forensic Remediation Certification (the "Certification"). The Certification shall include, at a minimum, the following components:
1. A comprehensive inventory of all Lumos proprietary materials identified during the remediation process across all target systems, devices, and accounts, organized by category (corresponding to the categories set forth in Section II above) and by target system, device, or account (corresponding to the targets set forth in Section III above);
2. Confirmation of the secure deletion and/or destruction of each identified item, including the methodology employed for each deletion or destruction event and the verification data (including hash values, timestamps, and confirmation receipts from cloud service providers, as applicable) supporting the completeness of the deletion;
3. A statement, rendered to a reasonable degree of forensic certainty, that no Lumos proprietary materials—including derivative works, modified versions, compilations, or materials based upon Lumos proprietary materials—remain on any of the target systems, devices, or accounts within the remediation scope; and
4. Any observations, caveats, or qualifications that Brindoval deems necessary or appropriate to include in the interest of forensic accuracy and completeness.
The Certification shall be signed by Dr. Irene Chow, in her capacity as Managing Director and Lead Forensic Examiner of Brindoval Digital Forensics LLC, and by Kevin Barr, Senior Forensic Analyst, who, we understand, served as the lead analyst on this engagement during the forensic imaging phase.
A copy of the Final Forensic Remediation Certification shall be provided to each of the following:
(a) Calderwood & Harkness LLP, Attention: Wendy Schultz, 555 California Street, 40th Floor, San Francisco, California 94104;
(b) Whitfield, Raines & Gerber LLP, Attention: Patricia Whitfield, 235 Montgomery Street, Suite 1800, San Francisco, California 94104; and
(c) Meridian Cybersecurity Advisors Inc., Attention: Naveen Kapoor, 2100 Geng Road, Suite 210, Palo Alto, California 94303.
XI. Contact Information and Coordination
For purposes of coordinating the remediation activities, the primary contacts at Calderwood & Harkness LLP are as follows:
Wendy Schultz, Lead Associate Calderwood & Harkness LLP 555 California Street, 40th Floor San Francisco, California 94104 Telephone: (415) 555-7200
Email: wschultz@calderwoodharkness.com
Omar Siddiqui, Working Associate Calderwood & Harkness LLP 555 California Street, 40th Floor San Francisco, California 94104 Telephone: (415) 555-7215
Email: osiddiqui@calderwoodharkness.com
The contact at Meridian Cybersecurity Advisors Inc. for oversight coordination is:
Naveen Kapoor, Senior Consultant Meridian Cybersecurity Advisors Inc. 2100 Geng Road, Suite 210 Palo Alto, California 94303 Telephone: (650) 555-4100
Email: nkapoor@meridiancyber.com
The contact for Defendants' cooperation is:
Patricia Whitfield, Partner Whitfield, Raines & Gerber LLP 235 Montgomery Street, Suite 1800 San Francisco, California 94104 Telephone: (415) 555-3300
Email: pwhitfield@wrglaw.com
We ask that Brindoval direct all substantive communications regarding the remediation to the Calderwood & Harkness contacts identified above, with copies to Mr. Kapoor at Meridian and Ms. Whitfield at Whitfield, Raines & Gerber, as appropriate.
XII. Reservation of Rights
Nothing in this letter is intended to modify, amend, waive, or supersede the terms of the Settlement Agreement and Mutual Release dated September 22, 2023, or the Stipulated Permanent Injunction entered by the Court on October 4, 2023. This letter is intended solely to provide Brindoval with an operational protocol for the forensic remediation contemplated by those governing documents. In the event of any conflict or inconsistency between the terms of this letter and the terms of the Settlement Agreement or the Stipulated Permanent Injunction, the terms of those governing documents shall control in all respects.
Lumos expressly reserves all rights and remedies available to it under the Settlement Agreement, the Stipulated Permanent Injunction, the California Uniform Trade Secrets Act (Cal. Civ. Code §§ 3426–3426.11), the Defend Trade Secrets Act (18 U.S.C. § 1836 et seq.), and all other applicable federal and state law. Nothing in this letter shall be construed as a waiver, release, or limitation of any such rights or remedies.
We kindly request that you confirm receipt of this letter and provide written acknowledgment that Brindoval accepts and will comply with the forensic remediation protocol and scope of work described herein. Should you have any questions regarding the protocol or require clarification on any point, please do not hesitate to contact the undersigned or Mr. Siddiqui at the contact information provided above.
We appreciate Brindoval's continued professionalism, diligence, and expertise in this matter, and we look forward to the successful completion of the remediation process.
Very truly yours,
CALDERWOOD & HARKNESS LLP
By: ________
Wendy Schultz Lead Associate 555 California Street, 40th Floor San Francisco, California 94104 Telephone: (415) 555-7200
Email: wschultz@calderwoodharkness.com
cc:
Marcus Delgado, Responsible Partner, Calderwood & Harkness LLP Catherine Bloom, Billing Partner, Calderwood & Harkness LLP Omar Siddiqui, Working Associate, Calderwood & Harkness LLP Naveen Kapoor, Senior Consultant, Meridian Cybersecurity Advisors Inc. Kevin Barr, Senior Forensic Analyst, Brindoval Digital Forensics LLC Patricia Whitfield, Whitfield, Raines & Gerber LLP (Defendants' counsel)
Enclosures:
1. Settlement Agreement and Mutual Release (executed September 22, 2023)
2. Stipulated Permanent Injunction (entered October 4, 2023)
3. Brindoval Preliminary Forensic Report (dated May 1, 2023) (for reference)

CALDERWOOD & HARKNESS LLP Attorneys at Law

VIA ELECTRONIC MAIL AND FIRST-CLASS MAIL

CALDERWOOD & HARKNESS LLP

Record

Parties

Dates

Amounts