PRIVILEGED AND CONFIDENTIAL — ATTORNEY WORK PRODUCT This memorandum is protected by the attorney-client privilege and the work product doctrine. It is intended solely for the use of attorneys and personnel of Calderwood & Harkness LLP and authorized representatives of Lumos Analytics Inc. in connection with legal representation. Do not distribute, copy, or disclose this memorandum or its contents without the prior written consent of Calderwood & Harkness LLP.
CALDERWOOD & HARKNESS LLP INTERNAL MEMORANDUM
Matter Number: 1008-00005
Date: November 1, 2023
To: Wendy Schultz, Lead Associate, intellectual Property Practice Group Marcus Delgado, Responsible Partner, intellectual Property Practice Group
From: Omar Siddiqui, Working Associate, intellectual Property Practice Group
Re: Review of Brindoval Digital Forensics LLC — Final Forensic Remediation Certification (Issued October 31, 2023); Lumos Analytics Inc. v. NovaSpark Technologies Inc., et al., Case No. 23-CV-004871 (Superior Court of the State of California, County of Santa Clara)
I. Executive Summary
The purpose of this memorandum is to review and confirm the completeness and adequacy of the Final Forensic Remediation Certification (the "Certification") issued by Brindoval Digital Forensics LLC ("Brindoval") on October 31, 2023, in connection with the above-referenced matter. This memorandum summarizes the scope and findings of the Certification, identifies the supporting independent verification, and provides a recommendation regarding the next procedural steps for the team.
The Certification was issued by Dr. Irene Chow, Managing Director and Lead Forensic Examiner at Brindoval, with supporting forensic analysis performed by Kevin Barr, Senior Forensic Analyst. Dr. Chow and Mr. Barr supervised all remediation activities from commencement on October 4, 2023 through completion on October 30, 2023, and Dr. Chow personally attested to the completeness and accuracy of the Certification under penalty of perjury.
The Certification concludes that all proprietary materials belonging to Lumos Analytics Inc. ("Lumos") have been verified as permanently deleted and destroyed from the following categories of devices and systems:
(a) all NovaSpark Technologies Inc. ("NovaSpark") servers, corporate systems, and corporate cloud infrastructure;
(b) all personal devices of the three individual Defendants — Rajiv Anand, Serena Mallick, and Derek Yun — including laptops, phones, and external storage media; and
(c) all associated cloud storage accounts, email accounts, and other online repositories used by or accessible to NovaSpark and the individual Defendants.
Independent verification of Brindoval's findings was conducted by Naveen Kapoor, Senior Consultant at Meridian Cybersecurity Advisors Inc. ("Meridian"), who provided oversight throughout the remediation period and issued a written confirmation letter concurring with the Certification on October 31, 2023. Meridian's independent verification constitutes an additional layer of assurance that the remediation was conducted thoroughly and in accordance with the forensic remediation protocol transmitted to Brindoval on October 3, 2023.
Based on my review of the Certification, Meridian's independent verification confirmation, and the underlying remediation documentation, it is my recommendation that the forensic remediation obligations imposed under the Settlement Agreement and Mutual Release dated September 22, 2023 (the "Settlement Agreement") and the Stipulated Permanent Injunction entered by the Honorable David Rutherford on October 4, 2023 (the "Stipulated Permanent Injunction") have been fully and satisfactorily completed. All conditions precedent to dismissal of the underlying action have been met, and the team should proceed with the filing of the Stipulation and Proposed Order of Dismissal with Prejudice at the earliest opportunity.
II. Background and Procedural Context
A. Settlement Agreement Remediation Requirements
On September 22, 2023, Lumos Analytics Inc., NovaSpark Technologies Inc., and the three individual Defendants — Rajiv Anand, Serena Mallick, and Derek Yun — executed the Settlement Agreement and Mutual Release, which resolved all claims asserted in the Verified Complaint filed in Lumos Analytics Inc. v. NovaSpark Technologies Inc., et al., Case No. 23-CV-004871, pending in the Superior Court of the State of California, County of Santa Clara. The Settlement Agreement was the product of extensive arms-length negotiations, including a full-day mediation conducted before the Honorable Lisa Tanaka (Ret.) on August 30, 2023 and follow-on negotiations over a period of approximately three weeks.
The Settlement Agreement contains detailed forensic remediation provisions that are central to the present analysis. Specifically, Section 5 of the Settlement Agreement (entitled "Forensic Remediation and Verified Destruction") imposes the following principal obligations on NovaSpark and the individual Defendants:
(a) NovaSpark and each individual Defendant were required to submit all systems, devices, and cloud accounts to a full forensic remediation — consisting of verified deletion and permanent destruction of all Lumos proprietary materials — under the direct supervision of Brindoval Digital Forensics LLC, the neutral forensic examiner previously appointed in the litigation;
(b) the forensic remediation was required to encompass all five categories of Lumos trade secrets identified in the Verified Complaint and the Preliminary Injunction Order (entered February 17, 2023), as further enumerated in Exhibit B to the Settlement Agreement;
(c) upon completion of the forensic remediation, Brindoval was required to issue a Final Forensic Remediation Certification confirming that all Lumos proprietary materials had been verified as permanently deleted and destroyed from all systems, devices, and accounts subject to the remediation; and
(d) independent verification by Meridian Cybersecurity Advisors Inc. was required to supplement and confirm Brindoval's findings.
In addition to the remediation obligations, the Settlement Agreement contains provisions governing NovaSpark's ongoing operations. Pursuant to Section 6, NovaSpark is permitted to continue its business operations, but only using technology that was independently created by NovaSpark without reference to or reliance upon any Lumos proprietary materials, or technology that is publicly available and not proprietary to Lumos. To ensure ongoing compliance with this requirement, Brindoval was granted audit rights over NovaSpark's systems for a period of eighteen (18) months from the effective date of the Settlement Agreement (i.e., from September 22, 2023 through approximately March 22, 2025). Such audits may be conducted at Brindoval's discretion upon reasonable notice, with costs borne by NovaSpark.
The Settlement Agreement further provides, in Section 7, that each individual Defendant — Rajiv Anand, Serena Mallick, and Derek Yun — personally covenanted not to use, disclose, or exploit any Lumos trade secrets in any future employment, consulting engagement, entrepreneurial venture, or other professional capacity for a period of five (5) years from the effective date of the Settlement Agreement (i.e., through September 22, 2028). These covenants survive the dismissal of the underlying action and are independently enforceable as contractual obligations under the Settlement Agreement.
B. Stipulated Permanent Injunction Requirements
On October 4, 2023, the Honorable David Rutherford entered the Stipulated Permanent Injunction (styled as an "Injunction-by-Consent") in Case No. 23-CV-004871. The Stipulated Permanent Injunction was jointly submitted by the parties pursuant to Section 8 of the Settlement Agreement and was entered by the Court without opposition.
The Stipulated Permanent Injunction permanently enjoins NovaSpark Technologies Inc., Rajiv Anand, Serena Mallick, and Derek Yun — as well as their respective agents, employees, officers, representatives, successors, and assigns — from possessing, using, disclosing, distributing, reproducing, reverse-engineering, or otherwise exploiting any Lumos trade secrets, proprietary materials, or confidential information, as defined in the Verified Complaint and the Court's February 17, 2023 Preliminary Injunction Order. The injunction is not limited in duration and remains in effect in perpetuity.
Critically for present purposes, the Stipulated Permanent Injunction specifies that completion of the forensic remediation under Brindoval's supervision is a condition precedent to the Court's entry of a final order of dismissal. Paragraph 7 of the Stipulated Permanent Injunction provides:
"The parties shall not seek dismissal of the underlying action until such time as (a) the neutral forensic examiner, Brindoval Digital Forensics LLC, has issued a Final Forensic Remediation Certification confirming that all Lumos proprietary materials have been verified as permanently deleted and destroyed from all systems, devices, and accounts subject to remediation, and (b) independent verification of the same has been provided by Meridian Cybersecurity Advisors Inc. The Stipulated Permanent Injunction shall survive and remain enforceable notwithstanding dismissal of the underlying action."
The condition precedent described above has now been satisfied, as discussed in detail in Sections IV and V below.
C. Forensic Remediation Timeline
The forensic remediation proceeded according to the following timeline:
October 3, 2023: Wendy Schultz, on behalf of Calderwood & Harkness LLP and Lumos, transmitted the Forensic Remediation Protocol and Scope Letter to Dr. Irene Chow at Brindoval Digital Forensics LLC, located at 1901 Harrison Street, Suite 600, Oakland, California 94612. The protocol letter detailed the scope of the remediation, the categories of Lumos proprietary materials to be deleted and destroyed, the specific devices and systems to be remediated, and the verification standards to be employed by Brindoval. A copy of the protocol letter is attached hereto as Attachment C.
October 4, 2023: Brindoval commenced the forensic remediation. On the same date, the Stipulated Permanent Injunction was entered by the Court, formally triggering the remediation timeline.
October 4–30, 2023: Brindoval conducted the forensic remediation over a period of twenty-seven (27) calendar days. During this period, Brindoval's team — led by Dr. Irene Chow and Kevin Barr — performed verified deletion and destruction activities across all NovaSpark corporate systems, all personal devices of the three individual Defendants, and all associated cloud storage and email accounts. Meridian Cybersecurity Advisors Inc. (Naveen Kapoor) provided independent oversight throughout this period pursuant to the remediation protocol.
October 30, 2023: Brindoval completed all forensic remediation activities.
October 31, 2023: Brindoval issued the Final Forensic Remediation Certification, signed by Dr. Irene Chow and Kevin Barr. On the same date, Naveen Kapoor of Meridian issued a written confirmation letter concurring with the Certification.
The remediation was completed within the timeframe contemplated by the Settlement Agreement, which provided for completion no later than thirty (30) days following the entry of the Stipulated Permanent Injunction (i.e., by November 3, 2023). The Certification was issued one business day after the completion of remediation activities.
D. Prior Forensic Work
Brindoval's involvement in this matter predates the Settlement Agreement by several months. On March 8, 2023, the parties filed a Joint Stipulation and Proposed Order for the Appointment of a Neutral Forensic Examiner, which was signed by Marcus Delgado on behalf of Lumos and by Patricia Whitfield of Whitfield, Raines & Gerber LLP on behalf of all Defendants. The Court entered the stipulated order on March 10, 2023, formally appointing Brindoval as the neutral forensic examiner for the litigation.
Pursuant to the stipulated order, Brindoval conducted forensic imaging of all devices and systems at issue from March 22 through April 14, 2023. The forensic imaging covered the following:
• All NovaSpark Technologies Inc. servers and corporate cloud infrastructure at the NovaSpark offices, located at 88 Bluxome Street, Floor 4, San Francisco, California 94107;
• Three personal laptops belonging to Rajiv Anand, Serena Mallick, and Derek Yun, respectively;
• Two personal phones (belonging to Rajiv Anand and Derek Yun);
• Two external USB storage drives (one belonging to Serena Mallick, serial number WD-4837291, and one belonging to Derek Yun); and
• All associated cloud storage accounts, including Rajiv Anand's personal Hollowell Health IT account, Derek Yun's personal Larkspur Technologies account, and all relevant email accounts.
On May 1, 2023, Brindoval issued its Preliminary Forensic Report (the "Preliminary Report"), which confirmed the presence of Lumos proprietary materials across NovaSpark's corporate systems and the individual Defendants' personal devices. The Preliminary Report was instrumental in the mediation and settlement negotiations that followed, as it provided objective, independently verified evidence of the scope and extent of the misappropriation.
The total fees incurred by Brindoval for its forensic examination services through the completion of the remediation (including forensic imaging, the Preliminary Report, and the remediation itself) amounted to $218,600. Pursuant to the Court's order of June 15, 2023, and as memorialized in Section 12 of the Settlement Agreement, these fees were allocated sixty percent (60%) to NovaSpark and the individual Defendants ($131,160) and forty percent (40%) to Lumos ($87,440). The Defendants' share was included in the overall settlement payment and has been received.
III. Scope of the Final Forensic Remediation Certification
A. Categories of Lumos Proprietary Materials Subject to Remediation
The Certification addresses all five categories of Lumos trade secrets and proprietary materials that were identified in the Verified Complaint (filed January 18, 2023), the Preliminary Injunction Order (entered February 17, 2023), and the Stipulated Permanent Injunction (entered October 4, 2023). These five categories were also enumerated in Exhibit B to the Settlement Agreement and in the Forensic Remediation Protocol and Scope Letter transmitted to Brindoval on October 3, 2023. The categories are as follows:
Category 1 — LumosEdge Ensemble ML Model Architecture: This category encompasses the proprietary neural-network topology and hyperparameter configurations underlying the LumosEdge ensemble machine-learning model, Lumos's flagship predictive analytics product. The LumosEdge architecture represents years of research and development investment and constitutes a core trade secret. The misappropriated materials in this category included model architecture specification documents, hyperparameter configuration files, and related technical documentation.
Category 2 — Proprietary Feature-Engineering Libraries: This category encompasses Lumos's proprietary feature-engineering libraries, which contain 2,847 individual engineered features for financial signal generation. These features were developed over a period of approximately four years and represent significant proprietary value. The libraries were stored in multiple code repositories and supporting documentation files.
Category 3 — DataStream ETL Pipeline Codebase and Data-Schema Definitions: This category encompasses the complete source code and data-schema definitions for the DataStream ETL (Extract, Transform, Load) pipeline, which manages ingestion from forty-three (43) alternative-data vendors. The DataStream pipeline is a critical component of Lumos's data infrastructure and contains proprietary algorithms for data normalization, quality assurance, and transformation.
Category 4 — Curated and Labeled Training Dataset: This category encompasses a curated and labeled training dataset of approximately 14.6 terabytes of historical financial and alternative data. This dataset was assembled and labeled over several years at considerable expense and represents a significant competitive asset. Portions of this dataset were identified on NovaSpark's servers and in the individual Defendants' cloud storage accounts.
Category 5 — Confidential Product Roadmap Documents (2023–2025): This category encompasses confidential product roadmap documents covering Lumos's strategic plans for 2023 through 2025, including the unreleased LumosEdge 3.0 specifications. The LumosEdge 3.0 specifications consisted of a thirty-seven-page PDF document that was forwarded by Rajiv Anand to his personal email account on September 28, 2022. The product roadmap documents are classified as highly confidential within Lumos's information security framework and were not intended for external distribution.
The Certification confirms that all instances of materials falling within each of these five categories have been identified and permanently deleted or destroyed across all systems, devices, and accounts subject to the remediation.
B. Devices and Systems Subject to Remediation
The remediation encompassed the following devices and systems, consistent with the scope defined in the Forensic Remediation Protocol and Scope Letter:
NovaSpark Corporate Systems. The remediation covered all NovaSpark Technologies Inc. servers located at the company's offices at 88 Bluxome Street, Floor 4, San Francisco, California 94107. This included NovaSpark's development environment servers, staging environment servers, and production environment servers. Additionally, the remediation covered NovaSpark's corporate cloud infrastructure, which included cloud-hosted virtual machines, object storage buckets, and container registry instances. The Certification confirms that all five categories of Lumos proprietary materials were found to have been present on NovaSpark's corporate systems, consistent with the findings of the May 1, 2023 Preliminary Report, and that all such materials have been permanently deleted.
Rajiv Anand's Personal Devices and Accounts. The remediation covered Mr. Anand's personal laptop, personal phone, personal Hollowell Health IT account, and personal email account (r.anand.personal@vaultmail.com). The Preliminary Report had identified Mr. Anand's Hollowell Health IT account as containing approximately 3.2 gigabytes of files that were transferred from Lumos systems on or about September 26, 2022. These files included model architecture specifications and hyperparameter configuration files falling within Category 1. Additionally, Mr. Anand's personal email account was identified as containing the thirty-seven-page LumosEdge 3.0 Product Roadmap PDF (Category 5), which was forwarded to the personal email address on September 28, 2022 — just four days before Mr. Anand's separation from Lumos on October 2, 2022.
Serena Mallick's Personal Devices and Accounts. The remediation covered Ms. Mallick's personal laptop and her external USB drive bearing serial number WD-4837291. The Preliminary Report had identified the external USB drive as containing approximately 780 megabytes of data from the DataStream ETL pipeline repository (Category 3), which had been cloned to the drive on or about October 10, 2022, approximately one week after Ms. Mallick's separation from Lumos on October 3, 2022. Ms. Mallick did not have any cloud storage accounts identified as containing Lumos materials.
Derek Yun's Personal Devices and Accounts. The remediation covered Mr. Yun's personal laptop, personal phone, and personal Larkspur Technologies account. The Preliminary Report had identified Mr. Yun's Larkspur Technologies account as containing forty-seven (47) proprietary Jupyter notebooks with feature-engineering code and model-training scripts (falling within Categories 1 and 2), which were downloaded to the Larkspur Technologies account on or about October 18, 2022 — approximately two weeks after Mr. Yun's separation from Lumos on October 5, 2022.
IV. Summary of Brindoval's Findings and Certification
The following is a summary of Brindoval's findings as set forth in the Certification. The Certification itself, together with its detailed appendices, is attached hereto as Attachment A and should be consulted for the complete forensic record.
A. NovaSpark Corporate Systems
Brindoval confirmed that all instances of Lumos proprietary materials — including source code, model architecture files, hyperparameter configurations, feature-engineering libraries, DataStream pipeline code and schema definitions, training data subsets, and product roadmap documents — have been identified and permanently deleted from NovaSpark's servers and corporate cloud infrastructure. The deletion activities encompassed all three server environments (development, staging, and production), as well as all cloud-hosted instances, object storage buckets, and container registries.
Critically, Brindoval conducted sector-level verification to confirm that all deleted files are unrecoverable. This means that Brindoval did not merely confirm that files were deleted at the operating-system level (which would leave data potentially recoverable through forensic techniques), but rather verified that the underlying disk sectors previously occupied by the deleted files have been overwritten with randomized data using a multi-pass overwrite protocol consistent with NIST SP 800-88 guidelines. Brindoval confirmed that the overwrite process was applied uniformly across all storage media and that no residual Lumos data remains in unallocated disk space, Meridian Solutions space, or temporary file caches.
In addition to the deletion and destruction activities, Brindoval reviewed NovaSpark's current active product development codebase to determine whether any Lumos-derived code or data had been integrated into NovaSpark's independent work product. This review was conducted using automated code-comparison tools, hash-value matching, and manual line-by-line analysis of code segments flagged by the automated tools. Brindoval's review confirmed that no Lumos-derived code or data was found to remain in the active development environment. The remaining NovaSpark code and data consisted solely of independently created materials and publicly available open-source libraries, consistent with the terms of the Settlement Agreement. The Certification expressly notes this finding, which provides additional assurance that NovaSpark's ongoing operations do not rely upon or incorporate any Lumos proprietary materials.
B. Rajiv Anand's Devices and Accounts
With respect to Mr. Anand's personal devices and accounts, Brindoval's findings are as follows:
Personal Hollowell Health IT Account. All files transferred to Mr. Anand's personal Hollowell Health IT account on or about September 26, 2022 — totaling approximately 3.2 gigabytes and consisting primarily of LumosEdge model architecture specifications and hyperparameter configuration files — have been verified as permanently deleted. Brindoval accessed the Hollowell Health IT account with Mr. Anand's cooperation and confirmed that all Lumos materials had been removed, including from the "Trash" folder and any version-history archives maintained by the Hollowell Health IT platform. The Severin Industries account was purged of all Lumos materials, and Brindoval reviewed the account's activity logs to confirm that no further copies of the materials had been shared with, transferred to, or accessed from any additional accounts or devices.
Personal Email Account (r.anand.personal@vaultmail.com). The LumosEdge 3.0 Product Roadmap PDF (thirty-seven pages), which was forwarded to this email address on September 28, 2022, has been verified as permanently deleted. Brindoval confirmed that the email message containing the attachment, as well as any copies in Mr. Anand's sent items folder, trash folder, archived folders, and spam folder, have been permanently purged. Brindoval further confirmed that the attachment had not been downloaded from the email to any local device other than Mr. Anand's personal laptop (addressed below) or forwarded to any additional email addresses.
Personal Laptop. Brindoval conducted a forensic wipe of all Lumos-related files identified on Mr. Anand's personal laptop. The wipe was performed with sector-level verification, confirming that the relevant disk sectors have been overwritten and the data is unrecoverable. Brindoval's forensic analysis confirmed that no residual Lumos materials remain on the device.
Personal Phone. Brindoval examined Mr. Anand's personal phone and confirmed that no Lumos proprietary materials were identified on the device. This finding is consistent with the Preliminary Report, which also found no Lumos materials on Mr. Anand's phone.
C. Serena Mallick's Devices and Accounts
With respect to Ms. Mallick's personal devices and accounts, Brindoval's findings are as follows:
External USB Drive (Serial Number WD-4837291). The complete DataStream ETL pipeline repository — approximately 780 megabytes of data that had been cloned to this drive on or about October 10, 2022 — has been verified as permanently destroyed. Pursuant to the remediation protocol, the USB drive was physically destroyed under Brindoval's direct supervision. The physical destruction was carried out using a certified degaussing and shredding process, rendering the storage media entirely unrecoverable. Brindoval prepared and maintained detailed photographic documentation and chain-of-custody records throughout the physical destruction process. These records are included in Appendix D to the Certification.
Personal Laptop. Brindoval conducted a forensic wipe of all Lumos-related files identified on Ms. Mallick's personal laptop. The wipe was performed with sector-level verification, confirming that the relevant disk sectors have been overwritten with randomized data and that no residual Lumos materials remain on the device. The forensic wipe specifically targeted files identified as originating from or related to the DataStream ETL pipeline repository and the feature-engineering libraries, which were the categories of Lumos materials most closely associated with Ms. Mallick's prior work at Lumos.
Cloud Storage Accounts. Brindoval confirmed that no additional cloud storage accounts maintained by or accessible to Ms. Mallick were found to contain Lumos proprietary materials. Ms. Mallick provided declarations and access credentials for all cloud storage accounts as required by the Settlement Agreement, and Brindoval's independent analysis corroborated that no Lumos materials were present.
D. Derek Yun's Devices and Accounts
With respect to Mr. Yun's personal devices and accounts, Brindoval's findings are as follows:
Personal Larkspur Technologies Account. All forty-seven (47) proprietary Jupyter notebooks — containing feature-engineering code and model-training scripts that had been downloaded to Mr. Yun's Larkspur Technologies account on or about October 18, 2022 — have been verified as permanently deleted from the Larkspur Technologies platform. Brindoval confirmed that all copies, including any locally synced copies on Mr. Yun's personal laptop and any version-history snapshots maintained by Larkspur Technologies, have been removed. Brindoval reviewed the Larkspur Technologies account's activity logs and sharing history to confirm that the notebooks had not been shared with or transferred to any additional accounts, devices, or recipients.
Personal Laptop. Brindoval conducted a forensic wipe of all Lumos-related files identified on Mr. Yun's personal laptop, including any locally synced copies of the Larkspur Technologies-hosted Jupyter notebooks. The wipe was performed with sector-level verification, confirming that the relevant disk sectors have been overwritten and the data is unrecoverable.
Personal Phone. Brindoval examined Mr. Yun's personal phone and confirmed that no Lumos proprietary materials were identified on the device. This finding is consistent with the Preliminary Report.
E. Verification Methodology
Throughout the remediation process, Brindoval employed a comprehensive and multi-layered verification methodology designed to ensure the completeness and reliability of the deletion and destruction activities. The methodology included the following components:
Forensic Imaging. Prior to conducting any deletion activities, Brindoval created updated forensic images of all devices and systems subject to remediation. These pre-remediation images served as a baseline against which the post-remediation state of each device and system could be compared. The imaging process followed industry-standard forensic imaging protocols, including the use of write-blocking hardware to ensure the integrity of the source media.
Hash-Value Comparison. Brindoval compiled a comprehensive inventory of all Lumos proprietary files identified during the initial forensic examination (March–April 2023) and documented in the May 1, 2023 Preliminary Report. Each file in the inventory was assigned a unique SHA-256 cryptographic hash value. Following the remediation, Brindoval conducted a hash-value search across all remediated devices and systems to confirm that no files matching the hash values of the inventoried Lumos materials remained present.
Sector-Level Overwrite Verification. For all file-level deletions, Brindoval performed sector-level verification to confirm that the disk sectors previously occupied by the deleted files had been overwritten with randomized data. The overwrite process employed a multi-pass protocol consistent with NIST SP 800-88 Rev. 1 guidelines for media sanitization.
Cloud-Account Audit Logs. For all cloud storage and email accounts subject to remediation, Brindoval reviewed platform-generated audit logs and activity records to verify that all Lumos materials had been permanently deleted and that no copies had been transferred, shared, or otherwise disseminated prior to or during the remediation process.
Cryptographic Verification and Timestamped Logging. All deletion activities were logged with precise timestamps, and each log entry was accompanied by cryptographic verification (SHA-256 hashes of the deleted files and the corresponding overwritten sectors). The resulting logs provide a complete and auditable record of every remediation action taken.
The Certification attaches detailed appendices listing every file identified as a Lumos proprietary material, its original location (by device, directory path, and/or cloud account), the date and time of its verified deletion or destruction, and the corresponding cryptographic verification record. These appendices are included in Attachment A and provide a granular, file-by-file record of the remediation.
V. Meridian Cybersecurity Advisors Inc. — Independent Verification
Pursuant to both the Settlement Agreement (Section 5(d)) and the Forensic Remediation Protocol and Scope Letter, Meridian Cybersecurity Advisors Inc. was retained to provide independent oversight and verification of Brindoval's remediation activities. Meridian's involvement was intended to provide an additional, independent layer of assurance to Lumos that the remediation was conducted thoroughly, accurately, and in accordance with the agreed-upon protocol.
Naveen Kapoor, Senior Consultant at Meridian Cybersecurity Advisors Inc., located at 2100 Geng Road, Suite 210, Palo Alto, California 94303, served as Meridian's lead consultant on this engagement. Mr. Kapoor holds a Certified Information Systems Security Professional (CISSP) certification and a Certified Computer Examiner (CCE) credential and has over fifteen years of experience in digital forensics and cybersecurity. Mr. Kapoor provided on-site and remote oversight throughout the remediation period from October 4 through October 30, 2023, consistent with the requirements of the remediation protocol.
Meridian's independent verification activities included the following:
• Independent review and validation of Brindoval's deletion logs, including verification of timestamp accuracy and cryptographic hash values;
• Spot-check analysis of post-remediation forensic images across a representative sample of devices and systems to confirm the absence of residual Lumos proprietary materials;
• Independent review of cloud-account audit trails for all Hollowell Health IT, Larkspur Technologies, and email accounts subject to remediation;
• Verification that Brindoval's sector-level overwrite procedures were conducted in accordance with NIST SP 800-88 Rev. 1 guidelines; and
• Observation and documentation of the physical destruction of Serena Mallick's external USB drive (serial number WD-4837291).
On October 31, 2023, Naveen Kapoor issued a written Independent Verification Confirmation Letter, addressed to Calderwood & Harkness LLP, concurring with Brindoval's Certification. The letter states that, based on Meridian's independent oversight and verification activities, Meridian is satisfied that all Lumos proprietary materials have been verified as permanently deleted and destroyed from all devices, systems, and accounts subject to the remediation. A copy of the Meridian Independent Verification Confirmation Letter is attached hereto as Attachment B.
For completeness, I note that Meridian's total fees for its engagement in this matter — encompassing pre-litigation technical consulting, trial-preparation support, and remediation oversight — amount to $94,300. Pursuant to the Settlement Agreement (Section 12(b)), these fees are borne entirely by Lumos. The fees have been invoiced and are being processed for payment through the firm's standard billing procedures.
VI. Compliance with Settlement Agreement and Stipulated Permanent Injunction
Based on the foregoing review, all material obligations arising under the Settlement Agreement and the Stipulated Permanent Injunction that are conditions precedent to dismissal have been fully satisfied. Specifically:
Forensic Remediation Complete. The forensic remediation was completed on October 30, 2023, within the thirty-day timeframe contemplated by the Settlement Agreement (which required completion no later than November 3, 2023 — thirty days following the entry of the Stipulated Permanent Injunction on October 4, 2023). The Certification was issued on October 31, 2023, one day after the completion of remediation activities.
Settlement Payment Received. The lump-sum settlement payment of $4,350,000 was received by Lumos on October 18, 2023, four (4) days before the contractual deadline of October 22, 2023 (thirty days from the effective date of the Settlement Agreement). The payment was confirmed as received in full by wire transfer to Lumos's designated account, as verified by Lumos's General Counsel, Thomas Brightwell, in an email to Wendy Schultz dated October 18, 2023.
Stipulated Permanent Injunction in Effect. The Stipulated Permanent Injunction entered by the Honorable David Rutherford on October 4, 2023 remains in full force and effect. The injunction permanently enjoins all Defendants and NovaSpark from possessing, using, disclosing, or exploiting any Lumos trade secrets. Pursuant to its terms, the Stipulated Permanent Injunction survives and remains enforceable as a court order notwithstanding the dismissal of the underlying action.
Ongoing Audit Rights. The eighteen-month audit rights provision set forth in Section 6 of the Settlement Agreement (running from September 22, 2023 through approximately March 22, 2025) permits Brindoval to conduct future audits of NovaSpark's systems at any time during that period to verify ongoing compliance with the Settlement Agreement's requirement that NovaSpark operate only using independently created or publicly available technology. These audit rights are not affected by the dismissal of the action and remain enforceable as a contractual obligation under the Settlement Agreement.
Personal Covenants. The five-year personal covenants of Rajiv Anand, Serena Mallick, and Derek Yun — prohibiting each of them from using, disclosing, or exploiting any Lumos trade secrets in any professional capacity — remain in full force and effect through September 22, 2028. These covenants are independently enforceable under the Settlement Agreement.
Conditions Precedent Satisfied. In light of the foregoing, all conditions precedent to the dismissal of the action — including (a) the completion of the forensic remediation and issuance of the Certification, (b) the independent verification by Meridian, and (c) the receipt of the settlement payment — have been satisfied. The parties are now in a position to proceed with the filing of the Stipulation and Proposed Order of Dismissal with Prejudice.
VII. Outstanding Post-Dismissal Monitoring Obligations
Although the matter is being recommended for closure and the underlying action is being dismissed, it is important to note that Lumos retains several significant rights and protections under the Settlement Agreement and the Stipulated Permanent Injunction that will continue in effect after the dismissal. The team should ensure that Lumos's General Counsel is fully apprised of these ongoing obligations and the procedures available to enforce them.
Eighteen-Month Audit Rights. As noted above, Brindoval Digital Forensics LLC retains the right to conduct audits of NovaSpark Technologies Inc.'s systems through approximately March 22, 2025 (eighteen months from the effective date of the Settlement Agreement). These audits may be initiated at Brindoval's discretion upon reasonable notice to NovaSpark and are designed to verify that NovaSpark continues to operate exclusively using independently created or publicly available technology, without reliance upon any Lumos proprietary materials. The costs of any such audits are to be borne by NovaSpark pursuant to Section 6(c) of the Settlement Agreement. Should Lumos wish to request that Brindoval initiate an audit at any point during the eighteen-month period, the request should be directed to Dr. Irene Chow through Calderwood & Harkness LLP.
Permanent Injunction. The Stipulated Permanent Injunction entered on October 4, 2023 remains enforceable as a court order of the Superior Court of the State of California, County of Santa Clara, notwithstanding the dismissal of the underlying action with prejudice. The injunction is unlimited in duration. Should any evidence arise that NovaSpark or any individual Defendant is in violation of the injunction — whether by possessing, using, disclosing, or exploiting Lumos trade secrets — Lumos may apply to the Court for a finding of contempt and appropriate sanctions, including monetary penalties and additional injunctive relief.
Five-Year Personal Covenants. The individual Defendants' personal covenants not to use Lumos trade secrets in any future professional capacity remain in effect for the full five-year term, through September 22, 2028. Breach of these covenants would give rise to a claim for breach of contract under the Settlement Agreement, with remedies including injunctive relief, compensatory damages, and, pursuant to Section 14 of the Settlement Agreement, recovery of attorneys' fees and costs incurred in enforcing the covenant.
In light of these continuing obligations, I recommend that Lumos's General Counsel, Thomas Brightwell, maintain internal monitoring procedures to detect any potential violations. Such procedures might include periodic review of NovaSpark's public-facing product descriptions and technical disclosures, monitoring of the individual Defendants' professional activities through publicly available sources (such as Westmark Health IT profiles and patent filings), and prompt investigation of any reports or suspicions of unauthorized use of Lumos trade secrets. Should any suspected violation come to Lumos's attention, Mr. Brightwell should contact Calderwood & Harkness LLP promptly so that the firm can evaluate the available enforcement options.
Should NovaSpark or any individual Defendant breach the Stipulated Permanent Injunction or the Settlement Agreement at any time in the future, the following enforcement remedies are available to Lumos:
(a) Contempt Proceedings: For violations of the Stipulated Permanent Injunction, Lumos may file a motion for contempt of court in Case No. 23-CV-004871, seeking civil and/or criminal contempt sanctions. The Court retains jurisdiction to enforce the injunction notwithstanding the dismissal of the underlying action.
(b) Breach of Contract Action: For violations of the Settlement Agreement (including breaches of the five-year personal covenants or the audit rights provisions), Lumos may file a separate action for breach of contract. The Settlement Agreement provides for recovery of attorneys' fees and costs to the prevailing party in any enforcement action (Section 14).
(c) Additional Injunctive Relief: In appropriate circumstances, Lumos may seek temporary restraining orders or preliminary injunctive relief to halt ongoing violations while enforcement proceedings are pending.
VIII. Recommendation
Based on my thorough review of the Brindoval Final Forensic Remediation Certification (dated October 31, 2023), the Meridian Independent Verification Confirmation Letter (dated October 31, 2023), and the underlying forensic documentation, it is my assessment that all forensic remediation obligations imposed under the Settlement Agreement and Mutual Release (dated September 22, 2023) and the Stipulated Permanent Injunction (entered October 4, 2023) have been fully and satisfactorily completed.
All five categories of Lumos proprietary materials have been verified as permanently deleted and destroyed from all NovaSpark corporate systems, all personal devices of the three individual Defendants, and all associated cloud storage and email accounts. The verification was conducted using rigorous forensic methodologies — including hash-value comparison, sector-level overwrite verification, and cloud-account audit log review — and was independently confirmed by Meridian Cybersecurity Advisors Inc. No residual Lumos materials remain on any device or system subject to the remediation.
Accordingly, I recommend that Calderwood & Harkness LLP proceed with the filing of the Stipulation and Proposed Order of Dismissal with Prejudice in Lumos Analytics Inc. v. NovaSpark Technologies Inc., et al., Case No. 23-CV-004871. The Stipulation and Proposed Order have been prepared by this team and are ready for execution. The Stipulation is to be signed by Marcus Delgado on behalf of Lumos Analytics Inc. and by Patricia Whitfield of Whitfield, Raines & Gerber LLP on behalf of all Defendants.
The target filing date for the Stipulation and Proposed Order is November 1, 2023 (today). Assuming timely filing, the case dismissal will be effective upon entry of the Order by the Honorable David Rutherford.
Upon the Court's entry of the Order of Dismissal with Prejudice, the matter (Calderwood & Harkness LLP Matter Number 1008-00005) should be formally closed in the firm's matter management system. A closing memorandum should be prepared for the file documenting the resolution of the matter, the satisfaction of all conditions precedent, and the continuing post-dismissal monitoring obligations described in Section VII above.
I am available to discuss this memorandum and the underlying documentation at the team's convenience.
Respectfully submitted,
Omar Siddiqui Working Associate Intellectual Property Practice Group Calderwood & Harkness LLP
IX. Attachments
The following documents are attached to this memorandum and should be maintained in the matter file:
Attachment A: Brindoval Digital Forensics LLC — Final Forensic Remediation Certification (October 31, 2023), including Appendices A through F (file inventories, deletion logs, cryptographic verification records, chain-of-custody documentation for physical destruction of Mallick USB drive, and cloud-account audit log summaries). Signed by Dr. Irene Chow, Managing Director & Lead Forensic Examiner, and Kevin Barr, Senior Forensic Analyst.
Attachment B: Meridian Cybersecurity Advisors Inc. — Independent Verification Confirmation Letter (October 31, 2023). Signed by Naveen Kapoor, Senior Consultant.
Attachment C: Forensic Remediation Protocol and Scope Letter — from Wendy Schultz, Calderwood & Harkness LLP, to Dr. Irene Chow, Brindoval Digital Forensics LLC (October 3, 2023). Includes detailed scope of remediation, categories of proprietary materials, device and system inventory, verification standards, and timeline requirements.
Attachment D: Settlement Agreement and Mutual Release — Execution Version (September 22, 2023). Relevant remediation provisions (Sections 5, 6, 7, 8, and 12) highlighted for ease of reference.
Attachment E: Stipulated Permanent Injunction — Execution Version, as entered by the Honorable David Rutherford on October 4, 2023, in Case No. 23-CV-004871 (Superior Court of the State of California, County of Santa Clara). Relevant remediation and dismissal provisions (Paragraphs 3 through 7) highlighted for ease of reference.
PRIVILEGED AND CONFIDENTIAL — ATTORNEY WORK PRODUCT Calderwood & Harkness LLP