1008-00005 · Lumos Analytics Inc · Pre-Litigation

evidence-preservation-memo.docx DOCUMENT Litigation

32 / 35 ← → ✕

Contract analysis Extract to table

PRIVILEGED & CONFIDENTIAL ATTORNEY-CLIENT COMMUNICATION / ATTORNEY WORK PRODUCT

CALDERWOOD & HARKNESS LLP 555 California Street, 40th Floor San Francisco, California 94104

January 11, 2023

MEMORANDUM

TO: Thomas Brightwell, General Counsel, Lumos Analytics Inc. Rachel Fong, VP of Engineering, Lumos Analytics Inc.

Lumos Analytics Inc. 4700 Orchard Parkway, Suite 300 San Jose, California 95134

FROM: Wendy Schultz, Lead Associate, Calderwood & Harkness LLP

RE: Litigation Hold and Evidence Preservation Obligations — Anticipated Litigation Against Rajiv Anand, Serena Mallick, Derek Yun, and NovaSpark Technologies Inc.

MATTER NO.: 1008-00005

CONFIDENTIALITY NOTICE: This memorandum is a privileged and confidential attorney-client communication and attorney work product prepared by Calderwood & Harkness LLP at the direction of and for the benefit of Lumos Analytics Inc. It contains legal analysis, strategy, and advice protected by the attorney-client privilege and the work-product doctrine. This memorandum should not be disclosed to any person outside Lumos Analytics Inc. without the prior written consent of Calderwood & Harkness LLP. Unauthorized disclosure may result in a waiver of applicable privileges. If you have received this memorandum in error, please contact Calderwood & Harkness LLP immediately.

I. PURPOSE AND BACKGROUND

Calderwood & Harkness LLP ("C&H") was retained by Lumos Analytics Inc. ("Lumos" or the "Company") on December 15, 2022, to investigate and pursue potential claims arising from the suspected misappropriation of Lumos trade secrets by three former employees: Rajiv Anand (former Principal Engineer — ML Infrastructure), Serena Mallick (former Senior Software Engineer — Data Pipelines), and Derek Yun (former Machine Learning Engineer II). This memorandum serves to formalize Lumos's litigation hold obligations and to provide detailed guidance on the scope, procedures, and responsibilities attendant to the preservation of relevant documents and electronically stored information ("ESI").

The factual circumstances giving rise to this engagement are summarized as follows. All three of the above-named individuals departed Lumos in late September through October 2022. Specifically, Rajiv Anand resigned effective September 30, 2022; Serena Mallick resigned effective October 14, 2022; and Derek Yun resigned effective October 21, 2022. Each of these individuals subsequently joined NovaSpark Technologies Inc. ("NovaSpark"), a competing startup that was incorporated in the State of Delaware on October 3, 2022, by Rajiv Anand. NovaSpark is headquartered at 88 Bluxome Street, Floor 4, San Francisco, California 94107, and appears to be operating in the same machine-learning-driven financial analytics space in which Lumos competes.

The retention of C&H was precipitated by the discovery, on December 12, 2022, by Lumos's IT security team, of anomalous data-exfiltration activity associated with the accounts and access credentials of the three former employees. The IT security team's investigation revealed a pattern of unauthorized data transfers occurring in the weeks prior to each employee's departure, the details of which are set forth more fully in Section IV.B of this memorandum. These transfers involved highly sensitive proprietary materials, including machine learning model architecture specifications, feature-engineering code, the entirety of the DataStream ETL pipeline repository, and confidential product roadmap documents.

Based on C&H's investigation to date, we anticipate filing a complaint in the Superior Court of the State of California, County of Santa Clara, on or about January 19, 2023. The complaint will assert the following causes of action against Rajiv Anand, Serena Mallick, Derek Yun, and NovaSpark Technologies Inc.:

1. Misappropriation of Trade Secrets under the California Uniform Trade Secrets Act, California Civil Code Sections 3426 through 3426.11;

2. Breach of Contract, specifically the Proprietary Information and Inventions Assignment Agreement (the "PIIAA") executed by each of the individual defendants at the commencement of their respective employment with Lumos;

3. Breach of Duty of Loyalty, arising from the individual defendants' surreptitious misappropriation of Company proprietary information while still employed by Lumos and their formation of a competing enterprise prior to and contemporaneous with their departures;

4. Unfair Business Practices under California Business and Professions Code Section 17200 et seq.; and

5. Conversion of Lumos's proprietary information and trade secret materials.

In addition to the complaint, C&H anticipates filing, contemporaneously with the complaint, an ex parte application for a Temporary Restraining Order ("TRO") and an Order to Show Cause re: Preliminary Injunction. The TRO application will seek, among other things, an order requiring the individual defendants and NovaSpark to immediately cease use and further dissemination of Lumos's trade secrets, to return or sequester all misappropriated materials, and to submit to expedited forensic inspection of relevant devices and systems.

Given the imminence of the filing of the complaint and the TRO application, it is critical that Lumos act immediately and comprehensively to identify, preserve, and protect all documents and ESI that may be relevant to the claims that will be asserted and to any defenses that the defendants may raise. The purpose of this memorandum is to set forth Lumos's legal obligation to preserve such evidence and to implement a litigation hold effective immediately upon receipt of this communication.

II. LEGAL OBLIGATION TO PRESERVE EVIDENCE

Under well-established California law and federal common law principles that California courts have adopted, a party has a legal duty to preserve all documents and electronically stored information that may be relevant to the claims or defenses in a pending or reasonably anticipated litigation. This duty attaches at the point in time when litigation becomes reasonably foreseeable — it is not necessary that a complaint have already been filed. See Camberwell & Co. v. Northgate & Co. Elecs. Co., 888 F. Supp. 2d 976, 991–92 (N.D. Cal. 2012); Zubulake v. Ashgrove Trust Bank, 220 F.R.D. 212, 216–18 (S.D.N.Y. 2003) (seminal federal authority widely followed in California state courts for ESI preservation obligations).

In this instance, litigation against Rajiv Anand, Serena Mallick, Derek Yun, and NovaSpark Technologies Inc. is not only reasonably anticipated but is imminent. C&H expects to file the complaint and TRO application within approximately eight days of the date of this memorandum. Accordingly, the duty to preserve relevant evidence has attached as of the date of this communication, and in all likelihood attached no later than December 15, 2022, when C&H was retained and commenced its investigation.

The scope of the preservation duty is broad. It encompasses all documents and ESI that may be relevant to any claim or defense in the anticipated litigation, regardless of whether Lumos believes the materials are favorable or unfavorable to its position. Relevance in this context is construed expansively; if a reasonable person would consider the information potentially useful to either party, it falls within the scope of the preservation obligation.

Failure to preserve relevant evidence can result in severe consequences, including but not limited to the following:

• Spoliation Sanctions. A court may impose monetary sanctions, issue adverse inference instructions to the jury, preclude evidence, or, in extreme cases, enter terminating sanctions (such as dismissal of claims or entry of default judgment) against a party that has destroyed or failed to preserve relevant evidence.

• Adverse Inference Instructions. The court may instruct the jury that it may presume that destroyed or lost evidence would have been unfavorable to the party that failed to preserve it. Such an instruction can be devastating to a party's case.

• Credibility Damage. Evidence of a party's failure to preserve documents — even if unintentional — can severely undermine that party's credibility before the court and the jury.

• Ethical and Professional Consequences. Officers and employees who destroy evidence after a litigation hold has been issued may face personal liability, contempt sanctions, or other adverse consequences.

The litigation hold described in this memorandum supersedes any routine document retention or destruction policies that Lumos may have in place. No documents or ESI that fall within the scope of this hold may be destroyed, altered, deleted, overwritten, or modified in any way, regardless of any existing retention schedules, auto-delete protocols, or data management policies. This includes, without limitation, any scheduled purges of email archives, any automatic deletion of Meridian Solutions or messaging platform histories, any overwriting of backup tapes or server snapshots, and any disposal of paper files.

The hold applies to all forms and media of information, including but not limited to: paper documents, electronic files (in any format), emails, instant messages (including Meridian Solutions, Northgate Data Systems, and any other messaging platform), voicemails, databases, server logs, network logs, authentication records, backup tapes, server snapshots, cloud-stored data (including data stored on third-party platforms such as Hollowell Health IT, Larkspur Technologies, Meridian Technologies, Azure, or any other cloud service), mobile device data (including text messages, call logs, and application data), removable media (including USB drives, external hard drives, and optical media), and any other medium on which relevant information may be stored.

III. SCOPE OF LITIGATION HOLD — CUSTODIANS

The litigation hold applies to all documents and ESI in the possession, custody, or control of the following categories of individuals. For purposes of clarity, we distinguish between key internal custodians who are currently employed by Lumos and the records associated with the three departed employees against whom claims will be asserted.

A. Key Internal Custodians

The following Lumos personnel are identified as key custodians whose files, accounts, devices, and records must be preserved in their entirety for the duration of this litigation hold. These individuals should each receive a copy of the attached custodian notice template and should be instructed to take no action that would result in the destruction or alteration of any potentially relevant information:

1. Priya Chandrasekaran — Chief Executive Officer. Ms. Chandrasekaran oversaw strategic decisions regarding the LumosEdge platform, was involved in senior-level discussions regarding the departures of Anand, Mallick, and Yun, and may have had direct communications with one or more of the departing employees regarding their roles, compensation, or the competitive landscape. She is also the primary point of contact for communications with Lumos's investors regarding the trade-secret threat and NovaSpark's activities.

2. Thomas Brightwell — General Counsel. Mr. Brightwell managed the Proprietary Information and Inventions Assignment Agreements (PIIAAs) executed by each of the departing employees, oversaw the departure and offboarding processes, and has been responsible for coordinating the internal investigation since December 12, 2022. Mr. Brightwell's files are central to establishing the contractual obligations of the departing employees and Lumos's protective measures.

3. Rachel Fong — Vice President of Engineering. Ms. Fong directly supervised Rajiv Anand, Serena Mallick, and Derek Yun during their respective tenures at Lumos. She has direct knowledge of the technology and systems to which each of the three employees had access, the nature and scope of their work on LumosEdge, DataStream, and the LumosEdge 3.0 product roadmap, and the proprietary and confidential nature of the materials at issue.

4. IT Security Team Lead(s) — This includes, without limitation, all personnel responsible for the December 12, 2022 identification of the anomalous data-exfiltration activity and the subsequent internal investigation. Specifically, any member of the IT security team who participated in monitoring, identifying, analyzing, or documenting the exfiltration events described in Section IV.B of this memorandum must preserve all records in their possession, custody, or control related to those events and the investigation.

5. Human Resources Personnel — All HR personnel who were involved in the onboarding of Rajiv Anand, Serena Mallick, and Derek Yun (including the execution and administration of their respective PIIAAs, offer letters, and employment agreements) and/or the offboarding of those individuals (including exit interviews, equipment return processes, and any post-separation communications). This includes, at a minimum, the HR Business Partner(s) assigned to the engineering department during the relevant period and any HR administrator who handled onboarding or offboarding documentation.

6. Additional Engineers and Managers — Any engineers, technical leads, product managers, or other managers who worked directly with Rajiv Anand, Serena Mallick, or Derek Yun on the LumosEdge platform, the DataStream ETL pipeline, or the LumosEdge 3.0 product roadmap. We request that Rachel Fong and Thomas Brightwell confer and provide C&H with a comprehensive list of these individuals within five (5) business days of the date of this memorandum so that they can be formally added to the custodian list and issued individual hold notices.

If additional custodians are identified during the course of discovery or the litigation, C&H will provide supplemental guidance, and those individuals must be promptly added to the hold and notified.

B. Departed Employee Accounts and Records

All records and data pertaining to the employment and departure of the following three former employees must be preserved:

1. Rajiv Anand — Employed by Lumos from approximately March 2019 through September 30, 2022. Mr. Anand held the position of Principal Engineer — ML Infrastructure and had extensive access to Lumos's most sensitive proprietary technology, including the LumosEdge ensemble model architecture, the DataStream ETL pipeline, and the confidential product roadmap.

2. Serena Mallick — Employed by Lumos from approximately June 2020 through October 14, 2022. Ms. Mallick held the position of Senior Software Engineer — Data Pipelines and was primarily responsible for developing and maintaining components of the DataStream ETL pipeline codebase.

3. Derek Yun — Employed by Lumos from approximately January 2021 through October 21, 2022. Mr. Yun held the position of Machine Learning Engineer II and worked on feature engineering and model training within the LumosEdge platform.

With respect to these three individuals, the preservation obligation extends to, without limitation: any archived email accounts (corporate email accounts that may have been suspended or archived upon departure), any suspended or deactivated user accounts on Lumos systems (including code repositories, cloud environments, project management tools, and internal collaboration platforms), stored access credentials, badge and building entry logs, VPN and remote access records, and any records documenting the return (or non-return) of Company equipment, devices, or materials. It is imperative that none of these accounts be deleted, purged, or overwritten.

IV. SCOPE OF LITIGATION HOLD — CATEGORIES OF DOCUMENTS AND ESI

The following categories of documents and ESI are within the scope of the litigation hold and must be preserved. This list is intended to be illustrative and not exhaustive. If any Lumos personnel become aware of additional categories of potentially relevant documents or ESI not described below, they should promptly notify C&H.

A. Employment and Contractual Records

The following employment and contractual records must be preserved in their entirety:

1. Proprietary Information and Inventions Assignment Agreements ("PIIAAs"). The fully executed PIIAAs for Rajiv Anand, Serena Mallick, and Derek Yun, together with any exhibits, schedules, or attachments thereto. As background, each PIIAA contains the following restrictive covenant provisions that are directly at issue in this matter:

(a) An assignment of all inventions clause, pursuant to which each employee assigned to Lumos all rights, title, and interest in any inventions, discoveries, improvements, or works of authorship conceived or developed during the course of employment or using Lumos resources;

(b) A confidentiality and non-disclosure provision surviving termination for a period of three (3) years, prohibiting the use or disclosure of Lumos confidential information and trade secrets;

(c) A non-solicitation of employees clause effective for twelve (12) months following separation from Lumos, prohibiting the departing employee from soliciting or inducing any Lumos employee to leave the Company's employ; and

(d) A covenant not to use or disclose Lumos trade secrets at any time, which survives termination without any time limitation to the extent permitted by applicable law.

2. Offer Letters, Employment Agreements, and Amendments. All offer letters, employment agreements, and any amendments, addenda, side letters, or supplemental agreements for Rajiv Anand, Serena Mallick, and Derek Yun, including any equity grant agreements, bonus or incentive compensation agreements, or promotion letters.

3. Onboarding and Offboarding Records. All records related to the onboarding and offboarding of the three departing employees, including but not limited to: new-hire paperwork and checklists, signed acknowledgments of Company policies (including information security policies, acceptable use policies, and code of conduct), exit interview notes or summaries, equipment return forms, IT asset inventories, and any acknowledgments (or the absence thereof) regarding the return of Company materials, devices, or proprietary information.

4. Departure Correspondence. Any correspondence — whether by email, letter, or otherwise — between Lumos personnel (including HR, management, legal, or any other department) and any of the three departing employees regarding their resignations, notice periods, transition plans, post-employment obligations, or any other matter related to their departures. This includes any communications occurring after their respective separation dates.

B. IT Security and Access Logs

The IT security and access log evidence is among the most critical categories of documents in this matter, as it provides direct evidence of the data-exfiltration activities attributed to the individual defendants. The following must be preserved:

1. Network and System Access Logs. All IT security logs, network access logs, VPN logs, authentication records (including single sign-on, multi-factor authentication, and any other access control records), and session logs for Rajiv Anand, Serena Mallick, and Derek Yun for the full duration of their respective employment with Lumos. Particular emphasis should be placed on the period from August 1, 2022 through the respective separation dates of each individual, as this period encompasses the window during which the exfiltration activities are believed to have occurred and the period during which NovaSpark was being planned and formed.

2. December 12, 2022 Investigation Records. All records generated by or in connection with the internal investigation conducted by Lumos's IT security team following the December 12, 2022 identification of anomalous data-exfiltration activity. This includes investigation reports, forensic analysis results, email chains among IT security team members, presentations to management, and any supporting documentation.

3. Specific Exfiltration Evidence. The following specific items of exfiltration evidence must be preserved with the highest priority, as they will form the evidentiary foundation for both the complaint and the TRO application:

(a) Rajiv Anand — Hollowell Health IT Transfer (September 26, 2022). All records — including DLP alerts, file transfer logs, cloud upload logs, and endpoint monitoring records — showing Rajiv Anand's transfer of approximately 3.2 gigabytes of files to a personal Hollowell Health IT account on September 26, 2022. The transferred files are believed to include model architecture specifications and hyperparameter configuration files for the LumosEdge ensemble ML model. Any records identifying the specific files transferred, their filenames, sizes, metadata, and the destination account should be preserved.

(b) Rajiv Anand — Product Roadmap Email Forwarding (September 28, 2022). All records — including email server logs, outbound email records, and DLP alerts — showing Rajiv Anand's access to and forwarding of the confidential "LumosEdge 3.0 Product Roadmap" document (a 37-page PDF) to his personal email address, r.anand.personal@vaultmail.com, on September 28, 2022. This includes the email itself (if recoverable from Lumos's mail server or archive), any attachments, and any log entries reflecting the transmission.

(c) Serena Mallick — USB Drive Repository Clone (October 10, 2022). All records — including endpoint monitoring logs, USB device connection logs, and file copy logs — showing Serena Mallick's cloning of the entire DataStream ETL pipeline repository (approximately 780 megabytes) to a personal external USB drive on October 10, 2022. The USB drive has been identified by serial number WD-4837291. Any records reflecting the connection of this device to a Lumos system, the files copied, and the duration and method of the transfer should be preserved.

(d) Derek Yun — Larkspur Technologies Download (October 18, 2022). All records — including DLP alerts, cloud upload logs, browser history logs, and endpoint monitoring records — showing Derek Yun's download of 47 proprietary Jupyter notebooks containing feature-engineering code and model-training scripts to a personal Larkspur Technologies account on October 18, 2022. Any records identifying the specific notebooks, their filenames, sizes, and the destination account should be preserved.

4. General File Access and Transfer Logs. All file access logs, download logs, data transfer logs, and print logs from all relevant Lumos systems, source code repositories (including Tidewater Solutions, Aldermere Software, Strathmore Solutions, or any other version control platform used by Lumos), cloud environments (including Meridian Technologies, Azure, GCP, or other cloud infrastructure), and internal file storage systems for the period August 1, 2022 through the present.

5. DLP and Anomaly Detection Records. All Data Loss Prevention ("DLP") alerts, endpoint monitoring logs, anomaly detection reports, and any other security alerts or reports generated in connection with the foregoing activities or in connection with any activity by Anand, Mallick, or Yun during the relevant period.

C. Proprietary Technology and Trade Secret Materials

The heart of this litigation will involve demonstrating the existence, proprietary nature, and competitive value of Lumos's trade secrets, and the defendants' access to, exfiltration of, and anticipated use of those trade secrets. The following materials must be preserved:

All records, documentation, source code, configuration files, and related files pertaining to the five categories of trade secrets that C&H has identified as being at issue in this matter:

1. LumosEdge Ensemble ML Model Architecture. This category encompasses the proprietary neural-network topology, ensemble model architecture, hyperparameter configurations, model training and validation protocols, and associated technical documentation for the LumosEdge platform. These materials represent the core intellectual property of Lumos's analytics offering and embody years of research, development, and iterative refinement.

2. Proprietary Feature-Engineering Libraries. This category encompasses the library of 2,847 individual engineered features developed by Lumos for financial signal generation. These features were developed through extensive proprietary research and constitute a significant competitive advantage, as they are not publicly available and cannot be readily reverse-engineered from Lumos's published outputs.

3. DataStream ETL Pipeline Codebase and Data-Schema Definitions. This category encompasses the complete codebase for the DataStream Extract, Transform, Load pipeline, including all data-schema definitions, data-ingestion configurations, and integration specifications covering ingestion from 43 alternative-data vendors. The DataStream pipeline is a proprietary system that enables Lumos to process and normalize vast quantities of heterogeneous data from diverse sources.

4. Curated and Labeled Training Dataset. This category encompasses the approximately 14.6 terabytes of historical financial and alternative data that Lumos has curated, cleaned, labeled, and organized for use in training and validating its machine learning models. The dataset represents a substantial investment of time, resources, and proprietary methodology.

5. Confidential Product Roadmap Documents (2023–2025). This category encompasses all unreleased product roadmap documents, strategic planning materials, and specification documents for the period 2023 through 2025, including, in particular, the 37-page "LumosEdge 3.0 Product Roadmap" document that Rajiv Anand forwarded to his personal email address on September 28, 2022. These documents contain forward-looking business strategy and technical planning that, if disclosed to a competitor, would cause significant competitive harm.

In addition to the foregoing trade secret materials themselves, the following related records must be preserved:

• Version-Control Histories. All version-control histories (e.g., Git logs, commit histories, branch histories, merge records, pull request records, and code review records) for all relevant codebases, including but not limited to the LumosEdge model codebase, the feature-engineering library, and the DataStream ETL pipeline codebase. These histories are essential to establishing the contributions and access patterns of Anand, Mallick, and Yun, and to demonstrating the scope of proprietary materials to which each had access.

• Documentation of Proprietary Nature and Confidential Treatment. Any documentation, records, policies, or communications that demonstrate the proprietary nature, competitive value, and confidential treatment of the trade secret materials identified above. This includes, without limitation, records of access controls (e.g., role-based access control configurations, permissions logs), classification or labeling of materials as confidential or proprietary, and any communications reflecting Lumos's intent to maintain the secrecy of these materials.

D. Email and Communications

Communications among Lumos personnel, between Lumos and the departing employees, and between Lumos and third parties are likely to be highly relevant to establishing the factual record, the defendants' knowledge and intent, and Lumos's diligence in protecting its proprietary information. The following must be preserved:

1. Corporate Email Accounts of Key Custodians. All email accounts (corporate) of the key custodians identified in Section III.A of this memorandum, including all sent, received, draft, deleted, and archived emails. If any custodian used a personal email account for Company business (or if any such account was monitored by the Company), those communications are also within scope.

2. Communications with Departing Employees. All email communications between any Lumos personnel and Rajiv Anand, Serena Mallick, or Derek Yun, without date restriction, but with particular emphasis on communications occurring in the period from August 1, 2022 through the present. This includes any communications occurring after the respective departure dates of the three individuals, whether initiated by Lumos or by the departing employees.

3. Internal Communications Referencing Key Topics. All internal Lumos communications — including emails, Meridian Solutions messages, Northgate Data Systems messages, or communications on any other messaging platform — that reference or relate to any of the following topics: Rajiv Anand, Serena Mallick, Derek Yun, NovaSpark or NovaSpark Technologies, the departures of the three employees, the data-exfiltration investigation, LumosEdge (including LumosEdge 3.0), DataStream, or the LumosEdge 3.0 product roadmap. Given the breadth of this category, C&H may work with Lumos to develop a targeted search protocol using relevant search terms and date filters. However, pending the development of such a protocol, no communications within this category should be destroyed or altered.

4. Communications with Investors. Any communications between Lumos personnel and Lumos's investors regarding the departures, the data-exfiltration events, NovaSpark, or the anticipated litigation. This includes, without limitation, communications with:

(a) Ridgeline Ventures (General Partner: Helen Trask); and

(b) Northstar Growth Equity (Managing Director: Jonathan Holt).

Any such communications should be preserved in their entirety, including all attachments, forwarded messages, and reply chains.

E. Corporate and Business Records

The following categories of corporate and business records are within the scope of the litigation hold:

1. Board Materials and Investor Communications. All board meeting minutes, board presentations, board resolutions, and investor communications that reference or relate to the departures of Anand, Mallick, or Yun, the formation or activities of NovaSpark, or the trade-secret misappropriation threat. This includes materials prepared for or distributed at any board meeting or board committee meeting at which these topics were discussed.

2. Financial and R&D Records. Financial records documenting Lumos's investment in the proprietary technology at issue, including research and development expenditures, engineering headcount and compensation data for the teams responsible for developing the trade secret materials, costs associated with acquiring and curating the training dataset, and any financial analyses quantifying the value of the proprietary technology. These records are relevant to establishing the economic value of the trade secrets and any damages.

3. Information Security and Trade Secret Protection Measures. Records documenting Lumos's measures to protect the secrecy of its proprietary information. Under the California Uniform Trade Secrets Act, a plaintiff must demonstrate that it took reasonable steps to maintain the secrecy of the information it claims as trade secrets. Accordingly, the following must be preserved:

(a) Access control policies, including role-based access control configurations and procedures;

(b) Information security policies, acceptable use policies, and data classification policies;

(c) Records of confidentiality training provided to employees, including attendance records, training materials, and acknowledgments;

(d) NDA and PIIAA administration records, including records showing that PIIAAs were uniformly required of all employees with access to proprietary information;

(e) Physical security measures (e.g., badge access restrictions to sensitive areas, clean desk policies); and

(f) Any security audits, penetration testing reports, or vulnerability assessments conducted during the relevant period.

F. External Communications

The following categories of external communications are within the scope of the litigation hold:

1. Correspondence with NovaSpark or Its Counsel. Any correspondence, communications, or interactions between Lumos (or any Lumos personnel) and NovaSpark Technologies Inc. or any attorney, agent, or representative of NovaSpark. As of the date of this memorandum, C&H is not aware that Lumos has had any direct communications with NovaSpark, but any such communications — past, present, or future — should be preserved and reported to C&H immediately.

2. Correspondence with NovaSpark's Investors or Other Third Parties. Any correspondence or communications with Blackpine Capital Partners LP (NovaSpark's reported seed investor; Managing Partner: Franklin Osei) or any other third party regarding NovaSpark's activities, NovaSpark's use or possession of Lumos technology, or the departures of Anand, Mallick, or Yun. This includes any inquiries or due diligence contacts from potential investors, customers, or partners of NovaSpark who may have contacted Lumos for reference or information.

V. PRESERVATION INSTRUCTIONS AND PROCEDURES

To ensure full compliance with Lumos's preservation obligations, the following actions and procedures must be implemented immediately.

A. Immediate Actions Required

1. Issue Custodian Notices. Thomas Brightwell, as General Counsel, should instruct all identified custodians of the litigation hold in writing, using the attached custodian notice template (Attachment A hereto). Each custodian notice should be sent via email with read-receipt confirmation and should be accompanied by a printed copy delivered to the custodian in person where practicable. The custodian notice should clearly explain the custodian's obligation to preserve all potentially relevant documents and ESI, the categories of information within scope, and the consequences of non-compliance. These notices should be issued no later than January 13, 2023 — within two (2) business days of the date of this memorandum.

2. Suspend Auto-Delete and Retention Schedule Operations. All auto-delete functions, retention schedule purges, and routine destruction protocols must be suspended immediately for any systems, repositories, email platforms, messaging platforms, backup systems, or accounts within the scope of this hold. This includes, without limitation:

(a) Any automatic deletion of emails after a specified retention period;

(b) Any automatic purging of Meridian Solutions or Northgate Data Systems message histories;

(d) Any scheduled deletion of log files (including access logs, VPN logs, and DLP logs); and

(e) Any scheduled disposal or recycling of paper files in accordance with a document retention policy.

3. Preserve Backup Media and Archived Data. Ensure that all backup tapes, server snapshots, disk images, and archived data covering the relevant period — at a minimum, August 1, 2022 through the present — are identified, segregated, and preserved. These media must not be overwritten, recycled, or degaussed. If Lumos utilizes a third-party backup or archiving service, the relevant service provider must be notified of the hold and instructed to preserve all data within scope.

4. Preserve Departed Employee Accounts. The corporate email accounts and user accounts of Rajiv Anand, Serena Mallick, and Derek Yun on all Lumos systems must be disabled or suspended (but under no circumstances deleted or purged), if this has not already been done. This includes accounts on email systems, code repositories, cloud platforms, project management tools (e.g., Jira, Sterling Reach Services Inc., confluence), internal wikis, and any other system to which these individuals had access. If any data associated with these accounts has already been deleted or purged since the individuals' departures, please notify C&H immediately so that we can assess the implications and explore recovery options.

B. IT Department Coordination

Given the highly technical nature of the evidence in this matter, close coordination between the engineering and IT security teams and C&H will be essential. Rachel Fong, as Vice President of Engineering, is requested to serve as the primary point of coordination with the IT security team and to take the following actions:

1. Preservation and Export of Forensic Evidence. Confirm that all access logs, file transfer logs, DLP alerts, endpoint monitoring records, and other forensic evidence identified in Section IV.B of this memorandum are preserved and exported to a secure, non-modifiable format (e.g., write-once media, cryptographic hash-verified copies, or a forensically sound image). The integrity of this evidence is paramount, and the chain of custody must be documented from this point forward.

2. Identification and Preservation of Repositories. Identify and preserve all version-control repositories (including all branches, tags, commit histories, and associated metadata) to which Rajiv Anand, Serena Mallick, or Derek Yun had access at any point during their employment. This should include a full list of repositories, the access permissions granted to each individual, and the dates of access.

3. Protection of Forensic Evidence from Remediation. Ensure that no remediation, patching, system migration, or infrastructure modification activities alter or destroy forensic evidence of the exfiltration events. If any such activities are necessary for operational or security reasons, C&H should be consulted in advance so that appropriate forensic preservation steps can be taken beforehand.

4. Comprehensive System and Device Inventory. Provide C&H with a complete inventory of all systems, devices, and accounts to which each of the three former employees had access during their employment. This inventory should include, at a minimum:

(a) All computer hardware (laptops, desktops, servers) assigned to or used by each individual;

(b) All software systems and platforms to which each individual had credentials or access permissions;

(d) All code repositories to which each individual had read or write access;

(e) All building access credentials, badge numbers, and physical access zones; and

(f) Any company-issued mobile devices, tokens, or other authentication devices.

This inventory should be provided to C&H no later than January 18, 2023, in advance of the anticipated complaint filing date.

C. Custodian Acknowledgments

To ensure that the litigation hold has been effectively communicated and understood, the following procedures must be followed:

1. Written Acknowledgment. Each identified custodian must acknowledge receipt and understanding of the litigation hold notice in writing. The acknowledgment should confirm that the custodian understands the scope of the hold, agrees to comply with the preservation obligations, and will promptly notify Thomas Brightwell of any questions, concerns, or potential issues.

2. Acknowledgment Log. Thomas Brightwell should maintain a log of all custodian acknowledgments, recording the name of the custodian, the date the hold notice was issued, the date the acknowledgment was received, and the method of acknowledgment. A copy of this log should be provided to C&H on a rolling basis and, in any event, no later than January 20, 2023.

3. Departure of Custodians. If any custodian identified in this hold departs Lumos (whether voluntarily or involuntarily) during the pendency of the hold, their files, email accounts, user accounts, and all other data within scope must be fully preserved before any account deactivation, device reallocation, or data deletion occurs. C&H should be promptly notified of any custodian departures so that appropriate additional preservation measures can be implemented.

D. Ongoing Obligations

The preservation obligations described in this memorandum are not a one-time event. They are ongoing and will remain in effect for the duration of the anticipated litigation:

1. Duration. The litigation hold will remain in effect until C&H provides written notice that it may be lifted. Do not assume that the hold has expired based on the passage of time, the resolution of a particular motion, or any other event. Only an express written communication from C&H can release the hold.

2. Periodic Reminders. Lumos should conduct periodic reminders to all custodians to ensure ongoing compliance with the hold. These reminders should be issued no less than quarterly and should reiterate the scope of the hold, the custodian's obligations, and the consequences of non-compliance. C&H can provide template language for these reminders upon request.

3. New Custodians. If, during the course of the litigation, C&H or Lumos identifies additional individuals whose files or records may be relevant, those individuals must be promptly added to the custodian list, issued a hold notice, and required to acknowledge the hold in writing.

4. New Categories of Information. Similarly, if new categories of potentially relevant documents or ESI are identified as the litigation develops, C&H will provide supplemental guidance regarding the expanded scope of the hold.

VI. DOCUMENT COLLECTION AND REVIEW

In the near term, C&H may request that Lumos collect and produce certain categories of documents for review in connection with preparing the complaint, the TRO application, and the supporting declarations that will be filed in support of the TRO. These requests will be made on an expedited basis given the anticipated filing date of January 19, 2023, and Lumos's prompt cooperation will be essential.

C&H has retained Meridian Cybersecurity Advisors Inc. as a technical consultant to assist in identifying, analyzing, and preserving the relevant proprietary materials and forensic evidence in this matter. Meridian's engagement is being directed by C&H, and all communications with Meridian regarding this matter are protected by the attorney-client privilege and/or the work-product doctrine. The relevant contact at Meridian is:

Naveen Kapoor, Senior Consultant Meridian Cybersecurity Advisors Inc. 2100 Geng Road, Suite 210 Palo Alto, California 94303

Meridian may coordinate directly with Lumos's IT and engineering teams, under C&H's direction, to perform the following functions:

• Forensic imaging and preservation of relevant systems, devices, and accounts;

• Analysis and documentation of the data-exfiltration events and the evidence supporting Lumos's claims;

• Identification and cataloging of the trade secret materials at issue;

• Preparation of forensic reports and, if necessary, expert declarations in support of the TRO application and subsequent proceedings; and

• Chain-of-custody documentation for all collected evidence.

Any document collection conducted by Lumos, Meridian, or C&H should be performed in a forensically sound manner to preserve metadata, file integrity, and chain of custody. Documents should not be opened, modified, renamed, or moved from their original locations except as part of a controlled collection process directed by C&H or Meridian. If Lumos personnel need to access documents within the scope of the hold for ordinary business purposes, they should do so without altering or deleting the documents and should notify C&H if any question arises regarding the permissibility of a particular action.

VII. CONFIDENTIALITY REMINDER

This memorandum and the litigation hold it implements are confidential. The following confidentiality guidelines must be strictly observed:

1. Internal Distribution. This memorandum and the associated custodian notices should be shared only with those Lumos personnel who have a need to know for purposes of implementing and complying with the hold. This includes the individuals identified as key custodians in Section III.A, as well as IT and HR personnel who are operationally necessary to implement the preservation steps described herein. The memorandum should not be distributed to all-hands, posted on internal bulletin boards or intranets, or otherwise made broadly available.

2. No Disclosure of Anticipated Litigation. The existence of the anticipated litigation, the anticipated filing of the complaint and TRO application, and C&H's engagement by Lumos should not be disclosed to any third parties — including customers, vendors, prospective business partners, media, or any other persons — without prior consultation with C&H. Premature disclosure could jeopardize the element of surprise that is essential to the effectiveness of the TRO application and could create other strategic risks.

3. Privilege Protection. All communications with C&H regarding this matter — including this memorandum, any custodian notices, any correspondence regarding the litigation hold, and any discussions regarding litigation strategy — are protected by the attorney-client privilege and/or the work-product doctrine. These protections can be waived by disclosure to third parties. Accordingly, Lumos personnel should exercise caution to ensure that privileged communications are not forwarded to, copied to, or discussed with any person who is not authorized to receive them.

VIII. CONTACT INFORMATION

For questions regarding this litigation hold, the scope of preservation obligations, the implementation of the procedures described herein, or any other aspect of this matter, please contact:

Wendy Schultz Lead Associate Calderwood & Harkness LLP 555 California Street, 40th Floor San Francisco, California 94104 Telephone: (415) 555-7200

Email: wschultz@calderwoodharkness.com

Omar Siddiqui Working Associate Calderwood & Harkness LLP 555 California Street, 40th Floor San Francisco, California 94104 Telephone: (415) 555-7245

Email: osiddiqui@calderwoodharkness.com

Marcus Delgado Responsible Partner Calderwood & Harkness LLP 555 California Street, 40th Floor San Francisco, California 94104 Available for escalation as needed. Telephone: (415) 555-7101

Email: mdelgado@calderwoodharkness.com

Please reference C&H Matter Number 1008-00005 in all correspondence and communications relating to this matter.

We appreciate Lumos's prompt attention to this matter and its commitment to complying with these important preservation obligations. Please do not hesitate to contact us with any questions.

Respectfully,

CALDERWOOD & HARKNESS LLP

By: ________

Wendy Schultz Lead Associate, intellectual Property Calderwood & Harkness LLP 555 California Street, 40th Floor San Francisco, California 94104

cc: Marcus Delgado, Responsible Partner, Calderwood & Harkness LLP Catherine Bloom, Billing Partner, Calderwood & Harkness LLP Omar Siddiqui, Working Associate, Calderwood & Harkness LLP

PRIVILEGED & CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION / ATTORNEY WORK PRODUCT This memorandum is not intended for distribution beyond the named recipients and the individuals identified herein as necessary for implementing the litigation hold. Unauthorized disclosure may result in waiver of applicable privileges.

PRIVILEGED & CONFIDENTIAL ATTORNEY-CLIENT COMMUNICATION / ATTORNEY WORK PRODUCT
CALDERWOOD & HARKNESS LLP 555 California Street, 40th Floor San Francisco, California 94104
January 11, 2023
MEMORANDUM
TO: Thomas Brightwell, General Counsel, Lumos Analytics Inc. Rachel Fong, VP of Engineering, Lumos Analytics Inc.
Lumos Analytics Inc. 4700 Orchard Parkway, Suite 300 San Jose, California 95134
FROM: Wendy Schultz, Lead Associate, Calderwood & Harkness LLP
RE: Litigation Hold and Evidence Preservation Obligations — Anticipated Litigation Against Rajiv Anand, Serena Mallick, Derek Yun, and NovaSpark Technologies Inc.
MATTER NO.: 1008-00005
CONFIDENTIALITY NOTICE: This memorandum is a privileged and confidential attorney-client communication and attorney work product prepared by Calderwood & Harkness LLP at the direction of and for the benefit of Lumos Analytics Inc. It contains legal analysis, strategy, and advice protected by the attorney-client privilege and the work-product doctrine. This memorandum should not be disclosed to any person outside Lumos Analytics Inc. without the prior written consent of Calderwood & Harkness LLP. Unauthorized disclosure may result in a waiver of applicable privileges. If you have received this memorandum in error, please contact Calderwood & Harkness LLP immediately.
I. PURPOSE AND BACKGROUND
Calderwood & Harkness LLP ("C&H") was retained by Lumos Analytics Inc. ("Lumos" or the "Company") on December 15, 2022, to investigate and pursue potential claims arising from the suspected misappropriation of Lumos trade secrets by three former employees: Rajiv Anand (former Principal Engineer — ML Infrastructure), Serena Mallick (former Senior Software Engineer — Data Pipelines), and Derek Yun (former Machine Learning Engineer II). This memorandum serves to formalize Lumos's litigation hold obligations and to provide detailed guidance on the scope, procedures, and responsibilities attendant to the preservation of relevant documents and electronically stored information ("ESI").
The factual circumstances giving rise to this engagement are summarized as follows. All three of the above-named individuals departed Lumos in late September through October 2022. Specifically, Rajiv Anand resigned effective September 30, 2022; Serena Mallick resigned effective October 14, 2022; and Derek Yun resigned effective October 21, 2022. Each of these individuals subsequently joined NovaSpark Technologies Inc. ("NovaSpark"), a competing startup that was incorporated in the State of Delaware on October 3, 2022, by Rajiv Anand. NovaSpark is headquartered at 88 Bluxome Street, Floor 4, San Francisco, California 94107, and appears to be operating in the same machine-learning-driven financial analytics space in which Lumos competes.
The retention of C&H was precipitated by the discovery, on December 12, 2022, by Lumos's IT security team, of anomalous data-exfiltration activity associated with the accounts and access credentials of the three former employees. The IT security team's investigation revealed a pattern of unauthorized data transfers occurring in the weeks prior to each employee's departure, the details of which are set forth more fully in Section IV.B of this memorandum. These transfers involved highly sensitive proprietary materials, including machine learning model architecture specifications, feature-engineering code, the entirety of the DataStream ETL pipeline repository, and confidential product roadmap documents.
Based on C&H's investigation to date, we anticipate filing a complaint in the Superior Court of the State of California, County of Santa Clara, on or about January 19, 2023. The complaint will assert the following causes of action against Rajiv Anand, Serena Mallick, Derek Yun, and NovaSpark Technologies Inc.:
1. Misappropriation of Trade Secrets under the California Uniform Trade Secrets Act, California Civil Code Sections 3426 through 3426.11;
2. Breach of Contract, specifically the Proprietary Information and Inventions Assignment Agreement (the "PIIAA") executed by each of the individual defendants at the commencement of their respective employment with Lumos;
3. Breach of Duty of Loyalty, arising from the individual defendants' surreptitious misappropriation of Company proprietary information while still employed by Lumos and their formation of a competing enterprise prior to and contemporaneous with their departures;
4. Unfair Business Practices under California Business and Professions Code Section 17200 et seq.; and
5. Conversion of Lumos's proprietary information and trade secret materials.
In addition to the complaint, C&H anticipates filing, contemporaneously with the complaint, an ex parte application for a Temporary Restraining Order ("TRO") and an Order to Show Cause re: Preliminary Injunction. The TRO application will seek, among other things, an order requiring the individual defendants and NovaSpark to immediately cease use and further dissemination of Lumos's trade secrets, to return or sequester all misappropriated materials, and to submit to expedited forensic inspection of relevant devices and systems.
Given the imminence of the filing of the complaint and the TRO application, it is critical that Lumos act immediately and comprehensively to identify, preserve, and protect all documents and ESI that may be relevant to the claims that will be asserted and to any defenses that the defendants may raise. The purpose of this memorandum is to set forth Lumos's legal obligation to preserve such evidence and to implement a litigation hold effective immediately upon receipt of this communication.
II. LEGAL OBLIGATION TO PRESERVE EVIDENCE
Under well-established California law and federal common law principles that California courts have adopted, a party has a legal duty to preserve all documents and electronically stored information that may be relevant to the claims or defenses in a pending or reasonably anticipated litigation. This duty attaches at the point in time when litigation becomes reasonably foreseeable — it is not necessary that a complaint have already been filed. See Camberwell & Co. v. Northgate & Co. Elecs. Co., 888 F. Supp. 2d 976, 991–92 (N.D. Cal. 2012); Zubulake v. Ashgrove Trust Bank, 220 F.R.D. 212, 216–18 (S.D.N.Y. 2003) (seminal federal authority widely followed in California state courts for ESI preservation obligations).
In this instance, litigation against Rajiv Anand, Serena Mallick, Derek Yun, and NovaSpark Technologies Inc. is not only reasonably anticipated but is imminent. C&H expects to file the complaint and TRO application within approximately eight days of the date of this memorandum. Accordingly, the duty to preserve relevant evidence has attached as of the date of this communication, and in all likelihood attached no later than December 15, 2022, when C&H was retained and commenced its investigation.
The scope of the preservation duty is broad. It encompasses all documents and ESI that may be relevant to any claim or defense in the anticipated litigation, regardless of whether Lumos believes the materials are favorable or unfavorable to its position. Relevance in this context is construed expansively; if a reasonable person would consider the information potentially useful to either party, it falls within the scope of the preservation obligation.
Failure to preserve relevant evidence can result in severe consequences, including but not limited to the following:
• Spoliation Sanctions. A court may impose monetary sanctions, issue adverse inference instructions to the jury, preclude evidence, or, in extreme cases, enter terminating sanctions (such as dismissal of claims or entry of default judgment) against a party that has destroyed or failed to preserve relevant evidence.
• Adverse Inference Instructions. The court may instruct the jury that it may presume that destroyed or lost evidence would have been unfavorable to the party that failed to preserve it. Such an instruction can be devastating to a party's case.
• Credibility Damage. Evidence of a party's failure to preserve documents — even if unintentional — can severely undermine that party's credibility before the court and the jury.
• Ethical and Professional Consequences. Officers and employees who destroy evidence after a litigation hold has been issued may face personal liability, contempt sanctions, or other adverse consequences.
The litigation hold described in this memorandum supersedes any routine document retention or destruction policies that Lumos may have in place. No documents or ESI that fall within the scope of this hold may be destroyed, altered, deleted, overwritten, or modified in any way, regardless of any existing retention schedules, auto-delete protocols, or data management policies. This includes, without limitation, any scheduled purges of email archives, any automatic deletion of Meridian Solutions or messaging platform histories, any overwriting of backup tapes or server snapshots, and any disposal of paper files.
The hold applies to all forms and media of information, including but not limited to: paper documents, electronic files (in any format), emails, instant messages (including Meridian Solutions, Northgate Data Systems, and any other messaging platform), voicemails, databases, server logs, network logs, authentication records, backup tapes, server snapshots, cloud-stored data (including data stored on third-party platforms such as Hollowell Health IT, Larkspur Technologies, Meridian Technologies, Azure, or any other cloud service), mobile device data (including text messages, call logs, and application data), removable media (including USB drives, external hard drives, and optical media), and any other medium on which relevant information may be stored.
III. SCOPE OF LITIGATION HOLD — CUSTODIANS
The litigation hold applies to all documents and ESI in the possession, custody, or control of the following categories of individuals. For purposes of clarity, we distinguish between key internal custodians who are currently employed by Lumos and the records associated with the three departed employees against whom claims will be asserted.
A. Key Internal Custodians
The following Lumos personnel are identified as key custodians whose files, accounts, devices, and records must be preserved in their entirety for the duration of this litigation hold. These individuals should each receive a copy of the attached custodian notice template and should be instructed to take no action that would result in the destruction or alteration of any potentially relevant information:
1. Priya Chandrasekaran — Chief Executive Officer. Ms. Chandrasekaran oversaw strategic decisions regarding the LumosEdge platform, was involved in senior-level discussions regarding the departures of Anand, Mallick, and Yun, and may have had direct communications with one or more of the departing employees regarding their roles, compensation, or the competitive landscape. She is also the primary point of contact for communications with Lumos's investors regarding the trade-secret threat and NovaSpark's activities.
2. Thomas Brightwell — General Counsel. Mr. Brightwell managed the Proprietary Information and Inventions Assignment Agreements (PIIAAs) executed by each of the departing employees, oversaw the departure and offboarding processes, and has been responsible for coordinating the internal investigation since December 12, 2022. Mr. Brightwell's files are central to establishing the contractual obligations of the departing employees and Lumos's protective measures.
3. Rachel Fong — Vice President of Engineering. Ms. Fong directly supervised Rajiv Anand, Serena Mallick, and Derek Yun during their respective tenures at Lumos. She has direct knowledge of the technology and systems to which each of the three employees had access, the nature and scope of their work on LumosEdge, DataStream, and the LumosEdge 3.0 product roadmap, and the proprietary and confidential nature of the materials at issue.
4. IT Security Team Lead(s) — This includes, without limitation, all personnel responsible for the December 12, 2022 identification of the anomalous data-exfiltration activity and the subsequent internal investigation. Specifically, any member of the IT security team who participated in monitoring, identifying, analyzing, or documenting the exfiltration events described in Section IV.B of this memorandum must preserve all records in their possession, custody, or control related to those events and the investigation.
5. Human Resources Personnel — All HR personnel who were involved in the onboarding of Rajiv Anand, Serena Mallick, and Derek Yun (including the execution and administration of their respective PIIAAs, offer letters, and employment agreements) and/or the offboarding of those individuals (including exit interviews, equipment return processes, and any post-separation communications). This includes, at a minimum, the HR Business Partner(s) assigned to the engineering department during the relevant period and any HR administrator who handled onboarding or offboarding documentation.
6. Additional Engineers and Managers — Any engineers, technical leads, product managers, or other managers who worked directly with Rajiv Anand, Serena Mallick, or Derek Yun on the LumosEdge platform, the DataStream ETL pipeline, or the LumosEdge 3.0 product roadmap. We request that Rachel Fong and Thomas Brightwell confer and provide C&H with a comprehensive list of these individuals within five (5) business days of the date of this memorandum so that they can be formally added to the custodian list and issued individual hold notices.
If additional custodians are identified during the course of discovery or the litigation, C&H will provide supplemental guidance, and those individuals must be promptly added to the hold and notified.
B. Departed Employee Accounts and Records
All records and data pertaining to the employment and departure of the following three former employees must be preserved:
1. Rajiv Anand — Employed by Lumos from approximately March 2019 through September 30, 2022. Mr. Anand held the position of Principal Engineer — ML Infrastructure and had extensive access to Lumos's most sensitive proprietary technology, including the LumosEdge ensemble model architecture, the DataStream ETL pipeline, and the confidential product roadmap.
2. Serena Mallick — Employed by Lumos from approximately June 2020 through October 14, 2022. Ms. Mallick held the position of Senior Software Engineer — Data Pipelines and was primarily responsible for developing and maintaining components of the DataStream ETL pipeline codebase.
3. Derek Yun — Employed by Lumos from approximately January 2021 through October 21, 2022. Mr. Yun held the position of Machine Learning Engineer II and worked on feature engineering and model training within the LumosEdge platform.
With respect to these three individuals, the preservation obligation extends to, without limitation: any archived email accounts (corporate email accounts that may have been suspended or archived upon departure), any suspended or deactivated user accounts on Lumos systems (including code repositories, cloud environments, project management tools, and internal collaboration platforms), stored access credentials, badge and building entry logs, VPN and remote access records, and any records documenting the return (or non-return) of Company equipment, devices, or materials. It is imperative that none of these accounts be deleted, purged, or overwritten.
IV. SCOPE OF LITIGATION HOLD — CATEGORIES OF DOCUMENTS AND ESI
The following categories of documents and ESI are within the scope of the litigation hold and must be preserved. This list is intended to be illustrative and not exhaustive. If any Lumos personnel become aware of additional categories of potentially relevant documents or ESI not described below, they should promptly notify C&H.
A. Employment and Contractual Records
The following employment and contractual records must be preserved in their entirety:
1. Proprietary Information and Inventions Assignment Agreements ("PIIAAs"). The fully executed PIIAAs for Rajiv Anand, Serena Mallick, and Derek Yun, together with any exhibits, schedules, or attachments thereto. As background, each PIIAA contains the following restrictive covenant provisions that are directly at issue in this matter:
(a) An assignment of all inventions clause, pursuant to which each employee assigned to Lumos all rights, title, and interest in any inventions, discoveries, improvements, or works of authorship conceived or developed during the course of employment or using Lumos resources;
(b) A confidentiality and non-disclosure provision surviving termination for a period of three (3) years, prohibiting the use or disclosure of Lumos confidential information and trade secrets;
(c) A non-solicitation of employees clause effective for twelve (12) months following separation from Lumos, prohibiting the departing employee from soliciting or inducing any Lumos employee to leave the Company's employ; and
(d) A covenant not to use or disclose Lumos trade secrets at any time, which survives termination without any time limitation to the extent permitted by applicable law.
2. Offer Letters, Employment Agreements, and Amendments. All offer letters, employment agreements, and any amendments, addenda, side letters, or supplemental agreements for Rajiv Anand, Serena Mallick, and Derek Yun, including any equity grant agreements, bonus or incentive compensation agreements, or promotion letters.
3. Onboarding and Offboarding Records. All records related to the onboarding and offboarding of the three departing employees, including but not limited to: new-hire paperwork and checklists, signed acknowledgments of Company policies (including information security policies, acceptable use policies, and code of conduct), exit interview notes or summaries, equipment return forms, IT asset inventories, and any acknowledgments (or the absence thereof) regarding the return of Company materials, devices, or proprietary information.
4. Departure Correspondence. Any correspondence — whether by email, letter, or otherwise — between Lumos personnel (including HR, management, legal, or any other department) and any of the three departing employees regarding their resignations, notice periods, transition plans, post-employment obligations, or any other matter related to their departures. This includes any communications occurring after their respective separation dates.
B. IT Security and Access Logs
The IT security and access log evidence is among the most critical categories of documents in this matter, as it provides direct evidence of the data-exfiltration activities attributed to the individual defendants. The following must be preserved:
1. Network and System Access Logs. All IT security logs, network access logs, VPN logs, authentication records (including single sign-on, multi-factor authentication, and any other access control records), and session logs for Rajiv Anand, Serena Mallick, and Derek Yun for the full duration of their respective employment with Lumos. Particular emphasis should be placed on the period from August 1, 2022 through the respective separation dates of each individual, as this period encompasses the window during which the exfiltration activities are believed to have occurred and the period during which NovaSpark was being planned and formed.
2. December 12, 2022 Investigation Records. All records generated by or in connection with the internal investigation conducted by Lumos's IT security team following the December 12, 2022 identification of anomalous data-exfiltration activity. This includes investigation reports, forensic analysis results, email chains among IT security team members, presentations to management, and any supporting documentation.
3. Specific Exfiltration Evidence. The following specific items of exfiltration evidence must be preserved with the highest priority, as they will form the evidentiary foundation for both the complaint and the TRO application:
(a) Rajiv Anand — Hollowell Health IT Transfer (September 26, 2022). All records — including DLP alerts, file transfer logs, cloud upload logs, and endpoint monitoring records — showing Rajiv Anand's transfer of approximately 3.2 gigabytes of files to a personal Hollowell Health IT account on September 26, 2022. The transferred files are believed to include model architecture specifications and hyperparameter configuration files for the LumosEdge ensemble ML model. Any records identifying the specific files transferred, their filenames, sizes, metadata, and the destination account should be preserved.
(b) Rajiv Anand — Product Roadmap Email Forwarding (September 28, 2022). All records — including email server logs, outbound email records, and DLP alerts — showing Rajiv Anand's access to and forwarding of the confidential "LumosEdge 3.0 Product Roadmap" document (a 37-page PDF) to his personal email address, r.anand.personal@vaultmail.com, on September 28, 2022. This includes the email itself (if recoverable from Lumos's mail server or archive), any attachments, and any log entries reflecting the transmission.
(c) Serena Mallick — USB Drive Repository Clone (October 10, 2022). All records — including endpoint monitoring logs, USB device connection logs, and file copy logs — showing Serena Mallick's cloning of the entire DataStream ETL pipeline repository (approximately 780 megabytes) to a personal external USB drive on October 10, 2022. The USB drive has been identified by serial number WD-4837291. Any records reflecting the connection of this device to a Lumos system, the files copied, and the duration and method of the transfer should be preserved.
(d) Derek Yun — Larkspur Technologies Download (October 18, 2022). All records — including DLP alerts, cloud upload logs, browser history logs, and endpoint monitoring records — showing Derek Yun's download of 47 proprietary Jupyter notebooks containing feature-engineering code and model-training scripts to a personal Larkspur Technologies account on October 18, 2022. Any records identifying the specific notebooks, their filenames, sizes, and the destination account should be preserved.
4. General File Access and Transfer Logs. All file access logs, download logs, data transfer logs, and print logs from all relevant Lumos systems, source code repositories (including Tidewater Solutions, Aldermere Software, Strathmore Solutions, or any other version control platform used by Lumos), cloud environments (including Meridian Technologies, Azure, GCP, or other cloud infrastructure), and internal file storage systems for the period August 1, 2022 through the present.
5. DLP and Anomaly Detection Records. All Data Loss Prevention ("DLP") alerts, endpoint monitoring logs, anomaly detection reports, and any other security alerts or reports generated in connection with the foregoing activities or in connection with any activity by Anand, Mallick, or Yun during the relevant period.
C. Proprietary Technology and Trade Secret Materials
The heart of this litigation will involve demonstrating the existence, proprietary nature, and competitive value of Lumos's trade secrets, and the defendants' access to, exfiltration of, and anticipated use of those trade secrets. The following materials must be preserved:
All records, documentation, source code, configuration files, and related files pertaining to the five categories of trade secrets that C&H has identified as being at issue in this matter:
1. LumosEdge Ensemble ML Model Architecture. This category encompasses the proprietary neural-network topology, ensemble model architecture, hyperparameter configurations, model training and validation protocols, and associated technical documentation for the LumosEdge platform. These materials represent the core intellectual property of Lumos's analytics offering and embody years of research, development, and iterative refinement.
2. Proprietary Feature-Engineering Libraries. This category encompasses the library of 2,847 individual engineered features developed by Lumos for financial signal generation. These features were developed through extensive proprietary research and constitute a significant competitive advantage, as they are not publicly available and cannot be readily reverse-engineered from Lumos's published outputs.
3. DataStream ETL Pipeline Codebase and Data-Schema Definitions. This category encompasses the complete codebase for the DataStream Extract, Transform, Load pipeline, including all data-schema definitions, data-ingestion configurations, and integration specifications covering ingestion from 43 alternative-data vendors. The DataStream pipeline is a proprietary system that enables Lumos to process and normalize vast quantities of heterogeneous data from diverse sources.
4. Curated and Labeled Training Dataset. This category encompasses the approximately 14.6 terabytes of historical financial and alternative data that Lumos has curated, cleaned, labeled, and organized for use in training and validating its machine learning models. The dataset represents a substantial investment of time, resources, and proprietary methodology.
5. Confidential Product Roadmap Documents (2023–2025). This category encompasses all unreleased product roadmap documents, strategic planning materials, and specification documents for the period 2023 through 2025, including, in particular, the 37-page "LumosEdge 3.0 Product Roadmap" document that Rajiv Anand forwarded to his personal email address on September 28, 2022. These documents contain forward-looking business strategy and technical planning that, if disclosed to a competitor, would cause significant competitive harm.
In addition to the foregoing trade secret materials themselves, the following related records must be preserved:
• Version-Control Histories. All version-control histories (e.g., Git logs, commit histories, branch histories, merge records, pull request records, and code review records) for all relevant codebases, including but not limited to the LumosEdge model codebase, the feature-engineering library, and the DataStream ETL pipeline codebase. These histories are essential to establishing the contributions and access patterns of Anand, Mallick, and Yun, and to demonstrating the scope of proprietary materials to which each had access.
• Documentation of Proprietary Nature and Confidential Treatment. Any documentation, records, policies, or communications that demonstrate the proprietary nature, competitive value, and confidential treatment of the trade secret materials identified above. This includes, without limitation, records of access controls (e.g., role-based access control configurations, permissions logs), classification or labeling of materials as confidential or proprietary, and any communications reflecting Lumos's intent to maintain the secrecy of these materials.
D. Email and Communications
Communications among Lumos personnel, between Lumos and the departing employees, and between Lumos and third parties are likely to be highly relevant to establishing the factual record, the defendants' knowledge and intent, and Lumos's diligence in protecting its proprietary information. The following must be preserved:
1. Corporate Email Accounts of Key Custodians. All email accounts (corporate) of the key custodians identified in Section III.A of this memorandum, including all sent, received, draft, deleted, and archived emails. If any custodian used a personal email account for Company business (or if any such account was monitored by the Company), those communications are also within scope.
2. Communications with Departing Employees. All email communications between any Lumos personnel and Rajiv Anand, Serena Mallick, or Derek Yun, without date restriction, but with particular emphasis on communications occurring in the period from August 1, 2022 through the present. This includes any communications occurring after the respective departure dates of the three individuals, whether initiated by Lumos or by the departing employees.
3. Internal Communications Referencing Key Topics. All internal Lumos communications — including emails, Meridian Solutions messages, Northgate Data Systems messages, or communications on any other messaging platform — that reference or relate to any of the following topics: Rajiv Anand, Serena Mallick, Derek Yun, NovaSpark or NovaSpark Technologies, the departures of the three employees, the data-exfiltration investigation, LumosEdge (including LumosEdge 3.0), DataStream, or the LumosEdge 3.0 product roadmap. Given the breadth of this category, C&H may work with Lumos to develop a targeted search protocol using relevant search terms and date filters. However, pending the development of such a protocol, no communications within this category should be destroyed or altered.
4. Communications with Investors. Any communications between Lumos personnel and Lumos's investors regarding the departures, the data-exfiltration events, NovaSpark, or the anticipated litigation. This includes, without limitation, communications with:
(a) Ridgeline Ventures (General Partner: Helen Trask); and
(b) Northstar Growth Equity (Managing Director: Jonathan Holt).
Any such communications should be preserved in their entirety, including all attachments, forwarded messages, and reply chains.
E. Corporate and Business Records
The following categories of corporate and business records are within the scope of the litigation hold:
1. Board Materials and Investor Communications. All board meeting minutes, board presentations, board resolutions, and investor communications that reference or relate to the departures of Anand, Mallick, or Yun, the formation or activities of NovaSpark, or the trade-secret misappropriation threat. This includes materials prepared for or distributed at any board meeting or board committee meeting at which these topics were discussed.
2. Financial and R&D Records. Financial records documenting Lumos's investment in the proprietary technology at issue, including research and development expenditures, engineering headcount and compensation data for the teams responsible for developing the trade secret materials, costs associated with acquiring and curating the training dataset, and any financial analyses quantifying the value of the proprietary technology. These records are relevant to establishing the economic value of the trade secrets and any damages.
3. Information Security and Trade Secret Protection Measures. Records documenting Lumos's measures to protect the secrecy of its proprietary information. Under the California Uniform Trade Secrets Act, a plaintiff must demonstrate that it took reasonable steps to maintain the secrecy of the information it claims as trade secrets. Accordingly, the following must be preserved:
(a) Access control policies, including role-based access control configurations and procedures;
(b) Information security policies, acceptable use policies, and data classification policies;
(c) Records of confidentiality training provided to employees, including attendance records, training materials, and acknowledgments;
(d) NDA and PIIAA administration records, including records showing that PIIAAs were uniformly required of all employees with access to proprietary information;
(e) Physical security measures (e.g., badge access restrictions to sensitive areas, clean desk policies); and
(f) Any security audits, penetration testing reports, or vulnerability assessments conducted during the relevant period.
F. External Communications
The following categories of external communications are within the scope of the litigation hold:
1. Correspondence with NovaSpark or Its Counsel. Any correspondence, communications, or interactions between Lumos (or any Lumos personnel) and NovaSpark Technologies Inc. or any attorney, agent, or representative of NovaSpark. As of the date of this memorandum, C&H is not aware that Lumos has had any direct communications with NovaSpark, but any such communications — past, present, or future — should be preserved and reported to C&H immediately.
2. Correspondence with NovaSpark's Investors or Other Third Parties. Any correspondence or communications with Blackpine Capital Partners LP (NovaSpark's reported seed investor; Managing Partner: Franklin Osei) or any other third party regarding NovaSpark's activities, NovaSpark's use or possession of Lumos technology, or the departures of Anand, Mallick, or Yun. This includes any inquiries or due diligence contacts from potential investors, customers, or partners of NovaSpark who may have contacted Lumos for reference or information.
V. PRESERVATION INSTRUCTIONS AND PROCEDURES
To ensure full compliance with Lumos's preservation obligations, the following actions and procedures must be implemented immediately.
A. Immediate Actions Required
1. Issue Custodian Notices. Thomas Brightwell, as General Counsel, should instruct all identified custodians of the litigation hold in writing, using the attached custodian notice template (Attachment A hereto). Each custodian notice should be sent via email with read-receipt confirmation and should be accompanied by a printed copy delivered to the custodian in person where practicable. The custodian notice should clearly explain the custodian's obligation to preserve all potentially relevant documents and ESI, the categories of information within scope, and the consequences of non-compliance. These notices should be issued no later than January 13, 2023 — within two (2) business days of the date of this memorandum.
2. Suspend Auto-Delete and Retention Schedule Operations. All auto-delete functions, retention schedule purges, and routine destruction protocols must be suspended immediately for any systems, repositories, email platforms, messaging platforms, backup systems, or accounts within the scope of this hold. This includes, without limitation:
(a) Any automatic deletion of emails after a specified retention period;
(b) Any automatic purging of Meridian Solutions or Northgate Data Systems message histories;
(c) Any scheduled rotation or overwriting of backup tapes or server snapshots;
(d) Any scheduled deletion of log files (including access logs, VPN logs, and DLP logs); and
(e) Any scheduled disposal or recycling of paper files in accordance with a document retention policy.
3. Preserve Backup Media and Archived Data. Ensure that all backup tapes, server snapshots, disk images, and archived data covering the relevant period — at a minimum, August 1, 2022 through the present — are identified, segregated, and preserved. These media must not be overwritten, recycled, or degaussed. If Lumos utilizes a third-party backup or archiving service, the relevant service provider must be notified of the hold and instructed to preserve all data within scope.
4. Preserve Departed Employee Accounts. The corporate email accounts and user accounts of Rajiv Anand, Serena Mallick, and Derek Yun on all Lumos systems must be disabled or suspended (but under no circumstances deleted or purged), if this has not already been done. This includes accounts on email systems, code repositories, cloud platforms, project management tools (e.g., Jira, Sterling Reach Services Inc., confluence), internal wikis, and any other system to which these individuals had access. If any data associated with these accounts has already been deleted or purged since the individuals' departures, please notify C&H immediately so that we can assess the implications and explore recovery options.
B. IT Department Coordination
Given the highly technical nature of the evidence in this matter, close coordination between the engineering and IT security teams and C&H will be essential. Rachel Fong, as Vice President of Engineering, is requested to serve as the primary point of coordination with the IT security team and to take the following actions:
1. Preservation and Export of Forensic Evidence. Confirm that all access logs, file transfer logs, DLP alerts, endpoint monitoring records, and other forensic evidence identified in Section IV.B of this memorandum are preserved and exported to a secure, non-modifiable format (e.g., write-once media, cryptographic hash-verified copies, or a forensically sound image). The integrity of this evidence is paramount, and the chain of custody must be documented from this point forward.
2. Identification and Preservation of Repositories. Identify and preserve all version-control repositories (including all branches, tags, commit histories, and associated metadata) to which Rajiv Anand, Serena Mallick, or Derek Yun had access at any point during their employment. This should include a full list of repositories, the access permissions granted to each individual, and the dates of access.
3. Protection of Forensic Evidence from Remediation. Ensure that no remediation, patching, system migration, or infrastructure modification activities alter or destroy forensic evidence of the exfiltration events. If any such activities are necessary for operational or security reasons, C&H should be consulted in advance so that appropriate forensic preservation steps can be taken beforehand.
4. Comprehensive System and Device Inventory. Provide C&H with a complete inventory of all systems, devices, and accounts to which each of the three former employees had access during their employment. This inventory should include, at a minimum:
(a) All computer hardware (laptops, desktops, servers) assigned to or used by each individual;
(b) All software systems and platforms to which each individual had credentials or access permissions;
(c) All cloud environments, storage buckets, or virtual machines to which each individual had access;
(d) All code repositories to which each individual had read or write access;
(e) All building access credentials, badge numbers, and physical access zones; and
(f) Any company-issued mobile devices, tokens, or other authentication devices.
This inventory should be provided to C&H no later than January 18, 2023, in advance of the anticipated complaint filing date.
C. Custodian Acknowledgments
To ensure that the litigation hold has been effectively communicated and understood, the following procedures must be followed:
1. Written Acknowledgment. Each identified custodian must acknowledge receipt and understanding of the litigation hold notice in writing. The acknowledgment should confirm that the custodian understands the scope of the hold, agrees to comply with the preservation obligations, and will promptly notify Thomas Brightwell of any questions, concerns, or potential issues.
2. Acknowledgment Log. Thomas Brightwell should maintain a log of all custodian acknowledgments, recording the name of the custodian, the date the hold notice was issued, the date the acknowledgment was received, and the method of acknowledgment. A copy of this log should be provided to C&H on a rolling basis and, in any event, no later than January 20, 2023.
3. Departure of Custodians. If any custodian identified in this hold departs Lumos (whether voluntarily or involuntarily) during the pendency of the hold, their files, email accounts, user accounts, and all other data within scope must be fully preserved before any account deactivation, device reallocation, or data deletion occurs. C&H should be promptly notified of any custodian departures so that appropriate additional preservation measures can be implemented.
D. Ongoing Obligations
The preservation obligations described in this memorandum are not a one-time event. They are ongoing and will remain in effect for the duration of the anticipated litigation:
1. Duration. The litigation hold will remain in effect until C&H provides written notice that it may be lifted. Do not assume that the hold has expired based on the passage of time, the resolution of a particular motion, or any other event. Only an express written communication from C&H can release the hold.
2. Periodic Reminders. Lumos should conduct periodic reminders to all custodians to ensure ongoing compliance with the hold. These reminders should be issued no less than quarterly and should reiterate the scope of the hold, the custodian's obligations, and the consequences of non-compliance. C&H can provide template language for these reminders upon request.
3. New Custodians. If, during the course of the litigation, C&H or Lumos identifies additional individuals whose files or records may be relevant, those individuals must be promptly added to the custodian list, issued a hold notice, and required to acknowledge the hold in writing.
4. New Categories of Information. Similarly, if new categories of potentially relevant documents or ESI are identified as the litigation develops, C&H will provide supplemental guidance regarding the expanded scope of the hold.
VI. DOCUMENT COLLECTION AND REVIEW
In the near term, C&H may request that Lumos collect and produce certain categories of documents for review in connection with preparing the complaint, the TRO application, and the supporting declarations that will be filed in support of the TRO. These requests will be made on an expedited basis given the anticipated filing date of January 19, 2023, and Lumos's prompt cooperation will be essential.
C&H has retained Meridian Cybersecurity Advisors Inc. as a technical consultant to assist in identifying, analyzing, and preserving the relevant proprietary materials and forensic evidence in this matter. Meridian's engagement is being directed by C&H, and all communications with Meridian regarding this matter are protected by the attorney-client privilege and/or the work-product doctrine. The relevant contact at Meridian is:
Naveen Kapoor, Senior Consultant Meridian Cybersecurity Advisors Inc. 2100 Geng Road, Suite 210 Palo Alto, California 94303
Meridian may coordinate directly with Lumos's IT and engineering teams, under C&H's direction, to perform the following functions:
• Forensic imaging and preservation of relevant systems, devices, and accounts;
• Analysis and documentation of the data-exfiltration events and the evidence supporting Lumos's claims;
• Identification and cataloging of the trade secret materials at issue;
• Preparation of forensic reports and, if necessary, expert declarations in support of the TRO application and subsequent proceedings; and
• Chain-of-custody documentation for all collected evidence.
Any document collection conducted by Lumos, Meridian, or C&H should be performed in a forensically sound manner to preserve metadata, file integrity, and chain of custody. Documents should not be opened, modified, renamed, or moved from their original locations except as part of a controlled collection process directed by C&H or Meridian. If Lumos personnel need to access documents within the scope of the hold for ordinary business purposes, they should do so without altering or deleting the documents and should notify C&H if any question arises regarding the permissibility of a particular action.
VII. CONFIDENTIALITY REMINDER
This memorandum and the litigation hold it implements are confidential. The following confidentiality guidelines must be strictly observed:
1. Internal Distribution. This memorandum and the associated custodian notices should be shared only with those Lumos personnel who have a need to know for purposes of implementing and complying with the hold. This includes the individuals identified as key custodians in Section III.A, as well as IT and HR personnel who are operationally necessary to implement the preservation steps described herein. The memorandum should not be distributed to all-hands, posted on internal bulletin boards or intranets, or otherwise made broadly available.
2. No Disclosure of Anticipated Litigation. The existence of the anticipated litigation, the anticipated filing of the complaint and TRO application, and C&H's engagement by Lumos should not be disclosed to any third parties — including customers, vendors, prospective business partners, media, or any other persons — without prior consultation with C&H. Premature disclosure could jeopardize the element of surprise that is essential to the effectiveness of the TRO application and could create other strategic risks.
3. Privilege Protection. All communications with C&H regarding this matter — including this memorandum, any custodian notices, any correspondence regarding the litigation hold, and any discussions regarding litigation strategy — are protected by the attorney-client privilege and/or the work-product doctrine. These protections can be waived by disclosure to third parties. Accordingly, Lumos personnel should exercise caution to ensure that privileged communications are not forwarded to, copied to, or discussed with any person who is not authorized to receive them.
VIII. CONTACT INFORMATION
For questions regarding this litigation hold, the scope of preservation obligations, the implementation of the procedures described herein, or any other aspect of this matter, please contact:
Wendy Schultz Lead Associate Calderwood & Harkness LLP 555 California Street, 40th Floor San Francisco, California 94104 Telephone: (415) 555-7200
Email: wschultz@calderwoodharkness.com
Omar Siddiqui Working Associate Calderwood & Harkness LLP 555 California Street, 40th Floor San Francisco, California 94104 Telephone: (415) 555-7245
Email: osiddiqui@calderwoodharkness.com
Marcus Delgado Responsible Partner Calderwood & Harkness LLP 555 California Street, 40th Floor San Francisco, California 94104 Available for escalation as needed. Telephone: (415) 555-7101
Email: mdelgado@calderwoodharkness.com
Please reference C&H Matter Number 1008-00005 in all correspondence and communications relating to this matter.
We appreciate Lumos's prompt attention to this matter and its commitment to complying with these important preservation obligations. Please do not hesitate to contact us with any questions.
Respectfully,
CALDERWOOD & HARKNESS LLP
By: ________
Wendy Schultz Lead Associate, intellectual Property Calderwood & Harkness LLP 555 California Street, 40th Floor San Francisco, California 94104
cc: Marcus Delgado, Responsible Partner, Calderwood & Harkness LLP Catherine Bloom, Billing Partner, Calderwood & Harkness LLP Omar Siddiqui, Working Associate, Calderwood & Harkness LLP
PRIVILEGED & CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION / ATTORNEY WORK PRODUCT This memorandum is not intended for distribution beyond the named recipients and the individuals identified herein as necessary for implementing the litigation hold. Unauthorized disclosure may result in waiver of applicable privileges.