ATTORNEY-CLIENT PRIVILEGED & WORK PRODUCT — PREPARED IN ANTICIPATION OF LITIGATION
E-DISCOVERY PROTOCOL & COLLECTION PLAN
Dunmore Energy Holdings Ltd. — DOJ Sanctions & Export Controls Inquiry
Calderwood & Harkness LLP Matter No.: 1016-00009 Nexagen Analytics Inc. Project No.: NX-DEH-2204
May 1, 2022
Prepared by: Thomas Bradshaw, Senior Paralegal, e-discovery Lead Calderwood & Harkness LLP, 1285 Avenue of the Americas, 35th Floor, New York, NY 10019
Reviewed by: Jasmine Thornton, Lead Associate, White Collar & Investigations Calderwood & Harkness LLP, 1750 Pennsylvania Avenue NW, Suite 800, Washington, DC 20006
Approved by: Victoria Chambers, Responsible Partner, White Collar & Investigations Calderwood & Harkness LLP, 1750 Pennsylvania Avenue NW, Suite 800, Washington, DC 20006
Distribution List:
Victoria Chambers, Responsible Partner Howard Quinn, Billing Partner Jasmine Thornton, Lead Associate Liam Donahue, Associate Conrad Reeves, Associate Amara Osei, Associate (London) Nicholas Ferreira, Associate (Houston) Elena Vasquez, Paralegal Manager Brian Cavanaugh, Project Manager, Nexagen Analytics Inc.
This document and the information contained herein are protected by the attorney-client privilege and/or the work product doctrine. This document was prepared by counsel at Calderwood & Harkness LLP in anticipation of litigation and in connection with the rendering of legal advice to Dunmore Energy Holdings Ltd. and its affiliates. Any unauthorized disclosure, distribution, or copying of this document or its contents is strictly prohibited. If you have received this document in error, please notify Thomas Bradshaw immediately.
Right-click to update Table of Contents
I. PURPOSE AND SCOPE
1.1 Purpose. This E-discovery Protocol and Collection Plan (the "Protocol") governs all aspects of the identification, preservation, collection, processing, hosting, review, and production of electronically stored information ("ESI") in connection with the investigation by the U.S. Department of Justice ("DOJ") into potential violations of U.S. sanctions laws (including programs administered by the Office of Foreign Assets Control ("OFAC") of the U.S. Department of the Treasury) and export control regulations by Dunmore Energy Holdings Ltd. ("DEH" or "Dunmore") and its subsidiaries and affiliates (collectively, the "Dunmore Entities"). The investigation arises from suspected dealings by certain Dunmore trading entities and personnel with designated and restricted parties, as well as potential unauthorized exports of controlled oilfield equipment and technology to the Russian Federation and the Republic of Belarus.
This Protocol is established to ensure that all e-discovery procedures employed in this matter are defensible, consistent, repeatable, and legally compliant. Given the scope and complexity of the Dunmore Entities' operations across six jurisdictions — the Cayman Islands, the United Arab Emirates (Dubai), the United States (Texas and Delaware), Germany, Nigeria, and the United Kingdom — this Protocol is designed to provide a unified framework that addresses the cross-border data transfer, data protection, and legal hold obligations applicable in each jurisdiction. All personnel involved in the e-discovery process, whether at Calderwood & Harkness LLP, Nexagen Analytics Inc., or the Dunmore Entities, are expected to adhere strictly to the procedures and requirements set forth herein.
This Protocol further governs the terms of Calderwood & Harkness LLP's engagement of Nexagen Analytics Inc. as the e-discovery and document review vendor for this matter, including the scope of services, data security requirements, quality control standards, and reporting obligations applicable to Nexagen's work. The engagement of Nexagen Analytics Inc. is made at the direction of counsel in connection with the provision of legal advice and in anticipation of and in connection with government enforcement proceedings, and all work performed by Nexagen in connection with this engagement is protected as attorney work product.
1.2 Scope of Engagement
Calderwood & Harkness LLP has retained Nexagen Analytics Inc., a full-service e-discovery and litigation technology firm headquartered at 100 Broadway, Suite 1400, New York, NY 10005, to serve as the e-discovery vendor for this matter. The engagement is managed on behalf of Nexagen by Brian Cavanaugh, Project Manager, and is designated as Nexagen Project No. NX-DEH-2204.
The scope of Nexagen's engagement encompasses the following services:
(a) Data Collection: On-site and remote forensic collection of ESI from custodian devices, enterprise systems, file servers, and other data sources across all six jurisdictions in which the Dunmore Entities maintain relevant data, including forensic imaging of laptops, mobile devices, and tablets.
(b) Forensic Imaging: Bit-for-bit forensic imaging of all collected media using industry-standard tools, with full chain of custody documentation and hash value verification.
(c) Processing: Ingestion, de-duplication, de-NISTing, text extraction, optical character recognition ("OCR"), language identification, email threading, and near-duplicate identification of all collected ESI.
(d) Hosting: Secure hosting of all processed data on Nexagen's proprietary cloud-based review platform, Nexagen Insight, with role-based access controls, audit logging, and multi-factor authentication.
(e) Technology-Assisted Review (TAR): Implementation and management of a Continuous Active Learning ("CAL") workflow for first-pass document review, including training set development, model iteration, and quality validation.
(f) Quality Control: Ongoing statistical sampling, inter-reviewer agreement analysis, elusion testing, and other quality assurance measures as described in this Protocol.
(g) Production Formatting and Bates-Stamping: Preparation of all production sets in the format and specifications required by the DOJ, including TIFF conversion, Bates-stamping, load file generation, and metadata extraction.
The anticipated document universe for this engagement is approximately 2.3 million documents across all data sources and custodians. This estimate is preliminary and will be refined following initial collection and processing activities. Any material changes to the estimated volume will be reported to the Calderwood & Harkness team and may result in budget adjustments as described in Section XIII of this Protocol.
1.3 Governing Legal Proceedings
The e-discovery activities governed by this Protocol arise from and are conducted in response to the following legal proceeding:
Grand Jury Subpoena GJ No. 22-418. On April 19, 2022, a federal grand jury empaneled in the United States District Court for the District of Columbia (Grand Jury 22-2) issued a subpoena duces tecum (GJ No. 22-418) directed to Dunmore Energy Holdings Ltd. The original return date specified in the subpoena was May 19, 2022. On April 28, 2022, Calderwood & Harkness LLP, on behalf of Dunmore, submitted a request to the DOJ for an extension of the initial return date to July 19, 2022, with an agreement for rolling productions of responsive documents thereafter. The DOJ has indicated informally that it will accept rolling productions, provided that the first substantial production is delivered no later than November 1, 2022.
The scope of the subpoena requires the production of all documents and communications from January 1, 2019, to the present date relating to the following subjects:
(a) Petronova Trading FZE, including but not limited to all contracts, agreements, correspondence, communications, invoices, payment records, trade confirmations, and shipping documents involving Petronova Trading FZE or any of its principals, agents, or affiliates;
(b) Volkhov Industrial Group JSC, including but not limited to all contracts, agreements, correspondence, communications, and financial records involving Volkhov Industrial Group JSC or any of its principals, agents, or affiliates, including but not limited to Arkady Volkhov;
(c) Zenith Petroleum DMCC, including but not limited to all contracts, agreements, correspondence, communications, invoices, and trade records involving Zenith Petroleum DMCC or any of its principals, agents, or affiliates, including but not limited to Farhan Qureshi;
(d) Caspian Logistik GmbH, including but not limited to all contracts, agreements, correspondence, communications, shipping documents, end-user certificates, and financial records involving Caspian Logistik GmbH or any of its principals, agents, or affiliates, including but not limited to Klaus Weidemann;
(e) Any transaction, agreement, or communication involving Russian-origin crude oil or refined petroleum products, including but not limited to crude oil swaps, spot and forward purchases, cargo nominations, tanker charters, and trade finance arrangements;
(f) Any export, re-export, or transfer of oilfield equipment, drilling components, downhole tools, wellhead assemblies, or related technology to the Russian Federation, the Republic of Belarus, or to any person or entity appearing on the OFAC Specially Designated Nationals and blocked Persons List ("SDN List"), the U.S. Department of Commerce Bureau of Industry and Security ("BIS") Entity List, or the BIS Denied Persons List.
The DOJ investigation is being conducted by the National Security Division, Counterintelligence and Export Control Section ("CES"). The assigned government attorneys are Assistant United States Attorney Meredith Calloway (lead), Trial Attorney Samuel Kovacs, and Trial Attorney Diana Pressman. The investigating agent is FBI Special Agent Paul Reinhardt. All communications with the DOJ regarding production matters are to be directed through Victoria Chambers and Jasmine Thornton.
1.4 Coordination with Related Workstreams
The e-discovery activities described in this Protocol are conducted in parallel with and in support of two related workstreams:
Internal Investigation. Calderwood & Harkness LLP is conducting a comprehensive internal investigation of the Dunmore Entities' transactions with the counterparties identified in the grand jury subpoena and related compliance practices. The internal investigation is led by Victoria Chambers, Responsible Partner, with day-to-day supervision by Jasmine Thornton, Lead Associate. The internal investigation includes witness interviews, document review, transactional analysis, and assessment of the Dunmore Entities' sanctions compliance program. The e-discovery activities described herein are integral to and conducted in support of this internal investigation.
Forensic Accounting Analysis. Calderwood & Harkness LLP has engaged Ridgeline Advisory Group LLC, a forensic accounting and financial advisory firm based in Washington, D.C. (Engagement No. RAG-2022-0319), to perform forensic accounting analysis of the financial transactions at issue. The Ridgeline engagement is led by Dr. Margaret Liu, CPA, CFE, and was formalized on May 2, 2022. Ridgeline has been retained as a consulting expert at the direction of counsel, and all work product generated by Ridgeline in connection with this engagement is protected by the attorney-client privilege and the work product doctrine. Ridgeline may, from time to time, request access to specific document sets hosted on the Nexagen platform for the purpose of financial tracing and transactional analysis. The protocol governing such requests is described in detail in Section X of this Protocol.
Coordination among the e-discovery, internal investigation, and forensic accounting workstreams is essential to ensure efficiency, avoid duplication of effort, and protect applicable privileges. All three workstreams are conducted at the direction of and under the supervision of counsel at Calderwood & Harkness LLP.
II. DEFINITIONS AND KEY TERMS
For purposes of this Protocol, the following terms shall have the meanings set forth below. Unless otherwise defined herein, capitalized terms used in this Protocol shall have the meanings ascribed to them in the context in which they appear.
"ESI" means Electronically Stored Information, as that term is used in the Federal Rules of Civil Procedure and as generally understood in the context of federal litigation and government investigations. ESI includes, without limitation, emails, email attachments, word processing documents, spreadsheets, presentations, databases, instant messages, text messages, chat logs, social media posts, voicemail recordings, audio files, video files, images, metadata, system logs, and any other information stored in electronic form on any device or medium.
"TAR" means Technology-Assisted Review, a process by which machine learning algorithms are used to classify documents as responsive or non-responsive based on training by human reviewers. As used in this Protocol, TAR refers specifically to the Continuous Active Learning ("CAL") methodology, also known as predictive coding with continuous training, in which the machine learning model is updated iteratively as reviewers code additional documents.
"Custodian" means any individual whose files, communications, devices, or data are subject to preservation, collection, and review under this Protocol. Custodians include current and former employees, officers, and directors of the Dunmore Entities whose documents may contain information responsive to the grand jury subpoena or relevant to the internal investigation.
"Non-Custodial Data Source" means any shared drive, enterprise system, database, application, or other electronic repository that is not attributable to a single custodian. Non-custodial data sources include, without limitation, shared network drives, Aldermere Systems sites, document management systems, enterprise resource planning ("ERP") systems, energy trading and risk management ("ETRM") systems, and compliance screening platforms.
"Bates Number" means the sequential alphanumeric identifier applied to each page of each document produced in response to the grand jury subpoena. The Bates numbering convention for this matter uses the prefix DEH-DOJ- followed by a six-digit sequential number (e.g., DEH-DOJ-000001).
"Privilege" means the protections afforded by the attorney-client privilege and/or the work product doctrine under applicable federal and state law. A document is designated as "Privileged" when it constitutes or reflects a confidential communication between an attorney and a client (or their agents) made for the purpose of obtaining or providing legal advice, or when it constitutes or reflects work product prepared by or at the direction of an attorney in anticipation of litigation or government enforcement proceedings.
"Responsive" means that a document falls within the scope of grand jury subpoena GJ No. 22-418 and/or is relevant to the internal investigation being conducted by Calderwood & Harkness LLP. A document may be responsive even if it is also privileged; responsiveness and privilege are assessed independently.
"Hot Document" means a document of particular factual significance to the investigation, including but not limited to documents that directly evidence a potential sanctions or export control violation, documents reflecting knowledge or intent by key custodians, documents that contradict or materially supplement prior witness statements, or documents that implicate new parties or transactions not previously identified. Hot Documents are flagged during review for immediate escalation to the responsible attorney team, as described in Section IX of this Protocol.
"Litigation Hold" or "Legal Hold" means a directive issued by counsel to preserve all documents and ESI potentially relevant to the investigation, including a suspension of any routine document destruction or retention policy that might otherwise result in the deletion of potentially relevant materials.
"OFAC" means the Office of Foreign Assets Control of the U.S. Department of the Treasury.
"SDN List" means the Specially Designated Nationals and blocked Persons List maintained by OFAC.
"BIS" means the Bureau of Industry and Security of the U.S. Department of Commerce.
"EAR" means the Export Administration Regulations, codified at 15 C.F.R. Parts 730–774.
III. DUNMORE ENTITY OVERVIEW AND JURISDICTIONAL FRAMEWORK
3.1 Entities Subject to Collection
The following table identifies each Dunmore Entity subject to data collection obligations under this Protocol, together with the jurisdiction of organization, principal address, and primary data locations for each entity. The entities listed below represent the full universe of Dunmore affiliates and subsidiaries from which data may be collected in connection with this matter.
3.2 Six-Jurisdiction Collection Framework
Data collection under this Protocol will be conducted across six jurisdictions. The following sets forth the jurisdictional framework, collection priority, and relevant considerations for each location:
Cayman Islands (George Town). DEH maintains its registered office at Harbour Place in George Town. The volume of data expected at this location is limited and consists primarily of corporate governance documents, including board minutes, resolutions, shareholder records, and formation documents. While the Cayman Islands registered office is not expected to yield a significant volume of substantive trading or operational records, collection is necessary to ensure completeness and to capture any board-level communications regarding the transactions at issue. Elena Vasquez will coordinate the collection from this location.
United Arab Emirates (Dubai). DTI's principal office at the Dubai International Financial Centre is the highest priority collection location. DTI is the Dunmore subsidiary that conducted the trading activities at the center of the DOJ inquiry, including the crude oil swap transactions with Petronova Trading FZE and Zenith Petroleum DMCC and the oilfield equipment export transactions facilitated through Caspian Logistik GmbH. The Dubai office houses the trading desk, the ETRM system, the primary financial and accounting records for DTI's trading operations, and the communications of the Tier 1 custodians most directly implicated in the investigation (Derek Hargrave, Natasha Sorokin, and Omar Al-Rashidi). The bulk of the anticipated document universe — including email communications, shared drive files, trading records, counterparty files, contracts, and financial records — is expected to originate from this location. Thomas Bradshaw will lead the Dubai collection effort personally, accompanied by a Nexagen field team.
United States (Houston, TX / Wilmington, DE). The Houston office at 1200 McKinney Street serves as the operational headquarters for both DEH and DUA. This location is the second highest priority for collection. The Houston office houses corporate oversight functions, compliance operations (including Gerald Fisk's former OFAC screening team), executive communications, and financial reporting infrastructure, including the Aldermere Services Inc. system used across Dunmore entities. Houston is also the location of key Tier 1 custodians, including Gerald Fisk (former Chief Compliance Officer), Marcus Wellbourne (General Counsel), Callum Renshaw (CEO), and Sandra Whitfield (CFO). The Wilmington, Delaware registered agent office is not expected to hold substantive data. Nicholas Ferreira will coordinate the Houston collection in conjunction with a Nexagen field team.
Germany (Hamburg). Dunmore Renewables GmbH maintains its registered office at Überseeallee 12 in Hamburg. The Hamburg collection is targeted specifically to capture documents and communications related to Caspian Logistik GmbH, which is organized under German law and which facilitated oilfield equipment shipments at issue in the investigation. Tobias Engel, Managing Director of Dunmore Renewables GmbH, has been identified as tangentially involved in at least one transaction with Caspian Logistik GmbH. The Hamburg collection will also capture any shipping, logistics, and end-user certificate documentation maintained at the Hamburg office. Amara Osei will lead the Hamburg collection in coordination with a local forensics vendor arranged by Nexagen. Special attention must be paid to GDPR compliance for all data collected in Hamburg.
Nigeria (Lagos). DEWA maintains its principal office at 14B Kofo Abayomi Street, Victoria Island, Lagos. The Lagos collection is limited and targeted, focused on identifying any cross-regional trading or logistics activities that may link DEWA's West African operations to the Russia-related transactions at issue. The collection scope includes targeted email and file server collections for any DEWA personnel involved in cross-regional trading or logistics coordination. Given the limited expected yield and the operational constraints of on-site collection in Lagos, Nexagen will conduct the Lagos collection remotely, supervised by Thomas Bradshaw.
United Kingdom (London). Although Dunmore does not maintain a separate UK-incorporated entity, certain Dunmore personnel and data are located in or transit through London. The London office of Calderwood & Harkness LLP (30 St Mary Axe, 12th Floor, London EC3A 8BF) serves as the coordination point for any UK-located data. Amara Osei, based in Calderwood & Harkness's London office, will supervise the identification and collection of any UK-based data, including data from any Dunmore personnel who are based in or regularly travel through London in connection with DTI's trading operations.
3.3 Cross-Border Data Transfer Considerations
The multi-jurisdictional scope of this engagement requires careful attention to the data protection and privacy laws applicable in each jurisdiction from which data is collected. The transfer of ESI from non-U.S. jurisdictions to Nexagen's U.S.-based processing and hosting facilities must be supported by appropriate legal bases and conducted in compliance with all applicable cross-border data transfer restrictions. The following summarizes the key data protection considerations for each jurisdiction; detailed legal basis memoranda for each jurisdiction are attached as Appendix F.
United Arab Emirates (Dubai / DIFC). Data collected from DTI's DIFC office is subject to the data protection framework applicable within the DIFC, including the DIFC Data Protection Law (DIFC Law No. 5 of 2020). A separate memorandum prepared by Amara Osei, dated April 25, 2022, addresses the UAE/DIFC document preservation obligations and the legal basis for transferring personal data from the DIFC to the United States in the context of a government enforcement proceeding. DTI must provide appropriate notice to affected individuals and ensure that transfers are conducted pursuant to a recognized legal mechanism, such as standard contractual clauses or a finding of adequate protection.
European Union (Germany — GDPR). Data collected from Dunmore Renewables GmbH in Hamburg is subject to the EU General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR"). The GDPR imposes significant restrictions on the transfer of personal data from the European Economic Area to third countries that have not been recognized by the European Commission as providing an adequate level of data protection — a category that includes the United States, notwithstanding the potential for a new transatlantic data privacy framework. Prior to any transfer of Hamburg-sourced data to Nexagen's U.S. facilities, Calderwood & Harkness and Nexagen must execute EU Standard Contractual Clauses (Module 2, Controller to Processor, as adopted by European Commission Implementing Decision (EU) 2021/914) and a compliant Data Processing Agreement. A Transfer Impact Assessment must be completed. Additional safeguards, including encryption and pseudonymization, may be required. Amara Osei, in coordination with Calderwood & Harkness's Hamburg-based German law advisors, is responsible for ensuring GDPR compliance.
United Kingdom (London — UK GDPR). To the extent that personal data of UK-based individuals is collected, such data is subject to the UK General Data Protection Regulation (as retained under the European Union (Withdrawal) Act 2018) and the UK Data Protection Act 2018. The UK GDPR imposes transfer restrictions substantially similar to those under the EU GDPR. Standard contractual clauses (UK International Data Transfer Addendum to the EU SCCs) and a data processing agreement are required prior to any transfer of UK-sourced personal data to the United States. Amara Osei is responsible for coordinating UK data protection compliance.
Nigeria (Lagos — NDPR). Data collected from DEWA's Lagos office is subject to the Nigeria Data Protection Regulation ("NDPR"), issued by the National Information Technology Development Agency ("NITDA") in January 2019. The NDPR requires, among other things, that any transfer of personal data from Nigeria be conducted with adequate protections and that the data subject's consent be obtained where required. Given the limited and targeted nature of the Lagos collection, the volume of personal data subject to the NDPR is expected to be minimal. Calderwood & Harkness's Nigerian law advisors will provide guidance on NDPR compliance for the Lagos collection.
Cayman Islands. The Cayman Islands Data Protection Act (2017), which became effective on September 30, 2019, establishes a comprehensive data protection framework broadly modeled on the EU GDPR. The applicability of the Cayman Islands Data Protection Act to the collection of corporate governance documents from DEH's registered office must be assessed. To the extent that any personal data is collected from the George Town office, appropriate transfer mechanisms must be in place.
General Requirements. All cross-border data transfers conducted under this Protocol are to be documented and supported by an appropriate legal basis. Nexagen Analytics Inc. is required to execute a Data Processing Addendum that addresses the specific data protection requirements applicable to each jurisdiction, including provisions for data security, data subject rights, sub-processor management, breach notification, and data return or destruction upon completion of the engagement. A copy of the executed Master Services Agreement and Data Processing Addendum between Calderwood & Harkness LLP and Nexagen Analytics Inc. is attached as Appendix D.
IV. CUSTODIAN IDENTIFICATION AND PRIORITIZATION
4.1 Custodian Prioritization Tiers
Custodians have been identified and prioritized into three tiers based on their role within the Dunmore Entities, their proximity to the transactions and conduct at issue in the DOJ investigation, and the anticipated relevance and volume of their documents and communications. Tier designations determine the order and intensity of collection, the scope of devices and data sources collected, and the priority for review and production.
Tier 1 — Highest Priority (Immediate Collection). Tier 1 custodians are individuals who are most directly connected to the transactions, counterparties, and compliance decisions at issue in the DOJ investigation. Data from Tier 1 custodians is subject to immediate collection, and all available data sources — including corporate devices, personal devices (where used for business purposes), email accounts, encrypted messaging applications, and cloud storage — are within scope. Tier 1 custodians' documents are prioritized for first-pass TAR review and manual second-pass review. Litigation hold notices were issued to all Tier 1 custodians on April 20, 2022, except as otherwise noted.
Tier 2 — High Priority. Tier 2 custodians are individuals with significant knowledge of, or involvement in, the transactions, financial processes, or corporate oversight functions relevant to the investigation. Tier 2 custodian data is subject to prompt collection following completion of Tier 1 collections. All corporate devices, email accounts, and relevant enterprise system data are within scope. Personal devices and encrypted messaging applications will be assessed on a custodian-by-custodian basis.
Tier 3 — Standard Priority (Targeted Collection). Tier 3 custodians are individuals whose data is subject to targeted collection based on specific topics, date ranges, or data sources, rather than the comprehensive collection applicable to Tier 1 and Tier 2 custodians. Tier 3 custodians include:
• Additional trading desk personnel at DTI (to be identified through a review of the DTI organizational chart and through information obtained during witness interviews);
• Finance and accounting personnel at DUA and DTI who were involved in the processing, recording, or reporting of the transactions at issue;
• IT administrators at DTI and DEH/DUA, from whom system-level data and access logs may be collected (including access logs for the ETRM system, the Aldermere Services Inc. system, and the compliance screening platform);
• Any DEWA personnel identified as having been involved in cross-regional trading, logistics coordination, or communications with DTI regarding transactions with the counterparties named in the grand jury subpoena;
• Any additional custodians identified through document review, witness interviews, or the internal investigation.
The full Tier 3 custodian list is maintained by Elena Vasquez, Paralegal Manager, and is updated on a rolling basis as new custodians are identified. The current Tier 3 custodian list is set forth in Appendix A.
4.2 Custodian-Specific Notes
The following notes address specific collection considerations, personal counsel relationships, and other matters relevant to individual custodians:
Derek Hargrave. Collection from Mr. Hargrave shall encompass all corporate-issued devices (laptop, mobile phone, tablet) as well as any bring-your-own-device ("BYOD") devices used for business purposes. An assessment of Mr. Hargrave's personal email accounts (including any Northgate Software, Cascade Health IT, or other personal email accounts) must be conducted to determine whether any business communications were transmitted through personal channels. Mr. Hargrave's personal attorney, James Overstreet of Overstreet & McClain PLLC, 2200 Ross Avenue, Suite 3600, Dallas, TX 75201, entered an appearance on Mr. Hargrave's behalf effective July 1, 2022. All collection activities involving Mr. Hargrave's personal devices must be coordinated with Mr. Overstreet. Prior to the entry of personal counsel, however, collection of all corporate-issued devices should proceed without delay.
Natasha Sorokin. Ms. Sorokin's data presents several unique collection and review considerations. First, as a Russian-American dual national, Ms. Sorokin's communications include a significant volume of Russian-language documents and correspondence, including communications with Sergei Volkov of Petronova Trading FZE that are believed to have been conducted predominantly in Russian. Russian-language documents will require specialized review by Russian-speaking reviewers, and Cyrillic character search terms must be developed and applied as described in Section VII.5 of this Protocol. Second, Ms. Sorokin is known to have used encrypted messaging applications (Meridian Services Inc., Signal, and Kestrel Data Systems) for business-related communications, including communications with Sergei Volkov and other counterparties. Forensic extraction of encrypted messaging data from Ms. Sorokin's mobile devices is a high priority. Third, Ms. Sorokin's personal attorney, Philip Keane of Wexford Keane LLP, 2000 K Street NW, Suite 650, Washington, DC 20006, entered an appearance effective September 2022. Given the timing of Mr. Keane's engagement, collection of Ms. Sorokin's personal devices should be completed, to the extent feasible, prior to Mr. Keane's entry into the matter. Collection of corporate devices is not contingent on personal counsel engagement.
Gerald Fisk. Mr. Fisk departed Dunmore on June 10, 2022. It is imperative that all corporate-issued devices and files assigned to or created by Mr. Fisk be collected and preserved prior to or contemporaneously with his departure. The Dunmore IT department has been instructed to disable Mr. Fisk's network access upon departure but to preserve, without alteration, his email account, home directory, and all files stored on corporate systems. Mr. Fisk's personal counsel, Catherine Blackthorn of Blackthorn & Associates LLP, 700 Louisiana Street, Suite 4300, Houston, TX 77002, should be contacted to coordinate the collection of any documents or data in Mr. Fisk's personal possession, including any personal devices on which business-related communications or documents may be stored.
Omar Al-Rashidi. Mr. Al-Rashidi has been identified as a cooperating witness. Expedited collection and review of his files is necessary to support the preparation of a proffer submission to the DOJ. All data from Mr. Al-Rashidi's corporate devices, email accounts, and shared drive locations should be prioritized in the processing and review queues, with the objective of completing a preliminary review of Mr. Al-Rashidi's most relevant communications within the first thirty days of collection.
4.3 Custodian Count and Projected Volume
The initial custodian list comprises approximately twenty-five to thirty individuals across all three tiers. This number is expected to increase as the investigation progresses. New custodians may be identified through witness interviews, document review, organizational chart analysis, and other investigative activities. Any additions to the custodian list must be approved by Jasmine Thornton and documented by Elena Vasquez in the master custodian tracking spreadsheet maintained as Appendix A.
The total estimated document volume across all custodians and non-custodial data sources is approximately 2,347,812 documents (pre-deduplication). This estimate is based on preliminary assessments of email volume, file server size, and enterprise system data volume conducted during the initial scoping phase. Actual volumes may vary and will be refined following initial collection and processing. Material changes to the estimated document volume will be reported to the Calderwood & Harkness team and to Howard Quinn (Billing Partner) in connection with budget management.
V. DATA SOURCES AND COLLECTION METHODOLOGY
5.1 Data Source Inventory
The following is a comprehensive inventory of the data sources subject to collection under this Protocol. Data sources are organized by category, with notes regarding the entities and locations at which each source is maintained.
Email Systems. Strathmore Data Systems / Outlook. All Dunmore Entities use Strathmore Data Systems as their primary email platform. Exchange-hosted email is the single largest source of ESI in this matter. Email collections will encompass all sent, received, and draft messages, calendar items, and contacts for each custodian within the relevant date range (January 1, 2019, to the present). Email attachments will be collected and processed together with their parent messages. Email archives (PST files) stored on local drives or network shares will also be collected.
Personal Email Accounts. Where custodian interviews or other evidence indicates that personal email accounts (including Northgate Software, Cascade Health IT, Ridgeline Technologies, or other consumer email services) were used for business-related communications, targeted forensic collection of those accounts will be conducted. Personal email collection requires custodian cooperation and, where personal counsel has entered an appearance, coordination with personal counsel. The scope of personal email collection will be defined on a custodian-by-custodian basis and will generally be limited to communications with counterparties named in the grand jury subpoena, other Dunmore personnel, and communications on topics within the scope of the investigation.
Encrypted Messaging Applications. Communications conducted through encrypted messaging applications — including Meridian Services Inc., Signal, and Kestrel Data Systems — are within the scope of collection, particularly for DTI trading desk personnel. Natasha Sorokin, Derek Hargrave, and Omar Al-Rashidi have been identified as users of one or more encrypted messaging applications for business-related communications. Forensic extraction of messaging data from mobile devices will be performed using Sundial Services Inc. or equivalent mobile forensics tools. The ability to extract data from encrypted messaging applications may be limited by device configuration, application settings, and encryption protocols. Any limitations encountered during extraction will be documented and reported to the Calderwood & Harkness team.
File Servers and Shared Drives. DTI Shared Network Drives (Dubai). The DTI Dubai office maintains shared network drives containing trading records, counterparty files, contracts, deal memos, term sheets, shipping documents, and other operational files. These shared drives are a critical non-custodial data source and will be collected in their entirety for the relevant date range.
DUA/DEH Shared Network Drives (Houston). The Houston office maintains shared network drives containing corporate governance documents, compliance files, board materials, regulatory filings, and corporate correspondence. Targeted collection of specific directories (e.g., compliance, legal, executive) will be prioritized, with broader collection of additional directories as warranted.
Dunmore Renewables GmbH Shared Drives (Hamburg). The Hamburg office maintains shared drives that may contain files related to Caspian Logistik GmbH transactions, including shipping documentation, logistics records, and correspondence with Klaus Weidemann. Collection will be targeted to directories and file paths identified through custodian interviews and IT department inquiry.
Enterprise Systems. Energy Trading and Risk Management (ETRM) System. DTI utilizes an ETRM system for trade capture, position management, risk analysis, and trade confirmation. The ETRM system contains transactional records for all crude oil swaps, spot and forward trades, and other energy commodity transactions executed by the DTI trading desk. Data from the ETRM system will be exported in native format with associated metadata, including trade date, counterparty, commodity, volume, price, delivery terms, and settlement status for all trades within the relevant date range.
Aldermere Services Inc. System. The Dunmore Entities use an Aldermere Services Inc. system for financial and accounting records across entities, including general ledger entries, accounts payable and receivable, purchase orders, invoices, payment authorizations, and intercompany transactions. Hollowell & Co. data relevant to the transactions at issue — including all journal entries, payment records, and financial documentation associated with the counterparties named in the grand jury subpoena — will be extracted and loaded to the Nexagen platform.
Compliance Screening System. Gerald Fisk's compliance team utilized an OFAC/sanctions screening tool to screen counterparties, beneficial owners, and transaction parties against the SDN List, Entity List, and other restricted party lists. Data from the compliance screening system — including screening logs, match results, escalation records, and disposition records — is critical to the investigation and will be collected in its entirety for the relevant date range.
Document Management System. To the extent that any Dunmore Entity utilizes a document management system (DMS) for the storage and retrieval of contracts, legal documents, or other business records, data from the DMS will be collected. The presence and configuration of any DMS will be confirmed during on-site collection activities.
Financial Records. Crescent Commercial Bank PJSC (Dubai). DTI maintained its primary trade finance banking relationship with Crescent Commercial Bank PJSC in Dubai. Banking records from Crescent Commercial Bank are central to the investigation and include trade finance records, wire transfer confirmations, SWIFT messages (MT103, MT202, MT700, and related message types), letters of credit, and account statements. The investigation has identified 127 transactions between March 2020 and March 2022, totaling approximately $34.2 million, that flowed through Crescent Commercial Bank. Khalid Mansour, Relationship Manager at Crescent Commercial Bank, is the designated contact for banking record requests. All banking record requests will be coordinated through Marcus Wellbourne, General Counsel.
Meridian National Bank, N.A. DEH maintains a $750 million senior secured revolving credit facility with a syndicate led by Meridian National Bank, N.A. To the extent that any drawdowns, repayments, or compliance certifications under the credit facility relate to the transactions at issue, relevant records will be obtained from Meridian National Bank.
Internal Financial Systems. Internal financial records — including invoices, payment authorizations, journal entries, trade confirmations, and settlement documents — for the fourteen crude oil swap transactions ($218.7 million notional value) with Petronova Trading FZE and Zenith Petroleum DMCC and the $12.4 million in oilfield equipment exports facilitated through Caspian Logistik GmbH will be collected from DTI and DEH/DUA financial systems.
Physical Documents. DTI Dubai Office. Hard copy files maintained at the DTI Dubai office include original executed contracts, end-user certificates, shipping documents (bills of lading, packing lists, commercial invoices), and counterparty correspondence. Hard copy documents will be collected, inventoried, and scanned to TIFF format for loading to the Nexagen platform. Chain of custody documentation will be maintained for all physical document collections.
Houston Office. Hard copy compliance files maintained at the DEH/DUA Houston office include OFAC screening records, compliance program documentation, and hard copy correspondence. These files will be collected and scanned in accordance with the procedures for physical document collection.
Hamburg Office. Hard copy shipping and logistics documents related to Caspian Logistik GmbH maintained at the Dunmore Renewables GmbH Hamburg office will be collected and scanned.
Mobile Devices and Laptops. Corporate-issued mobile phones and laptops for all Tier 1 and Tier 2 custodians will be collected and forensically imaged. For Tier 3 custodians, corporate devices will be collected on a targeted basis as determined by the investigation team. BYOD devices will be forensically imaged where evidence of business use has been identified, subject to coordination with personal counsel where applicable.
Cloud Storage. Severin Services Inc. / Aldermere Systems (Corporate). All Dunmore Entities use Severin Services Inc. and Aldermere Systems as part of their Ashgrove Software environment. Custodian-specific Cobalt Ridge Systems accounts and relevant Aldermere Systems sites will be collected as part of the email and file server collection process.
Personal Cloud Storage. Where evidence indicates that personal cloud storage services (such as Larkspur Technologies, Hollowell Health IT, or Meridian Systems) were used by custodians for business purposes, targeted collection of those accounts will be conducted on a custodian-by-custodian basis, subject to custodian cooperation and personal counsel coordination.
5.2 Collection Methodology
Forensic Imaging. All Tier 1 custodian devices — including laptops, desktop computers, mobile phones, and tablets — will be forensically imaged by Nexagen Analytics field technicians. Forensic imaging creates a bit-for-bit copy of the source media that preserves all data, including deleted files, file fragments, system artifacts, and metadata, in an unaltered state. The following protocols apply to all forensic imaging activities:
(a) Chain of custody documentation will be prepared for each device at the time of collection, recording the device description (make, model, serial number), the custodian to whom the device is assigned, the date and time of collection, the identity of the collecting technician, and any relevant observations regarding the condition of the device.
(b) Forensic imaging will be performed using industry-standard tools, including Stonefield Software (Drayton Technologies) for hard drives and solid-state drives, and Drayton Technologies for mobile devices and tablets.
(c) Hash values (both MD5 and SHA-1) will be computed and recorded for all collected media at the time of imaging. Hash values will be verified at each subsequent stage of the data handling chain (transport, processing, loading) to confirm data integrity.
(d) All forensic images will be stored on encrypted media (AES-256 encryption) during transport and at rest.
(e) Original devices will be returned to the custodian or to the Dunmore IT department following imaging, unless counsel determines that device retention is necessary.
Server / Enterprise Collections. Email collections from Strathmore Data Systems will be performed via Exchange journaling (where available) or through the export of PST or EML files with full metadata preservation. Where Exchange journaling is not enabled for all custodians, individual mailbox exports will be conducted using Microsoft's built-in compliance and eDiscovery tools (e.g., In-Place eDiscovery or Content Search) or equivalent third-party tools.
Shared drive collections will be performed using robocopy or equivalent file replication utilities configured to preserve all original metadata, including date created, date modified, date accessed, author, and full file path. Hash values will be computed for all collected files.
ETRM and ERP data will be exported in native format with all associated metadata fields. The specific export methodology for each enterprise system will be determined in coordination with Dunmore's IT department and the system vendors, as necessary.
Third-Party Collections. Certain data sources are maintained by third parties and are not directly within the control of the Dunmore Entities. Third-party collections will be coordinated as follows:
Crescent Commercial Bank PJSC. Formal requests for banking records, including wire transfer confirmations, SWIFT messages, letters of credit, and account statements, will be submitted to Crescent Commercial Bank through Khalid Mansour, Relationship Manager. All banking record requests will be coordinated through Marcus Wellbourne, General Counsel. Depending on the scope and format of the records produced by Crescent Commercial Bank, Nexagen may need to perform specialized processing to load banking data into the review platform.
Ashford & Whitmore LLP. Calderwood & Harkness will request relevant audit workpapers from Ashford & Whitmore LLP (Kenneth Ashford, Engagement Partner), Dunmore's external auditors, relating to the trade finance transactions and internal controls at issue. The scope of the workpaper request will be defined by Jasmine Thornton in consultation with Ridgeline Advisory Group.
Any third-party banking or financial records obtained under this Protocol will be loaded to the Nexagen platform separately from custodian and enterprise system data, tagged by source, and made available for review and, if responsive, for production.
On-Site Collection Schedule. The following table sets forth the on-site collection schedule across all six jurisdictions:
5.3 Metadata Preservation
The preservation of original metadata is essential to the integrity and defensibility of the e-discovery process. All collected ESI must retain its original metadata without alteration. The following metadata preservation standards apply:
(a) Nexagen Analytics shall extract and load a minimum of twenty-five (25) metadata fields per document, including but not limited to: document title, author, date created, date last modified, date last accessed, date sent (for emails), date received (for emails), sender, recipient(s), CC, BCC, subject line, file name, file extension, file size, file path, custodian, source device, hash value (MD5 and SHA-1), MIME type, and any custom metadata fields relevant to specific file types.
(b) All documents shall be preserved in their native file format. TIFF images and/or PDF renditions will be generated for review purposes, but original native files will be retained in the Nexagen platform and produced in native format where required (e.g., for spreadsheets, presentations, and other complex file types).
(c) Email threading metadata (conversation index, message ID, in-reply-to, references) shall be preserved and used to construct email thread groupings during processing.
(d) The integrity of metadata shall be verified through hash value comparison at each stage of the data handling chain.
VI. PROCESSING AND HOSTING
6.1 Processing Specifications
All data collected under this Protocol will be processed by Nexagen Analytics Inc. at its New York facility located at 100 Broadway, Suite 1400, New York, NY 10005. Processing activities are designed to reduce the collected data set to a manageable volume for review while preserving all potentially relevant documents and metadata. The following processing specifications apply:
De-duplication. Global de-duplication will be performed across all custodians and data sources using the MD5 hash value as the de-duplication key. Exact duplicates will be suppressed, with the earliest instance retained and all custodians to whom the duplicate was attributed tracked in the metadata. De-duplication will be applied separately to loose files and email families (an email and its attachments will be treated as a family unit for de-duplication purposes).
De-NISTing. System files, application files, and other files identified on the National Institute of Standards and Technology ("NIST") National Software Reference Library will be removed from the data set during processing. De-NISTing eliminates irrelevant operating system and application files that have no potential relevance to the investigation.
Text Extraction. Full text will be extracted from all processed documents. For image-based documents (scanned PDFs, TIFF images), optical character recognition ("OCR") will be applied to generate searchable text. OCR quality will be verified through random sampling.
Language Identification. Automated language identification will be applied during processing to identify the primary language of each document. Non-English documents will be flagged and routed to appropriate specialized review queues (Russian, French, Arabic, German) as described in Section VII.5.
Email Threading. Email threading algorithms will be applied to group related email messages into conversation threads, enabling reviewers to assess communications in context and facilitating more efficient review.
Near-Duplicate Identification. Near-duplicate detection will be applied to identify documents that are substantially similar but not exact duplicates (e.g., successive drafts of a contract, documents with minor formatting changes). Near-duplicates will be clustered for batch review.
Exception Files. Files that cannot be processed due to corruption, password protection, encryption, or other technical issues will be logged in an exception file report and reported to Thomas Bradshaw for resolution. Password-protected files will be cracked using commercially available tools where feasible; where password cracking is unsuccessful, the custodian or IT department will be contacted to obtain the password. Encrypted files that cannot be decrypted will be documented and preserved in their encrypted state.
The estimated pre-deduplication processing volume is approximately 2,347,812 documents. Post-deduplication and de-NISTing volumes will be reported to the Calderwood & Harkness team upon completion of processing.
6.2 Hosting Platform
All processed documents will be hosted on Nexagen's proprietary secure, cloud-based document review platform, Nexagen Insight. Nexagen Insight is a web-based application that supports document review, search, coding, TAR, analytics, and production workflow management. The platform provides the following capabilities relevant to this engagement:
• Full-text search with Boolean, proximity, and wildcard operators
• Metadata filtering and faceted search
• Email threading and conversation view
• Near-duplicate clustering
• Continuous Active Learning (CAL) TAR workflow
• Customizable coding panels and issue tag management
• Batch coding and propagation of coding decisions across families and threads
• Redaction tools (highlight, block, and text redaction)
• Production management (Bates-stamping, TIFF/native production, load file generation)
• Audit logging and user activity reporting
Access to the Nexagen Insight platform is restricted to authorized personnel. The following access controls apply:
• All authorized Calderwood & Harkness team members identified on the distribution list of this Protocol will receive individual user credentials.
• Ridgeline Advisory Group LLC personnel will receive read-only access to designated document subsets upon approval by Jasmine Thornton, as described in Section X.
• Contract reviewers engaged through Nexagen will receive access limited to the review workspaces and coding panels assigned to them.
• No access will be granted to any Dunmore Entity personnel without prior written approval from Victoria Chambers.
A user access matrix will be maintained by Brian Cavanaugh, Nexagen Project Manager, and updated as personnel are added or removed from the project. Each user will be assigned a unique login credential, and no sharing of credentials is permitted.
All data is hosted in U.S.-based data centers that maintain SOC 2 Type II certification, demonstrating compliance with industry-standard controls for security, availability, processing integrity, confidentiality, and privacy.
6.3 Data Security Requirements
The following data security requirements apply to all data processed, hosted, and maintained by Nexagen Analytics Inc. in connection with this engagement:
Encryption. All data must be encrypted at rest using AES-256 encryption and in transit using TLS 1.2 or higher. Encryption keys must be managed in accordance with industry best practices, with key rotation performed at least annually.
Multi-Factor Authentication. All user accounts on the Nexagen Insight platform must be protected by multi-factor authentication ("MFA"). MFA must be required at each login and may not be bypassed without prior written approval from Thomas Bradshaw and Brian Cavanaugh.
Audit Logging. All user activity on the Nexagen Insight platform must be logged, including login/logout events, document access (views, downloads), search queries, coding decisions, redaction actions, production activities, and administrative changes (user account creation, permission modifications). Audit logs must be retained for the duration of the engagement and for a period of three years following engagement termination.
Data Breach Notification. In the event of any actual or suspected data breach, unauthorized access, or security incident involving data maintained in connection with this engagement, Nexagen Analytics Inc. must notify Thomas Bradshaw and Victoria Chambers within twenty-four (24) hours of becoming aware of the incident. The notification must include a description of the incident, the data affected, the remedial actions taken or planned, and a point of contact for further communications. Nexagen must cooperate fully with any investigation of the incident conducted by Calderwood & Harkness LLP or the Dunmore Entities.
GDPR-Compliant Processing. Data sourced from the European Union (Germany) and the United Kingdom is subject to the data protection requirements of the GDPR and UK GDPR, respectively. Nexagen's processing of such data must comply with the terms of the Data Processing Addendum executed between Calderwood & Harkness LLP and Nexagen Analytics Inc. (Appendix D), including provisions for data minimization, purpose limitation, storage limitation, data subject rights, sub-processor management, and data return or destruction.
Physical Security. Nexagen's New York facility must maintain physical security controls adequate to protect the confidentiality and integrity of the data, including access controls (badge/key card access, visitor logs), surveillance, and secure destruction of media.
VII. SEARCH TERM METHODOLOGY
7.1 Initial Search Term Development
The search terms set forth in this Section VII are designed to identify documents within the scope of grand jury subpoena GJ No. 22-418 and the internal investigation. Search terms were developed collaboratively by Jasmine Thornton (Lead Associate), Liam Donahue (Associate), Conrad Reeves (Associate), and Thomas Bradshaw (e-discovery Lead), drawing upon the categories of documents and information described in the subpoena, the counterparties and individuals identified to date, and the subject matter areas central to the investigation.
Search terms will be applied to email bodies, email subject lines, email attachment content, and the content of loose files (word processing documents, spreadsheets, presentations, PDFs, and other text-containing file types). Search terms will be run against the full text index generated during processing. Search term hits will be tracked and reported for each term individually and in combination.
The search terms listed below represent the initial iteration of the search term protocol. As described in Section VII.4, search terms will be validated through statistical sampling and refined iteratively throughout the engagement. All iterations of the search term protocol, including validation results and any modifications, will be documented in the Search Term Log maintained by Thomas Bradshaw (Appendix C).
7.2 Entity / Counterparty Search Terms
The following search terms are designed to capture documents referencing the entities, counterparties, and individuals identified in the grand jury subpoena and the internal investigation:
7.3 Subject-Matter Search Terms
The following search terms are designed to capture documents relating to the subject matter areas central to the investigation, including sanctions, export controls, commodities trading, oilfield equipment, financial transactions, and compliance:
7.4 Search Term Validation and Refinement
Search term validation is essential to ensuring that the search methodology captures a sufficient proportion of responsive documents (recall) while maintaining an acceptable rate of relevant returns (precision). The following validation procedures will be applied:
(a) Initial Hit Reporting. Following the application of each search term to the processed data set, Nexagen will generate a search term hit report identifying the number of documents returned by each individual term, each term in combination with other terms, and any notable patterns or anomalies (e.g., unusually high or low hit rates).
(b) Statistical Sampling. For each search term, a minimum random sample of 200 documents will be drawn from the hit population and reviewed by a qualified attorney (Liam Donahue or Conrad Reeves) to assess precision — that is, the proportion of returned documents that are in fact responsive to the investigation. Terms with unacceptably low precision (below 50%) will be flagged for refinement.
(c) Refinement. Overly broad search terms — those returning a disproportionately large number of non-responsive documents — will be refined through the addition of proximity operators (e.g., w/5, w/10), Boolean connectors (AND, AND NOT), date restrictions, custodian restrictions, or other narrowing techniques.