PRIVILEGED AND CONFIDENTIAL — ATTORNEY WORK PRODUCT — PREPARED AT THE DIRECTION OF COUNSEL
MEMORANDUM
FROM: Devon Archer, Lead Associate, Labor & Employment Practice Group, Calderwood & Harkness LLP
TO: Linden Forensics Group Inc., 201 Mission Street, Suite 1400, San Francisco, CA 94105
DATE: May 8, 2023
RE: Forensic Collection Protocol & Custodian List — Independent Workplace Investigation, Aurelius Global Media Group PLC / Aurelius Pacific Studios Inc.
C&H MATTER NO.: 1017-00005
CC: Bernard Crawford, Esq. (Responsible Partner, Calderwood & Harkness LLP); Nadia Petrov, Esq. (Working Associate, Calderwood & Harkness LLP)
Right-click to update Table of Contents
I. PURPOSE AND BACKGROUND
This memorandum sets forth the forensic collection protocol, custodian list, data sources, date ranges, and search-term parameters for the collection of electronically stored information ("ESI") in connection with Calderwood & Harkness LLP's ("C&H") independent privileged workplace investigation conducted at the direction of the Board of Directors of Aurelius Global Media Group PLC ("AGMG"). The purpose of this memorandum is to provide Linden Forensics Group Inc. ("Linden Forensics") with detailed, authoritative instructions governing every aspect of the forensic collection process, to ensure that the collection is performed in a forensically sound, legally defensible, and privilege-protected manner.
Calderwood & Harkness LLP was retained on May 2, 2023 by the Board of Directors of AGMG, acting through Fiona Blackwood, General Counsel of AGMG, to conduct an independent investigation into allegations of sexual harassment, retaliation, and hostile work environment directed against Marcus Hale, President of Aurelius Pacific Studios Inc. ("APS"). APS is a wholly owned Delaware subsidiary of AGMG, with its principal place of business located at 3200 West Alameda Avenue, Suite 400, Burbank, California 91505. The allegations against Mr. Hale were initially raised through the company's third-party ethics hotline and subsequently escalated to the AGMG Board through established governance channels. The nature and severity of the allegations, as well as the seniority of the individual at issue, warranted the retention of outside counsel to conduct a thorough and independent investigation.
Linden Forensics Group Inc. was retained by Calderwood & Harkness on May 8, 2023 as agent of counsel to perform forensic collection, preservation, and processing of ESI in connection with this investigation, pursuant to the engagement letter of even date between C&H and Linden Forensics. It is critical that all work performed by Linden Forensics is understood to be undertaken at the express direction of counsel and is subject to the protections of the attorney-client privilege and the work-product doctrine. Linden Forensics's role as agent of counsel is fundamental to the preservation of these protections, and all personnel engaged in the collection effort must conduct themselves accordingly.
A litigation hold notice was issued by APS on May 2, 2023, by Victor Gallegos, Vice President of Human Resources at APS, directing the preservation of all documents and ESI potentially relevant to the allegations under investigation. The litigation hold notice was distributed to all identified custodians and relevant IT personnel and directed that no documents, communications, or data of any kind be deleted, destroyed, altered, or removed from company systems. This forensic collection protocol supplements and implements that preservation directive by establishing the specific parameters, methodology, and schedule for the affirmative collection of ESI from identified custodians and data sources.
This memorandum should be read in conjunction with the engagement letter between C&H and Linden Forensics, the litigation hold notice dated May 2, 2023, and the confidential custodian identification sheet attached hereto as Exhibit A (to be delivered separately under secure transmission). In the event of any conflict between this memorandum and the engagement letter, the terms of the engagement letter shall control with respect to commercial and contractual matters, while this memorandum shall control with respect to the substantive scope and methodology of the collection.
II. SCOPE OF COLLECTION
A. General Scope
The forensic collection authorized by this memorandum shall encompass all ESI from identified custodians who are employed by, or were formerly employed by, Aurelius Pacific Studios Inc. that is relevant to the investigation of the allegations of sexual harassment, retaliation, and hostile work environment against Marcus Hale. The scope of collection is intentionally broad at this stage of the investigation, consistent with the obligation to conduct a thorough and good-faith inquiry into the allegations. The collection is designed to capture communications, documents, and data that may shed light on the conduct at issue, the responses of company personnel to complaints or reports, the treatment of complainants and witnesses, and the broader workplace environment within APS's executive leadership.
The collection has been authorized by both the People & Culture Committee of the AGMG Board of Directors, chaired by Dame Cordelia Ashworth, and the Audit & Risk Committee of the AGMG Board, chaired by Raymond Okoro. Both committees have been briefed on the general scope of the investigation and have confirmed their authorization for the forensic collection described herein. Formal resolutions of both committees reflecting this authorization are on file with the AGMG Corporate Secretary.
It is noted that Elliot Vane, Chief Executive Officer of AGMG, has been recused from oversight of the investigation. Mr. Vane was recused due to his close working relationship with Marcus Hale and his involvement in certain executive personnel decisions that may be relevant to the investigation. Accordingly, no communications regarding the scope, methodology, progress, or results of the forensic collection — or of the investigation more broadly — should be directed to Mr. Vane. All inquiries from Mr. Vane or his office regarding the investigation should be referred to Bernard Crawford at Calderwood & Harkness.
B. Governing Legal Framework
The investigation is governed by the laws of the State of California, including, without limitation, the California Fair Employment and Housing Act ("FEHA"), Cal. Gov. Code §§ 12940 et seq., which prohibits sexual harassment, retaliation against individuals who oppose or report harassment, and the creation or tolerance of a hostile work environment. The investigation is also informed by the standards set forth in California Government Code § 12950.1 and applicable regulations of the California Civil Rights Department (formerly the Department of Fair Employment and Housing, or "DFEH"), as well as relevant provisions of Title VII of the Civil Rights Act of 1964, 42 U.S.C. §§ 2000e et seq.
The forensic collection must be conducted in a manner that is legally defensible and meets the evidentiary standards for potential use in administrative proceedings before the California Civil Rights Department, civil litigation in California state courts (including the Los Angeles County Superior Court), and civil litigation in the United States District Court for the Central District of California. The collection methodology must be sufficiently rigorous to withstand challenges to the completeness and integrity of the evidence gathered, and to support the admissibility of collected ESI in any such proceedings. To that end, Linden Forensics shall adhere to industry best practices for forensic collection, including those set forth in The Sedona Conference Principles Addressing Electronic Document Production and the Federal Judicial Center's Manual for Complex Litigation.
III. CUSTODIAN LIST
A. Identified Custodians (9 Total)
The following table sets forth the nine (9) identified custodians for the forensic collection. Each custodian is assigned a priority level that reflects the anticipated relevance of their data to the investigation and dictates the order of collection. Priority 1 custodians are the subject of the investigation and the primary complainants; Priority 2 custodians are key witnesses and internal stakeholders; and Priority 3 custodians are potential corroborating witnesses whose data will be collected to provide additional context and verification.
The following supplemental notes apply to individual custodians:
Custodian 1 — Marcus Hale. Mr. Hale was placed on paid administrative leave effective May 3, 2023, and his access to APS company email (Outlook/Exchange), Meridian Solutions, and all internal corporate systems was simultaneously suspended by APS IT at the direction of Victor Gallegos and the AGMG General Counsel. The forensic collection must capture all data in Mr. Hale's accounts and on his company-issued devices up to and including the date of suspension (May 3, 2023). Mr. Hale has retained personal counsel in connection with this matter: Graham Thornfield of Thornfield & Associates LLP, located at 10250 Constellation Boulevard, Suite 1950, Los Angeles, California 90067. The engagement of Mr. Thornfield has been noted, but as set forth in Section III.B below, the collection from Mr. Hale's company accounts and company-issued devices shall proceed without direct notification to Mr. Hale or his counsel, consistent with APS's ownership rights over its corporate systems and devices.
Custodian 2 — Jenna Morales. Ms. Morales is the primary complainant in this investigation. She has been employed by APS as Vice President of Development since March 2020. Ms. Morales is represented by outside counsel: Sandra Reeves of Nakamura Reeves LLP, located at 515 South Flower Street, Suite 3600, Los Angeles, California 90071. Ms. Morales's representation is noted for coordination purposes, particularly with respect to the potential collection of data from personal devices, as discussed in Section IV.C below.
Custodian 3 — Claire Ngo. Ms. Ngo is a complainant in this investigation. She has been employed by APS as Senior Director of Talent Relations since June 2021. Ms. Ngo does not have outside counsel at this time.
Custodian 4 — Darren Whitfield. Mr. Whitfield is a complainant alleging retaliation. He has been employed by APS as SVP of Physical Production since September 2017. The allegations of retaliation against Mr. Whitfield center on the reassignment of two major production projects — Project Meridian and Project Halcyon, with combined budgets of approximately $187 million — which were removed from Mr. Whitfield's oversight on February 6, 2023 at the direction of Marcus Hale and reassigned to Cameron Briggs (Custodian 6). Mr. Whitfield does not have outside counsel at this time.
Custodian 5 — Victor Gallegos. Mr. Gallegos, as VP of Human Resources, is the internal HR point of contact for the investigation. He received and escalated the initial hotline complaint. Mr. Gallegos's data is of particular relevance with respect to the handling of the initial complaint, the prior informal complaint by Serena Whitcomb in July 2021, the verbal counseling issued to Mr. Hale in August 2021, and the complaint intake and escalation process in April 2023.
Custodian 6 — Cameron Briggs. Mr. Briggs, as SVP of Production, received the reassigned Project Meridian and Project Halcyon from Mr. Whitfield on February 6, 2023 at Marcus Hale's direction. Mr. Briggs's communications are relevant to understanding the circumstances and rationale (or lack thereof) surrounding the reassignment, as well as any communications he may have had with Mr. Hale regarding the reassignment decision.
Custodians 7, 8, and 9 — SVP Witnesses 1, 2, and 3. The specific identities of these three custodians are set forth in the confidential custodian identification sheet attached as Exhibit A, which will be delivered separately via secure encrypted transmission. These individuals are among Marcus Hale's nine (9) direct-report Senior Vice Presidents at APS and have been identified as potential corroborating witnesses based on their positions within the organization, their participation in relevant meetings and events, and their proximity to the conduct at issue. Their data is being collected to provide additional evidentiary context and to corroborate or refute the accounts of the primary complainants and the subject of the investigation.
Note Regarding Serena Whitcomb. Serena Whitcomb, former Executive Assistant to Marcus Hale (employed by APS from approximately April 2019 through September 2021), who made a prior informal complaint regarding Mr. Hale's conduct in July 2021, is not included as a custodian for forensic collection. Ms. Whitcomb is a former employee whose company email account, Meridian Solutions access, and other corporate system credentials have been deactivated and whose company-issued devices were returned upon her departure. APS IT has confirmed that no recoverable data from Ms. Whitcomb's former accounts remains on active systems, and that her email archive was purged in accordance with APS's standard data retention policy approximately six (6) months after her departure. Ms. Whitcomb's personal communications and recollections will be sought through the witness interview process conducted by Calderwood & Harkness.
B. Custodian Contact and Coordination
All coordination regarding the forensic collection from current employee custodians shall be routed through Victor Gallegos, Vice President of Human Resources at APS, as the designated internal point of contact, and through Calderwood & Harkness LLP as directing counsel. Mr. Gallegos will facilitate scheduling, physical access to APS premises, coordination with APS IT staff, and the availability of company-issued devices for imaging.
No direct contact between Linden Forensics personnel and any custodian is authorized without prior written approval from Devon Archer or Bernard Crawford of Calderwood & Harkness. This restriction applies to all forms of communication, including in-person, telephone, email, and messaging. If a custodian approaches Linden Forensics personnel during on-site collection activities, the Linden Forensics technician should limit the interaction to a brief, professional acknowledgment, decline to discuss the nature or purpose of the collection, and promptly report the interaction to Devon Archer.
Collection from Marcus Hale's company-issued devices and company accounts shall proceed without direct notification to Mr. Hale or his personal counsel, Graham Thornfield of Thornfield & Associates LLP. This approach is appropriate and legally supportable because: (a) Mr. Hale's access to all company systems has been suspended as of May 3, 2023; (b) APS retains full ownership of all company-issued devices, equipment, email accounts, and data stored on corporate systems, as acknowledged by Mr. Hale in his employment agreement dated January 7, 2019 (Section 9.2, "Company Property and Information Systems"); (c) the APS Employee Handbook (Section 5.7, "Electronic Communications and Monitoring") provides that employees have no expectation of privacy in communications made on company systems; and (d) notification to Mr. Hale or his counsel of the specific timing and scope of the collection could risk spoliation of evidence on any personal devices or accounts not within APS's control. Calderwood & Harkness will address any communications with Mr. Thornfield regarding the investigation through separate counsel-to-counsel channels.
IV. DATA SOURCES
The following data sources have been identified for collection. Linden Forensics shall collect ESI from each of the sources described below for each identified custodian, unless otherwise specified.
A. Email. The primary source of ESI for collection is the Outlook / Exchange email accounts maintained by APS for all nine (9) custodians. APS's corporate email is hosted on APS corporate email servers managed by the APS IT department. The collection shall encompass the following components of each custodian's email account:
(i) Inbox (including all subfolders);
(ii) Sent Items;
(iii) Deleted Items (including any items recoverable from the "soft delete" or dumpster retention period);
(iv) Drafts;
(v) Archive folders;
(vi) Any personal folders (PST files) stored on network drives, local machines, or other accessible storage locations associated with the custodian; and
(vii) Journaled or archived copies of email maintained by the APS Exchange server, to the extent available and applicable.
APS IT department coordination for email collection shall be arranged through Victor Gallegos. Linden Forensics should expect to work with APS IT administrators to obtain administrative-level access to the Exchange environment for the purpose of executing targeted mailbox exports. If any custodian's email data has been migrated to a different server or archival system during the relevant date range, Linden Forensics shall ensure that data from all such systems is captured.
B. Instant Messaging — Meridian Solutions
APS maintains a corporate Meridian Solutions workspace that is used extensively by APS personnel for internal communications, including both formal and informal channels. The collection shall encompass the following:
(i) All public channels in which any of the nine (9) identified custodians is or was a member during the relevant date range;
(ii) All private channels in which any of the nine (9) identified custodians is or was a member during the relevant date range;
(iii) All direct messages (DMs) between any of the identified custodians and any other Meridian Solutions user during the relevant date range; and
(iv) All group direct messages (group DMs) in which any of the identified custodians participated during the relevant date range.
Meridian Solutions data shall be exported via the Meridian Solutions Enterprise Grid administrative export functionality, or an equivalent administrative export tool approved by C&H. The export should capture message content, timestamps, user identifiers, channel metadata, file attachments shared within messages, and any edited or deleted message content that is retained by the Meridian Solutions platform. Linden Forensics shall coordinate with APS IT to confirm the specific Meridian Solutions plan tier and export capabilities available.
C. Text Messages (SMS / Westmark Software)
Text messages on company-issued mobile devices shall be collected for all nine (9) identified custodians. APS issues company mobile devices (currently Ashbury Corporation devices on a Harborline Industries enterprise plan) to all employees at the SVP level and above, as well as to certain other personnel. The collection of text messages is of particular importance for the following custodians:
Marcus Hale: Text messages on Mr. Hale's company-issued mobile device are of heightened relevance to the investigation. The allegations include sexually suggestive text messages sent by Mr. Hale to Jenna Morales on the following specific dates: November 14, 2022; November 29, 2022; and December 8, 2022. Full forensic imaging of Mr. Hale's company-issued mobile device is required, including recovery of any deleted text messages, Ashbury Health IT, and associated metadata (including read receipts, delivery confirmations, and timestamps). Mr. Hale's company-issued mobile device was collected by APS IT on May 3, 2023, at the time of his placement on administrative leave, and is currently secured in APS IT's custody. Victor Gallegos will coordinate the transfer of the device to Linden Forensics for imaging.
Jenna Morales: Text messages on Ms. Morales's company-issued mobile device shall be collected, including both SMS and Ashbury Health IT. It is noted that Ms. Morales may also have relevant text messages — including messages from Mr. Hale — stored on a personal mobile device. The collection of data from Ms. Morales's personal device is not authorized under this protocol; it will be addressed separately in coordination with Ms. Morales and her counsel, Sandra Reeves of Nakamura Reeves LLP, through the witness cooperation and voluntary production process. Calderwood & Harkness will provide separate instructions to Linden Forensics if and when personal device collection for Ms. Morales is authorized.
For all other custodians, text messages on company-issued devices shall be collected to the extent they fall within the relevant date range and are accessible through forensic imaging or extraction tools.
D. Shared Network Drives and File Repositories
The collection shall include documents and files stored on shared network drives and file repositories accessible by the identified custodians. APS maintains departmental shared drives on its corporate network, and the following shared drive locations are specifically targeted for collection:
(i) Office of the President — shared drive or folder accessible to Marcus Hale and his direct support staff;
(ii) Development Department — shared drive or folder accessible to Jenna Morales and the Development team;
(iii) Talent Relations Department — shared drive or folder accessible to Claire Ngo and the Talent Relations team;
(iv) Physical Production Department — shared drive or folder accessible to Darren Whitfield and the Physical Production team;
(v) Human Resources Department — shared drive or folder accessible to Victor Gallegos and the HR team; and
(vi) Production Department — shared drive or folder accessible to Cameron Briggs and the Production team.
Within these shared drives, the collection shall focus on, but not be limited to, documents relating to the following categories:
• Personnel matters, including performance reviews, disciplinary records, and personnel action forms;
• Project assignments and reassignments, specifically including all documentation relating to Project Meridian and Project Halcyon, including project staffing memoranda, budget summaries, and communications regarding the February 6, 2023 reassignment;
• Meeting agendas, minutes, notes, and presentations for APS leadership meetings, with particular attention to the January 23, 2023 leadership meeting at which certain relevant events are alleged to have occurred;
• Event planning documentation for the APS leadership off-site held at the Monarch Valley Resort, Ojai, California on February 17–18, 2023, including invitation lists, attendee confirmations, room assignments, agendas, and post-event follow-up communications; and
• Any complaint or investigation-related files maintained outside of the HR department, if applicable.
E. Calendar Entries
Outlook calendar entries for all nine (9) identified custodians shall be collected for the full specified date range. Calendar data is relevant to corroborate meeting schedules, travel itineraries, event attendance, one-on-one meeting frequency between the subject and the complainants, and the presence or absence of individuals at key events, including the Monarch Valley Resort off-site and the January 23, 2023 leadership meeting. Calendar entries should be collected with all associated metadata, including organizer, attendees, location, recurrence information, and any notes or attachments embedded in calendar items.
F. Excluded Data Sources
The following data sources are specifically excluded from the forensic collection authorized under this protocol:
(i) Voicemail recordings. APS's telephony systems do not retain voicemail recordings beyond a rolling thirty (30) day period. As a result, no voicemail recordings from the relevant date range are expected to be available for collection. This exclusion has been noted in the litigation hold notice.
(ii) Physical / hard-copy documents. The collection of physical documents, including hard-copy personnel files, handwritten notes, printed memoranda, and other tangible materials, will be conducted separately by Calderwood & Harkness through Victor Gallegos and is not within the scope of Linden Forensics's engagement.
(iii) Ethics hotline data. Data from the Meridian Compliance Solutions LLC ethics hotline, including the intake report, case notes, and associated records for case reference number MCS-1014-00001, will be obtained separately by Calderwood & Harkness directly from Meridian Compliance Solutions and/or through Ingrid Holt, Chief Compliance Officer of AGMG. This data is excluded from Linden Forensics's collection scope.
V. DATE RANGE
Primary Date Range
The primary date range for the forensic collection is January 1, 2019 through May 3, 2023 (the date on which Marcus Hale's access to APS systems was suspended). This date range shall apply to all nine (9) identified custodians, subject to the adjustments noted below.
The rationale for this date range is as follows: January 1, 2019 corresponds to the period immediately preceding Marcus Hale's commencement of employment as President of APS. Mr. Hale's employment agreement with APS is dated January 7, 2019, and he assumed his duties as President on or about that date. Capturing data from January 1, 2019 forward ensures that the full period of Mr. Hale's tenure at APS is covered, including:
• The onboarding period and early tenure of Mr. Hale (January 2019 forward);
• The period of Serena Whitcomb's employment as Executive Assistant to Mr. Hale (approximately April 2019 through September 2021), including the period of her informal complaint in July 2021;
• The verbal counseling issued to Mr. Hale by Victor Gallegos on August 2, 2021, and any related follow-up;
• The period of the alleged sexually harassing conduct toward Jenna Morales (approximately September 2022 through at least December 2022);
• The alleged retaliatory reassignment of Darren Whitfield's projects on February 6, 2023;
• The Monarch Valley Resort off-site event on February 17–18, 2023;
• The formal hotline complaint and subsequent escalation in April 2023; and
• All events through the date of Mr. Hale's system access suspension on May 3, 2023.
Extended Date Range — Victor Gallegos
For Victor Gallegos (Custodian 5) only, the collection date range is July 1, 2021 through May 3, 2023. The extended backward reach to July 1, 2021 is intended to ensure comprehensive capture of Mr. Gallegos's communications during two critical periods:
(a) July–August 2021: The period during which Serena Whitcomb made her informal complaint regarding Marcus Hale's conduct, and during which Mr. Gallegos conducted the initial inquiry and issued verbal counseling to Mr. Hale on August 2, 2021. Communications during this period will shed light on the nature of the prior complaint, the company's response, any documentation of the verbal counseling, and any follow-up actions taken (or not taken).
(b) April 18–28, 2023: The period during which the formal hotline complaint was received, processed, and escalated by Mr. Gallegos to the AGMG General Counsel and, ultimately, to the AGMG Board committees. Communications during this period will document the complaint intake process, internal deliberations regarding the appropriate response, and the decision to retain outside counsel.
Because Mr. Gallegos's collection date range (commencing July 1, 2021) is narrower than the primary date range (commencing January 1, 2019), no adjustment to the primary date range is needed for Mr. Gallegos. However, if during the review process it becomes apparent that earlier data from Mr. Gallegos is relevant (e.g., communications predating the Whitcomb complaint), C&H reserves the right to expand the collection accordingly.
Custodians Hired After January 1, 2019
For custodians who commenced employment at APS after January 1, 2019, the collection shall begin from their respective dates of hire, as follows:
• Jenna Morales: Collection to begin from her date of hire in March 2020.
• Claire Ngo: Collection to begin from her date of hire in June 2021.
For all other custodians who were employed at APS on or before January 1, 2019 (including Marcus Hale, Darren Whitfield, Victor Gallegos, Cameron Briggs, and SVP Witnesses 1–3), the collection shall commence from January 1, 2019 unless otherwise specified herein.
VI. SEARCH-TERM PARAMETERS
The following search terms and parameters shall be applied to the collected ESI to identify documents and communications potentially responsive to the investigation. These terms are organized by category and are intended to be applied in combination using Boolean logic, as described in Section VI.F below.
A. Name and Entity Terms
The following name and entity terms shall be included in the search-term library:
• Marcus Hale / Hale / "M. Hale" / MH
• Jenna Morales / Morales / "J. Morales" / JM
• Claire Ngo / Ngo / "C. Ngo"
• Darren Whitfield / Whitfield / "D. Whitfield"
• Cameron Briggs / Briggs / "C. Briggs"
• Victor Gallegos / Gallegos / "V. Gallegos"
• Serena Whitcomb / Whitcomb / "S. Whitcomb"
Initials-based search terms (e.g., "MH," "JM") shall be applied with appropriate proximity and contextual limiters to avoid excessive false-positive results. Linden Forensics shall propose appropriate proximity parameters for these short-form terms in its initial hit report.
B. Project and Event Terms
The following terms relate to specific projects, events, and locations referenced in the allegations:
• "Project Meridian" / Meridian (in context of production projects, to be distinguished from "Meridian Compliance Solutions" through contextual review)
• "Project Halcyon" / Halcyon
• "Monarch Valley" / "Ojai" / "off-site" / "retreat"
• "Vancouver" / "production trip"
Note that the term "Meridian" may generate hits relating to Meridian Compliance Solutions LLC, the third-party ethics hotline provider. During the review process, C&H will address this overlap through relevance coding. For purposes of the initial search and hit report, both contexts should be captured.
C. Subject-Matter Terms
The following terms relate to the substantive subject matter of the allegations:
• Harassment / harass / "sexual harassment"
• Inappropriate / unwanted / advance / advances
• Retaliation / retaliate / retaliatory
• Complaint / complain / grievance / hotline
• Ethics / compliance / "ethics hotline"
• Reassign / reassignment / transfer / "taken off" / removed
• Discrimination / hostile / "hostile work environment"
• Counsel / counseling / warning / discipline / disciplinary
• "Human resources" / HR / "personnel file"
D. Contextual / Behavioral Terms
The following terms are designed to capture communications reflecting the specific types of conduct alleged in the complaints:
• Hotel / room / invitation / invite / drink / drinks / dinner
• Appearance / attractive / "looking good" / outfit / attire / dress
• "seeing anyone" / dating / personal / relationship
• Touch / touched / hand / back / thigh / physical
These contextual and behavioral terms are expected to generate a higher volume of false positives than the name and subject-matter terms. They will be applied in combination with custodian-specific or name-based terms to narrow the result set, as described in Section VI.F below.
E. Policy and Procedural Terms
The following terms relate to company policies and procedures relevant to the investigation:
• "Code of Conduct" / "employee handbook" / "anti-harassment" / "anti-retaliation"
• Section 5.3 / Section 5.7 / Section 8.1 / "Section 12"
• "performance review" / "performance-related"
The section number references correspond to specific provisions of the APS Employee Handbook and Code of Conduct that address, respectively, workplace conduct standards (Section 5.3), electronic communications and monitoring (Section 5.7), anti-harassment and anti-discrimination policies (Section 8.1), and the complaint and investigation procedure (Section 12).
F. Application of Search Terms
Search terms shall be applied as Boolean queries using appropriate connectors, including AND, OR, and proximity operators (e.g., w/5, w/10, w/25), to balance comprehensiveness with precision. The following general principles shall govern the application of search terms:
(i) Terms within each category (Sections VI.A through VI.E) shall generally be connected by the OR operator to capture any document containing at least one of the terms in the category.
(ii) Terms across categories shall be combined using the AND operator or proximity operators where appropriate to narrow the result set. For example, a contextual/behavioral term (e.g., "hotel" or "drinks") should be combined with a name term (e.g., "Hale" AND "Morales") to identify communications of investigative relevance.
(iii) Search terms shall be applied to the full text of documents and communications, including email bodies, email subject lines, the extracted text of attachments (including PDF, Word, Excel, and Northgate Services Inc. files), and relevant metadata fields (including "To," "From," "CC," and "BCC" fields for emails).
(iv) Linden Forensics shall generate and deliver to Calderwood & Harkness a comprehensive hit report prior to the delivery of data to the review platform. The hit report shall show the number of documents responsive to each individual search term, as well as the number of documents responsive to specified term combinations. The hit report shall be organized by custodian to allow C&H to assess the distribution of responsive documents across the custodian population.
(v) Calderwood & Harkness reserves the right to modify, expand, or narrow the search terms based on the results of the initial hit-report analysis. Additional iterative rounds of search-term testing may be conducted as warranted by the evolving understanding of the factual record.
VII. COLLECTION METHODOLOGY AND TECHNICAL REQUIREMENTS
A. Forensic Imaging
All collections shall be performed using forensically sound methods that preserve the integrity, authenticity, and metadata of the collected ESI. The following specific requirements apply:
(i) Write-blocking for physical devices. All forensic imaging of physical devices (including mobile devices, laptops, and any external storage media) shall be performed using hardware or software write-blockers to prevent any alteration to the original data during the imaging process.
(ii) Verified export tools for cloud-based data. For cloud-based data sources, including Cobalt Ridge Data Systems (if applicable), Meridian Solutions, and any cloud-hosted file repositories, Linden Forensics shall use verified, industry-accepted export tools that preserve data integrity and generate verifiable export logs.
(iii) Mobile device imaging. Company-issued mobile devices for all nine (9) identified custodians shall be forensically imaged. Imaging of the mobile devices for Marcus Hale and Jenna Morales is of particular priority given the specific allegations regarding text message communications. Full physical or file-system-level extraction shall be performed where device and operating system conditions permit, to maximize the recovery of deleted content.
(iv) Hash verification. Hash values using both MD5 and SHA-1 algorithms shall be generated for all collected items — including forensic images, individual files, and exported data sets — to ensure data integrity and enable subsequent verification. Hash values shall be recorded in the chain of custody log and included in the metadata delivered to the review platform.
B. Processing and De-Duplication
Following collection, the ESI shall be processed using industry-standard e-discovery processing tools (such as Severin Software, Brightmoor Health IT, or equivalent platforms approved by C&H) in accordance with the following parameters:
(i) De-duplication. De-duplication shall be performed at the global (cross-custodian) level using MD5 hash values. Global de-duplication removes exact duplicate copies of documents that exist across multiple custodians' data sets, reducing the overall review volume. Custodian-level tracking shall be maintained so that the review team can identify all custodians who possessed a given document, even where the duplicate copy has been suppressed from the review set.
(ii) Estimated collection volume. Based on preliminary estimates provided by APS IT regarding mailbox sizes, Meridian Solutions data volumes, shared drive sizes, and mobile device storage, the anticipated total collection volume is approximately 847,000 documents and communications prior to processing.
(iii) Estimated post-processing volume. Following processing and global de-duplication, the estimated volume is approximately 214,000 unique items.
(iv) Estimated post-filtering volume. Following the application of the search-term parameters and date-range filtering described in Sections V and VI of this memorandum, the estimated volume of documents to be delivered to the review platform for attorney review is approximately 38,600 items. This estimate is preliminary and subject to revision based on the actual hit report results.
These volume estimates are based on preliminary data provided by APS IT and Linden Forensics's experience with comparable corporate environments. Actual volumes may vary. Linden Forensics shall promptly notify C&H if actual collection volumes materially exceed these estimates, so that the parties may discuss any necessary adjustments to the processing and review approach.
C. Data Delivery
Processed and filtered data shall be loaded into the document review platform specified by Calderwood & Harkness. C&H will provide Linden Forensics with the specific platform details, workspace credentials, and load-file specifications in advance of the data delivery. The following requirements apply to data delivery:
(i) Data shall be delivered in a load-file format compatible with the designated review platform, including native files, extracted text files, and a comprehensive metadata load file. The metadata load file shall include, at a minimum, the following fields: custodian, document type, date sent/created/modified, author/sender, recipients (To, CC, BCC), subject line, file name, file path, file size, MD5 hash, SHA-1 hash, and family relationship indicators (parent/child for email attachments).
(ii) Email families (i.e., parent email messages and their associated attachments) shall be kept intact and loaded as family groups. Attachments shall not be separated from their parent emails.
(iii) All data transfers between Linden Forensics and C&H (including transfers to the review platform) shall be conducted via secure, encrypted channels using AES-256 encryption or equivalent. Acceptable transfer methods include SFTP, secure cloud-based transfer portals, and encrypted hard drives shipped via bonded courier.
(iv) No data shall be transmitted via unencrypted email, unencrypted removable media (such as unencrypted USB drives), or any other unsecured transmission method without prior written authorization from Calderwood & Harkness. Any request for an exception to this requirement must be approved in writing by Devon Archer or Bernard Crawford.
D. Chain of Custody
Linden Forensics shall maintain a detailed and continuous chain of custody log for all collections performed under this protocol. The chain of custody log shall document, at a minimum, the following information for each collection event:
(i) Custodian name and employee identifier;
(ii) Device or data source identifier (e.g., device serial number, mailbox name, Meridian Solutions workspace identifier, shared drive path);
(iii) Date and time of collection (start and end);
(iv) Name of the Linden Forensics technician performing the collection;
(v) Collection method used (e.g., forensic imaging tool and version, export utility and version);
(vi) Hash verification results (MD5 and SHA-1) for the collected data;
(vii) Storage location of the collected data following collection;
(viii) Transfer records documenting each subsequent movement or copy of the collected data, including the date, time, transferring party, receiving party, and method of transfer; and
(ix) Any anomalies, errors, or exceptions encountered during the collection process, along with a description of any remedial actions taken.
A formal chain of custody certification shall be provided to Calderwood & Harkness upon completion of the collection process. The anticipated completion date for the collection, based on the schedule set forth in Section VIII below, is on or about May 12, 2023, following the scheduled collection window of May 10–12, 2023. The chain of custody certification shall be signed by the Linden Forensics engagement manager and shall certify that all collections were performed in accordance with this protocol and in conformity with forensic best practices.
VIII. COLLECTION SCHEDULE
The forensic collection shall be conducted over a three (3) day period according to the following schedule:
May 10, 2023 (Day 1): On-site collection at APS headquarters, 3200 West Alameda Avenue, Suite 400, Burbank, California 91505. Day 1 activities shall include:
• Initial coordination meeting with APS IT personnel (facilitated by Victor Gallegos);
• Commencement of email server exports for all Priority 1 and Priority 2 custodians (Custodians 1–6);
• Initiation of Meridian Solutions workspace data export;
• Commencement of shared drive data collection for targeted departmental folders;
• Commencement of mobile device forensic imaging for Priority 1 custodians (Marcus Hale, Jenna Morales, Claire Ngo, and Darren Whitfield) and Priority 2 custodians (Victor Gallegos and Cameron Briggs).
May 11, 2023 (Day 2): Continuation of on-site collection activities. Day 2 activities shall include:
• Completion of email server exports for Priority 1 and Priority 2 custodians;
• Commencement of email server exports for Priority 3 custodians (Custodians 7–9);
• Completion of mobile device forensic imaging for all Priority 1 and Priority 2 custodians;
• Commencement of mobile device forensic imaging for Priority 3 custodians;