1017-00005 · Aurelius Global Media Group · Document Collection & Forensics

linden-forensics-engagement-letter.docx DOCUMENT Funds

23 / 38 ← → ✕

Contract analysis Extract to table

PRIVILEGED AND CONFIDENTIAL

CALDERWOOD & HARKNESS LLP Attorneys at Law

780 Seventh Avenue, 34th Floor New York, NY 10019

1999 Avenue of the Stars, Suite 2800 Los Angeles, CA 90067

Telephone: (310) 556-8000 Facsimile: (310) 556-8001 www.calderwoodharkness.com

May 8, 2023

Via Email and Sundial Data Systems

Linden Forensics Group Inc.

Attention: Engagement Manager

201 Mission Street, Suite 1400 San Francisco, CA 94105

Re: Engagement of Linden Forensics Group Inc. for Forensic Collection and Processing Services C&H Matter No.: 1017-00005 Client: Aurelius Global Media Group PLC / Aurelius Pacific Studios Inc.

Dear Engagement Manager:

1. Introduction and Purpose of Engagement

Calderwood & Harkness LLP ("C&H" or the "Firm"), a limited liability partnership organized under the laws of the State of New York, with principal offices at 780 Seventh Avenue, 34th Floor, New York, NY 10019 and 1999 Avenue of the Stars, Suite 2800, Los Angeles, CA 90067, writes to formally retain Linden Forensics Group Inc. ("Linden Forensics" or "Consultant") to perform forensic data collection, processing, and related services in connection with a privileged and confidential independent workplace investigation, as more fully described herein.

C&H has been retained by the Board of Directors of Aurelius Global Media Group PLC ("AGMG"), a public limited company incorporated in England and Wales (Company No. 08456213) with its registered office at 45 Aldwych House, Kingsway, London WC2B 6AH, United Kingdom, and whose shares are admitted to trading on the AIM market of the London Stock Exchange. AGMG is a diversified global media and entertainment conglomerate with operations across film and television production, digital content, music publishing, and live events.

The investigation to which this engagement relates concerns allegations of serious workplace misconduct involving a senior executive of Aurelius Pacific Studios Inc. ("APS"), a Delaware corporation and wholly owned subsidiary of AGMG, headquartered at 3200 West Alameda Avenue, Suite 400, Burbank, CA 91505. APS operates as AGMG's principal North American film and television production arm.

C&H was formally engaged by the AGMG Board on May 2, 2023, to conduct this investigation. The investigation is being conducted at the direction and under the supervision of both the People & Culture Committee of the AGMG Board of Directors, chaired by Dame Cordelia Ashworth, and the Audit & Risk Committee of the AGMG Board of Directors, chaired by Raymond Okoro. The investigation is proceeding on a privileged and confidential basis, and the preservation of attorney-client privilege and work-product protection is of paramount importance to the client and to C&H.

The primary C&H contacts for this engagement are Bernard Crawford, Responsible Partner, and Devon Archer, Lead Associate, both of whom are members of the Firm's Labor & Employment Practice Group and are based in the Firm's Los Angeles office. All communications from Linden Forensics regarding this engagement should be directed to Mr. Crawford and Ms. Archer unless otherwise instructed.

This letter (the "Engagement Letter") sets forth the terms and conditions upon which Linden Forensics is being retained by C&H to perform the services described herein. By executing this Engagement Letter in the space provided below, Linden Forensics agrees to be bound by the terms and conditions set forth herein.

2. Engagement as Agent of Counsel — Privilege Framework

Linden Forensics is being retained as a consulting expert and agent of counsel, acting at the direction and under the supervision of C&H, for the sole and express purpose of assisting C&H in the provision of legal services to AGMG in connection with the investigation described in Section 1 above. Linden Forensics is not being retained by AGMG or APS directly; rather, Linden Forensics' engagement flows through and is controlled by C&H as outside counsel to the client.

All work performed by Linden Forensics under this engagement is intended to be protected by the attorney-client privilege, the work-product doctrine, and any other applicable protections under federal and state law. The parties intend that the forensic collection, processing, analysis, and all related communications, reports, certifications, memoranda, and deliverables produced by Linden Forensics in connection with this engagement constitute attorney work product prepared in anticipation of litigation or in connection with the provision of legal advice, or both.

Linden Forensics acknowledges and agrees that the attorney-client privilege, the work-product protection, and any other applicable evidentiary or testimonial privileges belong exclusively to AGMG (the client) and that only AGMG, through its duly authorized representatives (including authorized officers, the Board of Directors, or the relevant Board committees), may waive such protections. Neither C&H nor Linden Forensics has independent authority to waive any privilege belonging to the client.

All communications between C&H and Linden Forensics relating to this engagement, including without limitation emails, telephone calls, memoranda, status updates, draft and final reports, and any other oral or written communications, shall be treated as privileged and confidential. Linden Forensics shall take all reasonable steps to preserve the privileged and confidential nature of such communications.

Linden Forensics shall not disclose any information, documents, data, communications, findings, analyses, or work product arising from or related to this engagement to any third party, including but not limited to AGMG, APS, their respective employees, officers, or directors, or any governmental or regulatory authority, without the prior written consent of C&H. All interactions between Linden Forensics and any employee, officer, or agent of AGMG or APS shall be coordinated through and approved by C&H in advance.

Linden Forensics shall prominently mark all reports, certifications, memoranda, deliverables, and other written materials prepared in connection with this engagement with the following legend:

"PRIVILEGED AND CONFIDENTIAL — PREPARED AT THE DIRECTION OF COUNSEL"

This legend shall appear on the first page and, where practicable, on each subsequent page of such materials. Electronic files shall include this legend in the document header, footer, or cover page, as appropriate.

3. Scope of Services

3.1 Forensic Collection

Linden Forensics shall perform forensic collection of electronically stored information ("ESI") from identified custodians at APS, as directed by C&H. The categories of ESI to be collected include, but are not limited to, the following:

(a) Email: Messages, attachments, calendar items, and contacts maintained on the Strathmore Data Systems / Outlook email platform administered by APS, including both server-side mailboxes and locally stored .PST or .OST files, as applicable.

(b) Meridian Solutions Workplace Messaging Platform Communications: All direct messages, group messages, channel messages, and shared files on the Meridian Solutions workspace(s) used by APS, including any archived or deleted messages recoverable through the Meridian Solutions Enterprise Grid administrative console or equivalent data export functionality.

(c) Text Messages (SMS and Westmark Software): Text message communications, including SMS, MMS, and Tidewater Industries Ashbury Health IT, residing on company-issued mobile devices assigned to the identified custodians, to the extent such devices are available and accessible.

(d) Shared Network Drives and Cloud-Based Document Repositories: Documents and files stored on APS shared network drives (including mapped drives and NAS storage), as well as cloud-based document repositories including, without limitation, Sundial Systems, Larkspur Health IT, Hollowell Health IT, and any other cloud storage platforms used by APS, as identified by C&H and the APS Information Technology department.

All collections shall be performed in a forensically sound and defensible manner, consistent with industry best practices, the Sedona Conference principles for electronic discovery, and applicable legal standards, including but not limited to the Federal Rules of Civil Procedure (to the extent applicable) and the standards established by the International Society of Forensic Computer Examiners (ISFCE) and the Scientific Working Group on Digital Evidence (SWGDE).

Linden Forensics shall use write-blocking technology to prevent any alteration of source data during the collection process. All forensic imaging shall be performed using verified forensic imaging tools (such as Stonefield Software, Calderon Technologies, or equivalent tools of comparable reliability and industry acceptance).

All collected data shall be hash-verified using both MD5 and SHA-1 hash algorithms at the time of collection to ensure and document the integrity of the collected data. Hash values shall be recorded in the chain of custody log described in Section 6 below.

3.2 Custodians. The initial custodian list consists of nine (9) individuals whose identities are specified in the Forensic Collection Protocol & Custodian List Memorandum (the "Collection Protocol"), which shall be provided by C&H to Linden Forensics contemporaneously with this Engagement Letter or promptly following its execution. The Collection Protocol, when delivered, shall be deemed incorporated into and made a part of this Engagement Letter for all purposes.

C&H reserves the right to add or remove custodians from the custodian list during the course of the engagement upon written notice (including email) to Linden Forensics. Any addition of custodians or expansion of collection scope that would materially increase the estimated fees set forth in Section 5 below shall be subject to the revised estimate procedures described therein.

The identity of the custodians is privileged and confidential information and shall not be disclosed by Linden Forensics to any party other than C&H. Linden Forensics shall take all reasonable precautions to protect the identity of the custodians from disclosure.

3.3 Date Range

The date range for collection of ESI shall be as specified in the Collection Protocol provided by C&H. The date range may vary by custodian and by data source, as directed by C&H in the Collection Protocol.

C&H may adjust the date range for one or more custodians or data sources upon written notice (including email) to Linden Forensics at any time during the course of the engagement. Any expansion of the date range that would materially increase the estimated fees set forth in Section 5 below shall be subject to the revised estimate procedures described therein.

3.4 Processing and De-Duplication

Following the completion of forensic collection, Linden Forensics shall process all collected data to prepare it for attorney review. Processing shall include, without limitation, the following:

(a) De-Duplication: Linden Forensics shall perform both global de-duplication (across all custodians) and custodian-level de-duplication to eliminate exact duplicate documents from the data set, using MD5 or SHA-1 hash values as the basis for de-duplication. Linden Forensics shall maintain records of the de-duplication process, including the number of documents removed and the basis for removal.

(b) De-NISTing: Linden Forensics shall remove known system files, application files, and other non-user-generated files from the data set by reference to the National Institute of Standards and Technology (NIST) National Software Reference Library (NSRL) hash set, or an equivalent and current reference database.

(c) Extraction and Indexing of Metadata: Linden Forensics shall extract and index all available metadata fields for the collected documents, including but not limited to author, date created, date modified, date sent, date received, sender, recipient(s), subject line, file path, file type, file size, and custodian.

(d) Rendering: Linden Forensics shall render all processed files into a format suitable for attorney review on a document review platform, including the generation of text-searchable versions (using optical character recognition where necessary), image renderings (TIFF or PDF, as directed by C&H), and native file production where appropriate.

In addition to the foregoing, Linden Forensics shall apply search terms and date-range filters as directed by C&H to reduce the data set for attorney review. C&H will provide the search term list and filtering parameters to Linden Forensics following the completion of processing. Linden Forensics shall provide C&H with hit reports and volume estimates to facilitate iterative refinement of the search term list.

3.5 Data Transfer and Hosting

Upon completion of processing, the processed data shall be transferred securely to the document review platform designated by C&H. C&H will provide Linden Forensics with the identity and technical specifications of the designated review platform, including any required data formatting, load file specifications, and upload protocols.

All data transfers between Linden Forensics and the review platform (and between Linden Forensics and C&H) shall be conducted using encrypted channels employing AES-256 encryption or an equivalent or superior encryption standard. Data shall not be transferred via unencrypted email, unencrypted FTP, or removable media that is not encrypted.

Linden Forensics shall coordinate directly with C&H's review team, specifically Devon Archer (Lead Associate) and Nadia Petrov (Senior Document Review Attorney), regarding platform specifications, load file formatting, upload procedures, quality control protocols, and any issues that arise during the data transfer process. All such coordination shall be treated as privileged and confidential consistent with Section 2 above.

4. Timeline

Linden Forensics shall commence on-site forensic collection at the offices of Aurelius Pacific Studios Inc., located at 3200 West Alameda Avenue, Suite 400, Burbank, CA 91505, no later than May 10, 2023. C&H will coordinate with APS's Information Technology department to ensure that Linden Forensics personnel have the necessary physical access, network credentials, and administrative permissions to perform the collection efficiently.

Collection from all nine (9) initial custodians across the identified data sources is expected to be completed within approximately three (3) business days, with an estimated completion date of May 12, 2023. Linden Forensics shall use commercially reasonable efforts to adhere to this timeline.

Processing, de-duplication, de-NISTing, and initial data transfer to the designated review platform shall be completed within five (5) business days following the completion of collection, with an estimated completion date of May 19, 2023. Linden Forensics shall provide C&H with regular status updates during the processing phase, including updates on data volumes, processing progress, and any issues or anomalies encountered.

C&H acknowledges that the foregoing timeline is an estimate and is subject to adjustment based on a number of factors, including but not limited to: the volume of data collected; the availability and cooperation of custodians; access to and performance of APS's IT systems; the complexity of the data sources; and any unforeseen technical issues. Linden Forensics shall promptly notify C&H of any circumstances that may cause material delay and shall work cooperatively with C&H to develop an adjusted timeline.

5. Estimated Fees and Expenses

5.1 Fee Estimate

The total estimated fees for the services described in this Engagement Letter are One Hundred Eighty-Nine Thousand Four Hundred Dollars ($189,400). This estimate is provided in good faith and is based on the scope of services described herein, including forensic collection from nine (9) custodians across the data sources identified in Section 3.1, processing, de-duplication, de-NISTing, metadata extraction and indexing, rendering, search-term and date-range filtering, and data transfer to the designated review platform.

The fee estimate encompasses the following categories of work:

(a) On-site forensic collection, including personnel costs, travel to and from the APS offices in Burbank, California, and use of forensic collection equipment and software;

(b) Processing and de-duplication, including data ingestion, global and custodian-level de-duplication, de-NISTing, metadata extraction and indexing, and rendering of documents into reviewable format;

(c) Search-term and date-range filtering, including application of C&H-directed search terms and date-range filters, generation of hit reports, and iterative refinement as directed;

(d) Data transfer to the C&H-designated review platform, including formatting, quality control, and coordination with C&H's review team; and

(e) Project management and coordination with C&H, including regular status reporting, issue resolution, and engagement administration.

If the scope of services materially changes during the course of the engagement — including, by way of example and not limitation, the addition of custodians beyond the initial nine, the expansion of data sources to include platforms or repositories not identified in Section 3.1, the expansion of date ranges, or the need for re-processing of previously collected data — Linden Forensics shall promptly provide C&H with a revised estimate reflecting the anticipated additional fees. Linden Forensics shall not incur fees materially in excess of the estimate set forth above, or in excess of any subsequently approved revised estimate, without the prior written approval of C&H.

5.2 Billing and Payment

Linden Forensics shall submit monthly invoices to C&H for services rendered during the preceding calendar month. Each invoice shall include reasonable detail regarding the work performed, including a description of the services provided, the dates on which services were performed, the personnel who performed the services (by role), and, where applicable, the data volumes processed.

All invoices shall prominently reference C&H Matter No. 1017-00005 and shall be marked "Privileged and Confidential."

Payment terms are net thirty (30) days from C&H's receipt of a properly submitted invoice. C&H shall have the right to review and, in good faith, dispute any charges that are not consistent with the terms of this Engagement Letter or any approved revised estimate, and any such dispute shall be resolved promptly through good-faith discussion between the parties.

All invoices shall be directed to:

Devon Archer Calderwood & Harkness LLP 1999 Avenue of the Stars, Suite 2800 Los Angeles, CA 90067

Email: darcher@calderwoodharkness.com

5.3 Expenses. Reasonable out-of-pocket expenses incurred by Linden Forensics in connection with this engagement, including but not limited to travel expenses (airfare, ground transportation, lodging, and meals), shipping and courier costs, and specialized equipment rental, shall be billed at cost. Such expenses are included within the $189,400 total estimate set forth in Section 5.1 above unless otherwise agreed in writing by C&H. Linden Forensics shall exercise reasonable economy in incurring expenses and shall comply with any expense guidelines communicated by C&H.

6. Chain of Custody Requirements

Linden Forensics shall maintain a detailed, contemporaneous chain of custody log for all data collected, processed, stored, transferred, or otherwise handled under this engagement. The chain of custody log is a critical component of the defensibility of the forensic collection process and shall be maintained with the degree of care and precision consistent with best practices in the digital forensics industry.

The chain of custody log shall document, at a minimum, the following information for each item of collected data:

(a) The identity of the custodian from whom the data was collected and the specific data source (e.g., email mailbox, Meridian Solutions account, mobile device, network drive location);

(b) The date, time (including time zone), and physical location of the collection;

(c) The identity of the Linden Forensics personnel who performed the collection, including the name, title, and relevant certifications (e.g., EnCE, CFCE, ACE) of each individual;

(d) A detailed description of the collection methodology and the specific forensic tools and software used (including version numbers);

(e) Hash values (both MD5 and SHA-1) for all forensic images, containers, and collected data sets, generated at the time of collection and verified upon transfer;

(f) A complete record of any transfers, copies, movements, or other handling of the data following initial collection, including the date, time, source, destination, method of transfer, and identity of the personnel involved;

(g) The identity of any Linden Forensics or other personnel who accessed the data at any point during the engagement, including the date, time, and purpose of such access; and

(h) Any anomalies, errors, deviations from the Collection Protocol, or other issues encountered during the collection process, together with a description of the steps taken to address such issues.

Upon completion of forensic collection from all custodians, Linden Forensics shall provide C&H with a Chain of Custody Certification, signed by the Linden Forensics project lead, certifying the integrity of the collection process and the authenticity of the collected data. The Chain of Custody Certification shall include a summary of the collection activities, the total data volumes collected (in gigabytes), the hash values for all forensic images, and a representation that the collection was performed in a forensically sound and defensible manner consistent with industry best practices.

All collected data shall be stored in a secure, access-controlled environment at all times, both physically (e.g., locked server rooms with restricted badge access) and electronically (e.g., encrypted storage, role-based access controls, audit logging). Access to collected data shall be limited to Linden Forensics personnel who are directly involved in performing the services under this engagement and who have been approved by C&H.

7. Confidentiality and Non-Disclosure

Linden Forensics acknowledges that all information received or generated in connection with this engagement is strictly confidential and privileged, and that the unauthorized disclosure of such information could cause irreparable harm to AGMG, APS, C&H, and the individuals involved in the investigation.

Linden Forensics shall not disclose any information about the existence or nature of this engagement, the identity of the client (AGMG or APS), the subject matter or findings of the investigation, the identity of the custodians or any other individuals, or any data, documents, communications, reports, analyses, or work product to any person or entity, whether inside or outside of Linden Forensics, without the prior written consent of C&H. This obligation extends to all forms of disclosure, whether oral, written, electronic, or otherwise, and includes disclosure in marketing materials, case studies, client references, conference presentations, publications, or social media.

Linden Forensics shall limit internal access to engagement materials to those Linden Forensics personnel who are directly involved in performing the services described in this Engagement Letter and who have a genuine need to know the information in order to perform their assigned tasks. Linden Forensics shall not share engagement materials with personnel who are not assigned to this engagement.

Linden Forensics shall ensure that all personnel assigned to this engagement have executed written confidentiality and non-disclosure agreements that are consistent with the obligations set forth in this Section 7 prior to such personnel being given access to any engagement materials. Linden Forensics shall provide copies of such executed agreements to C&H upon request.

In the event that Linden Forensics receives a subpoena, court order, discovery request, regulatory demand, or any other form of legal compulsion that seeks or requires the disclosure of information related to this engagement, Linden Forensics shall promptly notify C&H — specifically, Bernard Crawford and Devon Archer — before making any disclosure, to the fullest extent permitted by applicable law. Linden Forensics shall cooperate with C&H in seeking protective relief or other appropriate measures to resist or limit such disclosure. Linden Forensics shall not produce any documents or information in response to any such compulsory process without affording C&H a reasonable opportunity to assert applicable privileges and protections on behalf of the client.

The obligations set forth in this Section 7 shall survive the termination or expiration of this engagement.

8. Data Security

Linden Forensics shall implement and maintain industry-standard information security measures to protect all data collected, processed, stored, and transmitted in connection with this engagement. Given the sensitive and privileged nature of the data involved, Linden Forensics shall treat all engagement data as highly confidential and shall apply security controls commensurate with the sensitivity of the data.

At a minimum, Linden Forensics shall maintain the following security measures throughout the duration of the engagement and for as long as Linden Forensics retains any engagement data:

(a) Encryption: AES-256 encryption (or equivalent or superior encryption) for all engagement data at rest (on servers, storage media, and backup systems) and in transit (during electronic transfers, uploads, and downloads);

(b) Multi-Factor Authentication: Multi-factor authentication (MFA) shall be required for all personnel accessing engagement data, whether remotely or on-site;

(c) Access Logging and Audit Trails: Comprehensive access logging and audit trails shall be maintained for all systems and storage environments containing engagement data, recording the identity of each user, the date and time of access, and the nature of the activity performed;

(d) Physical Security: Servers, storage media, and other hardware containing engagement data shall be maintained in physically secure facilities with restricted access controls, including badge access, surveillance, and environmental controls (fire suppression, climate control);

(e) Regular Vulnerability Assessments: Linden Forensics shall conduct regular vulnerability assessments and penetration testing of the systems and networks used to store and process engagement data, and shall promptly remediate any identified vulnerabilities; and

(f) Endpoint Security: All workstations, laptops, and mobile devices used by Linden Forensics personnel in connection with this engagement shall be equipped with current antivirus, anti-malware, and endpoint detection and response software, and shall be subject to full-disk encryption.

Linden Forensics shall promptly notify C&H — within twenty-four (24) hours or as soon as reasonably practicable — of any actual or suspected data breach, security incident, unauthorized access, or unauthorized disclosure involving engagement data. Such notification shall include a description of the incident, the data potentially affected, the steps taken to contain and remediate the incident, and any recommended corrective actions. Linden Forensics shall cooperate fully with C&H in investigating and responding to any such incident.

9. Data Retention and Return/Destruction

Upon the completion of all services under this engagement and receipt of final written instruction from C&H, Linden Forensics shall, at C&H's sole direction, either: (a) return all collected data, forensic images, processed data, work product, reports, certifications, chain of custody logs, and all other engagement materials to C&H in a format and by a method specified by C&H; or (b) securely destroy all such materials using methods consistent with NIST Special Publication 800-88 (Guidelines for Media Sanitization) or equivalent standards.

If destruction is directed by C&H, Linden Forensics shall provide C&H with a written Certificate of Destruction, signed by an authorized representative of Linden Forensics, certifying the date, method, and completeness of destruction, and identifying the specific materials destroyed.

Linden Forensics shall not retain any copies, duplicates, excerpts, summaries, or derivatives of engagement data or work product beyond the period authorized by C&H, whether in electronic or physical form, and whether on primary systems, backup systems, archival storage, or any other medium. Linden Forensics shall certify in writing, upon request, that no copies have been retained.

Pending receipt of final instruction from C&H regarding return or destruction, Linden Forensics shall retain all engagement data in its secure, access-controlled environment, subject to the data security requirements set forth in Section 8 above, and shall continue to treat such data as privileged and confidential.

The obligations set forth in this Section 9 shall survive the termination or expiration of this engagement.

10. Personnel

Linden Forensics shall assign qualified forensic analysts, project managers, and such other personnel as are necessary to perform the services described in this Engagement Letter in a timely, professional, and competent manner. All personnel assigned to this engagement shall possess the training, experience, and professional certifications appropriate to their assigned roles.

Linden Forensics shall notify C&H of the identities, titles, and relevant qualifications (including professional certifications) of all personnel assigned to this engagement prior to such personnel commencing work. Linden Forensics shall provide updated personnel information to C&H promptly in the event of any changes to the engagement team.

C&H reserves the right to request the reassignment of any Linden Forensics personnel from this engagement for any reason, including but not limited to concerns regarding competence, professionalism, compliance with security protocols, or conflicts of interest. Linden Forensics shall promptly comply with any such request and shall assign a suitable replacement.

All Linden Forensics personnel shall comply at all times with all applicable policies, procedures, security protocols, and access restrictions of APS while on-site at APS facilities, including any visitor registration requirements, badge-access protocols, information security policies, and workplace conduct standards communicated by APS or C&H. Linden Forensics personnel shall conduct themselves professionally and discreetly at all times while on APS premises.

11. Conflicts of Interest

Linden Forensics represents and warrants that, as of the date of this Engagement Letter, it has no current conflict of interest, engagement, business relationship, or other circumstance that would prevent it from performing the services described herein on behalf of C&H and its client AGMG, or that would compromise or appear to compromise the independence, objectivity, or integrity of Linden Forensics' work under this engagement. Linden Forensics further represents that it has conducted a reasonable internal conflicts check and has identified no such conflicts.

Linden Forensics shall promptly notify C&H in writing if any actual or potential conflict of interest arises during the course of the engagement, including without limitation any engagement by or relationship with any party adverse to AGMG, APS, or C&H in connection with the matters at issue in the investigation or any related matter.

12. Independent Contractor Status

Linden Forensics is engaged as an independent contractor and not as an employee, partner, joint venturer, or general agent of C&H or AGMG. Nothing in this Engagement Letter shall be construed to create an employment relationship, a partnership, a joint venture, or any other relationship between the parties other than that of an independent contractor engaged to provide professional services. The designation of Linden Forensics as an "agent of counsel" in Section 2 above is solely for the purpose of establishing and preserving the attorney-client privilege and work-product protection applicable to Linden Forensics' work under this engagement, and does not create a general agency relationship for any other purpose.

Linden Forensics shall be solely responsible for the compensation, benefits, taxes, and insurance of its personnel, and shall comply with all applicable federal, state, and local laws regarding employment, taxation, and workers' compensation.

13. Limitation of Liability and Indemnification

The aggregate liability of either party to the other party arising out of or in connection with this Engagement Letter, whether based in contract, tort, negligence, strict liability, or any other theory, shall not exceed the total fees actually paid by C&H to Linden Forensics under this Engagement Letter, except that this limitation shall not apply to: (a) Linden Forensics' breach of its confidentiality obligations under Section 7; (b) Linden Forensics' breach of its data security obligations under Section 8; (c) either party's indemnification obligations as set forth below; or (d) either party's willful misconduct or gross negligence. In no event shall either party be liable to the other for any indirect, incidental, consequential, special, or punitive damages, including lost profits, regardless of whether such damages were foreseeable.

Linden Forensics shall defend, indemnify, and hold harmless C&H, AGMG, APS, and their respective partners, members, directors, officers, employees, and agents from and against any and all claims, demands, actions, losses, damages, liabilities, costs, and expenses (including reasonable attorneys' fees) arising out of or resulting from: (i) Linden Forensics' breach of its confidentiality obligations under Section 7; (ii) Linden Forensics' breach of its data security obligations under Section 8; (iii) any negligent act or omission of Linden Forensics or its personnel in the performance of services under this Engagement Letter; or (iv) any willful misconduct by Linden Forensics or its personnel.

C&H shall defend, indemnify, and hold harmless Linden Forensics and its directors, officers, employees, and agents from and against any and all claims, demands, actions, losses, damages, liabilities, costs, and expenses (including reasonable attorneys' fees) arising out of or resulting from C&H's material breach of this Engagement Letter.

14. Insurance

Linden Forensics shall maintain, at its own expense, throughout the term of this engagement and for a period of two (2) years following its completion or termination, the following insurance coverages in commercially reasonable amounts:

(a) Professional Liability (Errors and Omissions) Insurance, with per-occurrence and aggregate limits sufficient to cover the services provided under this Engagement Letter;

(b) Commercial General Liability Insurance, including coverage for bodily injury, property damage, and personal and advertising injury; and

Linden Forensics shall provide C&H with certificates of insurance evidencing the foregoing coverages upon request, and shall notify C&H promptly of any material change in, cancellation of, or failure to renew any such coverage.

15. Term and Termination

This engagement shall commence on the date of this Engagement Letter (May 8, 2023) and shall continue until the services described herein have been completed and all deliverables have been provided to C&H, or until the engagement is earlier terminated by either party as provided herein.

Either party may terminate this engagement upon fifteen (15) days' prior written notice to the other party, with or without cause. C&H may, in its sole discretion, terminate the engagement effective immediately upon written notice in the event of a material breach by Linden Forensics of any provision of this Engagement Letter, including without limitation the confidentiality, data security, or chain of custody requirements.

Upon termination or expiration of this engagement, Linden Forensics shall promptly deliver to C&H all collected data, forensic images, processed data, work product, chain of custody documentation, reports, certifications, and all other engagement materials in Linden Forensics' possession, custody, or control. Linden Forensics shall cooperate fully with C&H to ensure a smooth transition and shall not destroy any engagement materials without C&H's prior written authorization.

Linden Forensics shall be entitled to payment for all services rendered and reasonable expenses incurred through the effective date of termination, subject to the terms and conditions of this Engagement Letter. Termination shall not relieve either party of its obligations under Sections 2, 6, 7, 8, 9, 11, and 13, which shall survive termination.

16. Governing Law

This Engagement Letter shall be governed by and construed in accordance with the laws of the State of California, without regard to its conflict of laws principles. Any dispute, claim, or controversy arising out of or relating to this Engagement Letter or the services provided hereunder shall be resolved exclusively in the state or federal courts located in Los Angeles County, California, and each party hereby consents to the personal jurisdiction and venue of such courts and waives any objection based on forum non conveniens or any other basis.

17. Entire Agreement and Amendments

This Engagement Letter, together with the Collection Protocol when delivered, constitutes the entire agreement between C&H and Linden Forensics with respect to the engagement described herein and supersedes all prior and contemporaneous agreements, understandings, representations, and communications, whether oral or written, relating to the subject matter hereof.

No amendment, modification, supplement, or waiver of any provision of this Engagement Letter shall be effective unless made in writing and signed by authorized representatives of both C&H and Linden Forensics. No waiver of any provision or breach of this Engagement Letter shall constitute a waiver of any other provision or any subsequent breach.

18. Counterparts and Electronic Signatures

This Engagement Letter may be executed in one or more counterparts, each of which shall be deemed an original and all of which together shall constitute one and the same instrument. Delivery of an executed counterpart by email (including PDF), electronic signature platform (such as DocuSign or Ashford Health IT), or facsimile shall be effective as delivery of an original executed counterpart. Electronic signatures and facsimile signatures shall be deemed original signatures for all purposes and shall be binding on the party affixing such signature.

We look forward to working with Linden Forensics on this important engagement. Please indicate your agreement to the foregoing terms and conditions by signing and returning a copy of this Engagement Letter to my attention at the address below. If you have any questions, please do not hesitate to contact me or Devon Archer.

Very truly yours,

CALDERWOOD & HARKNESS LLP

By: ________

Name: Bernard Crawford

Title: Partner

Date: ________

Calderwood & Harkness LLP 1999 Avenue of the Stars, Suite 2800 Los Angeles, CA 90067 Direct: (310) 556-8042

Email: bcrawford@calderwoodharkness.com

cc: Devon Archer, Lead Associate, Calderwood & Harkness LLP Renata Vasquez, Billing Partner, Calderwood & Harkness LLP

AGREED AND ACCEPTED

By executing below, Linden Forensics Group Inc. acknowledges that it has read, understands, and agrees to be bound by all of the terms and conditions set forth in the foregoing Engagement Letter dated May 8, 2023.

LINDEN FORENSICS GROUP INC.

By: ________

Printed Name: ________

Title: ________

Date: ________

Linden Forensics Group Inc. 201 Mission Street, Suite 1400 San Francisco, CA 94105

PRIVILEGED AND CONFIDENTIAL
CALDERWOOD & HARKNESS LLP Attorneys at Law
780 Seventh Avenue, 34th Floor New York, NY 10019
1999 Avenue of the Stars, Suite 2800 Los Angeles, CA 90067
Telephone: (310) 556-8000 Facsimile: (310) 556-8001 www.calderwoodharkness.com
May 8, 2023
Via Email and Sundial Data Systems
Linden Forensics Group Inc.
Attention: Engagement Manager
201 Mission Street, Suite 1400 San Francisco, CA 94105
Re: Engagement of Linden Forensics Group Inc. for Forensic Collection and Processing Services C&H Matter No.: 1017-00005 Client: Aurelius Global Media Group PLC / Aurelius Pacific Studios Inc.
Dear Engagement Manager:
1. Introduction and Purpose of Engagement
Calderwood & Harkness LLP ("C&H" or the "Firm"), a limited liability partnership organized under the laws of the State of New York, with principal offices at 780 Seventh Avenue, 34th Floor, New York, NY 10019 and 1999 Avenue of the Stars, Suite 2800, Los Angeles, CA 90067, writes to formally retain Linden Forensics Group Inc. ("Linden Forensics" or "Consultant") to perform forensic data collection, processing, and related services in connection with a privileged and confidential independent workplace investigation, as more fully described herein.
C&H has been retained by the Board of Directors of Aurelius Global Media Group PLC ("AGMG"), a public limited company incorporated in England and Wales (Company No. 08456213) with its registered office at 45 Aldwych House, Kingsway, London WC2B 6AH, United Kingdom, and whose shares are admitted to trading on the AIM market of the London Stock Exchange. AGMG is a diversified global media and entertainment conglomerate with operations across film and television production, digital content, music publishing, and live events.
The investigation to which this engagement relates concerns allegations of serious workplace misconduct involving a senior executive of Aurelius Pacific Studios Inc. ("APS"), a Delaware corporation and wholly owned subsidiary of AGMG, headquartered at 3200 West Alameda Avenue, Suite 400, Burbank, CA 91505. APS operates as AGMG's principal North American film and television production arm.
C&H was formally engaged by the AGMG Board on May 2, 2023, to conduct this investigation. The investigation is being conducted at the direction and under the supervision of both the People & Culture Committee of the AGMG Board of Directors, chaired by Dame Cordelia Ashworth, and the Audit & Risk Committee of the AGMG Board of Directors, chaired by Raymond Okoro. The investigation is proceeding on a privileged and confidential basis, and the preservation of attorney-client privilege and work-product protection is of paramount importance to the client and to C&H.
The primary C&H contacts for this engagement are Bernard Crawford, Responsible Partner, and Devon Archer, Lead Associate, both of whom are members of the Firm's Labor & Employment Practice Group and are based in the Firm's Los Angeles office. All communications from Linden Forensics regarding this engagement should be directed to Mr. Crawford and Ms. Archer unless otherwise instructed.
This letter (the "Engagement Letter") sets forth the terms and conditions upon which Linden Forensics is being retained by C&H to perform the services described herein. By executing this Engagement Letter in the space provided below, Linden Forensics agrees to be bound by the terms and conditions set forth herein.
2. Engagement as Agent of Counsel — Privilege Framework
Linden Forensics is being retained as a consulting expert and agent of counsel, acting at the direction and under the supervision of C&H, for the sole and express purpose of assisting C&H in the provision of legal services to AGMG in connection with the investigation described in Section 1 above. Linden Forensics is not being retained by AGMG or APS directly; rather, Linden Forensics' engagement flows through and is controlled by C&H as outside counsel to the client.
All work performed by Linden Forensics under this engagement is intended to be protected by the attorney-client privilege, the work-product doctrine, and any other applicable protections under federal and state law. The parties intend that the forensic collection, processing, analysis, and all related communications, reports, certifications, memoranda, and deliverables produced by Linden Forensics in connection with this engagement constitute attorney work product prepared in anticipation of litigation or in connection with the provision of legal advice, or both.
Linden Forensics acknowledges and agrees that the attorney-client privilege, the work-product protection, and any other applicable evidentiary or testimonial privileges belong exclusively to AGMG (the client) and that only AGMG, through its duly authorized representatives (including authorized officers, the Board of Directors, or the relevant Board committees), may waive such protections. Neither C&H nor Linden Forensics has independent authority to waive any privilege belonging to the client.
All communications between C&H and Linden Forensics relating to this engagement, including without limitation emails, telephone calls, memoranda, status updates, draft and final reports, and any other oral or written communications, shall be treated as privileged and confidential. Linden Forensics shall take all reasonable steps to preserve the privileged and confidential nature of such communications.
Linden Forensics shall not disclose any information, documents, data, communications, findings, analyses, or work product arising from or related to this engagement to any third party, including but not limited to AGMG, APS, their respective employees, officers, or directors, or any governmental or regulatory authority, without the prior written consent of C&H. All interactions between Linden Forensics and any employee, officer, or agent of AGMG or APS shall be coordinated through and approved by C&H in advance.
Linden Forensics shall prominently mark all reports, certifications, memoranda, deliverables, and other written materials prepared in connection with this engagement with the following legend:
"PRIVILEGED AND CONFIDENTIAL — PREPARED AT THE DIRECTION OF COUNSEL"
This legend shall appear on the first page and, where practicable, on each subsequent page of such materials. Electronic files shall include this legend in the document header, footer, or cover page, as appropriate.
3. Scope of Services
3.1 Forensic Collection
Linden Forensics shall perform forensic collection of electronically stored information ("ESI") from identified custodians at APS, as directed by C&H. The categories of ESI to be collected include, but are not limited to, the following:
(a) Email: Messages, attachments, calendar items, and contacts maintained on the Strathmore Data Systems / Outlook email platform administered by APS, including both server-side mailboxes and locally stored .PST or .OST files, as applicable.
(b) Meridian Solutions Workplace Messaging Platform Communications: All direct messages, group messages, channel messages, and shared files on the Meridian Solutions workspace(s) used by APS, including any archived or deleted messages recoverable through the Meridian Solutions Enterprise Grid administrative console or equivalent data export functionality.
(c) Text Messages (SMS and Westmark Software): Text message communications, including SMS, MMS, and Tidewater Industries Ashbury Health IT, residing on company-issued mobile devices assigned to the identified custodians, to the extent such devices are available and accessible.
(d) Shared Network Drives and Cloud-Based Document Repositories: Documents and files stored on APS shared network drives (including mapped drives and NAS storage), as well as cloud-based document repositories including, without limitation, Sundial Systems, Larkspur Health IT, Hollowell Health IT, and any other cloud storage platforms used by APS, as identified by C&H and the APS Information Technology department.
All collections shall be performed in a forensically sound and defensible manner, consistent with industry best practices, the Sedona Conference principles for electronic discovery, and applicable legal standards, including but not limited to the Federal Rules of Civil Procedure (to the extent applicable) and the standards established by the International Society of Forensic Computer Examiners (ISFCE) and the Scientific Working Group on Digital Evidence (SWGDE).
Linden Forensics shall use write-blocking technology to prevent any alteration of source data during the collection process. All forensic imaging shall be performed using verified forensic imaging tools (such as Stonefield Software, Calderon Technologies, or equivalent tools of comparable reliability and industry acceptance).
All collected data shall be hash-verified using both MD5 and SHA-1 hash algorithms at the time of collection to ensure and document the integrity of the collected data. Hash values shall be recorded in the chain of custody log described in Section 6 below.
3.2 Custodians.  The initial custodian list consists of nine (9) individuals whose identities are specified in the Forensic Collection Protocol & Custodian List Memorandum (the "Collection Protocol"), which shall be provided by C&H to Linden Forensics contemporaneously with this Engagement Letter or promptly following its execution. The Collection Protocol, when delivered, shall be deemed incorporated into and made a part of this Engagement Letter for all purposes.
C&H reserves the right to add or remove custodians from the custodian list during the course of the engagement upon written notice (including email) to Linden Forensics. Any addition of custodians or expansion of collection scope that would materially increase the estimated fees set forth in Section 5 below shall be subject to the revised estimate procedures described therein.
The identity of the custodians is privileged and confidential information and shall not be disclosed by Linden Forensics to any party other than C&H. Linden Forensics shall take all reasonable precautions to protect the identity of the custodians from disclosure.
3.3 Date Range
The date range for collection of ESI shall be as specified in the Collection Protocol provided by C&H. The date range may vary by custodian and by data source, as directed by C&H in the Collection Protocol.
C&H may adjust the date range for one or more custodians or data sources upon written notice (including email) to Linden Forensics at any time during the course of the engagement. Any expansion of the date range that would materially increase the estimated fees set forth in Section 5 below shall be subject to the revised estimate procedures described therein.
3.4 Processing and De-Duplication
Following the completion of forensic collection, Linden Forensics shall process all collected data to prepare it for attorney review. Processing shall include, without limitation, the following:
(a) De-Duplication: Linden Forensics shall perform both global de-duplication (across all custodians) and custodian-level de-duplication to eliminate exact duplicate documents from the data set, using MD5 or SHA-1 hash values as the basis for de-duplication. Linden Forensics shall maintain records of the de-duplication process, including the number of documents removed and the basis for removal.
(b) De-NISTing: Linden Forensics shall remove known system files, application files, and other non-user-generated files from the data set by reference to the National Institute of Standards and Technology (NIST) National Software Reference Library (NSRL) hash set, or an equivalent and current reference database.
(c) Extraction and Indexing of Metadata: Linden Forensics shall extract and index all available metadata fields for the collected documents, including but not limited to author, date created, date modified, date sent, date received, sender, recipient(s), subject line, file path, file type, file size, and custodian.
(d) Rendering: Linden Forensics shall render all processed files into a format suitable for attorney review on a document review platform, including the generation of text-searchable versions (using optical character recognition where necessary), image renderings (TIFF or PDF, as directed by C&H), and native file production where appropriate.
In addition to the foregoing, Linden Forensics shall apply search terms and date-range filters as directed by C&H to reduce the data set for attorney review. C&H will provide the search term list and filtering parameters to Linden Forensics following the completion of processing. Linden Forensics shall provide C&H with hit reports and volume estimates to facilitate iterative refinement of the search term list.
3.5 Data Transfer and Hosting
Upon completion of processing, the processed data shall be transferred securely to the document review platform designated by C&H. C&H will provide Linden Forensics with the identity and technical specifications of the designated review platform, including any required data formatting, load file specifications, and upload protocols.
All data transfers between Linden Forensics and the review platform (and between Linden Forensics and C&H) shall be conducted using encrypted channels employing AES-256 encryption or an equivalent or superior encryption standard. Data shall not be transferred via unencrypted email, unencrypted FTP, or removable media that is not encrypted.
Linden Forensics shall coordinate directly with C&H's review team, specifically Devon Archer (Lead Associate) and Nadia Petrov (Senior Document Review Attorney), regarding platform specifications, load file formatting, upload procedures, quality control protocols, and any issues that arise during the data transfer process. All such coordination shall be treated as privileged and confidential consistent with Section 2 above.
4. Timeline
Linden Forensics shall commence on-site forensic collection at the offices of Aurelius Pacific Studios Inc., located at 3200 West Alameda Avenue, Suite 400, Burbank, CA 91505, no later than May 10, 2023. C&H will coordinate with APS's Information Technology department to ensure that Linden Forensics personnel have the necessary physical access, network credentials, and administrative permissions to perform the collection efficiently.
Collection from all nine (9) initial custodians across the identified data sources is expected to be completed within approximately three (3) business days, with an estimated completion date of May 12, 2023. Linden Forensics shall use commercially reasonable efforts to adhere to this timeline.
Processing, de-duplication, de-NISTing, and initial data transfer to the designated review platform shall be completed within five (5) business days following the completion of collection, with an estimated completion date of May 19, 2023. Linden Forensics shall provide C&H with regular status updates during the processing phase, including updates on data volumes, processing progress, and any issues or anomalies encountered.
C&H acknowledges that the foregoing timeline is an estimate and is subject to adjustment based on a number of factors, including but not limited to: the volume of data collected; the availability and cooperation of custodians; access to and performance of APS's IT systems; the complexity of the data sources; and any unforeseen technical issues. Linden Forensics shall promptly notify C&H of any circumstances that may cause material delay and shall work cooperatively with C&H to develop an adjusted timeline.
5. Estimated Fees and Expenses
5.1 Fee Estimate
The total estimated fees for the services described in this Engagement Letter are One Hundred Eighty-Nine Thousand Four Hundred Dollars ($189,400). This estimate is provided in good faith and is based on the scope of services described herein, including forensic collection from nine (9) custodians across the data sources identified in Section 3.1, processing, de-duplication, de-NISTing, metadata extraction and indexing, rendering, search-term and date-range filtering, and data transfer to the designated review platform.
The fee estimate encompasses the following categories of work:
(a) On-site forensic collection, including personnel costs, travel to and from the APS offices in Burbank, California, and use of forensic collection equipment and software;
(b) Processing and de-duplication, including data ingestion, global and custodian-level de-duplication, de-NISTing, metadata extraction and indexing, and rendering of documents into reviewable format;
(c) Search-term and date-range filtering, including application of C&H-directed search terms and date-range filters, generation of hit reports, and iterative refinement as directed;
(d) Data transfer to the C&H-designated review platform, including formatting, quality control, and coordination with C&H's review team; and
(e) Project management and coordination with C&H, including regular status reporting, issue resolution, and engagement administration.
If the scope of services materially changes during the course of the engagement — including, by way of example and not limitation, the addition of custodians beyond the initial nine, the expansion of data sources to include platforms or repositories not identified in Section 3.1, the expansion of date ranges, or the need for re-processing of previously collected data — Linden Forensics shall promptly provide C&H with a revised estimate reflecting the anticipated additional fees. Linden Forensics shall not incur fees materially in excess of the estimate set forth above, or in excess of any subsequently approved revised estimate, without the prior written approval of C&H.
5.2 Billing and Payment
Linden Forensics shall submit monthly invoices to C&H for services rendered during the preceding calendar month. Each invoice shall include reasonable detail regarding the work performed, including a description of the services provided, the dates on which services were performed, the personnel who performed the services (by role), and, where applicable, the data volumes processed.
All invoices shall prominently reference C&H Matter No. 1017-00005 and shall be marked "Privileged and Confidential."
Payment terms are net thirty (30) days from C&H's receipt of a properly submitted invoice. C&H shall have the right to review and, in good faith, dispute any charges that are not consistent with the terms of this Engagement Letter or any approved revised estimate, and any such dispute shall be resolved promptly through good-faith discussion between the parties.
All invoices shall be directed to:
Devon Archer Calderwood & Harkness LLP 1999 Avenue of the Stars, Suite 2800 Los Angeles, CA 90067
Email: darcher@calderwoodharkness.com
5.3 Expenses.  Reasonable out-of-pocket expenses incurred by Linden Forensics in connection with this engagement, including but not limited to travel expenses (airfare, ground transportation, lodging, and meals), shipping and courier costs, and specialized equipment rental, shall be billed at cost. Such expenses are included within the $189,400 total estimate set forth in Section 5.1 above unless otherwise agreed in writing by C&H. Linden Forensics shall exercise reasonable economy in incurring expenses and shall comply with any expense guidelines communicated by C&H.
6. Chain of Custody Requirements
Linden Forensics shall maintain a detailed, contemporaneous chain of custody log for all data collected, processed, stored, transferred, or otherwise handled under this engagement. The chain of custody log is a critical component of the defensibility of the forensic collection process and shall be maintained with the degree of care and precision consistent with best practices in the digital forensics industry.
The chain of custody log shall document, at a minimum, the following information for each item of collected data:
(a) The identity of the custodian from whom the data was collected and the specific data source (e.g., email mailbox, Meridian Solutions account, mobile device, network drive location);
(b) The date, time (including time zone), and physical location of the collection;
(c) The identity of the Linden Forensics personnel who performed the collection, including the name, title, and relevant certifications (e.g., EnCE, CFCE, ACE) of each individual;
(d) A detailed description of the collection methodology and the specific forensic tools and software used (including version numbers);
(e) Hash values (both MD5 and SHA-1) for all forensic images, containers, and collected data sets, generated at the time of collection and verified upon transfer;
(f) A complete record of any transfers, copies, movements, or other handling of the data following initial collection, including the date, time, source, destination, method of transfer, and identity of the personnel involved;
(g) The identity of any Linden Forensics or other personnel who accessed the data at any point during the engagement, including the date, time, and purpose of such access; and
(h) Any anomalies, errors, deviations from the Collection Protocol, or other issues encountered during the collection process, together with a description of the steps taken to address such issues.
Upon completion of forensic collection from all custodians, Linden Forensics shall provide C&H with a Chain of Custody Certification, signed by the Linden Forensics project lead, certifying the integrity of the collection process and the authenticity of the collected data. The Chain of Custody Certification shall include a summary of the collection activities, the total data volumes collected (in gigabytes), the hash values for all forensic images, and a representation that the collection was performed in a forensically sound and defensible manner consistent with industry best practices.
All collected data shall be stored in a secure, access-controlled environment at all times, both physically (e.g., locked server rooms with restricted badge access) and electronically (e.g., encrypted storage, role-based access controls, audit logging). Access to collected data shall be limited to Linden Forensics personnel who are directly involved in performing the services under this engagement and who have been approved by C&H.
7. Confidentiality and Non-Disclosure
Linden Forensics acknowledges that all information received or generated in connection with this engagement is strictly confidential and privileged, and that the unauthorized disclosure of such information could cause irreparable harm to AGMG, APS, C&H, and the individuals involved in the investigation.
Linden Forensics shall not disclose any information about the existence or nature of this engagement, the identity of the client (AGMG or APS), the subject matter or findings of the investigation, the identity of the custodians or any other individuals, or any data, documents, communications, reports, analyses, or work product to any person or entity, whether inside or outside of Linden Forensics, without the prior written consent of C&H. This obligation extends to all forms of disclosure, whether oral, written, electronic, or otherwise, and includes disclosure in marketing materials, case studies, client references, conference presentations, publications, or social media.
Linden Forensics shall limit internal access to engagement materials to those Linden Forensics personnel who are directly involved in performing the services described in this Engagement Letter and who have a genuine need to know the information in order to perform their assigned tasks. Linden Forensics shall not share engagement materials with personnel who are not assigned to this engagement.
Linden Forensics shall ensure that all personnel assigned to this engagement have executed written confidentiality and non-disclosure agreements that are consistent with the obligations set forth in this Section 7 prior to such personnel being given access to any engagement materials. Linden Forensics shall provide copies of such executed agreements to C&H upon request.
In the event that Linden Forensics receives a subpoena, court order, discovery request, regulatory demand, or any other form of legal compulsion that seeks or requires the disclosure of information related to this engagement, Linden Forensics shall promptly notify C&H — specifically, Bernard Crawford and Devon Archer — before making any disclosure, to the fullest extent permitted by applicable law. Linden Forensics shall cooperate with C&H in seeking protective relief or other appropriate measures to resist or limit such disclosure. Linden Forensics shall not produce any documents or information in response to any such compulsory process without affording C&H a reasonable opportunity to assert applicable privileges and protections on behalf of the client.
The obligations set forth in this Section 7 shall survive the termination or expiration of this engagement.
8. Data Security
Linden Forensics shall implement and maintain industry-standard information security measures to protect all data collected, processed, stored, and transmitted in connection with this engagement. Given the sensitive and privileged nature of the data involved, Linden Forensics shall treat all engagement data as highly confidential and shall apply security controls commensurate with the sensitivity of the data.
At a minimum, Linden Forensics shall maintain the following security measures throughout the duration of the engagement and for as long as Linden Forensics retains any engagement data:
(a) Encryption: AES-256 encryption (or equivalent or superior encryption) for all engagement data at rest (on servers, storage media, and backup systems) and in transit (during electronic transfers, uploads, and downloads);
(b) Multi-Factor Authentication: Multi-factor authentication (MFA) shall be required for all personnel accessing engagement data, whether remotely or on-site;
(c) Access Logging and Audit Trails: Comprehensive access logging and audit trails shall be maintained for all systems and storage environments containing engagement data, recording the identity of each user, the date and time of access, and the nature of the activity performed;
(d) Physical Security: Servers, storage media, and other hardware containing engagement data shall be maintained in physically secure facilities with restricted access controls, including badge access, surveillance, and environmental controls (fire suppression, climate control);
(e) Regular Vulnerability Assessments: Linden Forensics shall conduct regular vulnerability assessments and penetration testing of the systems and networks used to store and process engagement data, and shall promptly remediate any identified vulnerabilities; and
(f) Endpoint Security: All workstations, laptops, and mobile devices used by Linden Forensics personnel in connection with this engagement shall be equipped with current antivirus, anti-malware, and endpoint detection and response software, and shall be subject to full-disk encryption.
Linden Forensics shall promptly notify C&H — within twenty-four (24) hours or as soon as reasonably practicable — of any actual or suspected data breach, security incident, unauthorized access, or unauthorized disclosure involving engagement data. Such notification shall include a description of the incident, the data potentially affected, the steps taken to contain and remediate the incident, and any recommended corrective actions. Linden Forensics shall cooperate fully with C&H in investigating and responding to any such incident.
9. Data Retention and Return/Destruction
Upon the completion of all services under this engagement and receipt of final written instruction from C&H, Linden Forensics shall, at C&H's sole direction, either: (a) return all collected data, forensic images, processed data, work product, reports, certifications, chain of custody logs, and all other engagement materials to C&H in a format and by a method specified by C&H; or (b) securely destroy all such materials using methods consistent with NIST Special Publication 800-88 (Guidelines for Media Sanitization) or equivalent standards.
If destruction is directed by C&H, Linden Forensics shall provide C&H with a written Certificate of Destruction, signed by an authorized representative of Linden Forensics, certifying the date, method, and completeness of destruction, and identifying the specific materials destroyed.
Linden Forensics shall not retain any copies, duplicates, excerpts, summaries, or derivatives of engagement data or work product beyond the period authorized by C&H, whether in electronic or physical form, and whether on primary systems, backup systems, archival storage, or any other medium. Linden Forensics shall certify in writing, upon request, that no copies have been retained.
Pending receipt of final instruction from C&H regarding return or destruction, Linden Forensics shall retain all engagement data in its secure, access-controlled environment, subject to the data security requirements set forth in Section 8 above, and shall continue to treat such data as privileged and confidential.
The obligations set forth in this Section 9 shall survive the termination or expiration of this engagement.
10. Personnel
Linden Forensics shall assign qualified forensic analysts, project managers, and such other personnel as are necessary to perform the services described in this Engagement Letter in a timely, professional, and competent manner. All personnel assigned to this engagement shall possess the training, experience, and professional certifications appropriate to their assigned roles.
Linden Forensics shall notify C&H of the identities, titles, and relevant qualifications (including professional certifications) of all personnel assigned to this engagement prior to such personnel commencing work. Linden Forensics shall provide updated personnel information to C&H promptly in the event of any changes to the engagement team.
C&H reserves the right to request the reassignment of any Linden Forensics personnel from this engagement for any reason, including but not limited to concerns regarding competence, professionalism, compliance with security protocols, or conflicts of interest. Linden Forensics shall promptly comply with any such request and shall assign a suitable replacement.
All Linden Forensics personnel shall comply at all times with all applicable policies, procedures, security protocols, and access restrictions of APS while on-site at APS facilities, including any visitor registration requirements, badge-access protocols, information security policies, and workplace conduct standards communicated by APS or C&H. Linden Forensics personnel shall conduct themselves professionally and discreetly at all times while on APS premises.
11. Conflicts of Interest
Linden Forensics represents and warrants that, as of the date of this Engagement Letter, it has no current conflict of interest, engagement, business relationship, or other circumstance that would prevent it from performing the services described herein on behalf of C&H and its client AGMG, or that would compromise or appear to compromise the independence, objectivity, or integrity of Linden Forensics' work under this engagement. Linden Forensics further represents that it has conducted a reasonable internal conflicts check and has identified no such conflicts.
Linden Forensics shall promptly notify C&H in writing if any actual or potential conflict of interest arises during the course of the engagement, including without limitation any engagement by or relationship with any party adverse to AGMG, APS, or C&H in connection with the matters at issue in the investigation or any related matter.
12. Independent Contractor Status
Linden Forensics is engaged as an independent contractor and not as an employee, partner, joint venturer, or general agent of C&H or AGMG. Nothing in this Engagement Letter shall be construed to create an employment relationship, a partnership, a joint venture, or any other relationship between the parties other than that of an independent contractor engaged to provide professional services. The designation of Linden Forensics as an "agent of counsel" in Section 2 above is solely for the purpose of establishing and preserving the attorney-client privilege and work-product protection applicable to Linden Forensics' work under this engagement, and does not create a general agency relationship for any other purpose.
Linden Forensics shall be solely responsible for the compensation, benefits, taxes, and insurance of its personnel, and shall comply with all applicable federal, state, and local laws regarding employment, taxation, and workers' compensation.
13. Limitation of Liability and Indemnification
The aggregate liability of either party to the other party arising out of or in connection with this Engagement Letter, whether based in contract, tort, negligence, strict liability, or any other theory, shall not exceed the total fees actually paid by C&H to Linden Forensics under this Engagement Letter, except that this limitation shall not apply to: (a) Linden Forensics' breach of its confidentiality obligations under Section 7; (b) Linden Forensics' breach of its data security obligations under Section 8; (c) either party's indemnification obligations as set forth below; or (d) either party's willful misconduct or gross negligence. In no event shall either party be liable to the other for any indirect, incidental, consequential, special, or punitive damages, including lost profits, regardless of whether such damages were foreseeable.
Linden Forensics shall defend, indemnify, and hold harmless C&H, AGMG, APS, and their respective partners, members, directors, officers, employees, and agents from and against any and all claims, demands, actions, losses, damages, liabilities, costs, and expenses (including reasonable attorneys' fees) arising out of or resulting from: (i) Linden Forensics' breach of its confidentiality obligations under Section 7; (ii) Linden Forensics' breach of its data security obligations under Section 8; (iii) any negligent act or omission of Linden Forensics or its personnel in the performance of services under this Engagement Letter; or (iv) any willful misconduct by Linden Forensics or its personnel.
C&H shall defend, indemnify, and hold harmless Linden Forensics and its directors, officers, employees, and agents from and against any and all claims, demands, actions, losses, damages, liabilities, costs, and expenses (including reasonable attorneys' fees) arising out of or resulting from C&H's material breach of this Engagement Letter.
14. Insurance
Linden Forensics shall maintain, at its own expense, throughout the term of this engagement and for a period of two (2) years following its completion or termination, the following insurance coverages in commercially reasonable amounts:
(a) Professional Liability (Errors and Omissions) Insurance, with per-occurrence and aggregate limits sufficient to cover the services provided under this Engagement Letter;
(b) Commercial General Liability Insurance, including coverage for bodily injury, property damage, and personal and advertising injury; and
(c) Cyber Liability Insurance, including coverage for data breaches, network security failures, and related claims.
Linden Forensics shall provide C&H with certificates of insurance evidencing the foregoing coverages upon request, and shall notify C&H promptly of any material change in, cancellation of, or failure to renew any such coverage.
15. Term and Termination
This engagement shall commence on the date of this Engagement Letter (May 8, 2023) and shall continue until the services described herein have been completed and all deliverables have been provided to C&H, or until the engagement is earlier terminated by either party as provided herein.
Either party may terminate this engagement upon fifteen (15) days' prior written notice to the other party, with or without cause. C&H may, in its sole discretion, terminate the engagement effective immediately upon written notice in the event of a material breach by Linden Forensics of any provision of this Engagement Letter, including without limitation the confidentiality, data security, or chain of custody requirements.
Upon termination or expiration of this engagement, Linden Forensics shall promptly deliver to C&H all collected data, forensic images, processed data, work product, chain of custody documentation, reports, certifications, and all other engagement materials in Linden Forensics' possession, custody, or control. Linden Forensics shall cooperate fully with C&H to ensure a smooth transition and shall not destroy any engagement materials without C&H's prior written authorization.
Linden Forensics shall be entitled to payment for all services rendered and reasonable expenses incurred through the effective date of termination, subject to the terms and conditions of this Engagement Letter. Termination shall not relieve either party of its obligations under Sections 2, 6, 7, 8, 9, 11, and 13, which shall survive termination.
16. Governing Law
This Engagement Letter shall be governed by and construed in accordance with the laws of the State of California, without regard to its conflict of laws principles. Any dispute, claim, or controversy arising out of or relating to this Engagement Letter or the services provided hereunder shall be resolved exclusively in the state or federal courts located in Los Angeles County, California, and each party hereby consents to the personal jurisdiction and venue of such courts and waives any objection based on forum non conveniens or any other basis.
17. Entire Agreement and Amendments
This Engagement Letter, together with the Collection Protocol when delivered, constitutes the entire agreement between C&H and Linden Forensics with respect to the engagement described herein and supersedes all prior and contemporaneous agreements, understandings, representations, and communications, whether oral or written, relating to the subject matter hereof.
No amendment, modification, supplement, or waiver of any provision of this Engagement Letter shall be effective unless made in writing and signed by authorized representatives of both C&H and Linden Forensics. No waiver of any provision or breach of this Engagement Letter shall constitute a waiver of any other provision or any subsequent breach.
18. Counterparts and Electronic Signatures
This Engagement Letter may be executed in one or more counterparts, each of which shall be deemed an original and all of which together shall constitute one and the same instrument. Delivery of an executed counterpart by email (including PDF), electronic signature platform (such as DocuSign or Ashford Health IT), or facsimile shall be effective as delivery of an original executed counterpart. Electronic signatures and facsimile signatures shall be deemed original signatures for all purposes and shall be binding on the party affixing such signature.
We look forward to working with Linden Forensics on this important engagement. Please indicate your agreement to the foregoing terms and conditions by signing and returning a copy of this Engagement Letter to my attention at the address below. If you have any questions, please do not hesitate to contact me or Devon Archer.
Very truly yours,
CALDERWOOD & HARKNESS LLP
By: ________
Name: Bernard Crawford
Title: Partner
Date: ________
Calderwood & Harkness LLP 1999 Avenue of the Stars, Suite 2800 Los Angeles, CA 90067 Direct: (310) 556-8042
Email: bcrawford@calderwoodharkness.com
cc: Devon Archer, Lead Associate, Calderwood & Harkness LLP Renata Vasquez, Billing Partner, Calderwood & Harkness LLP
AGREED AND ACCEPTED
By executing below, Linden Forensics Group Inc. acknowledges that it has read, understands, and agrees to be bound by all of the terms and conditions set forth in the foregoing Engagement Letter dated May 8, 2023.
LINDEN FORENSICS GROUP INC.
By: ________
Printed Name: ________
Title: ________
Date: ________
Linden Forensics Group Inc. 201 Mission Street, Suite 1400 San Francisco, CA 94105

PRIVILEGED AND CONFIDENTIAL

CALDERWOOD & HARKNESS LLP

AGREED AND ACCEPTED

LINDEN FORENSICS GROUP INC.

Record

Parties

Dates

Amounts