PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGE / WORK PRODUCT DOCTRINE
CALDERWOOD & HARKNESS LLP 555 California Street, 40th Floor San Francisco, California 94104 Telephone: (415) 773-6200 Facsimile: (415) 773-6201
March 15, 2022
VIA ELECTRONIC MAIL AND OVERNIGHT COURIER
Mr. Neil Ashworth Project Director Redstone Digital Forensics Inc. 7925 Jones Branch Drive, Suite 600 McLean, Virginia 22102
Re: Engagement of Redstone Digital Forensics Inc. for Forensic Data Collection, Processing, Hosting, and Managed Review Services — In the Matter of Torchlight Mining Corp. C&H Matter No. 1039-00001
Dear Mr. Ashworth:
1. Engagement Confirmation
This letter (the "Engagement Letter") confirms the engagement by Calderwood & Harkness LLP ("C&H" or the "Firm"), on behalf of its client Torchlight Mining Corp. ("TMC" or the "Client"), of Redstone Digital Forensics Inc. ("Redstone" or the "Vendor") to provide forensic data collection, processing, hosting, and managed review services in connection with the matter referenced above.
TMC is a corporation organized under the Canada Business Corporations Act with its registered office at 200 Bay Street, Suite 3400, Toronto, Ontario M5J 2J2, Canada. TMC conducts its U.S. operations through its wholly owned subsidiary Torchlight Mining (U.S.) Inc. ("TMC US"), a Nevada corporation with its principal office at 8750 West Sahara Avenue, Suite 210, Reno, Nevada 89117. This engagement arises in connection with a pending United States Department of Justice, Antitrust Division ("DOJ") grand jury investigation (Grand Jury No. GJ-22-0194, U.S. District Court for the Northern District of California, San Francisco Division) involving suspected price-fixing, market allocation, and bid-rigging in the North American specialty-minerals sector.
On February 14, 2022, TMC was served with a grand jury subpoena duces tecum (Subpoena No. GJ-22-0194-SD-003) (the "Subpoena") requiring production of documents and electronically stored information ("ESI") relevant to the DOJ investigation. C&H was retained by TMC on February 18, 2022, to represent TMC and TMC US in connection with the DOJ investigation and an associated internal investigation. This vendor engagement flows directly from and is incident to C&H's representation of TMC.
The purpose of Redstone's engagement is to support C&H's efforts in complying with the Subpoena and in conducting an internal investigation on behalf of TMC. Redstone's services will encompass the full lifecycle of electronic discovery: forensic data collection, ESI processing, secure hosting, managed document review support, and rolling document productions to the DOJ, all as more particularly described in Section 3 below.
This Engagement Letter is designated as C&H Matter Number 1039-00001. The effective date of the engagement is March 15, 2022.
2. Relationship of Parties / Agent of Counsel
It is expressly understood and agreed that Redstone is being retained by Calderwood & Harkness LLP, and not directly by TMC or TMC US. Redstone's engagement is as an agent and consultant to C&H in its capacity as legal counsel to TMC. Redstone's work under this Engagement Letter is being directed by, and performed at the request of, C&H attorneys for the express purpose of providing legal advice and litigation support to TMC in connection with the DOJ investigation and related internal investigation.
All work product, analyses, reports, memoranda, communications, and other materials generated by Redstone in the course of this engagement (collectively, "Engagement Materials") are intended to be protected by the attorney-client privilege, the work-product doctrine, and any other applicable privilege or protection. Redstone acknowledges that it is functioning as a non-testifying consulting expert and litigation support vendor operating under the direction and supervision of counsel, within the meaning of Federal Rule of Civil Procedure 26(b)(4)(D) and analogous principles applicable to grand jury proceedings. Nothing in this Engagement Letter shall be construed to waive, limit, or undermine the privileged and protected nature of the Engagement Materials or the attorney-client relationship between C&H and TMC.
The primary C&H contacts for this engagement are as follows:
• Elaine Forsythe, Partner, Antitrust & Competition Practice Group — Strategic oversight and senior decision-making authority
• Aaron Liu, Lead Associate — Day-to-day project management, technical direction, and coordination of all forensic collection and processing activities
• Monica Reyes, Working Associate — Privilege review coordination and managed review oversight
The primary Redstone contact for this engagement shall be:
• Neil Ashworth, Project Director — Overall project management, staffing, and operational coordination on behalf of Redstone
All communications regarding the substantive direction of services, including modifications to scope, collection protocols, and review parameters, shall be directed through the above-named C&H contacts. Redstone shall not take substantive direction from TMC or TMC US personnel directly, and all operational communications with TMC's IT department or individual custodians shall be coordinated through and authorized by C&H.
3. Scope of Services
The services to be provided by Redstone under this Engagement Letter are described in the following subsections. C&H reserves the right to modify, expand, or narrow the scope of services at any time upon written notice to Redstone, and any material changes that affect the estimated budget or timeline shall be discussed and agreed upon by the parties in advance to the extent practicable.
3.1 Forensic Data Collection
Redstone shall perform forensic collection of ESI from TMC's and TMC US's systems and custodian data sources, as identified in the Data Collection Protocol and Custodian List to be provided by C&H. The Data Collection Protocol is anticipated to be delivered to Redstone on or about March 18, 2022. C&H has preliminarily identified approximately thirty-four (34) custodians whose data is potentially responsive to Subpoena GJ-22-0194-SD-003. The specific custodian list, including custodian names, titles, and associated data sources, will be furnished as Exhibit A to this Engagement Letter (to be provided under separate cover).
The data sources to be collected include, but are not limited to, the following:
(a) Corporate email systems — Strathmore Data Systems / Outlook email accounts maintained by TMC and TMC US for each identified custodian, including all mailbox contents, archived PST files, and journaled email where available;
(b) Shared network drives and departmental file shares — Network-accessible shared drives and departmental file shares associated with the U.S. Specialty Minerals Division of TMC US, including the Sales, Pricing, Contracts, and Business Development departments;
(c) VaultChat application archives — Encrypted messaging platform used by certain TMC and TMC US personnel for internal and external communications. Redstone shall work with C&H and, as necessary, the VaultChat platform provider, to extract archived communications in a forensically sound manner;
(d) Personal devices — Laptops, desktop computers, mobile phones (iOS and Android), and tablet devices used by identified custodians for business purposes, subject to custodian consent and C&H authorization prior to each collection;
(e) Cloud-based storage and collaboration platforms — Including, without limitation, Ashbury Holdings Cobalt Ridge Systems, Aldermere Systems, Teams, and any other cloud-based storage or collaboration platforms used by TMC US for business purposes;
(f) Backup tapes and archival media — Legacy backup tapes (LTO format) and other archival media, as directed by C&H. The scope and timing of backup tape restoration and collection will be determined by C&H on a rolling basis as the investigation progresses.
All forensic collections must be conducted using forensically defensible methods consistent with industry best practices and applicable legal standards. Specifically, Redstone shall:
(i) Create verified forensic images of all collected data using standard forensic imaging tools (e.g., Penrose Technologies, Calderon Technologies, or equivalent), with integrity verification through MD5 and/or SHA-1 hash algorithms applied at the time of acquisition;
(ii) Maintain complete and contemporaneous chain-of-custody documentation for all collected media and data, including date and time of collection, identity of the collecting technician, serial numbers and descriptions of source media, and storage location of collected data;
(iii) Preserve all original metadata associated with collected ESI, including file system metadata, email metadata, and application-specific metadata;
(iv) Prepare a written collection summary report for each collection event, to be provided to C&H within forty-eight (48) hours of completion of the collection.
On-site forensic collections shall be conducted at the principal office of TMC US located at 8750 West Sahara Avenue, Suite 210, Reno, Nevada 89117, and at such other TMC or TMC US facilities as may be identified by C&H during the course of the engagement. Remote collections shall be performed for cloud-based data sources and any other sources amenable to remote acquisition, provided that forensic defensibility is not compromised by remote collection methods.
All collections shall be coordinated with TMC's IT department exclusively through C&H. Redstone personnel shall not communicate directly with TMC or TMC US personnel regarding the substance of the DOJ investigation or the internal investigation without C&H's prior written authorization. Any operational communications with TMC IT staff necessary for the logistics of data collection (e.g., scheduling access, obtaining system credentials) shall be limited to logistical and technical matters and shall be conducted only with C&H's advance knowledge and approval.
3.2 Data Processing
Following forensic collection, Redstone shall process all collected ESI using industry-standard electronic discovery processing tools (e.g., Brightmoor Health IT, Severin Software, or equivalent). Data processing shall include the following:
(a) De-duplication — Global de-duplication and, where directed by C&H, custodian-level de-duplication of documents and email, using MD5 hash values for identification of exact duplicates;
(b) De-NISTing — Removal of known system and application files by reference to the National Institute of Standards and Technology (NIST) National Software Reference Library (NSRL), to eliminate non-responsive system files from the review population;
(c) Text extraction — Extraction of full text from all documents and email for indexing, searching, and review purposes;
(d) Optical character recognition (OCR) — Application of OCR to image-only files (including scanned PDFs, TIFF images, and similar formats) to enable full-text search capability;
(e) Metadata extraction — Extraction and preservation of all native metadata fields for each document and email, including but not limited to author, date created, date modified, date sent, date received, recipients, subject line, file path, and file type;
(f) Date-range filtering — Application of date-range parameters as specified by C&H in accordance with the Subpoena and investigation requirements. The anticipated primary date range is January 1, 2015 through March 1, 2022, encompassing the pre-conspiracy baseline period through the litigation hold date established by C&H;
(g) Exception reporting — Identification and reporting of corrupted, encrypted, password-protected, or otherwise unprocessable files. Exception reports shall be generated and provided to C&H for resolution, including file-level detail sufficient for C&H to assess the nature and significance of each exception;
(h) Near-duplicate identification — Application of near-duplicate identification algorithms (at a similarity threshold to be specified by C&H, anticipated at 85% or higher) to group substantially similar documents for efficient review;
(i) Email threading — Application of email threading analysis to organize email conversations into threaded families for inclusive-email-only review, as directed by C&H.
Redstone shall process all data in a manner that preserves the integrity and evidentiary value of the ESI, and shall maintain detailed processing logs and exception reports. Processing parameters (including any search-term culling, date filters, file-type exclusions, and domain filtering) shall be applied only upon written direction from C&H.
3.3 Hosting and Review Platform
Redstone shall host all processed data on its secure, access-controlled document review platform (the "Review Platform") for the purpose of enabling attorney review, coding, privilege analysis, quality control, and production preparation. The Review Platform must support the following functionalities at a minimum:
(a) Full-text search with Boolean operators (AND, OR, NOT) and proximity search capabilities (W/n, PRE/n);
(b) Metadata filtering and search across all extracted metadata fields;
(c) Customizable tag and coding fields, including responsiveness, privilege, confidentiality, issue coding, and production designations;
(d) Privilege-log generation functionality, enabling export of privilege-log entries from coded privilege fields;
(e) Production set management, including Bates-numbering assignment, endorsement application, and production tracking;
(f) Redaction capabilities for both text and image-based documents;
(g) Batch processing and bulk coding tools for efficient review management;
(h) Reporting and analytics dashboards, including review progress tracking, reviewer productivity metrics, and coding consistency metrics;
(i) Document family grouping and email threading visualization;
(j) Concurrent multi-user access with appropriate role-based permissions.
Redstone shall configure the Review Platform with coding panels, workflows, batching rules, and quality-control protocols as specified by C&H, consistent with C&H's Privilege Review Protocol (to be provided to Redstone prior to the commencement of managed review). User access to the Review Platform shall be strictly limited to authorized C&H attorneys, paralegals, and support staff, and to Redstone personnel with a need to access the platform for the performance of services under this Engagement Letter. Access credentials shall be managed by Redstone in coordination with C&H, with individual user accounts assigned to each authorized user and access rights controlled through role-based permissions.
Redstone shall maintain a platform uptime service level of 99.5% availability during business hours (8:00 a.m. to 8:00 p.m. Pacific Time, Monday through Friday), excluding scheduled maintenance windows, which shall be communicated to C&H at least forty-eight (48) hours in advance. In the event of unscheduled downtime, Redstone shall promptly notify C&H and provide estimated restoration timelines.
All data hosted on the Review Platform shall reside exclusively in Redstone's secure data center facilities located within the continental United States. No TMC data shall be transferred to, stored in, or processed at facilities outside the continental United States without C&H's prior written consent.
3.4 Managed Review Support
Redstone shall provide managed review support services, including the provision of contract review attorneys as requested by C&H, for first-level document review (responsiveness review), privilege review, and quality-control review. The scope and timing of managed review will be determined by C&H based on the volume of potentially responsive documents and the production schedule.
All contract review attorneys provided by Redstone must be licensed to practice law in at least one U.S. jurisdiction and must have relevant experience in document review, preferably with familiarity with antitrust or government investigation matters. All contract reviewers shall be supervised by C&H attorneys at all times during the review process and must execute individual confidentiality and non-disclosure agreements in a form approved by C&H (the form of which is attached hereto as Exhibit B) prior to commencing any review work.
C&H shall establish the review workflows, coding guidelines, quality-control protocols, and escalation procedures for the managed review. Redstone shall implement these protocols on the Review Platform and ensure that all contract reviewers are trained on the applicable coding guidelines and escalation procedures before beginning review. Redstone shall be responsible for the day-to-day operational management of the contract review team, including scheduling, batching, and first-line quality checks, subject to C&H's oversight and direction.
Redstone shall provide regular quality-control sampling reports to C&H at a frequency to be determined by C&H based on the pace of review, anticipated to be on a weekly basis during active review periods. Quality-control reports shall include, at a minimum: (i) review volumes by reviewer and by date; (ii) random-sample quality-check results, including error rates by coding field; (iii) escalation summaries; and (iv) any identified trends or anomalies in coding decisions.
3.5 Production Services
Redstone shall prepare rolling document productions for submission to the DOJ in compliance with DOJ production specifications and C&H's direction. Production preparation shall include the following:
(a) Production formatting — Documents shall be produced in the format required by the DOJ. The anticipated production format is as follows: (i) load files (Concordance/Opticon format) with extracted text files; (ii) native-format production for spreadsheets (e.g., .xlsx, .csv), presentations (e.g., .pptx), and other file types where native production is required or appropriate; (iii) single-page TIFF images with associated OCR text files for all other document types; and (iv) full metadata load files accompanying each production.
(b) Bates numbering — Application of Bates numbering to all produced documents in a numbering convention to be specified by C&H (anticipated prefix: TMC-GJ-).
(c) Endorsements and redactions — Application of confidentiality endorsements and privilege redactions as directed by C&H.
(d) Privilege log generation — Generation of privilege logs from coded privilege data in the Review Platform, in a format consistent with DOJ requirements and C&H's specifications.
(e) Production quality assurance — Pre-production quality-assurance checks to verify completeness, accuracy of Bates numbering, image quality, text file accuracy, and metadata integrity.
The first rolling production is targeted for on or about April 4, 2022 (approximately three weeks from the effective date of this engagement), subject to data volume, collection and processing timelines, and DOJ scheduling. Subsequent rolling productions shall be prepared and delivered on a schedule to be determined by C&H in coordination with the DOJ, with Redstone providing support on a timeline basis consistent with the production schedule.
4. Fee Schedule and Billing
4.1 Rate Card
Redstone's fees for services provided under this Engagement Letter shall be calculated in accordance with the Redstone rate card attached hereto as Exhibit C (the "Rate Card"). The following summarizes the general fee structure; specific rates are as set forth in Exhibit C:
(a) Forensic collection services — Billed on a per-custodian and per-device basis:
(i) On-site forensic collection: Per-custodian fee inclusive of forensic imaging, hash verification, chain-of-custody documentation, and collection summary reporting, at the rate specified in Exhibit C.
(ii) Remote collection (cloud sources): Per-data-source fee at the rate specified in Exhibit C.
(iii) Personal device collection: Per-device fee at the rate specified in Exhibit C, inclusive of forensic imaging and hash verification.
(b) Data processing — Billed per gigabyte of native data ingested for processing, at the rate specified in Exhibit C. Processing fees include de-duplication, de-NISTing, text extraction, OCR, metadata extraction, and loading to the Review Platform.
(c) Hosting — Billed per gigabyte per month of data hosted on the Review Platform, at the rate specified in Exhibit C. Review Platform licensing fees are included in hosting fees at no additional charge.
(d) Managed review contract attorneys — Billed at hourly rates as specified in Exhibit C, which vary by reviewer seniority and experience level. Anticipated hourly rate range is set forth in Exhibit C.
(e) Production services — Billed per document produced or per gigabyte of production output, as specified in Exhibit C, inclusive of image conversion, Bates stamping, endorsement application, and load-file generation.
(f) Project management — Neil Ashworth's project management time shall be billed at the hourly rate specified in Exhibit C.
(g) Travel and on-site expenses — Billed at actual cost incurred, including airfare, lodging, ground transportation, and per diem. Any individual travel or on-site expense exceeding Two Thousand Five Hundred Dollars ($2,500) must receive C&H's prior written approval.
4.2 Budget Estimate
Based on the preliminary scope assessment conducted by C&H and Redstone, the engagement is anticipated to involve the following approximate parameters: thirty-four (34) custodians; an estimated total collected data volume in the range of several terabytes; and an anticipated document universe, post-processing and prior to search-term culling, of several hundred thousand documents. Redstone's estimated total fees for the initial subpoena response phase (collection, processing, hosting, first-level review, and initial rolling productions) are incorporated into C&H's overall matter budget.
C&H's initial budget estimate for the entire matter — encompassing the internal investigation and grand jury defense phase — is approximately Twelve Million Dollars ($12,000,000.00). Redstone's estimated portion for e-discovery and forensic services constitutes a component of that overall budget and will be determined more precisely as data volumes are confirmed following collection and processing. The parties acknowledge that actual total Redstone fees will depend on data volumes collected, processed, and hosted, and on the ultimate scope and duration of managed review, which in turn will be influenced by the pace and direction of the DOJ investigation.
Redstone shall use commercially reasonable efforts to keep C&H informed of projected fee accruals and shall promptly notify C&H if actual or projected fees are expected to materially exceed the initial estimates.
4.3 Invoicing and Payment
Redstone shall submit monthly invoices to Calderwood & Harkness LLP, addressed as follows:
Calderwood & Harkness LLP
Attention: Howard Bellamy, Billing Partner
One Liberty Plaza, 50th Floor New York, New York 10006
Each invoice shall be itemized by service category (collection, processing, hosting, managed review, production, project management, and expenses), with supporting detail sufficient to enable C&H to verify the charges, including data volumes, hourly time entries with task descriptions, and per-unit calculations.
Payment terms are Net Thirty (30) days from C&H's receipt of a properly submitted invoice. C&H shall be responsible for payment of Redstone's fees and expenses under this Engagement Letter. TMC is not directly obligated to Redstone under this Engagement Letter, and Redstone shall have no right of action against TMC for fees or expenses. C&H will seek reimbursement of Redstone's fees and expenses from TMC under the terms of C&H's separate engagement letter with TMC. Late payments shall bear interest at the rate of one percent (1%) per month or the maximum rate permitted by applicable law, whichever is less.
5. Confidentiality Obligations
5.1 Definition of Confidential Information
For purposes of this Engagement Letter, "Confidential Information" means all information, in any form or medium, provided to Redstone by C&H or TMC, or generated by Redstone in the course of performing services under this Engagement Letter, including but not limited to:
(a) Documents, data, ESI, and physical media collected from TMC or TMC US systems and custodians;
(b) Interview materials, witness statements, interview memoranda, and related notes;
(c) Legal theories, investigation strategy, legal research, case assessments, and related work product prepared by C&H;
(d) Privileged communications between C&H and TMC, and between C&H and Redstone;
(e) Investigation findings, interim conclusions, and reports prepared by C&H or Redstone;
(f) The identity and scope of the DOJ investigation, including the existence of Grand Jury No. GJ-22-0194 and Subpoena No. GJ-22-0194-SD-003;
(g) The identities of custodians, witnesses, subjects, targets, and cooperating entities;
(h) Information regarding the products at issue in the investigation, including high-purity feldspar, industrial talc, and rare-earth concentrates;
(i) The identities of co-subjects in the investigation, including Ridgecrest Minerals Inc. and Pinnacle Earth Resources Ltd., and the identity of any cooperating entity, including Cascade Chemical Supply Co.;
(j) All derivative work product, analyses, reports, coding decisions, privilege determinations, and production materials prepared by Redstone or C&H in connection with this engagement.
5.2 Non-Disclosure Obligations
Redstone shall not disclose, publish, disseminate, or otherwise make available any Confidential Information to any third party without the prior written consent of C&H. Redstone shall limit internal access to Confidential Information exclusively to those Redstone personnel (including employees, contractors, and contract review attorneys) who have a demonstrable need to know such information for the performance of services under this Engagement Letter.
Redstone shall require all personnel with access to Confidential Information to execute individual confidentiality agreements in a form approved by C&H prior to being granted access to any Confidential Information or to the Review Platform. Redstone shall maintain a current log of all individuals who have executed such agreements and who have been granted access to Confidential Information, and shall make such log available to C&H upon request.
Redstone shall implement reasonable administrative, technical, and physical safeguards to protect the confidentiality of Confidential Information, consistent with the data security requirements set forth in Section 6 below.
The confidentiality obligations set forth in this Section 5 shall survive the termination or expiration of this Engagement Letter and shall continue in perpetuity with respect to attorney-client privileged materials and attorney work product. With respect to all other Confidential Information, the confidentiality obligations shall continue for a period of five (5) years following the termination of the engagement, or such longer period as may be required by applicable law.
5.3 Grand Jury Secrecy
Redstone acknowledges that certain materials and information relating to the grand jury proceedings in Grand Jury No. GJ-22-0194 are subject to the secrecy requirements of Federal Rule of Criminal Procedure 6(e). Redstone shall comply with all applicable grand jury secrecy obligations and shall not disclose any matters occurring before the grand jury, or any documents or information obtained in connection with grand jury proceedings, except as expressly directed by C&H and permitted by applicable law.
Redstone understands that unauthorized disclosure of grand jury materials may constitute a criminal offense and may subject the disclosing party to sanctions, including contempt of court. Redstone shall ensure that all personnel with access to grand jury materials are informed of these secrecy obligations and the consequences of any breach.
5.4 Return and Destruction of Materials
Upon termination or expiration of this Engagement Letter, or upon C&H's written request at any time during the engagement, Redstone shall, at C&H's direction, either: (a) return to C&H all Confidential Information and data in Redstone's possession, custody, or control, in a format and medium specified by C&H; or (b) securely destroy all such Confidential Information and data using methods consistent with NIST Special Publication 800-88 (Guidelines for Media Sanitization) or equivalent industry standards.
Within thirty (30) days of completing the return or destruction, Redstone shall provide C&H with a written certification, signed by an authorized officer of Redstone, confirming that all Confidential Information and data have been returned or destroyed in accordance with this Section 5.4, and identifying the method of return or destruction employed.
Notwithstanding the foregoing, Redstone may retain one (1) archival copy of Confidential Information solely to the extent required by Redstone's own legal and regulatory obligations (including records-retention requirements applicable to Redstone's business), provided that any such retained copy remains subject to the confidentiality obligations of this Section 5 and is maintained in a secure environment with access restricted to Redstone's legal and compliance personnel.
6. Data Security and Information Governance
Redstone shall maintain industry-standard data security protocols and safeguards to protect the confidentiality, integrity, and availability of all TMC data and Confidential Information in Redstone's possession. At a minimum, Redstone shall implement and maintain the following security controls:
(a) Encryption — Encryption of all data at rest using Advanced Encryption Standard (AES) with a minimum key length of 256 bits (AES-256), or an equivalent encryption standard. Encryption of all data in transit using Transport Layer Security (TLS) version 1.2 or higher.
(b) Access controls — Role-based access controls (RBAC) limiting access to TMC data and Confidential Information to authorized personnel only. Multi-factor authentication (MFA) required for all user access to the Review Platform and to Redstone systems storing TMC data.
(c) Audit logging — Comprehensive audit logging of all user access to TMC data, including login/logout events, document access events, data export events, coding and tagging events, and administrative actions. Audit logs shall be retained for the duration of the engagement and for a period of not less than two (2) years following termination.
(d) Physical security — Physical security controls at all data center facilities where TMC data is stored, including controlled access points, video surveillance, biometric or badge-based access controls, and 24/7 on-site security personnel or monitoring.
(e) Vulnerability management — Regular vulnerability assessments and penetration testing of systems and applications used to store or process TMC data, conducted no less frequently than annually, with results and remediation efforts documented and available for C&H's review upon request.
(f) Employee training — Regular security awareness training for all Redstone personnel with access to TMC data, conducted no less frequently than annually.
(g) Incident response — A documented incident response plan that includes procedures for identification, containment, eradication, recovery, and notification in the event of a data security incident.
Redstone shall promptly notify C&H, in writing and by telephone, within twenty-four (24) hours of discovering any actual or reasonably suspected data security breach, unauthorized access, or other security incident involving TMC data or Confidential Information. Such notification shall include, to the extent known at the time of notification: (i) a description of the nature and scope of the incident; (ii) the categories and approximate volume of data affected; (iii) the measures taken or proposed to contain and remediate the incident; and (iv) a designated point of contact for further communications regarding the incident.
All Redstone data center facilities where TMC data is stored or processed must be located within the continental United States. Redstone shall not transfer, transmit, or otherwise make accessible any TMC data to locations outside the continental United States without C&H's prior written consent.
Redstone shall comply with all applicable federal and state data protection laws and regulations, including but not limited to the California Consumer Privacy Act (CCPA) and any other privacy or data security law applicable to the handling of the data collected under this Engagement Letter.
7. Privilege and Work-Product Protections
The parties reiterate and emphasize that all services performed by Redstone under this Engagement Letter are performed under the direction and supervision of C&H attorneys for the express purpose of providing legal advice and litigation support to TMC in connection with the DOJ investigation and internal investigation. The engagement is structured to preserve and protect the attorney-client privilege and the work-product doctrine to the fullest extent permitted by law.
All communications between C&H and Redstone regarding the substantive direction, analysis, and findings of the engagement are intended to be privileged and/or protected attorney work product. Redstone shall treat all such communications as privileged and shall not disclose the substance of any such communications to any third party, including TMC personnel, without C&H's express prior written authorization.
Redstone shall not produce, disclose, or provide access to any Engagement Materials, TMC data, Confidential Information, or other materials in Redstone's possession related to this engagement to any party other than authorized C&H personnel without C&H's prior written consent. This prohibition applies regardless of the source or nature of any request for such materials, whether from TMC directly, government agencies, third parties, or any other person or entity.
In the event that Redstone receives a subpoena, court order, civil investigative demand, regulatory request, or other compulsory legal process seeking materials related to this engagement or to TMC data in Redstone's possession, Redstone shall:
(a) Promptly notify C&H, in writing and by telephone, within twenty-four (24) hours of receiving such process;
(b) Provide C&H with a copy of the subpoena, order, or other process;
(c) Not produce any materials or provide any testimony in response to such process without C&H's prior written consent or a final, non-appealable order of a court of competent jurisdiction;
(d) Cooperate with C&H in seeking protective orders, motions to quash, or other appropriate legal remedies to prevent or limit disclosure.
The privilege and work-product protections described in this Section 7 are the property of TMC as the privilege holder and may be waived only by TMC, acting through C&H as its legal counsel.
8. Conflicts of Interest
Redstone represents and warrants that it has conducted a thorough conflict-of-interest check with respect to the parties, entities, and individuals involved in or related to the DOJ investigation and the matters that are the subject of this Engagement Letter. Redstone further represents and warrants that, as of the date of this Engagement Letter, it does not currently provide services — and has not within the preceding twelve (12) months provided services — to any of the following entities or individuals, or their legal counsel, in connection with the same or any related matter:
(a) Ridgecrest Minerals Inc., or its counsel, Davenport, Kline & Archer LLP;
(b) Pinnacle Earth Resources Ltd., or its counsel, Ashford Whitmore LLP;
(c) Cascade Chemical Supply Co., or its counsel, Whitfield, Strauss & Tully LLP;
(d) The United States Department of Justice, Antitrust Division, in connection with any investigation of the North American specialty-minerals sector;
(e) Any individual identified as a subject, target, or witness in the DOJ investigation, including Gavin Holt, former Vice President of Commercial Operations at TMC US, or his personal counsel, Briarcliff Law Group PLLC.
Redstone acknowledges that any undisclosed conflict of interest could compromise the integrity of the engagement and could have severe adverse consequences for TMC and C&H. Redstone shall promptly notify C&H in writing if, at any time during the course of the engagement, Redstone becomes aware of any actual or potential conflict of interest involving any party to or participant in the DOJ investigation or related matters. In the event of a conflict that cannot be resolved to C&H's satisfaction, C&H shall have the right to terminate this Engagement Letter immediately upon written notice.
9. Term and Termination
This Engagement Letter shall become effective on March 15, 2022, and shall continue in effect until terminated by either party in accordance with this Section 9 or until all services have been completed and the parties mutually agree that the engagement has concluded.
Either party may terminate this Engagement Letter without cause upon thirty (30) days' prior written notice to the other party. C&H may terminate this Engagement Letter immediately upon written notice to Redstone for cause, including without limitation:
(a) Any material breach by Redstone of the confidentiality obligations set forth in Section 5;
(b) Any material breach by Redstone of the data security obligations set forth in Section 6;
(c) Any conflict of interest that arises during the engagement and cannot be resolved to C&H's satisfaction;
(d) Any other material breach by Redstone of its obligations under this Engagement Letter that is not cured within ten (10) days of written notice from C&H specifying the breach.
Upon termination of this Engagement Letter for any reason:
(a) Redstone shall, at C&H's direction, complete any in-progress document productions that are due or imminent at the time of termination, and shall cooperate in good faith with C&H and any successor vendor in the orderly transfer of all data, work product, and Engagement Materials;
(b) Redstone shall comply with the data return and destruction provisions of Section 5.4 within the timeframes specified therein;
(c) C&H shall pay Redstone for all services performed and expenses incurred through the effective date of termination, in accordance with the fee and payment terms of Section 4;
(d) All provisions of this Engagement Letter that by their nature are intended to survive termination shall survive, including without limitation the confidentiality obligations (Section 5), data security obligations (Section 6), privilege protections (Section 7), conflicts obligations (Section 8), limitation of liability and indemnification (Section 10), and governing law and dispute resolution provisions (Section 13).
10. Limitation of Liability and Indemnification
10.1 Limitation of Liability
Redstone's aggregate liability for all claims, losses, damages, and expenses arising under or in connection with this Engagement Letter shall not exceed the total fees actually paid by C&H to Redstone under this Engagement Letter during the twelve (12) months preceding the event giving rise to the claim. The foregoing limitation of liability shall not apply to claims arising from: (a) Redstone's breach of the confidentiality obligations set forth in Section 5; (b) a data security breach resulting from Redstone's failure to maintain the security controls required by Section 6; or (c) Redstone's gross negligence, willful misconduct, or fraud.
In no event shall either party be liable to the other for any indirect, incidental, consequential, special, or punitive damages, including lost profits or lost business opportunities, regardless of whether such damages were foreseeable or whether the party has been advised of the possibility of such damages. This exclusion of consequential damages shall not apply to breaches of confidentiality or data security obligations.
10.2 Indemnification by Redstone
Redstone shall indemnify, defend, and hold harmless C&H and TMC, and their respective partners, officers, directors, employees, agents, and affiliates, from and against any and all claims, losses, damages, liabilities, costs, and expenses (including reasonable attorneys' fees and costs of investigation) arising out of or relating to: (a) Redstone's breach of the confidentiality obligations set forth in Section 5; (b) Redstone's breach of the data security obligations set forth in Section 6; (c) any negligent acts, errors, or omissions of Redstone or its personnel in the performance of services under this Engagement Letter; or (d) any breach of Redstone's representations and warranties contained herein.
10.3 Indemnification by C&H
C&H shall indemnify, defend, and hold harmless Redstone and its officers, directors, employees, and agents from and against any and all claims, losses, damages, liabilities, costs, and expenses (including reasonable attorneys' fees) arising out of or relating to: (a) C&H's breach of its obligations under this Engagement Letter; or (b) claims by TMC against Redstone arising from the engagement, provided that Redstone has performed its services in material compliance with the terms and requirements of this Engagement Letter.
11. Independent Contractor Status
Redstone is engaged as an independent contractor and not as an employee, partner, joint venturer, or agent of C&H or TMC, except to the limited extent that Redstone is characterized as an agent of counsel for the purposes of preserving attorney-client privilege and work-product protections as set forth in Section 2 of this Engagement Letter. Nothing in this Engagement Letter shall be construed to create an employment, partnership, or joint venture relationship between C&H and Redstone, or between TMC and Redstone.
Redstone shall be solely responsible for all aspects of its employment relationships with its personnel, including without limitation compensation, benefits, taxes, insurance, workers' compensation, and compliance with all applicable labor and employment laws. Redstone shall be solely responsible for the payment of all federal, state, and local taxes arising from the compensation paid to Redstone under this Engagement Letter, including income taxes, self-employment taxes, and any other applicable taxes.
12. Insurance
Redstone shall maintain, at its own expense, the following insurance coverage during the term of this Engagement Letter and for a period of not less than two (2) years following the termination of the engagement:
(a) Professional liability (errors and omissions) insurance — With minimum coverage limits of Five Million Dollars ($5,000,000) per occurrence and Ten Million Dollars ($10,000,000) in the aggregate, covering claims arising from Redstone's professional services under this Engagement Letter;
(b) Cyber liability / data breach insurance — With minimum coverage limits of Ten Million Dollars ($10,000,000) per occurrence and in the aggregate, covering claims arising from data breaches, unauthorized access, and other cybersecurity incidents involving data in Redstone's possession or control;
(c) Commercial general liability insurance — With minimum coverage limits of Two Million Dollars ($2,000,000) per occurrence and Four Million Dollars ($4,000,000) in the aggregate;
(d) Workers' compensation insurance — As required by applicable law.
Redstone shall provide C&H with certificates of insurance evidencing the above-described coverage upon execution of this Engagement Letter and upon C&H's request at any time during the engagement. Such certificates shall name Calderwood & Harkness LLP as an additional insured where applicable. Redstone shall provide C&H with not less than thirty (30) days' prior written notice of any material change in, cancellation of, or non-renewal of any required insurance coverage.
13. Governing Law and Dispute Resolution
This Engagement Letter shall be governed by, and construed in accordance with, the laws of the State of California, without regard to its conflict-of-laws principles.
Any dispute, claim, or controversy arising out of or relating to this Engagement Letter, or the breach, termination, enforcement, interpretation, or validity thereof, including the determination of the scope or applicability of this agreement to arbitrate, shall be resolved by binding arbitration in San Francisco, California, administered by JAMS pursuant to its Comprehensive Arbitration Rules and Procedures. The arbitration shall be conducted by a single arbitrator mutually agreed upon by the parties, or, in the absence of agreement, selected by JAMS in accordance with its rules. The arbitrator's award shall be final and binding, and judgment upon the award may be entered in any court of competent jurisdiction.
Notwithstanding the foregoing arbitration provision, either party may seek temporary or preliminary injunctive relief, specific performance, or other equitable remedies in a court of competent jurisdiction located in San Francisco, California, to prevent or restrain any actual or threatened breach of the confidentiality, data security, or privilege obligations set forth in Sections 5, 6, and 7 of this Engagement Letter, without the necessity of posting a bond or other security and without proving actual damages. The exercise of such rights shall not constitute a waiver of the right to submit any dispute to arbitration.
Each party shall bear its own costs and attorneys' fees in connection with any arbitration or litigation under this Section 13, except that the prevailing party in any arbitration or litigation to enforce the terms of this Engagement Letter shall be entitled to recover its reasonable attorneys' fees and costs from the non-prevailing party.
14. Miscellaneous Provisions
Entire Agreement. This Engagement Letter, together with the exhibits attached hereto or incorporated herein by reference (Exhibits A, B, and C), constitutes the entire agreement between C&H and Redstone with respect to the subject matter hereof and supersedes all prior and contemporaneous oral and written agreements, understandings, negotiations, and discussions between the parties relating to the engagement.
Amendments. No amendment, modification, or waiver of any provision of this Engagement Letter shall be effective unless in writing and signed by authorized representatives of both C&H and Redstone.
Assignment. Redstone may not assign, delegate, or subcontract any portion of the services to be performed under this Engagement Letter, or any of its rights or obligations hereunder, without the prior written consent of C&H. Any purported assignment or subcontracting without C&H's consent shall be void and of no effect. C&H may assign its rights under this Engagement Letter to any successor firm or entity without Redstone's consent, provided that such successor assumes C&H's obligations hereunder.
Notices. All notices, requests, demands, and other communications required or permitted under this Engagement Letter shall be in writing and shall be deemed duly given when: (a) delivered personally; (b) sent by overnight courier (with confirmation of delivery); or (c) sent by certified mail, return receipt requested, postage prepaid, addressed to the parties as follows: