Preview
GLENN AGRE BERGMAN & FUENTES LLP
LYN R. AGRE (CASBN 178218)
EDWARD E. SHAPIRO (CASBN 326182)
44 Montgomery Street, Suite 2410
San Francisco, CA 94104
Telephone: (415) 599-0880
lagre@glennagre.com
eshapiro@glennagre.com
Attorneys for Individual Defendants
Geoffrey Peterson, Timothy Cordell,
and Devin Tomcik
SUPERIOR COURT OF THE STATE OF CALIFORNIA
COUNTY OF SANTA CLARA
TRACE3, LLC a California limited liability CASE NO. 23CV415833
company, Assigned to: Hon. Sunil R. Kulkarni
Plaintiff, DECLARATION OF EDWARD E.
SHAPIRO IN SUPPORT OF
INDIVIDUAL DEFENDANTS’
SYCOMP A TECHNOLOGY COMPANY, OPPOSITION TO PLAINTIFF TRACE3,
INC., a California corporation; TIMOTHY LLC’S EX PARTE APPLICATION FOR
CORDELL, an individual; LILIAN ELIAS, an AN ORDER CONTINUING THE
individual; GEOFF PETERSON, an individual; BRIEFING SCHEDULE AND HEARING
DEVIN TOMCIK, an individual; and DOES 1- ON TRACE3, LLC’S MOTION FOR
10, inclusive; PRELIMINARY INJUNCTION
Defendants. Date: September 1, 2023
Time: 4:00 p.m.
Dept: 1
Action Filed: May 12, 2023
DECLARATION OF EDWARD E. SHAPIRO IN SUPPORT OF
INDIVIDUAL DEFENDANTS’ OPPOSITION TO TRACE3’S EX PARTE APPLICATION
Case No. 23CV415833
DECLARATION OF EDWARD E. SHAPIRO
I, Edward E. Shapiro, declare as follows:
I am a member of the firm Glenn Agre Bergman & Fuentes LLP, counsel for
Individual Defendants Geoffrey Peterson, Timothy Cordell, and Devin Tomcik (“Individual
Defendants”) in this action. I submit this declaration in support of Individual Defendants’
Opposition to Plaintiff Trace3, LLC’s Ex Parte Application for an Order Continuing the Briefing
Schedule and Hearing on Trace3, LLC’s Motion for Preliminary Injunction. I am fully familiar
with and have personal knowledge of the matters described herein.
On May 23, 2023, the Court issued an order that, in part, authorized “limited
expedited discovery” to aid the parties in briefing and preparing for the Motion for Preliminary
Injunction hearing.
On June 12, 2023, Trace3 served discovery requests to the Individual Defendants,
and the Individual Defendants responded on June 19, 2023.
Trace3 indicated it believed the responses were deficient, and the Court instructed
Trace3 to move to compel further responses if Trace3 deemed necessary. Nevertheless, Trace3
elected not to move to compel. Trace3 thereby waived its entitlement to seek discovery from the
Individual Defendants on the subjects at issue in its first set of requests.
By Order of the Court dated August 22, 2023, the parties were directed to meet
and confer regarding whether searches of the mirrored images would occur and, if so, how and
when. The Order did not specify a deadline by which the parties were required to meet and
confer.
On the afternoon of August 24, 2023, Trace3’s counsel sent a demand letter to
meet and confer regarding search terms for and parameters of the neutral forensic examination.
See Declaration of Nicole S. Phillis in Support of Ex Parte Application for an Order Continuing
Schedule on Trace3, LLC’s Motion for Preliminary Injunction (“Phillis Dec.”), Ex B. Trace3’s
demand letter states that Trace3 was in the process of engaging FTI Consulting (“FTI”), a
supposedly neutral forensic examiner.
DECLARATION OF EDWARD E. SHAPIRO IN SUPPORT OF
INDIVIDUAL DEFENDANTS’ OPPOSITION TO TRACE3’S EX PARTE APPLICATION
CASE NO. 23CV415833
At 8:30 a.m. PT, on August 27, 2023, I responded to Trace3’s counsel, explaining
that Trace3’s demand letter contradicts the Court’s August 22 Order and adopted protocol. First,
I explained that, while Trace3 is responsible for payment of FTI’s invoices, FTI must be mutually
engaged by Trace3 and the Individual Defendants and accordingly subject only to mutual
direction from both parties—facets inherent to the notion of a “neutral” retention. I accordingly
requested a proposed engagement letter for the Individual Defendants and Sycomp to review.
I further explained that, given the Individual Defendants’ prior imaging of their
devices and Trace3’s declination of the use of those images, the Individual Defendants are not
required to part with their personal devices, and FTI will need to create all images at the
Individual Defendants’ residences. I did not inform Trace3’s counsel that FTI would need to “fly
out” to each Individual Defendant.
Finally, I noted that Trace3’s proposal seeks to impose material aspects of its
previous proposal that the Court rejected outright. For example, Trace3’s proposal attempts to
broaden the universe of devices to be imaged, as well as to direct FTI to run searches on the
images collected and to release any image of any device to Trace3, its counsel, or its forensic
expert.
In my August 27 email, I informed Trace3’s counsel that, due to commitments to
other clients and vacation schedules, counsel for the Individual Defendants would not be
available to meet and confer until Tuesday, August 29.
Counsel for Trace3 circulated a proposed FTI engagement letter on August 28 at
10 a.m. PT. This letter presupposed that FTI would be retained by only Trace3, despite the
Court’s Order and my August 27 email.
On August 30 at 1:40 p.m. PT, the Individual Defendants provided Trace3 with
proposed revisions to the FTI engagement letter that would allow for a tripartite engagement in
line with the Court’s Order. The one-sided nature of the initially proposed FTI engagement letter
is reflected in the necessity for extensive revisions. Attached hereto as Exhibit A is a “redline”
of the Individual Defendants’ revisions to the FTI engagement letter.
DECLARATION OF EDWARD E. SHAPIRO IN SUPPORT OF
INDIVIDUAL DEFENDANTS’ OPPOSITION TO TRACE3’S EX PARTE APPLICATION
CASE NO. 23CV415833
As of this filing, Trace3 has not responded to the Individual Defendant’s revisions
or otherwise taken any action to finalize the engagement – save for suggesting that the parties and
FTI schedule a call to discuss unspecified details.
Despite just having received Trace3’s proposed FTI engagement letter, counsel for
the Individual Defendants met and conferred with counsel for Trace3 on August 29.
On that meet and confer, counsel for Trace3 raised the issue of a potential
extension of the briefing and hearing schedule for Trace3’s Motion for Preliminary Injunction.
I was surprised by this discussion, as Trace3 had failed to respond to Sycomp’s
counter proposal regarding a potential extension of the schedule on August 23, 2023. See Phyllis
Dec., Ex. A at 1. I reminded counsel for Trace3 that Sycomp’s proposal had gone unanswered,
and that the Individual Defendants would wait until Trace3 responded in that regard to weigh in
on a potential extension of time.
Counsel for Trace3 appeared surprised to hear that no response to Sycomp’s
proposal had been provided.
I declare under penalty of perjury under the laws of the State of California that the
foregoing is true and correct.
Executed this 1st day of September 2023.
/s/ Edward E. Shapiro
Edward E. Shapiro
DECLARATION OF EDWARD E. SHAPIRO IN SUPPORT OF
INDIVIDUAL DEFENDANTS’ OPPOSITION TO TRACE3’S EX PARTE APPLICATION
CASE NO. 23CV415833
EXHIBIT A
Tracy L. Wilkison
350 S. Grand Avenue
Suite # 3000
Los Angeles, CA 90071
626-200-7635
Tracy.Wilkison@fticonsulting.com
www.fticonsulting.com Formatted: English (United States)
August 2530, 2023
Nicole Phillis
Davis Wright Tremaine LLP
865 S. Figueroa Street, Suite 2400
Los Angeles, CA 90017
Counsel for Trace3, LLC Formatted: Font: Italic
[Address]
Lyn R. Agre
Edward E. Shapiro
Glenn Agre Bergman & Fuentes LLP
44 Montgomery Street, Suite 2410
San Francisco, CA 94104
lagre@glennagre.com
eshapiro@glennagre.com
Counsel for Timothy Cordell,
Geoffrey Peterson, and Devin Tomcik
Re: Trace3, LLC v. Sycomp, et al.
Dear Counsel:
This letter will confirm the retention of FTI Consulting, Inc. (“FTI”) by Davis Wright Tremaine (“DWT”) in
connection with its representation of Trace3, LLC (“Trace3”) and Glenn Agre Bergman & Fuentes LLP
(“GABF” and together with DWT, “Counsel”) in connection with its representation of Trace3 (“Client
Timothy Cordell, Geoffrey Peterson, and Devin Tomcik (the “Individual Defendants,” and together with
Trace3, the “Clients”) to provide neutral cybersecurity and forensic examination services (the
“Engagement”) in connection with Trace3 v. Sycomp et al., 23CV415833, filed in the Superior Court of Formatted: Font: Italic
California, Santa Clara County.
FTI’s work is to assist on the above -referenced matter upon receiving joint instructions from all Counsel
and to perform such other tasks as may be identified during the course of this Engagement. Should
Counsel or Client request that someone from FTI provide expert testimony in based on joint instructions
from all Counsel. For the future, FTI will discuss and mutually agree on which FTI professional would serve
asavoidance of doubt, FTI is not authorized to turn over any devices belonging to the expert and such
Trace3, LLC v. Sycomp, et al.
Davis Wright Tremaine, LLP and Glenn Agre Bergman & Fuentes LLP
August 2529, 2023
Page 2 of 21
activity may be subject to a separate retention letter.Individual Defendants, or images of those devices,
to DWT or Trace3 without the Individual Defendants’ and/or GABF’s express written consent.
All professional conclusions will be those of the FTI professionals working on this matter. Counsel and the
ClientClients will make available to FTI the information, equipment, documents and access necessary for
FTI to perform requested services. Should FTI determine that additional documents are necessary, FTI
will make all requests for such records through Counsel.
I will maintain overall administrative responsibility for the Engagement, including billing and client
relations. I will be actively involved in the performance of the Engagement and will use such other staff
for assistance as deemed necessary. FTI’s work will be billed at stated hourly rates applied to productive
hours engaged in providing service and out-of-pocket expenses. Hourly rates are based upon the
experience and skills of the personnel involved. Hourly rate ranges by professional level are:
Formatted: Body Text
Professional Level Cybersecurity Rates
Senior Managing Director $940 $1350
Managing Director $830 $920
Senior Director $780 $810
Director $670 $765
Senior Consultant $515-$610
Consultant $405 $470
Project Assistant $175 $275
FTI understands that ClientDWT and/or Trace3 will be solely responsible for payment of its fees and
expenses and, that GABF and the Client hasIndividual Defendants bear no responsibility for payment of
FTI’s fees and expenses, that the Clients have been notified of the terms of this agreement, and that the
Client hasClients have authorized Counsel to enter into this agreement on Client’sthe Clients’ behalf. As
such, FTI will submit invoices for its fees and expenses incurred in connection with this Engagement
directly to the ClientTrace3, with a copy sent to Counsel. The parties acknowledge and agree that the
attorney-client privilege between Counsel and FTI shall remain notwithstanding the fact that Client is
billed directly for services provided under this Engagement. The name and address of the ClientTrace3’s
designee to receive and approve FTI’s invoice is indicated on the signature page of this letter.
A copy of FTI’s terms and conditions, which Counsel and Clientthe Clients accept and hereby agree to, is
attached, and together with this letter of engagement, constitute the “Engagement Contract.”
Counsel and the ClientClients acknowledge their respective agreement with this Engagement Contract as
evidenced by its signatures below. In the event only Counsel is executing on behalf of its Clientthe Clients,
Counsel represents and warrants that Client hasClients have been notified of the terms of this
Engagement Contract, agreesagree to be bound hereby and hashave authorized Counsel to enter into this
Engagement Contract on Client’sthe Clients’ behalf. Please return to FTI the signed copy of this
Engagement Contract. FTI will not be able to begin work until it has received an executed Engagement
Contract. If this Engagement Contract is not executed by Counsel and/or the ClientClients and returned
to FTI within ten days of the date of this letter, the offer to provide services is revoked and this
Engagement Contract shall be deemed null and void.
FTI Reference Number: _____________
Rev. 10.07.22
Trace3, LLC v. Sycomp, et al.
Davis Wright Tremaine, LLP and Glenn Agre Bergman & Fuentes LLP
August 2529, 2023
Page 3 of 21
Very truly yours,
FTI CONSULTING, INC.
By:
______________________________
Tracy Wilkison
Senior Managing Director
Cybersecurity
FTI Reference Number: _____________
Rev. 10.07.22
Trace3, LLC v. Sycomp, et al.
Davis Wright Tremaine, LLP and Glenn Agre Bergman & Fuentes LLP
August 2529, 2023
Page 4 of 21
Accepted by: Davis Wright Tremaine, LLP
By:
Print Name:
Title:
Date:
Email:
Accepted by: Trace3, LLC
By:
Print Name:
Title:
Date:
Email:
Accepted by: Glenn Agre Bergman & Fuentes LLP, counsel for Timothy Cordell, Geoffrey Peterson, and
Devin Tomcik
By:
Print Name:
Title:
Date:
Email:
Name and Address of person designated to receive and approve invoices related to this Engagement:
Name:
Address:
Phone:
Email:
FTI policy requires that we have contact information on file for the partyparties ultimately responsible
for payment (ClientTrace3) to FTI. If this person(s) is different than the person designated above to
receive and approve invoices, please complete:
Name:
FTI Reference Number: _____________
Rev. 10.07.22
Trace3, LLC v. Sycomp, et al.
Davis Wright Tremaine, LLP and Glenn Agre Bergman & Fuentes LLP
August 2529, 2023
Page 5 of 21
Address:
Phone:
Email:
Does ClientTrace3 require invoices to be submitted via an electronic billing system? Yes:____ No:____
If yes, which billing system? ________________________
FTI TERMS AND CONDITIONS
FTI’s rates are subject to adjustment from time to time and at least annually effective October 1. FTI will
advise Clientthe Clients and Counsel immediately if a rate adjustment is being made. Further, if any work
needs to be performed by FTI personnel in our international offices, such work will be billed at the rates
set forth for the specific international office.
FTI will bill for reimbursement of reasonable and customary out-of-pocket expenses that are directly
incurred on the Engagement, such as messenger, travel, meals, accommodations, computing resources,
and other expenses specifically related to the Engagement. FTI will also bill 10.0% of FTI’s professional
fees as a reasonable allocation of non-direct expenses such as cybersecurity-related equipment,
administrative support and other overhead expenses that are not billed as direct reimbursable expenses.
Further, if FTI and/or any of its employees are required to testify or provide evidence at or in connection
with any judicial or administrative proceeding relating to this Engagement to which FTI is not a party,
ClientTrace3 will compensate FTI at its stated hourly rates and reimburse FTI for reasonable direct and
allocated expenses (including counsel fees) with respect thereto.
All payments will be due upon receipt of the invoice. For your information and use, FTI’s Taxpayer
Identification Number is 52-1261113. In the event ClientTrace3 disputes any of the fees or expenses on
a specific invoice, the ClientTrace3 shall notify FTI within twenty (20) days of receipt of the invoice of such
a dispute. If Client failsTrace3 fail to notify FTI within the twenty (20) day period, the ClientTrace3 shall
have waived its right to dispute such invoice.
Without limiting FTI’s other rights and remedies, in the event any payment is not paid by ClientTrace3
within thirty (30) days of the date of invoice, then interest shall accrue, from the thirty-first (31st) day until
payment in full is received, at the rate of one and one half (1 ½ %) percent per month. Nothing herein
shall be construed as extending the due date of payments to be made by ClientTrace3 under this
Agreement. In addition to any other remedies set forth above, and any other remedies available at law,
FTI reserves the right to halt further services until payment is received on past-due invoices. It is FTI’s
normal practice to be paid in full for all work performed to date prior to issuance of a report, deposition
testimony and/or trial testimony. ClientTrace3 agrees to pay all court costs, attorney fees (whether or
Any payment, reimbursement, indemnification or similar obligations set forth in the FTI Terms and
Conditions shall be borne entirely by Trace3, LLC. Neither Glenn Agre Bergman & Fuentes LLP nor the Individual
Defendants shall bear any such obligation.
FTI Reference Number: _____________
Rev. 10.07.22
Trace3, LLC v. Sycomp, et al.
Davis Wright Tremaine, LLP and Glenn Agre Bergman & Fuentes LLP
August 2529, 2023
Page 6 of 21
not contingent on collection from ClientTrace3) and other expenses which may be associated with the
collection of unpaid invoices.
FTI’s fees and expenses are not contingent upon the final results, nor does it guarantee any result or
resolution in connection with this Engagement. FTI will meet jointly with Clientthe Clients and Counsel
regularly to discuss the ongoing work and associated fees.
FTI is a global firm and, through its practice groups and affiliated entities, provides a variety of services to
third parties on a non-exclusive basis including by way of example and not limitation, Forensic and
Litigation Consulting, Technology Services, Corporate Finance/Restructuring, Economic Consulting and
Strategic Communications. Other professionals of FTI may be engaged by parties with interests that are
adverse to and may not be consistent with the interests of ClientClients and Counsel. During the pendency
of this Engagement, the FTI professionals providing services hereunder will not provide services in this
matter to a party that is adverse to Clientthe Clients.
The parties hereto agree that any confidential information received from the other party shall only be
used for the purposes of providing or receiving Services under this Engagement Contract. Except as
provided below, neither party will disclose the other party’s confidential information to any third party
without the other party’s consent. FTI understands that the confidential information, as well as its work
product and files may become subject to discovery; however, until such materials are sought by subpoena
or other process, they will be maintained by FTI as confidential. It is agreed that those materials and all
other working papers and other documents prepared by FTI pursuant to this Engagement will be
maintained as confidential materials and will not be disclosed to third parties without Counsel’sCounsels’
joint consent, except as may be required by law, regulation, or judicial or administrative process. Unless
prohibited by law, FTI agrees to notify Counsel promptly of any of the following events: (a) a request by
anyone to examine, inspect, or copy such documents or records; or (b) any attempt to serve, or the actual
service of, any court order, subpoena, or summons upon FTI that requires the production of such
documents or records. Confidential information shall not include information that is or becomes generally
available to the public other than as a result of a breach of a non-disclosure obligation hereunder, is
acquired from a third party who, to the recipient party’s knowledge, owes no obligation of confidence in
respect of the information, or is or has been independently developed by the recipient.
Any advice given or report issued by FTI is provided solely for your use and benefit and only in connection
with the purpose in respect of which the Services are provided. Unless required by law, neither Clientthe
Clients nor Counsel shall provide any advice given or report issued by FTI to any third party, or refer to FTI
or the Services, without FTI’s prior written consent, which shall be conditioned on the execution of a third
party release letter in the form provided by FTI. In no event, regardless of whether consent has been
provided, shall FTI assume any responsibility to any third party to which any advice or report is disclosed
or otherwise made available.
While FTI’s work may include an analysis of financial and accounting data, the Services will not include an
audit, compilation or review of any kind of any financial statements or components thereof. Client
management will be responsible for any and all financial information they provide to FTI during the course
of this Engagement, and FTI will not examine or compile or verify any such financial information.
Moreover, the circumstances of the Engagement may cause FTI’s advice to be limited in certain respects
based upon, among other matters, the extent of sufficient and available data and the opportunity for
FTI Reference Number: _____________
Rev. 10.07.22
Trace3, LLC v. Sycomp, et al.
Davis Wright Tremaine, LLP and Glenn Agre Bergman & Fuentes LLP
August 2529, 2023
Page 7 of 21
supporting investigations in the time period. Accordingly, as part of this Engagement, FTI will not express
any opinion or other form of assurance on financial statements of the ClientClients.
In the event the Services involve prospective financial information, FTI’s work will not constitute an
examination or compilation, or apply agreed-upon procedures, in accordance with standards established
by the American Institute of Certified Public Accountants or otherwise, and FTI will express no assurance
of any kind on such information. There will usually be differences between estimated and actual results,
because events and circumstances frequently do not occur as expected, and those differences may be
material. FTI will take no responsibility for the achievability of results or events projected or anticipated
by the management of the ClientClients.
The ClientClients shall notify FTI in writing if Client deliversthey deliver to FTI any personally identifiable
information or equivalent and the ClientClients shall instruct FTI if any additional measures (i.e. data
transfer protections) are required. Upon written notice to the ClientClients, FTI will, at its option, destroy
or return to the ClientClients all original materials provided by the ClientClients to FTI, and all materials
created by FTI specifically for the ClientClients as a result of an engagement; provided, however, that with
respect to back-up media, such materials will be overwritten or destroyed, subject to FTI’s normal
schedule for overwriting and destruction, as the case may be.
If this engagement involves the processing of personal data (also referred to herein as personal
information) (i) as governed by Regulation (EU) 2016/679 of the European Parliament and of the Council
of 27 April 2016, the controller terms of the EU Data Protection Schedule attached hereto as Schedule A
shall apply to this engagement and it shall form an integral part of this Engagement Contract and (ii) as
governed by the California Consumer Privacy Act, the controller terms of the California Data Protection
Schedule attached hereto as Schedule B shall apply to this engagement and it shall form an integral part
of this Engagement Contract. In the event of a conflict between the terms of this Engagement Contract
and the terms of Schedule A or Schedule B, the terms of Schedule A or Schedule B shall prevail in relation
to the processing of such personal data. If such personal data is processed in connection with this
engagement, ClientClients shall notify FTI in writing before any personal data is disclosed to FTI.
ClientClients and Counsel agree that FTI shall not be liable under this Engagement Contract to the
ClientClients, Counsel, or their respective successors, assigns or affiliates for damages in excess of the
total amount of the fees paid to FTI under this Engagement Contract. In no event shall FTI be liable for
punitive or consequential damages of any kind. The ClientClients shall indemnify FTI and hold FTI harmless
against any and all claims by third parties for losses, damages or liabilities, including reasonable attorney’s
fees and expenses (“Losses”), arising in any manner out of or in connection with this Engagement, unless
it is finally judicially determined that such Losses resulted from the gross negligence or willful misconduct
of FTI. The terms of this paragraph shall survive the termination of this Engagement Contract and shall
apply to any controlling person, director, officer, employee or affiliate of FTI.
FTI may utilize services and products licensed by FTI for its delivery of services, including third party
software (the “Third Party Software”) under licensing agreements by and between FTI and the vendor of
such Third Party Software. The Client representsClients represent and warrantswarrant that it hasthey
have a lawful basis or hashave obtained all consents, licenses, and authorizations necessary for FTI to
perform the services under this Engagement Contract. The Client agreesClients agree that itthey will
FTI Reference Number: _____________
Rev. 10.07.22
Trace3, LLC v. Sycomp, et al.
Davis Wright Tremaine, LLP and Glenn Agre Bergman & Fuentes LLP
August 2529, 2023
Page 8 of 21
indemnify FTI and hold FTI harmless against any and all claims arising out of the use of such Third Party
Software on behalf of the ClientClients to provide the services under this Engagement Contract.
The Client agreesClients agree to promptly notify FTI if it extends (or solicits the possible interest in
receiving) an offer of employment to a principal or employee of FTI involved in this Engagement and
agrees that it will pay FTI a cash fee, upon hiring, equal to 150% of the aggregate current annualized
compensation (both cash and non cash consideration), including any guaranteed or target bonus, to be
paid to FTI’s former principal or employee that the ClientClients or any of itstheir subsidiaries or affiliates
hires at any time up to one year subsequent to the date of the final invoice rendered by FTI with respect
to this Engagement.
The Engagement shall be governed by and interpreted in accordance with the laws of the State of
California, without giving effect to the choice of law provisions thereof. The parties agree that any dispute
or controversy that arises from this Engagement including any dispute or controversy relating to the fees
and expenses billed under this Engagement Contract that cannot be resolved by the parties shall be
submitted to arbitration in Los Angeles, California, in accordance with the applicable rules, regulations,
policies, and procedures of the Commercial Arbitration Rules of the American Arbitration Association
(“AAA”) and the Federal Arbitration Act. The decision of the arbitrator shall be final and binding. The
parties consent to the jurisdiction of any federal and state court in the State of California for the
enforcement of the arbitration award or otherwise.
The Client agreesClients agree that itthey will comply with all anti-corruption, anti-money laundering, anti-
bribery and other economic sanctions laws and regulations of the United States, United Kingdom,
European Union and United Nations (collectively, the “ABC/AML/Sanction Laws”) in connection with this
Engagement. The ClientClients further agreesagree that itthey shall not, and itthey shall procure itstheir
employees not to, pay or cause other person(s) to pay FTI using any funds that would result in a violation
of any of the ABC/AML/Sanction Laws by either Clientthe Clients or FTI, or otherwise take any action that
would result in a violation of any of the ABC/AML/Sanction Laws by either Clientthe Clients or FTI. The
ClientClients shall promptly notify FTI in the event of any violation or failure to comply with
ABC/AML/Sanction Laws in connection with this Engagement, or allegations relating thereto, by the
ClientClients or itstheir directors, officers, employees or agents.
Additional Terms and Conditions for Technology/E-Discovery/Document Review Engagements
In the event the services provided under this Engagement Contract include services provided by FTI’s
Technology segment, the following additional terms and conditions shall apply to the Engagement
Contract with respect to the provision of services by FTI’s Technology segment.
Depending on certain state and/or municipality regulations, FTI may be required to collect sales and use
tax on certain of FTI’s products and services. Alternatively, clientthe Clients shall provide documentation
of direct pay certification or exemption from such taxes.
Neither the ClientClients nor its Counsel acquires any interest in the copyright or any other intellectual
property rights, including but not limited to any source code, enabling technology, information or other
processes, know-how, scripts or sub-routines in or related to any software owned or licensed by FTI (the
“FTI IP”). Except as expressly set forth herein, all rights and licenses granted to Clientthe Clients are non-
FTI Reference Number: _____________
Rev. 10.07.22
Trace3, LLC v. Sycomp, et al.
Davis Wright Tremaine, LLP and Glenn Agre Bergman & Fuentes LLP
August 2529, 2023
Page 9 of 21
transferable and non-assignable. ClientClients may make a reasonable number of back-up copies of the
FTI IP in accordance with its normal backup procedures so long as all copyright and other proprietary
rights notices are included on all copies. FTI reserves all rights not expressly granted herein. Client
acknowledgesClients acknowledge and agreesagree FTI shall be the sole and exclusive owner and
copyright proprietor of all rights and title in and to the FTI IP in whatever stage of completion. Except as
otherwise agreed to by FTI, no express or implied license or right of any kind is granted to ClientClients
regarding the FTI IP including, but not limited to, any right to know, use, produce, receive, reproduce,
copy, market, sell, distribute, transfer, modify, or adapt the FTI IP or create derivative works based on the
FTI IP or any portions thereof, or obtain possession of any source code or other technical material relating
to the FTI IP. The FTI IP specifically excludes the content of any documents collected by or furnished to
FTI by or on behalf of the ClientClients or itstheir Counsel which shall remain the sole and exclusive
property of ClientClients (the “Client Data”). The Client representsClients represent and warrantswarrant
that the Client isClients are the owner of the Client Data or otherwise hashave the express right to provide
the Client Data to FTI in connection with FTI’s provision of services hereunder.
In the event FTI’s provision of Review Services (as defined herein) shall be performed using Client’sthe
Clients’ or Counsel’s software (the “3rd Party Software”) licensed by ClientClients or Counsel (the
“Licensee”), the Licensee represents and warrants to FTI that the Licensee has the right to grant to FTI and
the Reviewers (as defined herein) a sublicense to use the 3rd Party Software in connection with FTI’s
provision of Review Services. The Licensee further agrees to indemnify FTI and the Reviewers, and hold
FTI and the Reviewers harmless against any and all claims for Losses (as defined herein) arising out of FTI’s
and the Reviewers’ use of the 3rd Party Software.
Document review services (the “Review Services”) requested by Clientthe Clients will be performed by FTI
or a subcontractor of FTI (together, the “Reviewers”). The Reviewers are subject to the same conflict of
interest and confidentiality undertakings as those set forth in this letter of engagement. Notwithstanding
the foregoing, FTI shall be entitled to disclose the existence of this engagement to other law firms
engaging FTI for Review Services solely for such law firm’s conflict review purposes. ClientClients, Counsel
and FTI acknowledge and agree that the Review Services shall include document review for both
responsiveness and privilege purposes. ClientClients, Counsel and FTI further acknowledge and agree that
FTI is not a law firm, Counsel shall oversee the responsiveness and privilege review, the Review Services
will be at the direction of Counsel, and all final determinations regarding relevance, privilege and
production shall be in the sole determinations of Counsel.
FTI may request or require that its Reviewers work from a location other than an FTI office, including,
without limitation, a non-FTI commercial space that FTI uses to temporarily house the Reviewers, a client
site and/or the employees’ residences (hereafter, a “Remote Work Location”). Client hasThe Clients have
been informed that while FTI will take reasonable steps to protect the security and integrity of Client’sthe
Clients’ documents and data while Reviewers are working from a Remote Work Location, the technical
measures and security protections associated with Reviewers working from a Remote Work Location are
necessarily different from, and less stringent than, those that exist while Reviewers work onsite. At
Client’sthe Clients’ request, FTI can provide Clientthe Clients with information regarding the security
procedures it will employ in the event that Reviewers working on the Engagement are required or
permitted to work from a Remote Work Location. After being fully apprised of the facts and risks,
ClientClients hereby authorizesauthorize FTI to permit its Reviewers to work on matters relating to or
arising out of the Engagement from a Remote Work Location. ClientClients further
FTI Reference Number: _____________
Rev. 10.07.22
Trace3, LLC v. Sycomp, et al.
Davis Wright Tremaine, LLP and Glenn Agre Bergman & Fuentes LLP
August 2529, 2023
Page 10 of 21
acknowledgesacknowledge that, while FTI Reviewers working on this engagement are working from a
Remote Work Location, FTI will maintain protocols and procedures that are commercially reasonable for
remote/internet access to documents and data, and that such procedures differ from those that are in
place for onsite review. ClientClients also acknowledgesacknowledge that, in the event Reviewers
working on the Engagement are required or requested to work from a Remote Work Location, FTI has
offered ClientClients the right to: (1) delay any services being performed under the Engagement until the
employees are able to work onsite; (2) suspend the review services associated with the Engagement
(subject to an agreement between the parties regarding how the non-review services under the
Engagement will be billed while the review services are suspended); or (3) where economically and
logistically feasible, and subject to an agreement regarding potential additional costs, redirect the work
to another geography as legally permissible. In the event that FTI requests or requires certain Reviewers
to work from a Remote Work Location, FTI will take reasonable steps to meet all deadlines discussed
and/or agreed to between the parties. Client understandsClients understand and
acknowledgesacknowledge that, despite FTI’s reasonable efforts, the provision of services to Clientthe
Clients under the Engagement may be delayed as a result of the impacts from pandemics or other factors
outside of FTI’s control including, without limitation, impacts caused by (i) a slowdown or shutdown in the
supply chain; (ii) limited access to technology or other resources; (iii) slowdown in review productivity
due to change in work environment; (iv) travel restrictions; (v) restrictions to office and other facilities;
and (vi) the inability of FTI Reviewers to work from a Remote Work Location.
FTI Reference Number: _____________
Rev. 10.07.22
Trace3, LLC v. Sycomp, et al.
Davis Wright Tremaine, LLP and Glenn Agre Bergman & Fuentes LLP
August 2529, 2023
Page 11 of 21
SCHEDULE A
FTI CONSULTING DATA PROTECTION SCHEDULE
This Data Protection Schedule ("Schedule") forms part of the contract for services to which it is an
attachment (the “Contract”) between the client partyparties identified in the Contract (the
ClientClients”) and the relevant FTI Consulting group entity identified in the Contract (“FTI”).
1. Definitions
1.1 In this Schedule, unless otherwise defined herein, all defined terms shall have the meaning set
out in the Contract.
1.2 In this Schedule, the following terms shall have the meanings set out below:
1.2.1 Data Protection Laws" means all legislation protecting the personal data of natural
persons that is applicable to the processing of Personal Data under this Schedule,
including (without limitation) the GDPR and any national legislation which
supplements the GDPR, and the data protection laws of any other country, state or
territory which apply to such processing;
1.2.2 “EEA Standard Contractual Clauses” means the Standard Contractual Clauses set out
in the European Implementing Decision (EU) 2021/914 on standard contractual
clauses for the transfer of personal data to third countries pursuant to Regulation
(EU) 2016/679, as updated, amended, replaced or superseded from time to time by
the European Commission;
1.2.3 GDPR" means the General Data Protection Regulation (EU) 2016/679;
1.2.4 "Restricted Transfer" means a transfer of Personal Data from ClientClients to FTI in
circumstances where such transfer would be prohibited by Data Protection Laws in
the absence of the EEA or UK Standard Contractual Clauses;
1.2.5 “Standard Contractual Clauses” means either the EEA or UK Standard Contractual
Clauses, as applicable to a Restricted Transfer;
1.2.6 "UK Standard Contractual Clauses" means the standard contractual clauses for the
transfer of personal data to Processors established in third countries which do not
ensure an adequate level of protection as set out in Commission Decision
2010/87/EU, as updated, amended, replaced or superseded from time to time by the
UK government; “UK GDPR” means the GDPR as transposed into United Kingdom
national law by operation of section 3 of the European Union (Withdrawal) Act 2018
and as amended by the Data Protection, Privacy and Electronic Communications
(Amendments etc.) (EU Exit) Regulations 2019; and
FTI Reference Number: _____________
Rev. 10.07.22
Trace3, LLC v. Sycomp, et al.
Davis Wright Tremaine, LLP and Glenn Agre Bergman & Fuentes LLP
August 2529, 2023
Page 12 of 21
1.2.7 Personal Data", "Process", "Controller", "Processor", "Data Subject", "Supervisory
Authority" and "Personal Data Breach" shall have the meanings given to them in the
Data Protection Laws.
2. Controller Terms
2.1 FTI and the ClientClients will each act as separate and individual Controllers in relation to any
Personal Data (including, without limitation, Personal Data relating to any of the Client’sClients’
workers, FTI’s workers, any litigation or arbitration opponent or customer or vendor or
transaction partner) Processed by the ClientClients or FTI to deliver the services set out under the
Contract.
2.2 FTI and the ClientClients will each comply with its own respective obligations under the Data
Protection Laws in relation to their Processing of Personal Data under the Contract. In particular,
the ClientClients will ensure that any disclosures of Personal Data to FTI are lawful, and, in each
case where necessary under the Data Protection Laws, the Client hasClients have notified and
secured the consent of the relevant Data Subjects.
2.3 FTI may appoint Processors as required to deliver the services, who will process the Personal Data
on FTI’s behalf and at FTI’s direction. Further, FTI may disclose Personal Data to other Controllers:
2.3.1 where necessary to deliver the services (including, but without limitation, law firms,
accountants, other third party experts and any member of FTI’s group of companies);
or
2.3.2 pursuant to a legally binding written request, an order or request of a court of
competent jurisdiction or any governmental or regulatory authority or where
disclosure is required by applicable law or regulation (“Legal Process”). In relation to
any Legal Process, FTI shall assess the lawfulness of the request before responding,
and shall take any steps required by Data Protection Laws to protect Personal Data
prior to its disclosure (including, without limitation, with respect to data minimization
and data security);
2.4 In respect of any Restricted Transfer subject to the GDPR, the parties hereby enter into Module 1
of the EEA Standard Contractual Clauses (with ClientClients as data exporterexporters and FTI as
data importer), which is hereby incorporated by reference into this Schedule and which shall
come into effect upon the commencement of a Restricted Transfer. The parties make the
following selections for the purposes of Module 1:
2.4.1 Clause 7 – Docking clause shall apply;
2.4.2 Clause 11(a) – Redress the optional language shall not apply;
2.4.3 Clause 13(a) – Supervision
FTI Reference Number: _____________
Rev. 10.07.22
Trace3, LLC v. Sycomp, et al.
Davis Wright Tremaine, LLP and Glenn Agre Bergman & Fuentes LLP
August 2529, 2023
Page 13 of 21
2.4.3.1 Where a Client is established in an EU Member State, the following shall
apply: “The supervisory authority with responsibility for ensuring
compliance by the data exporter with Regulation (EU) 2016/679 as
regards the data transfer shall be the supervisory authority of the
Member State in which Client is established or (if different) the lead
supervisory authority of the Client in respect of a cross-border processing
activity”. OR
2.4.3.2 Where a Client is not established in an EU Member State, but falls within
the territorial scope of application of the GDPR in accordance with Article
3(2) and has appointed a representative pursuant to Article 27(1) of the
GDPR the following shall apply: “The supervisory authority of the Member
State in which the representative within the meaning of Article 27(1) of
Regulation (EU) 2016/679 is established, shall act as competent
supervisory authority.” OR
2.4.3.3 Where a Client is not established in an EU Member State, but falls within
the territorial scope of application of the GDPR in accordance with Article
3(2) without however having to appoint a representative the following
shall apply: “The supervisory authority of one of the Member States in
which the data subjects whose personal data is transferred under these
Clauses in relation to the offering of goods or services to them, or whose
behaviour is monitored, are located, as indicated in Annex I.C, shall act as
competent supervisory authority.”
2.4.4 Clause 17 – Governing law “Option 1” shall apply and the “Member State” shall be
the Republic of Ireland;
2.4.5 Clause 18 – Choice of forum and jurisdiction the Member State shall be the Republic
of Ireland;
2.4.6 Annex 1 – the data exporter is Clientexporters are the Clients and the data importer
is FTI (in each case as identified, including in relation to their places of establishment,
in the Principal Agreement) and the description of transfer is deemed to be as
described in Annex 1 to this Schedule;
2.4.7 Annex 2 – the technical and organizational security measures are deemed to be as
described in Annex 2 to this Schedule; and
2.4.8 Annex 3 – not applicable.
2.5 In respect of any Restricted Transfer subject to the UK GDPR, the parties hereby enter into the UK
Standard Contractual Clauses (with ClientClients as data exporterexporters and FTI as data
importer), which are incorporated by reference into this Schedule and which shall come into
effect upon the commencement of a Restricted Transfer. For the purposes of clause II h) of the
UK Standard Contractual Clauses, the Parties shall be deemed to have selected option (iii). Annex
2 to the UK Standard Contractual Clauses shall be deemed to be prepopulated with the relevant
FTI Reference Number: _____________
Rev. 10.07.22
Trace3, LLC v. Sycomp, et al.
Davis Wright Tremaine, LLP and Glenn Agre Bergman & Fuentes LLP
August 2529, 2023
Page 14 of 21
sections of the Annex to this Schedule. If at any time the UK government approves the EEA
Standard Contractual Clauses for use under the UK GDPR, the provisions of paragraph 2.4 shall
apply in place of this paragraph 2.5 in respect of Restricted Transfers subject to the UK GDPR,
subject to any modifications to the EEA Standard Contractual Clauses required by the UK GDPR
(and subject to the governing law of the EEA Standard Contractual Clauses being English law).
2.6 The Client acknowledgesClients acknowledge and agreesagree that certain Processors or
Controllers engaged by FTI under paragraph 2.3 may be located in places that may require cross-
border transfers of Personal Data. In respect of transfers by FTI to such Controllers or Processors,
FTI will take steps in accordance with the Data Protection Laws to ensure an adequate level of
protection for the Personal Data Processed by such Processors or Controllers. Where such a
Controller or Processor notifies FTI that it may no longer be able to provide an adequate level of
protection in accordance with Data Protection Laws, FTI shall independently assess the level of
protection provided and, where ne
Preview
GLENN AGRE BERGMAN & FUENTES LLP LYN R. AGRE (CASBN 178218) EDWARD E. SHAPIRO (CASBN 326182) 44 Montgomery Street, Suite 2410 San Francisco, CA 94104 Telephone: (415) 599-0880 lagre@glennagre.com eshapiro@glennagre.com Attorneys for Individual Defendants Geoffrey Peterson, Timothy Cordell, and Devin Tomcik SUPERIOR COURT OF THE STATE OF CALIFORNIA COUNTY OF SANTA CLARA TRACE3, LLC a California limited liability CASE NO. 23CV415833 company, Assigned to: Hon. Sunil R. Kulkarni Plaintiff, DECLARATION OF EDWARD E. SHAPIRO IN SUPPORT OF INDIVIDUAL DEFENDANTS’ SYCOMP A TECHNOLOGY COMPANY, OPPOSITION TO PLAINTIFF TRACE3, INC., a California corporation; TIMOTHY LLC’S EX PARTE APPLICATION FOR CORDELL, an individual; LILIAN ELIAS, an AN ORDER CONTINUING THE individual; GEOFF PETERSON, an individual; BRIEFING SCHEDULE AND HEARING DEVIN TOMCIK, an individual; and DOES 1- ON TRACE3, LLC’S MOTION FOR 10, inclusive; PRELIMINARY INJUNCTION Defendants. Date: September 1, 2023 Time: 4:00 p.m. Dept: 1 Action Filed: May 12, 2023 DECLARATION OF EDWARD E. SHAPIRO IN SUPPORT OF INDIVIDUAL DEFENDANTS’ OPPOSITION TO TRACE3’S EX PARTE APPLICATION Case No. 23CV415833 DECLARATION OF EDWARD E. SHAPIRO I, Edward E. Shapiro, declare as follows: I am a member of the firm Glenn Agre Bergman & Fuentes LLP, counsel for Individual Defendants Geoffrey Peterson, Timothy Cordell, and Devin Tomcik (“Individual Defendants”) in this action. I submit this declaration in support of Individual Defendants’ Opposition to Plaintiff Trace3, LLC’s Ex Parte Application for an Order Continuing the Briefing Schedule and Hearing on Trace3, LLC’s Motion for Preliminary Injunction. I am fully familiar with and have personal knowledge of the matters described herein. On May 23, 2023, the Court issued an order that, in part, authorized “limited expedited discovery” to aid the parties in briefing and preparing for the Motion for Preliminary Injunction hearing. On June 12, 2023, Trace3 served discovery requests to the Individual Defendants, and the Individual Defendants responded on June 19, 2023. Trace3 indicated it believed the responses were deficient, and the Court instructed Trace3 to move to compel further responses if Trace3 deemed necessary. Nevertheless, Trace3 elected not to move to compel. Trace3 thereby waived its entitlement to seek discovery from the Individual Defendants on the subjects at issue in its first set of requests. By Order of the Court dated August 22, 2023, the parties were directed to meet and confer regarding whether searches of the mirrored images would occur and, if so, how and when. The Order did not specify a deadline by which the parties were required to meet and confer. On the afternoon of August 24, 2023, Trace3’s counsel sent a demand letter to meet and confer regarding search terms for and parameters of the neutral forensic examination. See Declaration of Nicole S. Phillis in Support of Ex Parte Application for an Order Continuing Schedule on Trace3, LLC’s Motion for Preliminary Injunction (“Phillis Dec.”), Ex B. Trace3’s demand letter states that Trace3 was in the process of engaging FTI Consulting (“FTI”), a supposedly neutral forensic examiner. DECLARATION OF EDWARD E. SHAPIRO IN SUPPORT OF INDIVIDUAL DEFENDANTS’ OPPOSITION TO TRACE3’S EX PARTE APPLICATION CASE NO. 23CV415833 At 8:30 a.m. PT, on August 27, 2023, I responded to Trace3’s counsel, explaining that Trace3’s demand letter contradicts the Court’s August 22 Order and adopted protocol. First, I explained that, while Trace3 is responsible for payment of FTI’s invoices, FTI must be mutually engaged by Trace3 and the Individual Defendants and accordingly subject only to mutual direction from both parties—facets inherent to the notion of a “neutral” retention. I accordingly requested a proposed engagement letter for the Individual Defendants and Sycomp to review. I further explained that, given the Individual Defendants’ prior imaging of their devices and Trace3’s declination of the use of those images, the Individual Defendants are not required to part with their personal devices, and FTI will need to create all images at the Individual Defendants’ residences. I did not inform Trace3’s counsel that FTI would need to “fly out” to each Individual Defendant. Finally, I noted that Trace3’s proposal seeks to impose material aspects of its previous proposal that the Court rejected outright. For example, Trace3’s proposal attempts to broaden the universe of devices to be imaged, as well as to direct FTI to run searches on the images collected and to release any image of any device to Trace3, its counsel, or its forensic expert. In my August 27 email, I informed Trace3’s counsel that, due to commitments to other clients and vacation schedules, counsel for the Individual Defendants would not be available to meet and confer until Tuesday, August 29. Counsel for Trace3 circulated a proposed FTI engagement letter on August 28 at 10 a.m. PT. This letter presupposed that FTI would be retained by only Trace3, despite the Court’s Order and my August 27 email. On August 30 at 1:40 p.m. PT, the Individual Defendants provided Trace3 with proposed revisions to the FTI engagement letter that would allow for a tripartite engagement in line with the Court’s Order. The one-sided nature of the initially proposed FTI engagement letter is reflected in the necessity for extensive revisions. Attached hereto as Exhibit A is a “redline” of the Individual Defendants’ revisions to the FTI engagement letter. DECLARATION OF EDWARD E. SHAPIRO IN SUPPORT OF INDIVIDUAL DEFENDANTS’ OPPOSITION TO TRACE3’S EX PARTE APPLICATION CASE NO. 23CV415833 As of this filing, Trace3 has not responded to the Individual Defendant’s revisions or otherwise taken any action to finalize the engagement – save for suggesting that the parties and FTI schedule a call to discuss unspecified details. Despite just having received Trace3’s proposed FTI engagement letter, counsel for the Individual Defendants met and conferred with counsel for Trace3 on August 29. On that meet and confer, counsel for Trace3 raised the issue of a potential extension of the briefing and hearing schedule for Trace3’s Motion for Preliminary Injunction. I was surprised by this discussion, as Trace3 had failed to respond to Sycomp’s counter proposal regarding a potential extension of the schedule on August 23, 2023. See Phyllis Dec., Ex. A at 1. I reminded counsel for Trace3 that Sycomp’s proposal had gone unanswered, and that the Individual Defendants would wait until Trace3 responded in that regard to weigh in on a potential extension of time. Counsel for Trace3 appeared surprised to hear that no response to Sycomp’s proposal had been provided. I declare under penalty of perjury under the laws of the State of California that the foregoing is true and correct. Executed this 1st day of September 2023. /s/ Edward E. Shapiro Edward E. Shapiro DECLARATION OF EDWARD E. SHAPIRO IN SUPPORT OF INDIVIDUAL DEFENDANTS’ OPPOSITION TO TRACE3’S EX PARTE APPLICATION CASE NO. 23CV415833 EXHIBIT A Tracy L. Wilkison 350 S. Grand Avenue Suite # 3000 Los Angeles, CA 90071 626-200-7635 Tracy.Wilkison@fticonsulting.com www.fticonsulting.com Formatted: English (United States) August 2530, 2023 Nicole Phillis Davis Wright Tremaine LLP 865 S. Figueroa Street, Suite 2400 Los Angeles, CA 90017 Counsel for Trace3, LLC Formatted: Font: Italic [Address] Lyn R. Agre Edward E. Shapiro Glenn Agre Bergman & Fuentes LLP 44 Montgomery Street, Suite 2410 San Francisco, CA 94104 lagre@glennagre.com eshapiro@glennagre.com Counsel for Timothy Cordell, Geoffrey Peterson, and Devin Tomcik Re: Trace3, LLC v. Sycomp, et al. Dear Counsel: This letter will confirm the retention of FTI Consulting, Inc. (“FTI”) by Davis Wright Tremaine (“DWT”) in connection with its representation of Trace3, LLC (“Trace3”) and Glenn Agre Bergman & Fuentes LLP (“GABF” and together with DWT, “Counsel”) in connection with its representation of Trace3 (“Client Timothy Cordell, Geoffrey Peterson, and Devin Tomcik (the “Individual Defendants,” and together with Trace3, the “Clients”) to provide neutral cybersecurity and forensic examination services (the “Engagement”) in connection with Trace3 v. Sycomp et al., 23CV415833, filed in the Superior Court of Formatted: Font: Italic California, Santa Clara County. FTI’s work is to assist on the above -referenced matter upon receiving joint instructions from all Counsel and to perform such other tasks as may be identified during the course of this Engagement. Should Counsel or Client request that someone from FTI provide expert testimony in based on joint instructions from all Counsel. For the future, FTI will discuss and mutually agree on which FTI professional would serve asavoidance of doubt, FTI is not authorized to turn over any devices belonging to the expert and such Trace3, LLC v. Sycomp, et al. Davis Wright Tremaine, LLP and Glenn Agre Bergman & Fuentes LLP August 2529, 2023 Page 2 of 21 activity may be subject to a separate retention letter.Individual Defendants, or images of those devices, to DWT or Trace3 without the Individual Defendants’ and/or GABF’s express written consent. All professional conclusions will be those of the FTI professionals working on this matter. Counsel and the ClientClients will make available to FTI the information, equipment, documents and access necessary for FTI to perform requested services. Should FTI determine that additional documents are necessary, FTI will make all requests for such records through Counsel. I will maintain overall administrative responsibility for the Engagement, including billing and client relations. I will be actively involved in the performance of the Engagement and will use such other staff for assistance as deemed necessary. FTI’s work will be billed at stated hourly rates applied to productive hours engaged in providing service and out-of-pocket expenses. Hourly rates are based upon the experience and skills of the personnel involved. Hourly rate ranges by professional level are: Formatted: Body Text Professional Level Cybersecurity Rates Senior Managing Director $940 $1350 Managing Director $830 $920 Senior Director $780 $810 Director $670 $765 Senior Consultant $515-$610 Consultant $405 $470 Project Assistant $175 $275 FTI understands that ClientDWT and/or Trace3 will be solely responsible for payment of its fees and expenses and, that GABF and the Client hasIndividual Defendants bear no responsibility for payment of FTI’s fees and expenses, that the Clients have been notified of the terms of this agreement, and that the Client hasClients have authorized Counsel to enter into this agreement on Client’sthe Clients’ behalf. As such, FTI will submit invoices for its fees and expenses incurred in connection with this Engagement directly to the ClientTrace3, with a copy sent to Counsel. The parties acknowledge and agree that the attorney-client privilege between Counsel and FTI shall remain notwithstanding the fact that Client is billed directly for services provided under this Engagement. The name and address of the ClientTrace3’s designee to receive and approve FTI’s invoice is indicated on the signature page of this letter. A copy of FTI’s terms and conditions, which Counsel and Clientthe Clients accept and hereby agree to, is attached, and together with this letter of engagement, constitute the “Engagement Contract.” Counsel and the ClientClients acknowledge their respective agreement with this Engagement Contract as evidenced by its signatures below. In the event only Counsel is executing on behalf of its Clientthe Clients, Counsel represents and warrants that Client hasClients have been notified of the terms of this Engagement Contract, agreesagree to be bound hereby and hashave authorized Counsel to enter into this Engagement Contract on Client’sthe Clients’ behalf. Please return to FTI the signed copy of this Engagement Contract. FTI will not be able to begin work until it has received an executed Engagement Contract. If this Engagement Contract is not executed by Counsel and/or the ClientClients and returned to FTI within ten days of the date of this letter, the offer to provide services is revoked and this Engagement Contract shall be deemed null and void. FTI Reference Number: _____________ Rev. 10.07.22 Trace3, LLC v. Sycomp, et al. Davis Wright Tremaine, LLP and Glenn Agre Bergman & Fuentes LLP August 2529, 2023 Page 3 of 21 Very truly yours, FTI CONSULTING, INC. By: ______________________________ Tracy Wilkison Senior Managing Director Cybersecurity FTI Reference Number: _____________ Rev. 10.07.22 Trace3, LLC v. Sycomp, et al. Davis Wright Tremaine, LLP and Glenn Agre Bergman & Fuentes LLP August 2529, 2023 Page 4 of 21 Accepted by: Davis Wright Tremaine, LLP By: Print Name: Title: Date: Email: Accepted by: Trace3, LLC By: Print Name: Title: Date: Email: Accepted by: Glenn Agre Bergman & Fuentes LLP, counsel for Timothy Cordell, Geoffrey Peterson, and Devin Tomcik By: Print Name: Title: Date: Email: Name and Address of person designated to receive and approve invoices related to this Engagement: Name: Address: Phone: Email: FTI policy requires that we have contact information on file for the partyparties ultimately responsible for payment (ClientTrace3) to FTI. If this person(s) is different than the person designated above to receive and approve invoices, please complete: Name: FTI Reference Number: _____________ Rev. 10.07.22 Trace3, LLC v. Sycomp, et al. Davis Wright Tremaine, LLP and Glenn Agre Bergman & Fuentes LLP August 2529, 2023 Page 5 of 21 Address: Phone: Email: Does ClientTrace3 require invoices to be submitted via an electronic billing system? Yes:____ No:____ If yes, which billing system? ________________________ FTI TERMS AND CONDITIONS FTI’s rates are subject to adjustment from time to time and at least annually effective October 1. FTI will advise Clientthe Clients and Counsel immediately if a rate adjustment is being made. Further, if any work needs to be performed by FTI personnel in our international offices, such work will be billed at the rates set forth for the specific international office. FTI will bill for reimbursement of reasonable and customary out-of-pocket expenses that are directly incurred on the Engagement, such as messenger, travel, meals, accommodations, computing resources, and other expenses specifically related to the Engagement. FTI will also bill 10.0% of FTI’s professional fees as a reasonable allocation of non-direct expenses such as cybersecurity-related equipment, administrative support and other overhead expenses that are not billed as direct reimbursable expenses. Further, if FTI and/or any of its employees are required to testify or provide evidence at or in connection with any judicial or administrative proceeding relating to this Engagement to which FTI is not a party, ClientTrace3 will compensate FTI at its stated hourly rates and reimburse FTI for reasonable direct and allocated expenses (including counsel fees) with respect thereto. All payments will be due upon receipt of the invoice. For your information and use, FTI’s Taxpayer Identification Number is 52-1261113. In the event ClientTrace3 disputes any of the fees or expenses on a specific invoice, the ClientTrace3 shall notify FTI within twenty (20) days of receipt of the invoice of such a dispute. If Client failsTrace3 fail to notify FTI within the twenty (20) day period, the ClientTrace3 shall have waived its right to dispute such invoice. Without limiting FTI’s other rights and remedies, in the event any payment is not paid by ClientTrace3 within thirty (30) days of the date of invoice, then interest shall accrue, from the thirty-first (31st) day until payment in full is received, at the rate of one and one half (1 ½ %) percent per month. Nothing herein shall be construed as extending the due date of payments to be made by ClientTrace3 under this Agreement. In addition to any other remedies set forth above, and any other remedies available at law, FTI reserves the right to halt further services until payment is received on past-due invoices. It is FTI’s normal practice to be paid in full for all work performed to date prior to issuance of a report, deposition testimony and/or trial testimony. ClientTrace3 agrees to pay all court costs, attorney fees (whether or Any payment, reimbursement, indemnification or similar obligations set forth in the FTI Terms and Conditions shall be borne entirely by Trace3, LLC. Neither Glenn Agre Bergman & Fuentes LLP nor the Individual Defendants shall bear any such obligation. FTI Reference Number: _____________ Rev. 10.07.22 Trace3, LLC v. Sycomp, et al. Davis Wright Tremaine, LLP and Glenn Agre Bergman & Fuentes LLP August 2529, 2023 Page 6 of 21 not contingent on collection from ClientTrace3) and other expenses which may be associated with the collection of unpaid invoices. FTI’s fees and expenses are not contingent upon the final results, nor does it guarantee any result or resolution in connection with this Engagement. FTI will meet jointly with Clientthe Clients and Counsel regularly to discuss the ongoing work and associated fees. FTI is a global firm and, through its practice groups and affiliated entities, provides a variety of services to third parties on a non-exclusive basis including by way of example and not limitation, Forensic and Litigation Consulting, Technology Services, Corporate Finance/Restructuring, Economic Consulting and Strategic Communications. Other professionals of FTI may be engaged by parties with interests that are adverse to and may not be consistent with the interests of ClientClients and Counsel. During the pendency of this Engagement, the FTI professionals providing services hereunder will not provide services in this matter to a party that is adverse to Clientthe Clients. The parties hereto agree that any confidential information received from the other party shall only be used for the purposes of providing or receiving Services under this Engagement Contract. Except as provided below, neither party will disclose the other party’s confidential information to any third party without the other party’s consent. FTI understands that the confidential information, as well as its work product and files may become subject to discovery; however, until such materials are sought by subpoena or other process, they will be maintained by FTI as confidential. It is agreed that those materials and all other working papers and other documents prepared by FTI pursuant to this Engagement will be maintained as confidential materials and will not be disclosed to third parties without Counsel’sCounsels’ joint consent, except as may be required by law, regulation, or judicial or administrative process. Unless prohibited by law, FTI agrees to notify Counsel promptly of any of the following events: (a) a request by anyone to examine, inspect, or copy such documents or records; or (b) any attempt to serve, or the actual service of, any court order, subpoena, or summons upon FTI that requires the production of such documents or records. Confidential information shall not include information that is or becomes generally available to the public other than as a result of a breach of a non-disclosure obligation hereunder, is acquired from a third party who, to the recipient party’s knowledge, owes no obligation of confidence in respect of the information, or is or has been independently developed by the recipient. Any advice given or report issued by FTI is provided solely for your use and benefit and only in connection with the purpose in respect of which the Services are provided. Unless required by law, neither Clientthe Clients nor Counsel shall provide any advice given or report issued by FTI to any third party, or refer to FTI or the Services, without FTI’s prior written consent, which shall be conditioned on the execution of a third party release letter in the form provided by FTI. In no event, regardless of whether consent has been provided, shall FTI assume any responsibility to any third party to which any advice or report is disclosed or otherwise made available. While FTI’s work may include an analysis of financial and accounting data, the Services will not include an audit, compilation or review of any kind of any financial statements or components thereof. Client management will be responsible for any and all financial information they provide to FTI during the course of this Engagement, and FTI will not examine or compile or verify any such financial information. Moreover, the circumstances of the Engagement may cause FTI’s advice to be limited in certain respects based upon, among other matters, the extent of sufficient and available data and the opportunity for FTI Reference Number: _____________ Rev. 10.07.22 Trace3, LLC v. Sycomp, et al. Davis Wright Tremaine, LLP and Glenn Agre Bergman & Fuentes LLP August 2529, 2023 Page 7 of 21 supporting investigations in the time period. Accordingly, as part of this Engagement, FTI will not express any opinion or other form of assurance on financial statements of the ClientClients. In the event the Services involve prospective financial information, FTI’s work will not constitute an examination or compilation, or apply agreed-upon procedures, in accordance with standards established by the American Institute of Certified Public Accountants or otherwise, and FTI will express no assurance of any kind on such information. There will usually be differences between estimated and actual results, because events and circumstances frequently do not occur as expected, and those differences may be material. FTI will take no responsibility for the achievability of results or events projected or anticipated by the management of the ClientClients. The ClientClients shall notify FTI in writing if Client deliversthey deliver to FTI any personally identifiable information or equivalent and the ClientClients shall instruct FTI if any additional measures (i.e. data transfer protections) are required. Upon written notice to the ClientClients, FTI will, at its option, destroy or return to the ClientClients all original materials provided by the ClientClients to FTI, and all materials created by FTI specifically for the ClientClients as a result of an engagement; provided, however, that with respect to back-up media, such materials will be overwritten or destroyed, subject to FTI’s normal schedule for overwriting and destruction, as the case may be. If this engagement involves the processing of personal data (also referred to herein as personal information) (i) as governed by Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, the controller terms of the EU Data Protection Schedule attached hereto as Schedule A shall apply to this engagement and it shall form an integral part of this Engagement Contract and (ii) as governed by the California Consumer Privacy Act, the controller terms of the California Data Protection Schedule attached hereto as Schedule B shall apply to this engagement and it shall form an integral part of this Engagement Contract. In the event of a conflict between the terms of this Engagement Contract and the terms of Schedule A or Schedule B, the terms of Schedule A or Schedule B shall prevail in relation to the processing of such personal data. If such personal data is processed in connection with this engagement, ClientClients shall notify FTI in writing before any personal data is disclosed to FTI. ClientClients and Counsel agree that FTI shall not be liable under this Engagement Contract to the ClientClients, Counsel, or their respective successors, assigns or affiliates for damages in excess of the total amount of the fees paid to FTI under this Engagement Contract. In no event shall FTI be liable for punitive or consequential damages of any kind. The ClientClients shall indemnify FTI and hold FTI harmless against any and all claims by third parties for losses, damages or liabilities, including reasonable attorney’s fees and expenses (“Losses”), arising in any manner out of or in connection with this Engagement, unless it is finally judicially determined that such Losses resulted from the gross negligence or willful misconduct of FTI. The terms of this paragraph shall survive the termination of this Engagement Contract and shall apply to any controlling person, director, officer, employee or affiliate of FTI. FTI may utilize services and products licensed by FTI for its delivery of services, including third party software (the “Third Party Software”) under licensing agreements by and between FTI and the vendor of such Third Party Software. The Client representsClients represent and warrantswarrant that it hasthey have a lawful basis or hashave obtained all consents, licenses, and authorizations necessary for FTI to perform the services under this Engagement Contract. The Client agreesClients agree that itthey will FTI Reference Number: _____________ Rev. 10.07.22 Trace3, LLC v. Sycomp, et al. Davis Wright Tremaine, LLP and Glenn Agre Bergman & Fuentes LLP August 2529, 2023 Page 8 of 21 indemnify FTI and hold FTI harmless against any and all claims arising out of the use of such Third Party Software on behalf of the ClientClients to provide the services under this Engagement Contract. The Client agreesClients agree to promptly notify FTI if it extends (or solicits the possible interest in receiving) an offer of employment to a principal or employee of FTI involved in this Engagement and agrees that it will pay FTI a cash fee, upon hiring, equal to 150% of the aggregate current annualized compensation (both cash and non cash consideration), including any guaranteed or target bonus, to be paid to FTI’s former principal or employee that the ClientClients or any of itstheir subsidiaries or affiliates hires at any time up to one year subsequent to the date of the final invoice rendered by FTI with respect to this Engagement. The Engagement shall be governed by and interpreted in accordance with the laws of the State of California, without giving effect to the choice of law provisions thereof. The parties agree that any dispute or controversy that arises from this Engagement including any dispute or controversy relating to the fees and expenses billed under this Engagement Contract that cannot be resolved by the parties shall be submitted to arbitration in Los Angeles, California, in accordance with the applicable rules, regulations, policies, and procedures of the Commercial Arbitration Rules of the American Arbitration Association (“AAA”) and the Federal Arbitration Act. The decision of the arbitrator shall be final and binding. The parties consent to the jurisdiction of any federal and state court in the State of California for the enforcement of the arbitration award or otherwise. The Client agreesClients agree that itthey will comply with all anti-corruption, anti-money laundering, anti- bribery and other economic sanctions laws and regulations of the United States, United Kingdom, European Union and United Nations (collectively, the “ABC/AML/Sanction Laws”) in connection with this Engagement. The ClientClients further agreesagree that itthey shall not, and itthey shall procure itstheir employees not to, pay or cause other person(s) to pay FTI using any funds that would result in a violation of any of the ABC/AML/Sanction Laws by either Clientthe Clients or FTI, or otherwise take any action that would result in a violation of any of the ABC/AML/Sanction Laws by either Clientthe Clients or FTI. The ClientClients shall promptly notify FTI in the event of any violation or failure to comply with ABC/AML/Sanction Laws in connection with this Engagement, or allegations relating thereto, by the ClientClients or itstheir directors, officers, employees or agents. Additional Terms and Conditions for Technology/E-Discovery/Document Review Engagements In the event the services provided under this Engagement Contract include services provided by FTI’s Technology segment, the following additional terms and conditions shall apply to the Engagement Contract with respect to the provision of services by FTI’s Technology segment. Depending on certain state and/or municipality regulations, FTI may be required to collect sales and use tax on certain of FTI’s products and services. Alternatively, clientthe Clients shall provide documentation of direct pay certification or exemption from such taxes. Neither the ClientClients nor its Counsel acquires any interest in the copyright or any other intellectual property rights, including but not limited to any source code, enabling technology, information or other processes, know-how, scripts or sub-routines in or related to any software owned or licensed by FTI (the “FTI IP”). Except as expressly set forth herein, all rights and licenses granted to Clientthe Clients are non- FTI Reference Number: _____________ Rev. 10.07.22 Trace3, LLC v. Sycomp, et al. Davis Wright Tremaine, LLP and Glenn Agre Bergman & Fuentes LLP August 2529, 2023 Page 9 of 21 transferable and non-assignable. ClientClients may make a reasonable number of back-up copies of the FTI IP in accordance with its normal backup procedures so long as all copyright and other proprietary rights notices are included on all copies. FTI reserves all rights not expressly granted herein. Client acknowledgesClients acknowledge and agreesagree FTI shall be the sole and exclusive owner and copyright proprietor of all rights and title in and to the FTI IP in whatever stage of completion. Except as otherwise agreed to by FTI, no express or implied license or right of any kind is granted to ClientClients regarding the FTI IP including, but not limited to, any right to know, use, produce, receive, reproduce, copy, market, sell, distribute, transfer, modify, or adapt the FTI IP or create derivative works based on the FTI IP or any portions thereof, or obtain possession of any source code or other technical material relating to the FTI IP. The FTI IP specifically excludes the content of any documents collected by or furnished to FTI by or on behalf of the ClientClients or itstheir Counsel which shall remain the sole and exclusive property of ClientClients (the “Client Data”). The Client representsClients represent and warrantswarrant that the Client isClients are the owner of the Client Data or otherwise hashave the express right to provide the Client Data to FTI in connection with FTI’s provision of services hereunder. In the event FTI’s provision of Review Services (as defined herein) shall be performed using Client’sthe Clients’ or Counsel’s software (the “3rd Party Software”) licensed by ClientClients or Counsel (the “Licensee”), the Licensee represents and warrants to FTI that the Licensee has the right to grant to FTI and the Reviewers (as defined herein) a sublicense to use the 3rd Party Software in connection with FTI’s provision of Review Services. The Licensee further agrees to indemnify FTI and the Reviewers, and hold FTI and the Reviewers harmless against any and all claims for Losses (as defined herein) arising out of FTI’s and the Reviewers’ use of the 3rd Party Software. Document review services (the “Review Services”) requested by Clientthe Clients will be performed by FTI or a subcontractor of FTI (together, the “Reviewers”). The Reviewers are subject to the same conflict of interest and confidentiality undertakings as those set forth in this letter of engagement. Notwithstanding the foregoing, FTI shall be entitled to disclose the existence of this engagement to other law firms engaging FTI for Review Services solely for such law firm’s conflict review purposes. ClientClients, Counsel and FTI acknowledge and agree that the Review Services shall include document review for both responsiveness and privilege purposes. ClientClients, Counsel and FTI further acknowledge and agree that FTI is not a law firm, Counsel shall oversee the responsiveness and privilege review, the Review Services will be at the direction of Counsel, and all final determinations regarding relevance, privilege and production shall be in the sole determinations of Counsel. FTI may request or require that its Reviewers work from a location other than an FTI office, including, without limitation, a non-FTI commercial space that FTI uses to temporarily house the Reviewers, a client site and/or the employees’ residences (hereafter, a “Remote Work Location”). Client hasThe Clients have been informed that while FTI will take reasonable steps to protect the security and integrity of Client’sthe Clients’ documents and data while Reviewers are working from a Remote Work Location, the technical measures and security protections associated with Reviewers working from a Remote Work Location are necessarily different from, and less stringent than, those that exist while Reviewers work onsite. At Client’sthe Clients’ request, FTI can provide Clientthe Clients with information regarding the security procedures it will employ in the event that Reviewers working on the Engagement are required or permitted to work from a Remote Work Location. After being fully apprised of the facts and risks, ClientClients hereby authorizesauthorize FTI to permit its Reviewers to work on matters relating to or arising out of the Engagement from a Remote Work Location. ClientClients further FTI Reference Number: _____________ Rev. 10.07.22 Trace3, LLC v. Sycomp, et al. Davis Wright Tremaine, LLP and Glenn Agre Bergman & Fuentes LLP August 2529, 2023 Page 10 of 21 acknowledgesacknowledge that, while FTI Reviewers working on this engagement are working from a Remote Work Location, FTI will maintain protocols and procedures that are commercially reasonable for remote/internet access to documents and data, and that such procedures differ from those that are in place for onsite review. ClientClients also acknowledgesacknowledge that, in the event Reviewers working on the Engagement are required or requested to work from a Remote Work Location, FTI has offered ClientClients the right to: (1) delay any services being performed under the Engagement until the employees are able to work onsite; (2) suspend the review services associated with the Engagement (subject to an agreement between the parties regarding how the non-review services under the Engagement will be billed while the review services are suspended); or (3) where economically and logistically feasible, and subject to an agreement regarding potential additional costs, redirect the work to another geography as legally permissible. In the event that FTI requests or requires certain Reviewers to work from a Remote Work Location, FTI will take reasonable steps to meet all deadlines discussed and/or agreed to between the parties. Client understandsClients understand and acknowledgesacknowledge that, despite FTI’s reasonable efforts, the provision of services to Clientthe Clients under the Engagement may be delayed as a result of the impacts from pandemics or other factors outside of FTI’s control including, without limitation, impacts caused by (i) a slowdown or shutdown in the supply chain; (ii) limited access to technology or other resources; (iii) slowdown in review productivity due to change in work environment; (iv) travel restrictions; (v) restrictions to office and other facilities; and (vi) the inability of FTI Reviewers to work from a Remote Work Location. FTI Reference Number: _____________ Rev. 10.07.22 Trace3, LLC v. Sycomp, et al. Davis Wright Tremaine, LLP and Glenn Agre Bergman & Fuentes LLP August 2529, 2023 Page 11 of 21 SCHEDULE A FTI CONSULTING DATA PROTECTION SCHEDULE This Data Protection Schedule ("Schedule") forms part of the contract for services to which it is an attachment (the “Contract”) between the client partyparties identified in the Contract (the ClientClients”) and the relevant FTI Consulting group entity identified in the Contract (“FTI”). 1. Definitions 1.1 In this Schedule, unless otherwise defined herein, all defined terms shall have the meaning set out in the Contract. 1.2 In this Schedule, the following terms shall have the meanings set out below: 1.2.1 Data Protection Laws" means all legislation protecting the personal data of natural persons that is applicable to the processing of Personal Data under this Schedule, including (without limitation) the GDPR and any national legislation which supplements the GDPR, and the data protection laws of any other country, state or territory which apply to such processing; 1.2.2 “EEA Standard Contractual Clauses” means the Standard Contractual Clauses set out in the European Implementing Decision (EU) 2021/914 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679, as updated, amended, replaced or superseded from time to time by the European Commission; 1.2.3 GDPR" means the General Data Protection Regulation (EU) 2016/679; 1.2.4 "Restricted Transfer" means a transfer of Personal Data from ClientClients to FTI in circumstances where such transfer would be prohibited by Data Protection Laws in the absence of the EEA or UK Standard Contractual Clauses; 1.2.5 “Standard Contractual Clauses” means either the EEA or UK Standard Contractual Clauses, as applicable to a Restricted Transfer; 1.2.6 "UK Standard Contractual Clauses" means the standard contractual clauses for the transfer of personal data to Processors established in third countries which do not ensure an adequate level of protection as set out in Commission Decision 2010/87/EU, as updated, amended, replaced or superseded from time to time by the UK government; “UK GDPR” means the GDPR as transposed into United Kingdom national law by operation of section 3 of the European Union (Withdrawal) Act 2018 and as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019; and FTI Reference Number: _____________ Rev. 10.07.22 Trace3, LLC v. Sycomp, et al. Davis Wright Tremaine, LLP and Glenn Agre Bergman & Fuentes LLP August 2529, 2023 Page 12 of 21 1.2.7 Personal Data", "Process", "Controller", "Processor", "Data Subject", "Supervisory Authority" and "Personal Data Breach" shall have the meanings given to them in the Data Protection Laws. 2. Controller Terms 2.1 FTI and the ClientClients will each act as separate and individual Controllers in relation to any Personal Data (including, without limitation, Personal Data relating to any of the Client’sClients’ workers, FTI’s workers, any litigation or arbitration opponent or customer or vendor or transaction partner) Processed by the ClientClients or FTI to deliver the services set out under the Contract. 2.2 FTI and the ClientClients will each comply with its own respective obligations under the Data Protection Laws in relation to their Processing of Personal Data under the Contract. In particular, the ClientClients will ensure that any disclosures of Personal Data to FTI are lawful, and, in each case where necessary under the Data Protection Laws, the Client hasClients have notified and secured the consent of the relevant Data Subjects. 2.3 FTI may appoint Processors as required to deliver the services, who will process the Personal Data on FTI’s behalf and at FTI’s direction. Further, FTI may disclose Personal Data to other Controllers: 2.3.1 where necessary to deliver the services (including, but without limitation, law firms, accountants, other third party experts and any member of FTI’s group of companies); or 2.3.2 pursuant to a legally binding written request, an order or request of a court of competent jurisdiction or any governmental or regulatory authority or where disclosure is required by applicable law or regulation (“Legal Process”). In relation to any Legal Process, FTI shall assess the lawfulness of the request before responding, and shall take any steps required by Data Protection Laws to protect Personal Data prior to its disclosure (including, without limitation, with respect to data minimization and data security); 2.4 In respect of any Restricted Transfer subject to the GDPR, the parties hereby enter into Module 1 of the EEA Standard Contractual Clauses (with ClientClients as data exporterexporters and FTI as data importer), which is hereby incorporated by reference into this Schedule and which shall come into effect upon the commencement of a Restricted Transfer. The parties make the following selections for the purposes of Module 1: 2.4.1 Clause 7 – Docking clause shall apply; 2.4.2 Clause 11(a) – Redress the optional language shall not apply; 2.4.3 Clause 13(a) – Supervision FTI Reference Number: _____________ Rev. 10.07.22 Trace3, LLC v. Sycomp, et al. Davis Wright Tremaine, LLP and Glenn Agre Bergman & Fuentes LLP August 2529, 2023 Page 13 of 21 2.4.3.1 Where a Client is established in an EU Member State, the following shall apply: “The supervisory authority with responsibility for ensuring compliance by the data exporter with Regulation (EU) 2016/679 as regards the data transfer shall be the supervisory authority of the Member State in which Client is established or (if different) the lead supervisory authority of the Client in respect of a cross-border processing activity”. OR 2.4.3.2 Where a Client is not established in an EU Member State, but falls within the territorial scope of application of the GDPR in accordance with Article 3(2) and has appointed a representative pursuant to Article 27(1) of the GDPR the following shall apply: “The supervisory authority of the Member State in which the representative within the meaning of Article 27(1) of Regulation (EU) 2016/679 is established, shall act as competent supervisory authority.” OR 2.4.3.3 Where a Client is not established in an EU Member State, but falls within the territorial scope of application of the GDPR in accordance with Article 3(2) without however having to appoint a representative the following shall apply: “The supervisory authority of one of the Member States in which the data subjects whose personal data is transferred under these Clauses in relation to the offering of goods or services to them, or whose behaviour is monitored, are located, as indicated in Annex I.C, shall act as competent supervisory authority.” 2.4.4 Clause 17 – Governing law “Option 1” shall apply and the “Member State” shall be the Republic of Ireland; 2.4.5 Clause 18 – Choice of forum and jurisdiction the Member State shall be the Republic of Ireland; 2.4.6 Annex 1 – the data exporter is Clientexporters are the Clients and the data importer is FTI (in each case as identified, including in relation to their places of establishment, in the Principal Agreement) and the description of transfer is deemed to be as described in Annex 1 to this Schedule; 2.4.7 Annex 2 – the technical and organizational security measures are deemed to be as described in Annex 2 to this Schedule; and 2.4.8 Annex 3 – not applicable. 2.5 In respect of any Restricted Transfer subject to the UK GDPR, the parties hereby enter into the UK Standard Contractual Clauses (with ClientClients as data exporterexporters and FTI as data importer), which are incorporated by reference into this Schedule and which shall come into effect upon the commencement of a Restricted Transfer. For the purposes of clause II h) of the UK Standard Contractual Clauses, the Parties shall be deemed to have selected option (iii). Annex 2 to the UK Standard Contractual Clauses shall be deemed to be prepopulated with the relevant FTI Reference Number: _____________ Rev. 10.07.22 Trace3, LLC v. Sycomp, et al. Davis Wright Tremaine, LLP and Glenn Agre Bergman & Fuentes LLP August 2529, 2023 Page 14 of 21 sections of the Annex to this Schedule. If at any time the UK government approves the EEA Standard Contractual Clauses for use under the UK GDPR, the provisions of paragraph 2.4 shall apply in place of this paragraph 2.5 in respect of Restricted Transfers subject to the UK GDPR, subject to any modifications to the EEA Standard Contractual Clauses required by the UK GDPR (and subject to the governing law of the EEA Standard Contractual Clauses being English law). 2.6 The Client acknowledgesClients acknowledge and agreesagree that certain Processors or Controllers engaged by FTI under paragraph 2.3 may be located in places that may require cross- border transfers of Personal Data. In respect of transfers by FTI to such Controllers or Processors, FTI will take steps in accordance with the Data Protection Laws to ensure an adequate level of protection for the Personal Data Processed by such Processors or Controllers. Where such a Controller or Processor notifies FTI that it may no longer be able to provide an adequate level of protection in accordance with Data Protection Laws, FTI shall independently assess the level of protection provided and, where ne