Preview
1 Claire E. Cochran (SBN 222529)
Natalie A. Xifo (SBN 280930) ELECTRONICALLY
2
LAW OFFICES OF CLAIRE COCHRAN, P.C.
100 Pine Street, Suite 1250
FILED
3 Superior Court of California,
San Francisco, CA 94111 County of San Francisco
4 Telephone: (415) 580-6019 03/10/2021
Facsimile: (415) 745-3301 Clerk of the Court
BY: JUDITH NUNEZ
5 Deputy Clerk
6 Attorneys for Plaintiff
NATHAN PETER RUNYON
7
8 SUPERIOR COURT OF THE STATE OF CALIFORNIA
9 FOR THE COUNTY OF SAN FRANCISCO
10 [UNLIMITED JURISDICTION]
11 Case No. CGC-19-581099
NATHAN PETER RUNYON
12 EX PARTE APPLICATION FOR ORDER
Plaintiff, SHORTENING TIME FOR PLAINTIFF
13 NATHAN PETER RUNYON’S NOTICE
v. OF MOTION TO APPOINT A SPECIAL
14 MASTER
15 PAYWARD, INC., a California Corporation [Filed Concurrently with Memorandum of
Points and Authorities; Declaration of Claire
d/b/a KRAKEN; and KAISER NG an individual E. Cochran, Esq. and Proposed Order]
16
and DOES 1-50, inclusive
17 Ex Parte Hearing Date: March 11, 2021
Time: 11:00 a.m.
Defendants. Dept.: 302
18
19 Date Action Filed: November 26, 2019
Trial Date: July 12, 2021
20
21
22
23 ///
24 ///
25 ///
26 ///
27 ///
28
Page | 1
EX PARTE APPLICATION FOR ORDER SHORTENING TIME FOR PLAINTIFF’S NOTICE OF
MOTION TO APPOINT A SPECIAL MASTER
1 ///
2
3 TO DEFENDANTS AND THEIR ATTORNEYS OF RECORD:
4 NOTICE IS HEREBY GIVEN THAT on March 11, 2020, at 11:00 a.m. or as soon as thereafter
5 as the matter may heard in Department 302 of the San Francisco Superior Court located at 400
6 McAllister Street, San Francisco, CA, Plaintiff NATHAN PETER RUNYON (“Plaintiff”) and
7 through his attorneys of record, will and hereby does move for an Order Shortening Time on
8 Plaintiff’s Notice of Motion to Appoint a Special Master.
9 Plaintiff’s Notice of Motion to Appoint a Special Master is based upon this Notice, the
10 accompanying Memorandum of Points and Authorities, the Declaration of Claire Cochran, Esq.
11 and exhibit thereto served and filed herewith.
12 Notice of this Application was given in compliance with Rule 3.1203 of the California
13 Rules of Court.
14
15 Dated: March 9, 2021 LAW OFFICES OF CLAIRE COCHRAN PC
16
17 ____________________________
CLAIRE E. COCHRAN
18
Attorneys for Plaintiff,
19 NATHAN PETER RUNYON
20
21
22
23
24
25
26
27
28
Page | 1
EX PARTE APPLICATION FOR ORDER SHORTENING TIME FOR PLAINTIFF’S NOTICE OF
MOTION TO APPOINT A SPECIAL MASTER
1 MEMORANDUM OF POINTS AND AUTHORITIES
2
3 I. STATEMENT OF FACTS
4 This matter was filed on November 26, 2019. Plaintiff filed a First Amended Complaint
5 (“FAC”) on January 6, 2020. Plaintiff alleges that his former employer, Defendants Payward and
6 Kaiser Ng, discriminated against him based on his disability, and that Defendants retaliated
7 against him for raising concerns about their misconduct in altering employees’ equity vesting
8 schedules.
9 The Defendants filed a Notice of Demurrer and Motion to Strike Plaintiff’s FAC
10 (“Defendants’ Motions”). The hearing on Defendants’ Motions was held on March 11, 2020. The
11 Court overruled Defendants’ request to demurrer Plaintiff’s FEHA causes of action, fifth, eighth,
12 ninth and tenth causes of action. The Court denied Defendant’s Motion to Strike Irrelevant, False
or Improper Matters in Plaintiff’s FAC in its entirety.
13
This request is being made in order to allow for the orderly and well-considered
14
resolution of a pressing discovery issue. Plaintiff’s counsel has in their possession electronically-
15
stored documents that Plaintiff provided on a USB flash drive, which substantiate that
16
Defendants altered employees’ equity vesting schedule without consent of the Payward’s Board
17
of Directors. The documents that Plaintiff obtained were prior to Payward terminating him. The
18
information is contained on two USB flash drives that Plaintiff created while he was employed
19
by Payward.
20
Counsel for Defendant, Christopher LaVigne, recently advised Plaintiff’s counsel that
21
Payward, dba Kraken, will be pursuing Plaintiff’s communications protected by the work-
22
product doctrine and attorney-client privilege under the crime fraud exception to the attorney-
23
client privilege, and any related case, as they relate to documents provided by Plaintiff. In light
24
of this assertion, and to make sure Plaintiff’s counsel is compliant with ESI collection and
25
management, Plaintiff’s counsel explained to Defendants’ counsel that the document production
26 must be conducted by an expert via a forensic analysis and any related data and documents were
27 to be produced by the expert to both sides. Plaintiff’s counsel proposed the parties stipulate to a
28
Page | 1
EX PARTE APPLICATION FOR ORDER SHORTENING TIME FOR PLAINTIFF’S MPA ISO OF
PLAINTIFF’S NOTICE OF MOTION TO APPOINT A SPECIAL MASTER
1 joint expert to expedite the process. Defendants’ counsel declined the offer and instead ignored
2 the protocol and demanded the production of the USB flash drives.
3 In order to have the forensic analysis conducted, Plaintiff’s counsel needs to have an
4 expert to create an image of the USB flash drives that Plaintiff created and no expert would do so
5 absent an Order from this Honorable Court or a stipulation from both parties that the confidential
6 data can be examined. This forensic road map is an essential first step before Plaintiff’s counsel
7 can produce the USB flash drives for inspection (and confidential production) to counsel for
Defendants. Plaintiff’s counsel was advised of this requirement just 24 hours prior to inquiring
8
of Defendants’ counsel whether they would stipulate to the appointment of a Special Master and
9
to continue the existing trial date. The need to continue the trial date is due to the upcoming
10
deadline for Defendants’ Motion for Summary Judgment which must be filed no later than
11
March 23, 2021. As such, these documents and the USB flash drives must be analyzed, reviewed
12
and produced as soon as possible. As it is unlikely that an expert can do this work within the next
13
two weeks, Plaintiff is simultaneously filing a motion to continue the trial.
14
Plaintiff expects that the same forensic analysis designated will be applied to sources or
15
confidential documents produced by Defendants in this case, especially when a confidential
16
document has been or will be produced that conflicts with the versions on the USB flash drives.
17
A proper analysis and consideration of the documents has implications beyond this civil
18
action. Four days after they filed their Answer in this civil action, Defendants filed a civil action
19
against Mr. Runyon in the United States District Court for the Northern District of California –
20
reciting the identical arguments they cited in their Notice of Demurrer and Motion to Strike
21 Plaintiff’s FAC. After their first Complaint in that action was dismissed on Mr. Runyon’s
22 motion, Payward filed an Amended Complaint. In their Amended Complaint, Payward set out
23 three causes of action: (1) violation of the Defendant Trade Secrets Act (“DTSA”), 18 U.S.C. §§
24 1831-39, based on an allegation that Mr. Runyon retained his company-issued laptop, copied
25 documents that contained trade secrets, and disclosed or used the trade secrets contained in those
26 documents; (2) violation of the Computer Fraud and Abuse Act (“CFAA”), 18 U.S.C. § 1030,
27 based on an allegation that Mr. Runyon failed to return his laptop when he was terminated; and
28
Page | 1
EX PARTE APPLICATION FOR ORDER SHORTENING TIME FOR PLAINTIFF’S MPA ISO OF
PLAINTIFF’S NOTICE OF MOTION TO APPOINT A SPECIAL MASTER
1 (3) breach of contract, under California State law, for allegedly failing to return his laptop. Mr.
2 Runyon filed a new motion to dismiss; the Court granted the motion as to the first claim for relief
3 and denied the motion as to the other two claims for relief. Accordingly, that federal action,
4 which thus implicates the contents of the USB flash drives at issue here, remains pending.
5 In light of all of this, it is clear that the appointment of a digital forensics Special Master
6 is necessary to proper evaluate the contents of the USB flash drives at issue here. In particular, it
7 is clear that it is essential to a proper resolution of this action for a neutral third party to examine
the contents of the USB flash drives, including when this information was obtained – so that
8
Defendants do not further retaliate against Plaintiff and his attorneys with baseless lawsuits
9
alleging that Plaintiff stole their trade secrets after being terminated.
10
II. ARGUMENT
11
California Code of Civil Procedure § 845 states in relevant part:
12
(a) The court may appoint one or more special masters whose duties may include
13 the following (1) Investigating technical and legal issues, as directed by the court.
14 The special master shall compile a report of findings in accordance with Section
846.
15 Under this code section, the Special Master is appointed by the court and has the
16 authority to carry out court orders, whether agreed to by the parties ahead of time, or ordered by
17 the court after hearing testimony, arguments, or recommendations by party experts.
18 A Special Master appointed by the court has the technical expertise to understand
19 eDiscovery issues and settle disputes efficiently. Plaintiff proposes a scope of duty that would
20 allow the Special Master to conduct discovery, take evidence and argument, and review the
21 existing record in making recommended findings of fact, conclusions of law, or terms of final
22 judgment in his or her report. This scope of duty allows the Special Master to carefully examine
23 the complex legal and factual issues presented by the case. If appointed, a Special Master may
24 take evidence and recommend findings of fact and conclusions of law regarding the contents of
25 the USB flash drives. These duties fall squarely within the purview of California Civil Procedure
26 section 845(a)(1).
27
28
Page | 1
EX PARTE APPLICATION FOR ORDER SHORTENING TIME FOR PLAINTIFF’S MPA ISO OF
PLAINTIFF’S NOTICE OF MOTION TO APPOINT A SPECIAL MASTER
1 Plaintiff proposes that the Court appoint Tom Howe of the Howe Law Firm as Digital
2 Forensics Special Master. The firm has the expertise and qualifications to perform the task at
3 hand – a task that is essential to a proper resolution of this civil action and the action filed by
4 Defendants in the United States District Court.
5 III. CONCLUSION
6 The interests of justice are served by the immediate appointment of a Special Master to
7 assist the Court in reviewing the flash drives which contain confidential relevant information
8 which substantiate Plaintiff’s Labor Code section 1102.5 claims. Utilizing the skills of a digital
9 forensics special master will eliminate the parties fighting over whether or not Plaintiff “stole”
10 documents, whether the documents have been altered or reproduced in any format other than to
11 his attorneys. Nothing is more counter-productive than lawyers arguing technical e-discovery
12 issues when an expert in the field could illuminate a case knowledgeably. A Digital Forensics
13 Special Master, or court-appointed expert, is valuable resource. There is no valid reason to deny
14 such an appointment.
15 Dated: March 9, 2021 LAW OFFICES OF CLAIRE COCHRAN PC
16
17 ____________________________
CLAIRE E. COCHRAN
18
Attorneys for Plaintiff,
19 NATHAN PETER RUNYON
20
21
22
23
24
25
26
27
28
Page | 1
EX PARTE APPLICATION FOR ORDER SHORTENING TIME FOR PLAINTIFF’S MPA ISO OF
PLAINTIFF’S NOTICE OF MOTION TO APPOINT A SPECIAL MASTER
1
DECLARATION OF CLAIRE E. COCHRAN
2
I, CLAIRE E. COCHRAN, ESQ., declare as follows:
3
1. I am an attorney licensed to practice law in the State of California. I am the
4
Owner and Principal of the law firm Law Offices of Claire Cochran, P.C. (“LOCC”), attorneys
5
of record for Plaintiff NATHAN PETER RUNYON (“Plaintiff”) in the within civil proceeding.
6
If called upon as a witness, I could and would competently testify to the following:
7
2. This declaration is in support of Plaintiff’s Motion to Appoint a Special Master
8
in this civil action.
9
3. This matter was filed November 26, 2019. Plaintiff filed a First Amended
10
Complaint (“FAC”) on January 6, 2020. By February 2020, the Defendants filed a Notice of
11
Demurrer and Motion to Strike Plaintiff’s FAC (“Defendants’ Motions”). The hearing on
12
Defendants’ Motions was held on March 11, 2020. The Court overruled Defendants’ request to
13
demurrer Plaintiff’s FEHA causes of action, fifth, eighth, ninth and tenth causes of action. The
14
Court denied Defendant’s Motion to Strike Irrelevant, False or Improper Matters in Plaintiff’s
15
FAC in its entirety.
16
4. Plaintiff’s counsel has documents Plaintiff provided to LOCC on two USB flash
17
drives, which substantiate that Defendants altered employees’ equity vesting schedule without
18
consent of the Payward’s Board of Directors. The documents that Plaintiff obtained and saved
19
on the USB flash drives were prior to Payward terminating him.
20
5. Counsel for Defendants, Christopher LaVigne, recently advised me that
21
Payward, dba Kraken, will be pursuing our work production and attorney-client privileged
22
communications under the crime fraud exception to the attorney-client privilege, and any related
23
case, as they relate to documents provided to us by our client. In light of this assertion, and to
24
make sure we are compliant with ESI collection and management, we explained to Mr. LaVigne
25
that the document production must be conducted by an expert via a forensic analysis and any
26
related data and documents were to be produced by the expert to both sides. I proposed the
27
parties stipulate to a joint expert to expedite the process. Mr. LaVigne declined the offer and
28
Page | 1
DECLARATION OF CLAIRE COCHRAN, ESQ. ISO OF EX PARTE APPLICATION FOR ORDER
SHORTENING TIME FOR PLAINTIFF’S NOTICE OF MOTION TO APPOINT A SPECIAL MASTER
1 instead ignored the protocol and demanded the production of the USB flash drives.
2 6. In order to have the forensic analysis conducted, we need an expert to create a
3 forensic image of the USB flash drives and review the metadata on every document that
4 Plaintiff saved; no expert will conduct a forensic analysis absent an order from the Court or a
5 stipulation from both parties that the confidential data can be examined. This forensic road map
6 is an essential first step before we can produce the USB flash drives for inspection (and
7 confidential production) to counsel for Defendants. We became aware of this requirement just
8 24 hours prior to requesting that Mr. LaVigne stipulate to the appointment of a Special Master
9 and to continue the existing trial date.
10 7. The need to continue the trial date is due to the upcoming deadline for
11 Defendants’ Motion for Summary Judgment which must be filed no later than March 23, 2021.
12 As such, these documents and the USB flash drives must be analyzed, reviewed and produced
13 as soon as possible. As it is unlikely that an expert can do this work within the next two weeks,
14 Plaintiff is simultaneously filing a motion to continue the trial.
15 8. Plaintiff expects that the same forensic analysis designated will be applied to
16 sources or confidential documents produced by Defendants in this case, especially when a
17 confidential document has been or will be produced that conflicts with the versions on our
18 client’s USB flash drives.
19 9. A proper analysis and consideration of the documents also has implications
20 beyond this civil action. Four days after they filed their Answer in this civil action, Defendants
21 filed a civil action against Mr. Runyon in the United States District Court for the Northern
22 District of California – reciting the identical arguments they cited in their Notice of Demurrer
23 and Motion to Strike Plaintiff’s FAC. In their federal action, Case No. 3:20-cv-02130-MMC,
24 Defendants stated causes of action for Misappropriation of Trade Secrets, Unlawfully Accessing
25 a Protected Computer under Computer Fraud and Abuse Act and Breach of Contract. Mr.
26 Runyon filed a motion to dismiss; the District Court granted Mr. Runyon’s motion; and the
27 Defendants filed an Amended Complaint. In their Amended Complaint, Payward set out three
28
Page | 1
DECLARATION OF CLAIRE COCHRAN, ESQ. ISO OF EX PARTE APPLICATION FOR ORDER
SHORTENING TIME FOR PLAINTIFF’S NOTICE OF MOTION TO APPOINT A SPECIAL MASTER
1 causes of action: (1) violation of the Defendant Trade Secrets Act (“DTSA”), 18 U.S.C. §§
2 1831-39, based on an allegation that Mr. Runyon retained his company-issued laptop, copied
3 documents that contained trade secrets, and disclosed or used the trade secrets contained in
4 those documents; (2) violation of the Computer Fraud and Abuse Act (“CFAA”), 18 U.S.C. §
5 1030, based on an allegation that Mr. Runyon failed to return his laptop when he was
6 terminated; and (3) breach of contract, under California State law, for allegedly failing to return
7 his laptop. A true and correct copy of Payward’s Amended Complaint filed in United States
8 District Court for the Northern District of California is attached as Exhibit “A.” Mr. Runyon
9 filed a new motion to dismiss; the Court granted the motion as to the first claim for relief and
10 denied the motion as to the other two claims for relief. A true and correct copy of the District
11 Court’s ruling on Mr. Runyon’s motion to dismiss is attached as Exhibit “B.” Accordingly, that
12 federal action, which thus implicates the contents of the thumb drives at issue here, remains
13 pending.
14 Efforts to Meet and Confer and Stipulate to the Appointment of a Joint Expert
15 10. On March 3, 2021, I sent a letter via email to Defendants’ counsel, Christopher
16 LaVigne. 1 I advised Mr. LaVigne of the facts set out above concerning our inability to produce
17 the flash drives until a forensic analysis had been conducted. I proposed to Mr. LaVigne that
18 the parties jointly retain an expert who could conduct an analysis of the USB flash drives and
19 map any related usage of the jump drives, and their confidential documents, immediately. I
20 also suggested that we offer up related experts as quickly as possible and get these examined,
21 mapped and provided to both parties for use in his deposition of Plaintiff and before
22 Defendants’ deadline to file a Motion for Summary Judgment.
23 11. I also explained that, whatever happens, it is essential that Plaintiff be allowed to
24 conduct this forensic review of the flash drives to defend against claims of wrongful acts,
25 levied against both Plaintiff and his Counsel and to substantiate his claims of retaliation for
26
1
This correspondence was designated as highly confidential and protected pursuant to Stipulated Protective Order,
27 as such it cannot be attached as an exhibit herein.
28
Page | 1
DECLARATION OF CLAIRE COCHRAN, ESQ. ISO OF EX PARTE APPLICATION FOR ORDER
SHORTENING TIME FOR PLAINTIFF’S NOTICE OF MOTION TO APPOINT A SPECIAL MASTER
1 whistleblowing pursuant to Labor Code section 1102.5. I also made clear that any forensic
2 review would be provided to Defendants.
3 12. On March 3, 2021, Mr. LaVigne sent an email to me in which he declined to
4 agree to the appointment of a Special Master and declined to agree to a brief continuance of the
5 July 12, 2021 trial date. Instead, Mr. LaVigne demanded that my firm send them the USB flash
6 drives absent any forensic evaluation of same. A true and correct copy of the email exchange is
7 attached as Exhibit “C.” As such, a motion was required to be filed to immediately address
8 this issue.
9 13. Based on the foregoing, it is respectfully requested that this appoint a Special
10 Master to review the contents of two flash drives at issue in this civil action and that are also
11 implicated in the civil action filed by Payward in the federal District Court.
12 I declare under penalty of perjury under the laws of the State of California that the
13 foregoing is true and correct.
14 Executed on March 9, 2021, at San Francisco California.
15
16
17
CLAIRE E. COCHRAN
18 Attorneys for Plaintiff,
19 NATHAN PETER RUNYON
.
20
21
22
23
24
25
26
27
28
Page | 1
DECLARATION OF CLAIRE COCHRAN, ESQ. ISO OF EX PARTE APPLICATION FOR ORDER
SHORTENING TIME FOR PLAINTIFF’S NOTICE OF MOTION TO APPOINT A SPECIAL MASTER
Exhibit A
Case 3:20-cv-02130-MMC Document 34 Filed 10/09/20 Page 1 of 27
Kimberly Almazan (SBN 288605)
1
kimberly.almazan@withersworldwide.com
2 Christopher N. LaVigne (NYBN 4811121)
(Admitted Pro Hac Vice)
3 christopher.lavigne@withersworldwide.com
Withers Bergman LLP
4
505 Sansome Street, 2nd Floor
5 San Francisco, California 94111
Telephone: 415.872.3200
6 Facsimile: 415.549 2480
7
Attorneys for Plaintiffs Payward, Inc., a
8 California Corporation d/b/a Kraken
9
UNITED STATES DISTRICT COURT
10
NORTHERN DISTRICT OF CALIFORNIA
11
SAN FRANCISCO/OAKLAND DIVISION
12
13
PAYWARD, INC., a California Corporation, Case No.: 20-cv-2130-MMC
14 d/b/a KRAKEN,
AMENDED COMPLAINT
15
Plaintiff, DEMAND FOR JURY TRIAL
16
v.
17
NATHAN PETER RUNYON., an individual,
18
and DOES 1 through 10, inclusive.
19
Defendant.
20
21
22
23
24
25
26
27
28
PAYWARD v. RUNYON
Case No. 20-CV-2130-MMC NY28571/0002-US-8632109/2
AMENDED COMPLAINT
Case 3:20-cv-02130-MMC Document 34 Filed 10/09/20 Page 2 of 27
1 Plaintiff Payward, Inc. d/b/a Kraken (“Payward” or “the Company”) alleges the following:
2 INTRODUCTION
3 1. Payward is a global cryptocurrency exchange that critically relies on trade secrets
4 and confidential business information to maintain the security of its operations. Because of the
5 nature of its business, Payward is subject to constant physical and electronic hacking attempts,
6 and the security of Payward’s physical business locations, employees, and business and customer
7 data is of the utmost importance to ensure Plaintiff’s successful and continuing business
8 operations.
9 2. This action seeks to hold Defendant Nathan Peter Runyon, a former employee of
10 Payward, accountable for unlawfully accessing and misappropriating Payward’s confidential
11 business information and trade secrets and for violating his confidentiality agreement with
12 Payward.
13 3. Payward employed Defendant as a financial analyst in its San Francisco, CA office
14 from March 26, 2018 until August 1, 2019. Before his employment began, Defendant signed a
15 Confidential Information and Invention Assignment Agreement on March 14, 2018 (the
16 “Confidentiality Agreement”) that bound him to protect and maintain in strict confidence the
17 information and data he became aware of, accessed, and stored through his employment with
18 Payward.
19 4. In connection with his hiring and employment by Payward, Defendant was
20 repeatedly made aware of, and bore witness to, the paramount necessity for confidentiality
21 surrounding Payward’s business. This need for confidentiality in all aspects of Payward’s
22 business includes numerous security measures ranging from, for example, protection of sensitive
23 customer electronic account information to safeguarding the confidentiality of the physical
24 locations and addresses of Payward’s offices.
25 5. In connection with Defendant’s employment, Payward issued Defendant a laptop
26 for use in his day-to-day activities and responsibilities at Payward. During the course of
27 Defendant’s employment at Payward, he accumulated a large amount of financial, business,
28 customer, technical, and economic proprietary information and data in the form of, among other
PAYWARD v. RUNYON
Case No. 20-CV-2130-MMC 1 NY28571/0002-US-8632109/2
AMENDED COMPLAINT
Case 3:20-cv-02130-MMC Document 34 Filed 10/09/20 Page 3 of 27
1 things, documents, emails, and internal Company communications, all of which Defendant stored
2 on his Company-issued laptop.
3 6. Payward terminated Defendant’s employment on August 1, 2019.
4 7. Payward was acutely aware of the sensitive, confidential, and trade-secret
5 information contained on Defendant’s laptop computer. Accordingly, immediately upon
6 Defendant’s termination from the Company, Payward instructed Defendant to return the laptop
7 to Payward. Additionally, Defendant was obligated under the Confidentiality Agreement to return
8 Company property, including the laptop, to Payward immediately upon his termination.
9 8. Despite repeated attempts by Payward to collect the laptop from Defendant, he
10 refused to return the laptop to Payward. Instead, Defendant strung Payward along with false
11 promises to return the laptop while he could continue to access the confidential and trade secret
12 information on the laptop.
13 9. On August 2, 2019, Defendant claimed he could not return the laptop to Payward
14 because he may be going on a vacation. On August 6, 2019, he stated he would keep Payward
15 updated on his return from vacation and when he could return the laptop. Payward followed up
16 with Defendant on August 14, 2019, seeking clarity on when Defendant would return the laptop.
17 Defendant sent a series of emails stating he would return the laptop on successively later dates.
18 10. Eventually, Defendant stated he would return the laptop to Payward on August 29,
19 2019. However, when that date arrived, Defendant emailed Payward and said the laptop had been
20 stolen from his vehicle. To date, the laptop has not been recovered.
21 11. Defendant continued to access the trade secrets and confidential business
22 information on his Company laptop while in unlawful possession of it.
23 12. Defendants became aware he was accessing and sharing the confidential and trade
24 secret information contained in the laptop because he produced copies of confidential Company
25 documents in connection with an employment lawsuit he brought in California Superior Court.
26 Plaintiff would only have access to these documents through his employment at Payward.
27 13. Defendant revealed additional confidential and trade secret information in
28 connection with his lawsuit against Payward, which alleges he was discriminated and retaliated
PAYWARD v. RUNYON
Case No. 20-CV-2130-MMC 2 NY28571/0002-US-8632109/2
AMENDED COMPLAINT
Case 3:20-cv-02130-MMC Document 34 Filed 10/09/20 Page 4 of 27
1 against by Payward based on his veteran status and disabilities and his reporting of certain alleged
2 stock vesting discrepancies. The confidential and trade secret information stored on and
3 accessible through Defendant’s laptop was extensive. The information and data he possessed on
4 his laptop went well beyond the information necessary to support his lawsuit against Payward.
5 Indeed, much of the information was completely unrelated to the lawsuit.
6 14. Among Defendant’s most blatant and unnecessary disclosures of confidential and
7 trade secret information was Defendant’s public exposure of the physical address of Payward’s
8 headquarters, which, up to the date of Defendant’s publicly-filed lawsuit, had not been publicly
9 disclosed, through great efforts by Payward to protect the confidentiality of that address.
10 15. Defendant has first-hand knowledge of Payward’s efforts to keep the physical
11 addresses of its offices, including its headquarters, confidential. Defendant worked at Payward’s
12 headquarters, and was subject to and aware of Payward’s requirement, for example, that all
13 employees and visitors sign non-disclosure agreements regarding the whereabouts and physical
14 address of Payward’s headquarters. Defendant knew that Payward instead made public only a
15 mailing address for its headquarters that is geographically distinct from the headquarters’ actual
16 address.
17 16. Defendant’s publication of the physical address of Payward’s headquarters
18 breached the Confidentiality Agreement and Payward’s standard confidentiality practices, which
19 are and were well known to Defendant. Defendant’s publication of Payward’s physical address,
20 known to him only through his work for Payward and specifically his work at that address, was
21 intentional and malicious.
22 17. Defendant’s misappropriation of Payward’s trade secrets and the breach of his
23 confidentiality agreement have required that Payward spend money and time mitigating the
24 immediate risk of harm and significant continued risk of future harm created by Defendant’s
25 failure to return his laptop upon his termination as required by the Confidentiality Agreement, his
26 continued access to the confidential business and customer information and trade secrets on that
27 laptop, his (at best) carelessness with the laptop that led to it purportedly being stolen by an
28
PAYWARD v. RUNYON
Case No. 20-CV-2130-MMC 3 NY28571/0002-US-8632109/2
AMENDED COMPLAINT
Case 3:20-cv-02130-MMC Document 34 Filed 10/09/20 Page 5 of 27
1 unknown third party, and his public revelation of the confidential physical address of Payward’s
2 headquarters.
3 PA R T I E S
4 18. Payward, Inc. d/b/a Kraken is a California corporation, incorporated in the State
5 of Delaware, with its principal place of business in San Francisco, California.
6 19. Defendant Nathan Peter Runyon is an individual and citizen of California who is
7 believed to reside at 456 South Van Ness Avenue, San Francisco, CA 94103.
8 JURISDICTION AND VENUE
9 20. This Court has subject matter jurisdiction because Payward has asserted claims
10 against Defendant pursuant to 28 U.S.C. § 1331 for misappropriation of trade secrets under the
11 Defend Trade Secrets Act (“DTSA”) and 10 U.S.C. § 1030 for violation of the Computer Fraud
12 and Abuse Act (“CFAA”). This Court has supplemental or pendent jurisdiction over Payward’s
13 remaining claims pursuant to 28 U.S.C. § 1367 because such claims are so related to Payward’s
14 federal DTSA claim that they form part of the same case or controversy under Article III of the
15 United States Constitution.
16 21. Venue is proper in the Northern District of California pursuant to 28 U.S.C.
17 § 1391(b)(1) because Payward and Defendant are residents of San Francisco, CA. Venue is also
18 appropriate in this district pursuant to 28 U.S.C, § 1391(b)(2) because the events that gave rise to
19 this complaint occurred in this district.
20 FA C T U A L A L L E G AT I O N S
21 A. Payward Is One of the Largest and Oldest Bitcoin Exchanges in the World
22 22. Payward formed in 2011 in the nascent market of cryptocurrency trading and
23 launched its trading platform two years later in 2013. Payward’s trading platform allows
24 customers to buy and trade Bitcoin and other cryptocurrencies online. Payward has grown to
25 become a leading platform with hundreds of employees and operations spanning the globe.
26 23. The cryptocurrency trading market is intensely competitive. Security is among the
27 leading factors that consumers consider when selecting a trading platform and a critical element
28 for business growth. Payward’s reputation for security translates to consumer confidence and
PAYWARD v. RUNYON
Case No. 20-CV-2130-MMC 4 NY28571/0002-US-8632109/2
AMENDED COMPLAINT
Case 3:20-cv-02130-MMC Document 34 Filed 10/09/20 Page 6 of 27
1 leads to greater usage. Greater usage helps improve liquidity — how easily assets can be bought
2 or sold at a stable price — by raising trade volume and active traders. Increased liquidity in turn
3 attracts more consumers.
4 24. The cryptocurrency trading industry is exceptionally prone to hacking attempts
5 and exploitation of trade secrets. The rise in popularity and value of cryptocurrencies has made
6 trading platforms a prime target for hackers. See Brian Fung, Why bitcoin exchanges keep getting
7 hacked – and how to protect yourself, The Switch, June 20, 2018 (“The price of bitcoin took a
8 tumble early Wednesday after a major South Korea-based cryptocurrency exchange, Bithumb,
9 admitted hackers made off with more than $31 million worth of virtual currency.”), available at
10 https://www.washingtonpost.com/news/the-switch/wp/2018/06/20/why-bitcoin-exchanges-
11 keep-getting-hacked-and-how-to-protect-yourself/?utm_term=.ab72f3bcf185.
12 25. Since 2011, there have been 56 documented hacks of cryptocurrency exchanges.
13 See Lauren Yates, Memorandum re Meeting With Bitwise Asset Management, Inc., NYSE Arca,
14 Inc., and Vedder Price P.C., SEC, Mar. 20, 2019, available at https://www.sec.gov/comments/sr-
15 nysearca-2019-01/srnysearca201901-5164833-183434.pdf. These hacks have cost exchanges
16 billions of dollars:
17
18
19
20
21
22
23
24
25
26 26. Many of these hacks result from hackers’ identification and exploitation of
27 cryptocurrency exchange employees. For example, a highly-sophisticated phishing attack (a
28 fraudulent practice intended to induce individuals to reveal personal information or open
PAYWARD v. RUNYON
Case No. 20-CV-2130-MMC 5 NY28571/0002-US-8632109/2
AMENDED COMPLAINT
Case 3:20-cv-02130-MMC Document 34 Filed 10/09/20 Page 7 of 27
1 malicious artifacts) targeted employees of the cryptocurrency exchange Bitstamp in 2014 and
2 2015. Hackers first targeted Bitstamp’s Chief Technology Officer, offering him free tickets to a
3 rock concert. When that failed, they posed as a reporter in an attempt to get a different employee
4 to open a document that allegedly contained an article on which the reporters sought comment,
5 but that really housed malware designed to give hackers access to the employee's computer.
6 Eventually, the hackers contacted a system administrator, promising him membership into a
7 “special fraternity.” When the administrator opened the file containing information about the
8 purported fraternity, it installed malware known as a remote-access Trojan on the administrator's
9 computer, which allowed the hackers to access Bitstamp’s networks without credentials and steal
10 up to 18,000 Bitcoins worth approximately $5 million.
11 27. As another example, in May 2019 the cryptocurrency exchange Coinbase was
12 targeted by a sophisticated phishing attack aiming to obtain private keys and passwords from
13 employees. Hackers took over or created University of Cambridge email accounts with legitimate
14 Cambridge domains and emailed over a dozen Coinbase employees posing as an innocuous-
15 seeming “Research Grants Administrator.” The email referenced Coinbase employees’ past
16 histories and requested help judging student projects for an academic competition. The hackers
17 developed email conversations with several Coinbase employees and eventually sent an email
18 containing a URL that, when opened in the Mozilla Firefox browser, would install malware
19 capable of taking over the employees’ computers. Luckily, a Coinbase employee flagged the
20 email as suspicious and Coinbase was able to swiftly locate the single affected computer and
21 revoke all credentials and accounts associated with the compromised computer.
22 28. A more recent example occurred in July 2020, when Twitter employees were
23 targeted in a phone spear phishing attack. Hackers called Twitter employees while posing as
24 colleagues or members of Twitter’s security team, and convinced the employees to reveal the
25 credentials they use to access Twitter’s internal systems and account support tools. Using these
26 credentials, the hackers accessed the Twitter accounts of prominent users such as Barack Obama,
27 Kanye West, and Bill Gates and promoted a Bitcoin scam that earned approximately $120,000.
28 The FBI, the IRS, and the US Secret Service were able to apprehend the hackers and the US
PAYWARD v. RUNYON
Case No. 20-CV-2130-MMC 6 NY28571/0002-US-8632109/2
AMENDED COMPLAINT
Case 3:20-cv-02130-MMC Document 34 Filed 10/09/20 Page 8 of 27
1 Department of Justice filed criminal charges against the hackers for conspiracy to commit wire
2 fraud and money laundering, and intentional access of a protected computer in violation of the
3 CFAA.
4 29. These risks require Payward to take extraordinary measures to maintain the
5 security of its operations, including keeping its employees’ identities confidential and maintaining
6 the secrecy of the locations at which those employees work. If hackers are able to identify
7 Payward employees, including by surveilling them to and from the office, they are able to exploit
8 those employees to gain access to Payward’s systems. For example, the Twitter hackers initially
9 targeted employees that did not have permission to use account management tools, but were able
10 to procure those employees’ credentials and use those credentials to gain enough information
11 about Twitter’s systems to target other employees that did have access to Twitter’s account
12 management tools.
13 30. Payward’s industry success thus far, and its ability to attract customers, is due in
14 part to its ability to repel these attacks. Payward has gone to great lengths to maintain the physical
15 and virtual security of its business and customer data and its trade secrets.
16 31. Among its customer-facing security measures, Payward employs access control
17 systems, encrypted email, and employees trained to identify and mitigate account intrusions.
18 32. Payward uses similarly extensive electronic security measures for its employees
19 and internal systems, including, for example, utilization of secure and encrypted internal
20 communications systems, secure hardware and software, and employees trained to identify and
21 mitigate electronic threats.
22 33. In addition to electronic hacking risks, Payward’s offices, servers, and employees
23 are subject to constant physical security threats, such as hacking and kidnapping. There has been
24 a recent spate of kidnappings designed to secure hefty cryptocurrency ransoms. For example, on
25 December 26, 2017, an analyst in Ukraine who worked for one of the largest European
26 cryptocurrency exchanges was bundled into a car and whisked away by armed men wearing
27 balaclavas. The analyst remained kidnapped for five months until the ransom of $1 million in
28
PAYWARD v. RUNYON
Case No. 20-CV-2130-MMC 7 NY28571/0002-US-8632109/2
AMENDED COMPLAINT
Case 3:20-cv-02130-MMC Document 34 Filed 10/09/20 Page 9 of 27
1 Bitcoin was paid, at which point the analyst was returned alive. See Greg Thomson,
2 Cryptocurrency Kidnappings – New Dogs with the Same Old Tricks, Blockonomi, May 30, 2018.1
3 34. Payward itself has been personally subject to physical risks. It recently received a
4 package that purportedly contained a bomb, with a threat to detonate the bomb if it did not transfer
5 cryptocurrency to an identified recipient. Payward was forced to contact the San Francisco Bomb
6 Squad.
7 35. Payward also recently received a weaponized package at its office, targeting any
8 unsuspecting staffer opening the package and designed to terrorize all of Payward’s personnel.
9 Payward was forced to involve federal law enforcement to protect itself and its people.
10 36. In the cryptocurrency trading industry, these incidents and any failure, real or
11 perceived, to protect the confidentiality and safety of its office locations and its employees has a
12 negative impact on the Company’s ability to recruit talent and therefore compete in the industry.
13 37. To protect against these physical threats, Payward employs extensive physical
14 security measures. Those include measures to keep confidential the physical addresses of its
15 offices and headquarters, and the identities of the majority of its employees. Among other things,
16 Payward strictly instructs its employees not to disclose its physical addresses. Payward requires
17 that visitors receive pre-approval and limits visitor access. Payward requires both employees and
18
19
1
20 Additional examples of such physical security threats abound. The wife of a businessman in the
cryptocurrency industry was kidnapped and ransomed for Bitcoin. Duncan Riley, Woman in
21 Brazil rescued after kidnappers demanded bitcoin ransom payment, SingleAngle, May 1, 2017,
available at https://siliconangle.com/2017/05/01/woman-brazil-rescued-kidnappers-demanded-
22
bitcoin-ransom-payment/. Robbers broke into a man’s house and tortured him in front of his child
23 with a drill until he surrendered his Bitcoin funds. Jon Christian, Robbers Tortured a Man With
a Drill to Steal His Cryptocurrency, Futurism, Mar. 8, 2019 (“A key promise of the digital cash
24 known as cryptocurrency is its security—because only you possess the password to access your
money, it’s presumably more safe than it would be at a bank. But a grisly crime . . . shows that
25
there’s also a dark side to having total control over your own wealth.”), available at
26 https://futurism.com/robbers-tortured-man-drill-steal-cryptocurrency. Cryptocurrency traders in
India were abducted and held hostage for Bitcoin. Erik Gibbs, Kidnap-for-crypto scheme in India
27 stopped, Coingeek, July 16, 2019, available at https://coingeek.com/kidnap-for-crypto-scheme-
28
in-india-stopped/. This list goes on. Id. (“India isn’t the only country to have had to deal with
crypto kidnappers.”).
PAYWARD v. RUNYON
Case No. 20-CV-2130-MMC 8 NY28571/0002-US-8632109/2
AMENDED COMPLAINT
Case 3:20-cv-02130-MMC Document 34 Filed 10/09/20 Page 10 of 27
1 visitors to sign non-disclosure agreements. Additionally, Payward uses a mailing address that is
2 geographically distinct from its headquarters’ address as its official public address.
3 38. Payward takes the security measures seriously. For example, Payward was forced
4 to permanently shut down a 90-person office in Canada after a former employee revealed on
5 Reddit the secure and confidential location of the Company’s facility, and secure servers, in Nova
6 Scotia.
7 39. Other tech companies routinely conceal their physical locations for similar
8 reasons. For example, Amazon conceals its data centers to protect both their customers and
9 employees. See Ingrid Burrington, Why Amazon’s Data Centers Are Hidden in Spy Country, The
10 Atlantic, Jan. 8, 2016, https://www.theatlantic.com/technology/archive/2016/01/amazon-web-
11 services-data-center/423147/. Recently, Microsoft unveiled two new data centers but has
12 concealed their location, saying only that they are 500 miles apart from each other. See Frank
13 Konkel, Microsoft is building data centers and expanding security capabilities to compete with
14 Amazon to host sensitive government data, Nextgov, Apr. 17, 2019,
15 https://www.nextgov.com/emerging-tech/2019/04/microsoft-unveils-two-secret-data-centers-
16 built-classified-government-data/156376/.
17 40. As an employee working from Payward’s San Francisco headquarters, Defendant
18 signed a non-disclosure agreement and knew about the extensive electronic and physical security
19 measures Payward employs.
20 B. Defendant’s Employment With Payward
21 41. On March 18, 2018, Payward sent Defendant an at-will employment offer for the
22 position of financial analyst. The offer was contingent upon Defendant signing Payward’s
23 Confidential Information and Invention Assignment Agreement (the “Confidentiality
24 Agreement”). The Confidentiality Agreement required Defendant to protect confidential
25 information, in part, as follows:
26 (a) Protection of Information. I understand that during the
Relationship, the Company intends to provide me with i
Preview
1 Claire E. Cochran (SBN 222529) Natalie A. Xifo (SBN 280930) ELECTRONICALLY 2 LAW OFFICES OF CLAIRE COCHRAN, P.C. 100 Pine Street, Suite 1250 FILED 3 Superior Court of California, San Francisco, CA 94111 County of San Francisco 4 Telephone: (415) 580-6019 03/10/2021 Facsimile: (415) 745-3301 Clerk of the Court BY: JUDITH NUNEZ 5 Deputy Clerk 6 Attorneys for Plaintiff NATHAN PETER RUNYON 7 8 SUPERIOR COURT OF THE STATE OF CALIFORNIA 9 FOR THE COUNTY OF SAN FRANCISCO 10 [UNLIMITED JURISDICTION] 11 Case No. CGC-19-581099 NATHAN PETER RUNYON 12 EX PARTE APPLICATION FOR ORDER Plaintiff, SHORTENING TIME FOR PLAINTIFF 13 NATHAN PETER RUNYON’S NOTICE v. OF MOTION TO APPOINT A SPECIAL 14 MASTER 15 PAYWARD, INC., a California Corporation [Filed Concurrently with Memorandum of Points and Authorities; Declaration of Claire d/b/a KRAKEN; and KAISER NG an individual E. Cochran, Esq. and Proposed Order] 16 and DOES 1-50, inclusive 17 Ex Parte Hearing Date: March 11, 2021 Time: 11:00 a.m. Defendants. Dept.: 302 18 19 Date Action Filed: November 26, 2019 Trial Date: July 12, 2021 20 21 22 23 /// 24 /// 25 /// 26 /// 27 /// 28 Page | 1 EX PARTE APPLICATION FOR ORDER SHORTENING TIME FOR PLAINTIFF’S NOTICE OF MOTION TO APPOINT A SPECIAL MASTER 1 /// 2 3 TO DEFENDANTS AND THEIR ATTORNEYS OF RECORD: 4 NOTICE IS HEREBY GIVEN THAT on March 11, 2020, at 11:00 a.m. or as soon as thereafter 5 as the matter may heard in Department 302 of the San Francisco Superior Court located at 400 6 McAllister Street, San Francisco, CA, Plaintiff NATHAN PETER RUNYON (“Plaintiff”) and 7 through his attorneys of record, will and hereby does move for an Order Shortening Time on 8 Plaintiff’s Notice of Motion to Appoint a Special Master. 9 Plaintiff’s Notice of Motion to Appoint a Special Master is based upon this Notice, the 10 accompanying Memorandum of Points and Authorities, the Declaration of Claire Cochran, Esq. 11 and exhibit thereto served and filed herewith. 12 Notice of this Application was given in compliance with Rule 3.1203 of the California 13 Rules of Court. 14 15 Dated: March 9, 2021 LAW OFFICES OF CLAIRE COCHRAN PC 16 17 ____________________________ CLAIRE E. COCHRAN 18 Attorneys for Plaintiff, 19 NATHAN PETER RUNYON 20 21 22 23 24 25 26 27 28 Page | 1 EX PARTE APPLICATION FOR ORDER SHORTENING TIME FOR PLAINTIFF’S NOTICE OF MOTION TO APPOINT A SPECIAL MASTER 1 MEMORANDUM OF POINTS AND AUTHORITIES 2 3 I. STATEMENT OF FACTS 4 This matter was filed on November 26, 2019. Plaintiff filed a First Amended Complaint 5 (“FAC”) on January 6, 2020. Plaintiff alleges that his former employer, Defendants Payward and 6 Kaiser Ng, discriminated against him based on his disability, and that Defendants retaliated 7 against him for raising concerns about their misconduct in altering employees’ equity vesting 8 schedules. 9 The Defendants filed a Notice of Demurrer and Motion to Strike Plaintiff’s FAC 10 (“Defendants’ Motions”). The hearing on Defendants’ Motions was held on March 11, 2020. The 11 Court overruled Defendants’ request to demurrer Plaintiff’s FEHA causes of action, fifth, eighth, 12 ninth and tenth causes of action. The Court denied Defendant’s Motion to Strike Irrelevant, False or Improper Matters in Plaintiff’s FAC in its entirety. 13 This request is being made in order to allow for the orderly and well-considered 14 resolution of a pressing discovery issue. Plaintiff’s counsel has in their possession electronically- 15 stored documents that Plaintiff provided on a USB flash drive, which substantiate that 16 Defendants altered employees’ equity vesting schedule without consent of the Payward’s Board 17 of Directors. The documents that Plaintiff obtained were prior to Payward terminating him. The 18 information is contained on two USB flash drives that Plaintiff created while he was employed 19 by Payward. 20 Counsel for Defendant, Christopher LaVigne, recently advised Plaintiff’s counsel that 21 Payward, dba Kraken, will be pursuing Plaintiff’s communications protected by the work- 22 product doctrine and attorney-client privilege under the crime fraud exception to the attorney- 23 client privilege, and any related case, as they relate to documents provided by Plaintiff. In light 24 of this assertion, and to make sure Plaintiff’s counsel is compliant with ESI collection and 25 management, Plaintiff’s counsel explained to Defendants’ counsel that the document production 26 must be conducted by an expert via a forensic analysis and any related data and documents were 27 to be produced by the expert to both sides. Plaintiff’s counsel proposed the parties stipulate to a 28 Page | 1 EX PARTE APPLICATION FOR ORDER SHORTENING TIME FOR PLAINTIFF’S MPA ISO OF PLAINTIFF’S NOTICE OF MOTION TO APPOINT A SPECIAL MASTER 1 joint expert to expedite the process. Defendants’ counsel declined the offer and instead ignored 2 the protocol and demanded the production of the USB flash drives. 3 In order to have the forensic analysis conducted, Plaintiff’s counsel needs to have an 4 expert to create an image of the USB flash drives that Plaintiff created and no expert would do so 5 absent an Order from this Honorable Court or a stipulation from both parties that the confidential 6 data can be examined. This forensic road map is an essential first step before Plaintiff’s counsel 7 can produce the USB flash drives for inspection (and confidential production) to counsel for Defendants. Plaintiff’s counsel was advised of this requirement just 24 hours prior to inquiring 8 of Defendants’ counsel whether they would stipulate to the appointment of a Special Master and 9 to continue the existing trial date. The need to continue the trial date is due to the upcoming 10 deadline for Defendants’ Motion for Summary Judgment which must be filed no later than 11 March 23, 2021. As such, these documents and the USB flash drives must be analyzed, reviewed 12 and produced as soon as possible. As it is unlikely that an expert can do this work within the next 13 two weeks, Plaintiff is simultaneously filing a motion to continue the trial. 14 Plaintiff expects that the same forensic analysis designated will be applied to sources or 15 confidential documents produced by Defendants in this case, especially when a confidential 16 document has been or will be produced that conflicts with the versions on the USB flash drives. 17 A proper analysis and consideration of the documents has implications beyond this civil 18 action. Four days after they filed their Answer in this civil action, Defendants filed a civil action 19 against Mr. Runyon in the United States District Court for the Northern District of California – 20 reciting the identical arguments they cited in their Notice of Demurrer and Motion to Strike 21 Plaintiff’s FAC. After their first Complaint in that action was dismissed on Mr. Runyon’s 22 motion, Payward filed an Amended Complaint. In their Amended Complaint, Payward set out 23 three causes of action: (1) violation of the Defendant Trade Secrets Act (“DTSA”), 18 U.S.C. §§ 24 1831-39, based on an allegation that Mr. Runyon retained his company-issued laptop, copied 25 documents that contained trade secrets, and disclosed or used the trade secrets contained in those 26 documents; (2) violation of the Computer Fraud and Abuse Act (“CFAA”), 18 U.S.C. § 1030, 27 based on an allegation that Mr. Runyon failed to return his laptop when he was terminated; and 28 Page | 1 EX PARTE APPLICATION FOR ORDER SHORTENING TIME FOR PLAINTIFF’S MPA ISO OF PLAINTIFF’S NOTICE OF MOTION TO APPOINT A SPECIAL MASTER 1 (3) breach of contract, under California State law, for allegedly failing to return his laptop. Mr. 2 Runyon filed a new motion to dismiss; the Court granted the motion as to the first claim for relief 3 and denied the motion as to the other two claims for relief. Accordingly, that federal action, 4 which thus implicates the contents of the USB flash drives at issue here, remains pending. 5 In light of all of this, it is clear that the appointment of a digital forensics Special Master 6 is necessary to proper evaluate the contents of the USB flash drives at issue here. In particular, it 7 is clear that it is essential to a proper resolution of this action for a neutral third party to examine the contents of the USB flash drives, including when this information was obtained – so that 8 Defendants do not further retaliate against Plaintiff and his attorneys with baseless lawsuits 9 alleging that Plaintiff stole their trade secrets after being terminated. 10 II. ARGUMENT 11 California Code of Civil Procedure § 845 states in relevant part: 12 (a) The court may appoint one or more special masters whose duties may include 13 the following (1) Investigating technical and legal issues, as directed by the court. 14 The special master shall compile a report of findings in accordance with Section 846. 15 Under this code section, the Special Master is appointed by the court and has the 16 authority to carry out court orders, whether agreed to by the parties ahead of time, or ordered by 17 the court after hearing testimony, arguments, or recommendations by party experts. 18 A Special Master appointed by the court has the technical expertise to understand 19 eDiscovery issues and settle disputes efficiently. Plaintiff proposes a scope of duty that would 20 allow the Special Master to conduct discovery, take evidence and argument, and review the 21 existing record in making recommended findings of fact, conclusions of law, or terms of final 22 judgment in his or her report. This scope of duty allows the Special Master to carefully examine 23 the complex legal and factual issues presented by the case. If appointed, a Special Master may 24 take evidence and recommend findings of fact and conclusions of law regarding the contents of 25 the USB flash drives. These duties fall squarely within the purview of California Civil Procedure 26 section 845(a)(1). 27 28 Page | 1 EX PARTE APPLICATION FOR ORDER SHORTENING TIME FOR PLAINTIFF’S MPA ISO OF PLAINTIFF’S NOTICE OF MOTION TO APPOINT A SPECIAL MASTER 1 Plaintiff proposes that the Court appoint Tom Howe of the Howe Law Firm as Digital 2 Forensics Special Master. The firm has the expertise and qualifications to perform the task at 3 hand – a task that is essential to a proper resolution of this civil action and the action filed by 4 Defendants in the United States District Court. 5 III. CONCLUSION 6 The interests of justice are served by the immediate appointment of a Special Master to 7 assist the Court in reviewing the flash drives which contain confidential relevant information 8 which substantiate Plaintiff’s Labor Code section 1102.5 claims. Utilizing the skills of a digital 9 forensics special master will eliminate the parties fighting over whether or not Plaintiff “stole” 10 documents, whether the documents have been altered or reproduced in any format other than to 11 his attorneys. Nothing is more counter-productive than lawyers arguing technical e-discovery 12 issues when an expert in the field could illuminate a case knowledgeably. A Digital Forensics 13 Special Master, or court-appointed expert, is valuable resource. There is no valid reason to deny 14 such an appointment. 15 Dated: March 9, 2021 LAW OFFICES OF CLAIRE COCHRAN PC 16 17 ____________________________ CLAIRE E. COCHRAN 18 Attorneys for Plaintiff, 19 NATHAN PETER RUNYON 20 21 22 23 24 25 26 27 28 Page | 1 EX PARTE APPLICATION FOR ORDER SHORTENING TIME FOR PLAINTIFF’S MPA ISO OF PLAINTIFF’S NOTICE OF MOTION TO APPOINT A SPECIAL MASTER 1 DECLARATION OF CLAIRE E. COCHRAN 2 I, CLAIRE E. COCHRAN, ESQ., declare as follows: 3 1. I am an attorney licensed to practice law in the State of California. I am the 4 Owner and Principal of the law firm Law Offices of Claire Cochran, P.C. (“LOCC”), attorneys 5 of record for Plaintiff NATHAN PETER RUNYON (“Plaintiff”) in the within civil proceeding. 6 If called upon as a witness, I could and would competently testify to the following: 7 2. This declaration is in support of Plaintiff’s Motion to Appoint a Special Master 8 in this civil action. 9 3. This matter was filed November 26, 2019. Plaintiff filed a First Amended 10 Complaint (“FAC”) on January 6, 2020. By February 2020, the Defendants filed a Notice of 11 Demurrer and Motion to Strike Plaintiff’s FAC (“Defendants’ Motions”). The hearing on 12 Defendants’ Motions was held on March 11, 2020. The Court overruled Defendants’ request to 13 demurrer Plaintiff’s FEHA causes of action, fifth, eighth, ninth and tenth causes of action. The 14 Court denied Defendant’s Motion to Strike Irrelevant, False or Improper Matters in Plaintiff’s 15 FAC in its entirety. 16 4. Plaintiff’s counsel has documents Plaintiff provided to LOCC on two USB flash 17 drives, which substantiate that Defendants altered employees’ equity vesting schedule without 18 consent of the Payward’s Board of Directors. The documents that Plaintiff obtained and saved 19 on the USB flash drives were prior to Payward terminating him. 20 5. Counsel for Defendants, Christopher LaVigne, recently advised me that 21 Payward, dba Kraken, will be pursuing our work production and attorney-client privileged 22 communications under the crime fraud exception to the attorney-client privilege, and any related 23 case, as they relate to documents provided to us by our client. In light of this assertion, and to 24 make sure we are compliant with ESI collection and management, we explained to Mr. LaVigne 25 that the document production must be conducted by an expert via a forensic analysis and any 26 related data and documents were to be produced by the expert to both sides. I proposed the 27 parties stipulate to a joint expert to expedite the process. Mr. LaVigne declined the offer and 28 Page | 1 DECLARATION OF CLAIRE COCHRAN, ESQ. ISO OF EX PARTE APPLICATION FOR ORDER SHORTENING TIME FOR PLAINTIFF’S NOTICE OF MOTION TO APPOINT A SPECIAL MASTER 1 instead ignored the protocol and demanded the production of the USB flash drives. 2 6. In order to have the forensic analysis conducted, we need an expert to create a 3 forensic image of the USB flash drives and review the metadata on every document that 4 Plaintiff saved; no expert will conduct a forensic analysis absent an order from the Court or a 5 stipulation from both parties that the confidential data can be examined. This forensic road map 6 is an essential first step before we can produce the USB flash drives for inspection (and 7 confidential production) to counsel for Defendants. We became aware of this requirement just 8 24 hours prior to requesting that Mr. LaVigne stipulate to the appointment of a Special Master 9 and to continue the existing trial date. 10 7. The need to continue the trial date is due to the upcoming deadline for 11 Defendants’ Motion for Summary Judgment which must be filed no later than March 23, 2021. 12 As such, these documents and the USB flash drives must be analyzed, reviewed and produced 13 as soon as possible. As it is unlikely that an expert can do this work within the next two weeks, 14 Plaintiff is simultaneously filing a motion to continue the trial. 15 8. Plaintiff expects that the same forensic analysis designated will be applied to 16 sources or confidential documents produced by Defendants in this case, especially when a 17 confidential document has been or will be produced that conflicts with the versions on our 18 client’s USB flash drives. 19 9. A proper analysis and consideration of the documents also has implications 20 beyond this civil action. Four days after they filed their Answer in this civil action, Defendants 21 filed a civil action against Mr. Runyon in the United States District Court for the Northern 22 District of California – reciting the identical arguments they cited in their Notice of Demurrer 23 and Motion to Strike Plaintiff’s FAC. In their federal action, Case No. 3:20-cv-02130-MMC, 24 Defendants stated causes of action for Misappropriation of Trade Secrets, Unlawfully Accessing 25 a Protected Computer under Computer Fraud and Abuse Act and Breach of Contract. Mr. 26 Runyon filed a motion to dismiss; the District Court granted Mr. Runyon’s motion; and the 27 Defendants filed an Amended Complaint. In their Amended Complaint, Payward set out three 28 Page | 1 DECLARATION OF CLAIRE COCHRAN, ESQ. ISO OF EX PARTE APPLICATION FOR ORDER SHORTENING TIME FOR PLAINTIFF’S NOTICE OF MOTION TO APPOINT A SPECIAL MASTER 1 causes of action: (1) violation of the Defendant Trade Secrets Act (“DTSA”), 18 U.S.C. §§ 2 1831-39, based on an allegation that Mr. Runyon retained his company-issued laptop, copied 3 documents that contained trade secrets, and disclosed or used the trade secrets contained in 4 those documents; (2) violation of the Computer Fraud and Abuse Act (“CFAA”), 18 U.S.C. § 5 1030, based on an allegation that Mr. Runyon failed to return his laptop when he was 6 terminated; and (3) breach of contract, under California State law, for allegedly failing to return 7 his laptop. A true and correct copy of Payward’s Amended Complaint filed in United States 8 District Court for the Northern District of California is attached as Exhibit “A.” Mr. Runyon 9 filed a new motion to dismiss; the Court granted the motion as to the first claim for relief and 10 denied the motion as to the other two claims for relief. A true and correct copy of the District 11 Court’s ruling on Mr. Runyon’s motion to dismiss is attached as Exhibit “B.” Accordingly, that 12 federal action, which thus implicates the contents of the thumb drives at issue here, remains 13 pending. 14 Efforts to Meet and Confer and Stipulate to the Appointment of a Joint Expert 15 10. On March 3, 2021, I sent a letter via email to Defendants’ counsel, Christopher 16 LaVigne. 1 I advised Mr. LaVigne of the facts set out above concerning our inability to produce 17 the flash drives until a forensic analysis had been conducted. I proposed to Mr. LaVigne that 18 the parties jointly retain an expert who could conduct an analysis of the USB flash drives and 19 map any related usage of the jump drives, and their confidential documents, immediately. I 20 also suggested that we offer up related experts as quickly as possible and get these examined, 21 mapped and provided to both parties for use in his deposition of Plaintiff and before 22 Defendants’ deadline to file a Motion for Summary Judgment. 23 11. I also explained that, whatever happens, it is essential that Plaintiff be allowed to 24 conduct this forensic review of the flash drives to defend against claims of wrongful acts, 25 levied against both Plaintiff and his Counsel and to substantiate his claims of retaliation for 26 1 This correspondence was designated as highly confidential and protected pursuant to Stipulated Protective Order, 27 as such it cannot be attached as an exhibit herein. 28 Page | 1 DECLARATION OF CLAIRE COCHRAN, ESQ. ISO OF EX PARTE APPLICATION FOR ORDER SHORTENING TIME FOR PLAINTIFF’S NOTICE OF MOTION TO APPOINT A SPECIAL MASTER 1 whistleblowing pursuant to Labor Code section 1102.5. I also made clear that any forensic 2 review would be provided to Defendants. 3 12. On March 3, 2021, Mr. LaVigne sent an email to me in which he declined to 4 agree to the appointment of a Special Master and declined to agree to a brief continuance of the 5 July 12, 2021 trial date. Instead, Mr. LaVigne demanded that my firm send them the USB flash 6 drives absent any forensic evaluation of same. A true and correct copy of the email exchange is 7 attached as Exhibit “C.” As such, a motion was required to be filed to immediately address 8 this issue. 9 13. Based on the foregoing, it is respectfully requested that this appoint a Special 10 Master to review the contents of two flash drives at issue in this civil action and that are also 11 implicated in the civil action filed by Payward in the federal District Court. 12 I declare under penalty of perjury under the laws of the State of California that the 13 foregoing is true and correct. 14 Executed on March 9, 2021, at San Francisco California. 15 16 17 CLAIRE E. COCHRAN 18 Attorneys for Plaintiff, 19 NATHAN PETER RUNYON . 20 21 22 23 24 25 26 27 28 Page | 1 DECLARATION OF CLAIRE COCHRAN, ESQ. ISO OF EX PARTE APPLICATION FOR ORDER SHORTENING TIME FOR PLAINTIFF’S NOTICE OF MOTION TO APPOINT A SPECIAL MASTER Exhibit A Case 3:20-cv-02130-MMC Document 34 Filed 10/09/20 Page 1 of 27 Kimberly Almazan (SBN 288605) 1 kimberly.almazan@withersworldwide.com 2 Christopher N. LaVigne (NYBN 4811121) (Admitted Pro Hac Vice) 3 christopher.lavigne@withersworldwide.com Withers Bergman LLP 4 505 Sansome Street, 2nd Floor 5 San Francisco, California 94111 Telephone: 415.872.3200 6 Facsimile: 415.549 2480 7 Attorneys for Plaintiffs Payward, Inc., a 8 California Corporation d/b/a Kraken 9 UNITED STATES DISTRICT COURT 10 NORTHERN DISTRICT OF CALIFORNIA 11 SAN FRANCISCO/OAKLAND DIVISION 12 13 PAYWARD, INC., a California Corporation, Case No.: 20-cv-2130-MMC 14 d/b/a KRAKEN, AMENDED COMPLAINT 15 Plaintiff, DEMAND FOR JURY TRIAL 16 v. 17 NATHAN PETER RUNYON., an individual, 18 and DOES 1 through 10, inclusive. 19 Defendant. 20 21 22 23 24 25 26 27 28 PAYWARD v. RUNYON Case No. 20-CV-2130-MMC NY28571/0002-US-8632109/2 AMENDED COMPLAINT Case 3:20-cv-02130-MMC Document 34 Filed 10/09/20 Page 2 of 27 1 Plaintiff Payward, Inc. d/b/a Kraken (“Payward” or “the Company”) alleges the following: 2 INTRODUCTION 3 1. Payward is a global cryptocurrency exchange that critically relies on trade secrets 4 and confidential business information to maintain the security of its operations. Because of the 5 nature of its business, Payward is subject to constant physical and electronic hacking attempts, 6 and the security of Payward’s physical business locations, employees, and business and customer 7 data is of the utmost importance to ensure Plaintiff’s successful and continuing business 8 operations. 9 2. This action seeks to hold Defendant Nathan Peter Runyon, a former employee of 10 Payward, accountable for unlawfully accessing and misappropriating Payward’s confidential 11 business information and trade secrets and for violating his confidentiality agreement with 12 Payward. 13 3. Payward employed Defendant as a financial analyst in its San Francisco, CA office 14 from March 26, 2018 until August 1, 2019. Before his employment began, Defendant signed a 15 Confidential Information and Invention Assignment Agreement on March 14, 2018 (the 16 “Confidentiality Agreement”) that bound him to protect and maintain in strict confidence the 17 information and data he became aware of, accessed, and stored through his employment with 18 Payward. 19 4. In connection with his hiring and employment by Payward, Defendant was 20 repeatedly made aware of, and bore witness to, the paramount necessity for confidentiality 21 surrounding Payward’s business. This need for confidentiality in all aspects of Payward’s 22 business includes numerous security measures ranging from, for example, protection of sensitive 23 customer electronic account information to safeguarding the confidentiality of the physical 24 locations and addresses of Payward’s offices. 25 5. In connection with Defendant’s employment, Payward issued Defendant a laptop 26 for use in his day-to-day activities and responsibilities at Payward. During the course of 27 Defendant’s employment at Payward, he accumulated a large amount of financial, business, 28 customer, technical, and economic proprietary information and data in the form of, among other PAYWARD v. RUNYON Case No. 20-CV-2130-MMC 1 NY28571/0002-US-8632109/2 AMENDED COMPLAINT Case 3:20-cv-02130-MMC Document 34 Filed 10/09/20 Page 3 of 27 1 things, documents, emails, and internal Company communications, all of which Defendant stored 2 on his Company-issued laptop. 3 6. Payward terminated Defendant’s employment on August 1, 2019. 4 7. Payward was acutely aware of the sensitive, confidential, and trade-secret 5 information contained on Defendant’s laptop computer. Accordingly, immediately upon 6 Defendant’s termination from the Company, Payward instructed Defendant to return the laptop 7 to Payward. Additionally, Defendant was obligated under the Confidentiality Agreement to return 8 Company property, including the laptop, to Payward immediately upon his termination. 9 8. Despite repeated attempts by Payward to collect the laptop from Defendant, he 10 refused to return the laptop to Payward. Instead, Defendant strung Payward along with false 11 promises to return the laptop while he could continue to access the confidential and trade secret 12 information on the laptop. 13 9. On August 2, 2019, Defendant claimed he could not return the laptop to Payward 14 because he may be going on a vacation. On August 6, 2019, he stated he would keep Payward 15 updated on his return from vacation and when he could return the laptop. Payward followed up 16 with Defendant on August 14, 2019, seeking clarity on when Defendant would return the laptop. 17 Defendant sent a series of emails stating he would return the laptop on successively later dates. 18 10. Eventually, Defendant stated he would return the laptop to Payward on August 29, 19 2019. However, when that date arrived, Defendant emailed Payward and said the laptop had been 20 stolen from his vehicle. To date, the laptop has not been recovered. 21 11. Defendant continued to access the trade secrets and confidential business 22 information on his Company laptop while in unlawful possession of it. 23 12. Defendants became aware he was accessing and sharing the confidential and trade 24 secret information contained in the laptop because he produced copies of confidential Company 25 documents in connection with an employment lawsuit he brought in California Superior Court. 26 Plaintiff would only have access to these documents through his employment at Payward. 27 13. Defendant revealed additional confidential and trade secret information in 28 connection with his lawsuit against Payward, which alleges he was discriminated and retaliated PAYWARD v. RUNYON Case No. 20-CV-2130-MMC 2 NY28571/0002-US-8632109/2 AMENDED COMPLAINT Case 3:20-cv-02130-MMC Document 34 Filed 10/09/20 Page 4 of 27 1 against by Payward based on his veteran status and disabilities and his reporting of certain alleged 2 stock vesting discrepancies. The confidential and trade secret information stored on and 3 accessible through Defendant’s laptop was extensive. The information and data he possessed on 4 his laptop went well beyond the information necessary to support his lawsuit against Payward. 5 Indeed, much of the information was completely unrelated to the lawsuit. 6 14. Among Defendant’s most blatant and unnecessary disclosures of confidential and 7 trade secret information was Defendant’s public exposure of the physical address of Payward’s 8 headquarters, which, up to the date of Defendant’s publicly-filed lawsuit, had not been publicly 9 disclosed, through great efforts by Payward to protect the confidentiality of that address. 10 15. Defendant has first-hand knowledge of Payward’s efforts to keep the physical 11 addresses of its offices, including its headquarters, confidential. Defendant worked at Payward’s 12 headquarters, and was subject to and aware of Payward’s requirement, for example, that all 13 employees and visitors sign non-disclosure agreements regarding the whereabouts and physical 14 address of Payward’s headquarters. Defendant knew that Payward instead made public only a 15 mailing address for its headquarters that is geographically distinct from the headquarters’ actual 16 address. 17 16. Defendant’s publication of the physical address of Payward’s headquarters 18 breached the Confidentiality Agreement and Payward’s standard confidentiality practices, which 19 are and were well known to Defendant. Defendant’s publication of Payward’s physical address, 20 known to him only through his work for Payward and specifically his work at that address, was 21 intentional and malicious. 22 17. Defendant’s misappropriation of Payward’s trade secrets and the breach of his 23 confidentiality agreement have required that Payward spend money and time mitigating the 24 immediate risk of harm and significant continued risk of future harm created by Defendant’s 25 failure to return his laptop upon his termination as required by the Confidentiality Agreement, his 26 continued access to the confidential business and customer information and trade secrets on that 27 laptop, his (at best) carelessness with the laptop that led to it purportedly being stolen by an 28 PAYWARD v. RUNYON Case No. 20-CV-2130-MMC 3 NY28571/0002-US-8632109/2 AMENDED COMPLAINT Case 3:20-cv-02130-MMC Document 34 Filed 10/09/20 Page 5 of 27 1 unknown third party, and his public revelation of the confidential physical address of Payward’s 2 headquarters. 3 PA R T I E S 4 18. Payward, Inc. d/b/a Kraken is a California corporation, incorporated in the State 5 of Delaware, with its principal place of business in San Francisco, California. 6 19. Defendant Nathan Peter Runyon is an individual and citizen of California who is 7 believed to reside at 456 South Van Ness Avenue, San Francisco, CA 94103. 8 JURISDICTION AND VENUE 9 20. This Court has subject matter jurisdiction because Payward has asserted claims 10 against Defendant pursuant to 28 U.S.C. § 1331 for misappropriation of trade secrets under the 11 Defend Trade Secrets Act (“DTSA”) and 10 U.S.C. § 1030 for violation of the Computer Fraud 12 and Abuse Act (“CFAA”). This Court has supplemental or pendent jurisdiction over Payward’s 13 remaining claims pursuant to 28 U.S.C. § 1367 because such claims are so related to Payward’s 14 federal DTSA claim that they form part of the same case or controversy under Article III of the 15 United States Constitution. 16 21. Venue is proper in the Northern District of California pursuant to 28 U.S.C. 17 § 1391(b)(1) because Payward and Defendant are residents of San Francisco, CA. Venue is also 18 appropriate in this district pursuant to 28 U.S.C, § 1391(b)(2) because the events that gave rise to 19 this complaint occurred in this district. 20 FA C T U A L A L L E G AT I O N S 21 A. Payward Is One of the Largest and Oldest Bitcoin Exchanges in the World 22 22. Payward formed in 2011 in the nascent market of cryptocurrency trading and 23 launched its trading platform two years later in 2013. Payward’s trading platform allows 24 customers to buy and trade Bitcoin and other cryptocurrencies online. Payward has grown to 25 become a leading platform with hundreds of employees and operations spanning the globe. 26 23. The cryptocurrency trading market is intensely competitive. Security is among the 27 leading factors that consumers consider when selecting a trading platform and a critical element 28 for business growth. Payward’s reputation for security translates to consumer confidence and PAYWARD v. RUNYON Case No. 20-CV-2130-MMC 4 NY28571/0002-US-8632109/2 AMENDED COMPLAINT Case 3:20-cv-02130-MMC Document 34 Filed 10/09/20 Page 6 of 27 1 leads to greater usage. Greater usage helps improve liquidity — how easily assets can be bought 2 or sold at a stable price — by raising trade volume and active traders. Increased liquidity in turn 3 attracts more consumers. 4 24. The cryptocurrency trading industry is exceptionally prone to hacking attempts 5 and exploitation of trade secrets. The rise in popularity and value of cryptocurrencies has made 6 trading platforms a prime target for hackers. See Brian Fung, Why bitcoin exchanges keep getting 7 hacked – and how to protect yourself, The Switch, June 20, 2018 (“The price of bitcoin took a 8 tumble early Wednesday after a major South Korea-based cryptocurrency exchange, Bithumb, 9 admitted hackers made off with more than $31 million worth of virtual currency.”), available at 10 https://www.washingtonpost.com/news/the-switch/wp/2018/06/20/why-bitcoin-exchanges- 11 keep-getting-hacked-and-how-to-protect-yourself/?utm_term=.ab72f3bcf185. 12 25. Since 2011, there have been 56 documented hacks of cryptocurrency exchanges. 13 See Lauren Yates, Memorandum re Meeting With Bitwise Asset Management, Inc., NYSE Arca, 14 Inc., and Vedder Price P.C., SEC, Mar. 20, 2019, available at https://www.sec.gov/comments/sr- 15 nysearca-2019-01/srnysearca201901-5164833-183434.pdf. These hacks have cost exchanges 16 billions of dollars: 17 18 19 20 21 22 23 24 25 26 26. Many of these hacks result from hackers’ identification and exploitation of 27 cryptocurrency exchange employees. For example, a highly-sophisticated phishing attack (a 28 fraudulent practice intended to induce individuals to reveal personal information or open PAYWARD v. RUNYON Case No. 20-CV-2130-MMC 5 NY28571/0002-US-8632109/2 AMENDED COMPLAINT Case 3:20-cv-02130-MMC Document 34 Filed 10/09/20 Page 7 of 27 1 malicious artifacts) targeted employees of the cryptocurrency exchange Bitstamp in 2014 and 2 2015. Hackers first targeted Bitstamp’s Chief Technology Officer, offering him free tickets to a 3 rock concert. When that failed, they posed as a reporter in an attempt to get a different employee 4 to open a document that allegedly contained an article on which the reporters sought comment, 5 but that really housed malware designed to give hackers access to the employee's computer. 6 Eventually, the hackers contacted a system administrator, promising him membership into a 7 “special fraternity.” When the administrator opened the file containing information about the 8 purported fraternity, it installed malware known as a remote-access Trojan on the administrator's 9 computer, which allowed the hackers to access Bitstamp’s networks without credentials and steal 10 up to 18,000 Bitcoins worth approximately $5 million. 11 27. As another example, in May 2019 the cryptocurrency exchange Coinbase was 12 targeted by a sophisticated phishing attack aiming to obtain private keys and passwords from 13 employees. Hackers took over or created University of Cambridge email accounts with legitimate 14 Cambridge domains and emailed over a dozen Coinbase employees posing as an innocuous- 15 seeming “Research Grants Administrator.” The email referenced Coinbase employees’ past 16 histories and requested help judging student projects for an academic competition. The hackers 17 developed email conversations with several Coinbase employees and eventually sent an email 18 containing a URL that, when opened in the Mozilla Firefox browser, would install malware 19 capable of taking over the employees’ computers. Luckily, a Coinbase employee flagged the 20 email as suspicious and Coinbase was able to swiftly locate the single affected computer and 21 revoke all credentials and accounts associated with the compromised computer. 22 28. A more recent example occurred in July 2020, when Twitter employees were 23 targeted in a phone spear phishing attack. Hackers called Twitter employees while posing as 24 colleagues or members of Twitter’s security team, and convinced the employees to reveal the 25 credentials they use to access Twitter’s internal systems and account support tools. Using these 26 credentials, the hackers accessed the Twitter accounts of prominent users such as Barack Obama, 27 Kanye West, and Bill Gates and promoted a Bitcoin scam that earned approximately $120,000. 28 The FBI, the IRS, and the US Secret Service were able to apprehend the hackers and the US PAYWARD v. RUNYON Case No. 20-CV-2130-MMC 6 NY28571/0002-US-8632109/2 AMENDED COMPLAINT Case 3:20-cv-02130-MMC Document 34 Filed 10/09/20 Page 8 of 27 1 Department of Justice filed criminal charges against the hackers for conspiracy to commit wire 2 fraud and money laundering, and intentional access of a protected computer in violation of the 3 CFAA. 4 29. These risks require Payward to take extraordinary measures to maintain the 5 security of its operations, including keeping its employees’ identities confidential and maintaining 6 the secrecy of the locations at which those employees work. If hackers are able to identify 7 Payward employees, including by surveilling them to and from the office, they are able to exploit 8 those employees to gain access to Payward’s systems. For example, the Twitter hackers initially 9 targeted employees that did not have permission to use account management tools, but were able 10 to procure those employees’ credentials and use those credentials to gain enough information 11 about Twitter’s systems to target other employees that did have access to Twitter’s account 12 management tools. 13 30. Payward’s industry success thus far, and its ability to attract customers, is due in 14 part to its ability to repel these attacks. Payward has gone to great lengths to maintain the physical 15 and virtual security of its business and customer data and its trade secrets. 16 31. Among its customer-facing security measures, Payward employs access control 17 systems, encrypted email, and employees trained to identify and mitigate account intrusions. 18 32. Payward uses similarly extensive electronic security measures for its employees 19 and internal systems, including, for example, utilization of secure and encrypted internal 20 communications systems, secure hardware and software, and employees trained to identify and 21 mitigate electronic threats. 22 33. In addition to electronic hacking risks, Payward’s offices, servers, and employees 23 are subject to constant physical security threats, such as hacking and kidnapping. There has been 24 a recent spate of kidnappings designed to secure hefty cryptocurrency ransoms. For example, on 25 December 26, 2017, an analyst in Ukraine who worked for one of the largest European 26 cryptocurrency exchanges was bundled into a car and whisked away by armed men wearing 27 balaclavas. The analyst remained kidnapped for five months until the ransom of $1 million in 28 PAYWARD v. RUNYON Case No. 20-CV-2130-MMC 7 NY28571/0002-US-8632109/2 AMENDED COMPLAINT Case 3:20-cv-02130-MMC Document 34 Filed 10/09/20 Page 9 of 27 1 Bitcoin was paid, at which point the analyst was returned alive. See Greg Thomson, 2 Cryptocurrency Kidnappings – New Dogs with the Same Old Tricks, Blockonomi, May 30, 2018.1 3 34. Payward itself has been personally subject to physical risks. It recently received a 4 package that purportedly contained a bomb, with a threat to detonate the bomb if it did not transfer 5 cryptocurrency to an identified recipient. Payward was forced to contact the San Francisco Bomb 6 Squad. 7 35. Payward also recently received a weaponized package at its office, targeting any 8 unsuspecting staffer opening the package and designed to terrorize all of Payward’s personnel. 9 Payward was forced to involve federal law enforcement to protect itself and its people. 10 36. In the cryptocurrency trading industry, these incidents and any failure, real or 11 perceived, to protect the confidentiality and safety of its office locations and its employees has a 12 negative impact on the Company’s ability to recruit talent and therefore compete in the industry. 13 37. To protect against these physical threats, Payward employs extensive physical 14 security measures. Those include measures to keep confidential the physical addresses of its 15 offices and headquarters, and the identities of the majority of its employees. Among other things, 16 Payward strictly instructs its employees not to disclose its physical addresses. Payward requires 17 that visitors receive pre-approval and limits visitor access. Payward requires both employees and 18 19 1 20 Additional examples of such physical security threats abound. The wife of a businessman in the cryptocurrency industry was kidnapped and ransomed for Bitcoin. Duncan Riley, Woman in 21 Brazil rescued after kidnappers demanded bitcoin ransom payment, SingleAngle, May 1, 2017, available at https://siliconangle.com/2017/05/01/woman-brazil-rescued-kidnappers-demanded- 22 bitcoin-ransom-payment/. Robbers broke into a man’s house and tortured him in front of his child 23 with a drill until he surrendered his Bitcoin funds. Jon Christian, Robbers Tortured a Man With a Drill to Steal His Cryptocurrency, Futurism, Mar. 8, 2019 (“A key promise of the digital cash 24 known as cryptocurrency is its security—because only you possess the password to access your money, it’s presumably more safe than it would be at a bank. But a grisly crime . . . shows that 25 there’s also a dark side to having total control over your own wealth.”), available at 26 https://futurism.com/robbers-tortured-man-drill-steal-cryptocurrency. Cryptocurrency traders in India were abducted and held hostage for Bitcoin. Erik Gibbs, Kidnap-for-crypto scheme in India 27 stopped, Coingeek, July 16, 2019, available at https://coingeek.com/kidnap-for-crypto-scheme- 28 in-india-stopped/. This list goes on. Id. (“India isn’t the only country to have had to deal with crypto kidnappers.”). PAYWARD v. RUNYON Case No. 20-CV-2130-MMC 8 NY28571/0002-US-8632109/2 AMENDED COMPLAINT Case 3:20-cv-02130-MMC Document 34 Filed 10/09/20 Page 10 of 27 1 visitors to sign non-disclosure agreements. Additionally, Payward uses a mailing address that is 2 geographically distinct from its headquarters’ address as its official public address. 3 38. Payward takes the security measures seriously. For example, Payward was forced 4 to permanently shut down a 90-person office in Canada after a former employee revealed on 5 Reddit the secure and confidential location of the Company’s facility, and secure servers, in Nova 6 Scotia. 7 39. Other tech companies routinely conceal their physical locations for similar 8 reasons. For example, Amazon conceals its data centers to protect both their customers and 9 employees. See Ingrid Burrington, Why Amazon’s Data Centers Are Hidden in Spy Country, The 10 Atlantic, Jan. 8, 2016, https://www.theatlantic.com/technology/archive/2016/01/amazon-web- 11 services-data-center/423147/. Recently, Microsoft unveiled two new data centers but has 12 concealed their location, saying only that they are 500 miles apart from each other. See Frank 13 Konkel, Microsoft is building data centers and expanding security capabilities to compete with 14 Amazon to host sensitive government data, Nextgov, Apr. 17, 2019, 15 https://www.nextgov.com/emerging-tech/2019/04/microsoft-unveils-two-secret-data-centers- 16 built-classified-government-data/156376/. 17 40. As an employee working from Payward’s San Francisco headquarters, Defendant 18 signed a non-disclosure agreement and knew about the extensive electronic and physical security 19 measures Payward employs. 20 B. Defendant’s Employment With Payward 21 41. On March 18, 2018, Payward sent Defendant an at-will employment offer for the 22 position of financial analyst. The offer was contingent upon Defendant signing Payward’s 23 Confidential Information and Invention Assignment Agreement (the “Confidentiality 24 Agreement”). The Confidentiality Agreement required Defendant to protect confidential 25 information, in part, as follows: 26 (a) Protection of Information. I understand that during the Relationship, the Company intends to provide me with i