DeclarationCal. Super. - 6th Dist.July 26, 2018 1 DECLARATION OF ROSS A. SPECTOR - Opposition re: OSC re: Preliminary Injunction 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 ROSS SPECTOR, ESQ. (CSB #135949) SPECTOR & BENNETT A Professional Corporation 50 California Street, 15th Floor San Francisco, CA 94111 Telephone: (415) 439-5390 Facsimile: (415) 707-2064 ross.spector@spectorandbennett.com Attorneys for Respondent, Natalie Heroux SUPERIOR COURT OF THE STATE OF CALIFORNIA COUNTY OF SANTA CLARA ASTREYA PARTNERS, INC., a California corporation, Petitioner, v. NATALIE HEROUX, an individual, Respondent ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) Case No. 18CV331864 DECLARATION OF ROSS A. SPECTOR IN SUPPORT OF RESPONDENT’S OPPOSITION TO PETITION RE: ORDER TO SHOW CAUSE RE: PRELIMINARY INJUNCTION Date: April 30, 2019 Time: 9:00 AM Dept.: 10 Judge: Hon. Helen E. Williams I, Ross A. Spector, declare as follows: 1. I am an attorney at law duly licensed to practice before all the courts of the State of California and am a principal in the law firm Spector & Bennett, A Professional Corporation, attorneys of record for Respondent, Natalie Heroux (“Heroux”). I have personal knowledge of the following facts, and if called as a witness, I could and would competently testify thereto. Electronically Filed by Superior Court of CA, County of Santa Clara, on 4/17/2019 12:25 PM Reviewed By: R. Burciaga Case #18CV331864 Envelope: 2771196 18CV331864 Santa Clara - Civil R. Burciaga 2 DECLARATION OF ROSS A. SPECTOR - Opposition re: OSC re: Preliminary Injunction 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 2. Attached hereto as Exhibit 1 is a true and correct copy of the “DECLARATION OF NATALIE HEROUX IN OPPOSITION TO EX PARTE APPLICATION FOR PRELIMINARY INJUNCTION AND FOR ISSUANCE OF TEMPORARY RESTRAINING ORDER” that was filed with the Court on July 26, 2018. 3. Attached hereto as Exhibit 2 is a true and correct copy of the “DECLARATION OF NATALIE HEROUX IN SUPPORT OF MOTION FOR PROTECTIVE ORDER AND REQUEST FOR SANCTIONS” that was filed with the Court on October 1, 2018. 4. Attached hereto as Exhibit 3 is a true and correct copy of the “DECLARATION OF NATALIE HEROUX IN SUPPORT OF REPLY TO OPPOSITION TO MOTION FOR PROTECTIVE ORDER AND REQUEST FOR SANCTIONS” that was filed with the Court on March 26, 2019. 5. Attached hereto as Exhibit 4 is a true and correct copy of the “DECLARATION OF ALEXANDER TETELBAUM IN SUPPORT OF REPLY TO OPPOSITION TO MOTION FOR PROTECTIVE ORDER AND REQUEST FOR SANCTIONS” that was filed with the Court on March 26, 2019. 6. Attached hereto as Exhibit 5 is a true and correct copy of the “DECLARATION OF DONALD VILFER IN SUPPORT OF RESPONDENT'S MOTION FOR PROTECTIVE ORDER AND REQUEST FORSANCTIONS” that was filed with the Court on October 1, 2018. 7. Attached hereto as Exhibit 6 is a true and correct copy of the “DECLARATION OF DONALD VILFER IN SUPPORT OF REPLY TO OPPOSITION OF RESPONDENT’S // // 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 MOTION FOR PROTECTIVE ORDER AND REQUEST FOR SANCTIONS" that was filed with the Court on March 26, 2019. I declare under penalty of perjury under the laws of the State of California that the foregoing is true and correct. Executed this 17th day of April, 2019, at San Francisco, California. 3 DECLARATION OF ROSS A. SPECTOR- Opposition re: OSC re: Preliminary Injunction 1 2 3 4 5 6 7 8 9 PROOF OF SERVICE I am a citizen of the United States, and over the age of 18 years. I am not a party to the within above-entitled action; my business address is 50 California Street, 15th Floor, San Francisco, CA 94111. I am readily familiar with Spector & Bennett's practice of collection and pro.cessing of correspondence to be deposited for delivery via the US Postal Service, as well as other methods used for delivery of correspondence. On April 17, 2019, in the manner indicated, I caused the within document(s) entitled: DECLARATION OF ROSS A. SPECTOR IN SUPPORT OF RESPONDENT'S 1 O OPPOSITION TO PETITION RE: ORDER TO SHOW CAUSE RE: PRELIMINARY INJUNCTION 11 12 13 14 15 to be served on the party(ies) or their (its) attorney( s) of _record in this action via: (By Mail) Each envelope, with postage fully paid , to be placed in the United States mail at San Francisco, California. (By Hand) Each envelope to be delivered by hand to the address( es) listed below. 16 XX Each envelope, with postage fully paid, to be sent by UPS - Overnight 17 18 19 20 21 addressed as follows: Steven Cohn, Esq. Advocacy Center for Employment Law 2084 Alameda Way San Jose, CA 95126 n ~ 23 declaration was executed on April 1 7, 2019. 24 25 26 27 28 EXHIBIT 1 HI I 10 ll 12 13 14 15 16 l7 18 19 20 21 22 23 24 25 26 27 28 ROSS A. SPECTOR, ESQ. (S.B. #135949) SPECTOR & BENNETT A Professional Corporation 50 Califomia Street, 15‘“ Floor San Francisco, California 941 1 1 Telephone: (41 5) 43 9-5390 Attorneys for Respondent NATALIE HEROUX mdir w irr- mur-‘é-v' (ENDORSEE JUL 2 6 2018 Clerk of the Court Superior Court of CA County of Santa Clara BY DEPUTY 5-? 4M}! E vi 5.1 - "Q' rm:- AmQN SUPERIOR COURT OF THE STATE OF CALIFORNIA COUNTY OF SANTA CLARA ASTREYA PARTNERS, INC, a California corporation, Petitioner, VS. NATALIE HEROUX, an individual; and DOES 1-100, inclusive, Respondents. Declaration of Natalie Heroux CaseNo: ,acy‘fs/géy DECLARATION 0F NATALIE HEROUX IN OPPOSITION TO EX PARTE APPLICATION FOR PRELIMINARY INJUNCTION AND FOR ISSUANCE OF TEMPORARY RESTRAINING ORDER ' Date: July 26, 201 8 Time: 8: 1 5am Dept: TBD PAGE 1 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 I, Natalie Heroux, am the respondent in the above entitled action. [make the following declaration based on my own knowledge, and, if called upon, I could and would give competent testimony thereto. 1. At no time from April 18, 2018 forward did I 0r anyone under my control copy any Astreya files from any Astreya cloud storage or any Astreya storage device. 2. Ido not maintain in my possession, custody and control any Astreya files in cloud storage or on any memory storage device. 3. At no time from April 18, 201 8 forward did I or anyone under my control share or transfer any Astreya files to any person or entity. 4. More specifically, at no time from April 18, 2018 forward have Ia) used, divulged, disclosed, made known, distributed, transferred, or made any use whatsoever of Astreya’s confidential, proprietary infomation; b) concealed, altered and/or transferred propeny belonging to Astreya, including the confidential information of Astreya; c) used, destroyed, concealed, altered, and/or transferred evidence of any wrongful conduct engaged in by me (notwithstanding the foregoing, Ihave not engaged in any wrongful conduct); and d) contacted Astreya’s employees for the purpose of soliciting said employees for employment. 5. I am aware of my “Duty to Preserve Evidence”, understand the duty and am complying with the requirements of the duty. 6. The Declaration of Valerie Carpenter submitted by Astreya mischaracterizes and falsely describes the dialogue between her and I. At no time have I ever offered Ms. Carpenter or any other employee of Astreya a position as an employee or work as an independent contractor. Ms. Carpenter’s attempt to paint my communications With her as unwanted advances is ridiculous. Ms. Carpenter’s comment at paragraph 2 of her declaration that “Ms. Heroux asked for my personal cell phone number” appears to be intentionally provided out of context to Declaration of Natalie Heroux PAGE 2 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 manufacture the impression that I was pursuing communication with Ms. Carpenter in a manner which she found to be uncomfortable or somehow inappropriate. In fact, as the true and correct copies 0f the Linkedin Messages attached to hereto as Exhibit A clearly indicate, Ms. Carpenter was warm and friendly to me, welcoming a dialogue between us. The messages also clearly show that the reason I asked Ms. Carpenter for her phone number was in response to Ms. Carpenter asking me, “let me know what is new!” As the Linkedin Messages clearly indicate, I responded to Ms. Carpenter’s desire to “keep in touch” and request to let her “know what is new” by stating “Absolutely...Let’s catch up..What’s your phone #?” Notwithstanding the foregoing, during my telephone conversation with Ms. Carpenter she expressed to me her frustration with being stuck in the same job at Astreya for three years, being unclear as t0 the company’s future, not knowing where she stood with Astreya’s management and, concerns over her job security. In my view Ms. Carpenter attempted t0 turn the pleasant little dialogue evidenced by the Linkedin Messages into a conversation scenario whereby I might offer to help her find a new job, but she was sadly mistaken as I did not bite, did not offer her a job and would never offer her a job. 7. I did not have access to the MacAir referenced in Petitioner’s application on April 18, 2018 at 1:56pm, the MacAir being then located three hours away in my vacation home in Clear Lake (which, as an aside, was the reason it took me a bit of time to return the laptop to Astreya). At precisely the time in question I was using a Google-issued Chromebook assigned to me to use for the work I did for Google on behalf 0f Astreya, with full authorization to d0 as such. Idid not copy or transfer the files discussed in the Declaration of Lynell Phillips (Petitioner’s expert) on April 18, 2018, or at any time subsequently, to any device or cloud storage whatsoever, and I maintain no copies of Astreya files on any USB device, cloud storage, or any other device whatsoever. At the time of my termination and at all times subsequently, Ihave not shared or transferred any Astreya files to any person or entity. Declaration ofNatalie Heroux PAGE 3 \DOOQO\Ul-me)-o NNNNNNMNNHNHp-A 8. With regard to the Declaration of- Jay Preston submitted by Astreya, 'in mentioning that he was my direct supervisor a1 the time of termination, Mr. Preston conVeniently fails to state that he stmted work at Astreya a mere two weeks before my termination and that I was on vacation for one of those weeks. ML Preston and I barely knew each other and had extremely limited interaction. Regarding the m-eeting on the morning of April 18 which Mr. Preston says I failed to attend, Mr. Preston was notified by me that [would not be attending as [was en” route to a very important client meeting. As to the mysterious “offsite client location” where I was terminated, the location was actually the Googlc building where I'quite ofien went to work (Goog'le being an Astreya client that I consistently worked with). Iwas scheduled to be in client meetings at Google most of the teminafion day, April 18, 201 8, something clearly visible from a review of my work calendar. Mr. Preston? gratuitous comments concéming myjob performance are false, as I consistently obtained superior reViews from Astreya (and the Astreya clients I Worked with): Further to this, about 90vminutes before Mr. Preston terminated me 6n April 18, 2018, I advised Mr. Preston abOut an email Ireceived about an hour earlier fiom David Yamevich of Google (the Astreya ac-count I spent the overwhelming majority of my time with while employed by Astreya) cémplemenfing the work Iwas engaged in. I declane under penalty of perjury under the laws ofthe State of California that the foregoing is true and correct. Executed this 25m day ofJuly 2018 at Danville, California. @M/y Natalie Hetoux L») \IONU‘I-b 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 PROOF OF SERVICE I am a citizen of the United States, and over the age of 18 years. I am not a party to the within above-entitled action; my business address is 50 California Street, 15th Floor, San Francisco, CA 941 1 1. I am readily familiar with Spector & Bennett's practice of collection and processing of correspondence to be deposited for delivery via the US Postal Service, as well as other methods used for delivery of correSpondence. On July 26, 201 8, in the manner indicated, I caused the within document(s) entitled: DECLARATION OF NATALIE HEROUX IN OPPOSITION T0 EX PARTE APPLICATION FOR PRELIMINARY INJUNCTION AND FOR ISSUANCE OF TEMPORARY RESTRAINING ORDER to be served on the paflyfies) or their (its) attomey(s) of record in this action via: (By Mail) Each envelope, With postage fully paid t6 be placed in the United States mail at San Francisco, California. ' XX (By Hand) Each enveIOpe to be delivered by hand to the address(es) listed below. (By Email) to: (By Fax) to Each envelope, with postage fillly paid to be sent by UPS NEXT DAY addressed as follows: Sean Bothamley Advocacy Center for Employment Law * *Served at the Courthouse during Ex Parte Proccedings** I declare under penalty of perjury that the foregoing i declaration was executed on July 26, 201 8. EXHIBIT A View Natalie’s profile Natalie Heroux Natalie Heroux 5:56 AM r Hi stranger, how are you? Had coffee with Scott R. the other day and he mentioned you... Hope you are wel|!! Stay in touch, Natalie o Valerie Carpenter is now a connection JUN 8Valerie Carpenter sent the following message at 10:22 AM View Valerie’s profile Valerie Carpenter Valerie Carpenter 10:22 AM HI Natalie! Sorry for the delayed response. Yes, Scott and l keep in touch- and | hope to stay in touch with you as well. Hope you are good- let me know what is new! Natalie Heroux sent the following message at 12:13 PM View Natalie's profile Natalie Heroux Natalie Heroux 12:13 PM Hi stranger... Absolutely... Let's catch up.. What‘s your phone #? JUN 11Valerie Carpenter sent the following message at 8:02 AM View Valerie's profile Valerie Carpenter Valerie Carpenter 8:02 AM 248 390 431 1 EXHIBIT 2 ‘ HI I ROSS A. SPECTOR, ESQ. (CSB #135949) 1 SPECTOR & BENNETT A Professional Corporation 2 50 California Street, 15th Floor San Francisco, CA 94111 3 Telephone: (415) 439-5390 Facsimile: (415) 707-2064 4 ross.spector@spectorandbennett.com 5 Attorneys for Respondent, Natalie Heroux 6 7 8 9 SUPERIOR COURT OF THE STATE OF CALIFORNIA COUNTY OF SANTA CLARA 10 11 12 ASTREYA PARTNERS, INC., a California corporation, 13 14 15 v. Petitioner, 16 NAT ALIE HEROUX, an individual, Respondent ) CaseNo.18CV331864 ) ) ) ) DECLARATION OF NATALIE HEROUX ) IN SUPPORT OF MOTION FOR ~ PROTECTIVE ORDER AND REQUEST ) FOR SANCTIONS ) ) Date: January 31, 2019 (earliest date available ) from Court) ) Time: 9:00 a.m. ) Dept.: D-13 ~ ) ) 17 18 19 20 21 22 23 24 25 26 27 28 ~~~~~~~~~~~~~~-) DECLARATION OF NATALIE HEROUX Electronically Filed by Superior Court of CA, County of Santa Clara, on 10/1/2018 5:17 PM Reviewed By: E. Fang Case #18CV331864 Envelope: 2009843 18CV331864 Santa Clara - Civil E. Fang 2 DECLARATION OF NATALIE HEROUX 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 I, Natalie Heroux, am the respondent in the above entitled action. I make the following declaration based on my own knowledge, and, if called upon, I could and would give competent testimony thereto. 1. On April 16, 2018 I made a written complaint to the Human Resources Department (“HR”) of Astreya Partners, Inc (“Astreya”) regarding the hostile work environment within which I was forced to work, a hostile work environment perpetrated upon me principally by Astreya CEO Edwin Miller (“Miller”). A true and correct copy of my complaint is attached hereto as Exhibit A. 2. In clear retaliation for my complaint, approximately 48 hours later, during the afternoon of April 18, 2018, my employment with Astreya was terminated. 3. On April 19, 2018 Astreya emailed me a “Separation Notice” which confirmed the “Termination of Employment”. A true and correct copy of the “Separation Notice” is attached hereto as Exhibit B. 4. After I had consulted counsel regarding my rights concerning the wrongful termination, discrimination, harassment and retaliation I was subjected to at Astreya, on May 16, 2018 Astreya’s outside counsel, Steven Paul Cohn (“Cohn”) emailed to me a vicious and intimidating letter which, among other things, threatened me with “criminal felony prosecution” should I not comply with his demands, of course regardless of whether they are reasonable, lawful or enforceable. A true and correct copy of the letter is attached hereto as Exhibit C. I am informed and believe that Cohn is a lawyer specializing = in employment and trade secrets law and used the mechanism of his letter to attempt bully me into abandoning my civil-matter rights. 5. I do not maintain in my possession, custody and control any Astreya files in cloud storage or on any memory storage device. At no time from April 18, 2018 forward did I or 3 DECLARATION OF NATALIE HEROUX 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 anyone under my control share or transfer any Astreya files to any person or entity. Further, at no time from April 18, 2018 forward have I a) used, divulged, disclosed, made known, distributed, transferred, or made any use whatsoever of Astreya’s confidential, proprietary information (to the extent any such information is identified and thereafter deemed confidential or proprietary); b) concealed, altered and/or transferred property belonging to Astreya, including the confidential information of Astreya (to the extent any such information is identified and thereafter deemed confidential); c) used, destroyed, concealed, altered, and/or transferred evidence of any wrongful conduct engaged in by me (notwithstanding that I have not engaged in any wrongful conduct); and d) contacted Astreya’s employees for the purpose of soliciting said employees for employment (as addressed by me in detail in my July 26, 2018 declaration). Despite the foregoing and the existence of no evidence, admissible or otherwise, to the contrary (notwithstanding the wholly ineffectual and discredited testimony of Astreya’s expert), I believe that Astreya and Cohn chose to use Cohn’s May 16, 2018 letter as the next step in their campaign of retaliation against me for making my hostile work environment complaint to Astreya’s HR department. 6. On June 14, 2018 my counsel served Astreya and Miller with a Demand for Arbitration (“Demand”). A true and correct copy of the Demand is attached hereto as Exhibit D. 7. On June 15, 2018 I exercised my option to purchase 6,318 shares of Astreya stock. A true and correct copy of the Notice of Exercise delivered to Astreya is attached hereto as Exhibit E. 8. On or about June 25, 2018, Astreya filed a complaint with Google falsely accusing me of misuse of Astreya files. Strangely enough, it happened just after I filed a demand for arbitration against Astreya and Miller personally. Google is and has been a client of both Astreya 4 DECLARATION OF NATALIE HEROUX 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 and my new employer, Milestone Technologies, Inc. (“Milestone”). While employed at Astreya as a General Manager, I spent all of my time working on the Google account overseeing 50% of Astreya’s business. The complaint filed with Google resulted in two senior Milestone executives and me needing to appear before a Google investigator. Before this occurred, my dispute with Astreya was not to be public, but to be handled through private mediation. I believe this action was a further retaliation against me by Astreya and could not have happened without Miller’s personal direction. These charges were levied to damage my ability to work for or at Google by defaming my reputation and in an attempt to get me fired from my new job. 9. The very next day, June 26, 2018, more than two months after I was terminated, Astreya/Miller upped the retaliatory ante by retaining the services of a computer forensics expert to, as in the words she used in her declaration filed with the Court on July 26, 2018, “to look for evidence to determine if the former employee that used the MacBook Air during their employment with Astreya may have copied or uploaded company files from that MacBook Air”. The report of Astreya’s expert makes no conclusions which she supports with evidence and has otherwise been completely discredited. Much as was the case with the false Google complaint, based upon my close working relationship with Miller in my position as General Manager at Astreya, it is inconceivable to me that the step to retain a forensic expert was taken other than at Miller’s direction in consultation with Cohn. 10. In a further retaliatory effort, and in an additional attempt to get me fired from my new position with Milestone, on July 12, 2018 Astreya, by and through Cohn’s associate Sean Bothamley (“Bothamley”), tendered a letter to Milestone threatening Milestone with possible “claims against Milestone Technologies, Inc. directly”. A true and correct copy of the letter is attached hereto as Exhibit F. Bothamley’s letter provides no specifics whatsoever and, I am 5 DECLARATION OF NATALIE HEROUX 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 informed and believe, more than two months later Bothamley still has not provided Milestone with any specifics. Notwithstanding the foregoing, it is quite ironic that Astreya/Miller would pursue me (and possibly Milestone) for alleged trade secrets law violations given that it has engaged in an aggressive campaign over the past year to poach Milestone Employees and acquire the very same type of trade secret information that Astreya claims it is trying to protect. I am informed and believe that Astreya has hired at least 15 Milestone employees over the past year, including Jay Preston, Astreya’s Senior Vice President of Global Service Delivery (my boss over the last 2 weeks at Astreya) and Anita Nunez, Astreya’s Senior Vice President of Sales. Between Mr. Preston and Ms. Nunez, they hired a number of recruiters, including a Global Director for Europe, the Middle East and Africa, and many management leaders, including Brian Vierra, Astreya’s Sales Operations Manager; Britt Swan, Service Delivery Executive; Mike Thompson, Global Service Delivery Manager, and many others - all with an intimate familiarity with Milestone’s pricing, proposals and clients. I am further informed and believe that Astreya is continuing its assault on the Milestone workforce, recently trying to get another couple of Milestone employees to leave and go to Astreya. 11. Notwithstanding that I have not engaged in any activity whatsoever which could be characterized as a violation of any laws or duties, I believe that even if Astreya had come forth with any specific information which it felt were “trade secrets” inappropriately handled, such information would ultimately not be deemed a trade secret given the “small world” which constitutes the IT Managed Services business in Silicon Valley and the amount of employee turnover between the companies in the industry. 12. Also on July 12, 2018, Cohn wrote to my counsel and, based upon Cohn’s misrepresentation that “upon learning of the termination of her employment with Astreya, Ms. 6 DECLARATION OF NATALIE HEROUX 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Heroux intentionally and knowingly accessed and downloaded from her company laptop approximately 2.232 gigabytes of confidential and proprietary documents and information belonging to Astreya, using a personal Google Drive account and external drive”, again threatened me with criminal prosecution to coerce me into abandoning my civil-based claims, stating that the above false accusations resulted in “exposing Ms. Heroux to civil and criminal penalties for each unauthorized access”. As problematic as the report of Astreya’s expert is, even she does not come remotely close to stating what Cohn represents about me in his July 12, 2018 letter to my counsel. A true and correct copy of the letter is attached hereto as Exhibit G. 13. On or about July 26, 2018, more than three months after my last day at Astreya, Astreya/Miller/Cohn/Bothamley commenced a Superior Court proceeding against me and filed an ex parte application for a temporary restraining order (“TRO”). I note the obvious - that if Astreya had legitimate, non-retaliatory concerns about my alleged handling of Astreya information - why did Astreya wait more than two months to hire a forensic expert and more than three months to commence ex parte proceedings. There were two parts to the ex parte application. The first sought to prohibit me from accessing, using, etc. Astreya’s alleged confidential information and to prohibit me from contacting Astreya’s employees for the purpose of soliciting them for employment. Prior to the hearing I had agreed to stipulate to these items and to maintaining the status quo pending a full hearing since I had not engaged nor was I engaging in these activities anyway. However, with the second part of the application Astreya sought to obtain any electronic storage devices and access to any online storage accounts which I might have. Given that Astreya and its expert could not proffer evidence of any wrongdoing on my part and given Cohn’s clever by half, red herring argument that the devices/online storage account access were necessary to determine the further extent to which I 7 DECLARATION OF NATALIE HEROUX 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 accessed/used/copied/transferred any alleged confidential information while I did not and there is no evidence that I accessed/used/copied/transferred any alleged confidential information in the first place, I decided to strongly contest Astreya’s efforts regarding access to my very personal and private information. At the hearing on July 26, 2018 the Court denied Astreya’s attempt to acquire any devices and/or online account access which I may have. 14. On August 1, 2018 Astreya engaged in a further act of retaliation against me by engaging in a forced repurchase of the Astreya stock I acquired in June 2018, a repurchase in an amount I am informed and believe is approximately 80% less than what the stock is reasonably worth. I am pursuing Astreya/Miller for securities fraud. A true and correct copy of Astreya’s August 1, 2018 letter advising me of the forced repurchase is attached hereto as Exhibit H. 15. Notwithstanding the Court’s July 26, 2018 ruling denying access to any storage devices or online storage accounts which I may maintain, on August 10, 2018 Astreya, by and through Bothamley, incredibly advised that they would be seeking an ex parte order on August 13, 2018 seeking the same devices and access credentials. Apparently Astreya and its counsel came to see the wisdom of not pursuing the application and decided against proceeding to the August 13 hearing. What I am informed and believe is a true and correct copy of the August 10, 2018 email to my counsel concerning this issue is attached hereto as Exhibit I. 16. I am informed and believe that also on August 10, 2018 Cohn yet again, for the third time, threatened me with criminal prosecution while discussing my civil-based claims with my counsel. 17. Astreya’s false accusations state that I was copying or transferring files on the day of termination before termination. But Astreya conveniently forgets to mention that after termination, I still had full access to Google drive for about 1 month and didn’t copy or transfer 8 DECLARATION OF NATALIE HEROUX 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 anything. This completely invalidates Astreya’s entire theory that I needed to copy all files before termination. 18. On August 27, 2018, Astreya served my attorneys with its Special Interrogatories (Set 1) and Request for Production of Documents (Set 1), true and correct copies of which are attached hereto as Exhibits J and K, respectively. These discovery requests have one purpose - to obtain any electronic storage devices and access to any online storage accounts which I might have - the very thing this Court denied when it denied the second part of Astreya’s July 26, 2018 ex parte application. 19. The two electronic devices that are at the center of Astreya’s baseless allegations against me are a MacBook Air (“Laptop”) and a google Chomebook (“Chromebook”). I had not used the Laptop for anything having to do with Astreya for at least 12 months prior to my April 18, 2018 termination date. The Laptop had been located at my parents’ vacation home in Clear Lake, CA. I used the Chromebook for my Astreya work. The Laptop was brought back from Clear Lake by my father on May 21, was FedExed to Astreya on May 22, and received by Astreya on May 23, 2018. The Laptop was used mostly by my father, for personal matters. All the alleged activity on April 18, 2018 highlighted by Astreya’s expert Lynell Phillips was done on the Chromebook and was likely updated on the Laptop through autosyncronization. On May 21, 2018, my father and I deleted personal material on the Laptop before sending it back to Astreya. As set forth in the declaration of my expert Don Vilfer, there is no evidence whatsoever that I downloaded Astreya’s purported confidential information. That is because I never did download any of Astreya’s purported confidential information. 20. Granting Astreya access to my “electronic devices” (“computers, laptops, tablets, internet-connected cellular phones, USB memory sticks, and external hard and/or solid-state 9 DECLARATION OF NATALIE HEROUX 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 drives”), accounts, and passwords would let Astreya (a hostile and aggressive adversary with regard to my wrongful termination action) gain access to wholly immaterial, irrelevant and not reasonably-calculated-to-lead-to-the-discovery-of-admissibile-evidence information that has nothing to do with any of Astreya’s purported trade secrets - a very large percentage of the information on my devices and in my accounts is highly personal information. Again, I did not download any of Astreya’s purported confidential information onto any of my devices or into any of the online storage accounts I may maintain. In addition, most if not all of that inconsequential to this action information constitutes information that is protected by my right of privacy. The devices/accounts at issue contain extremely sensitive and confidential personal financial and medical information, as well as sensitive and confidential communications with my mother and father, delicate communications concerning my teenage children, plus communications with my attorneys, that no third-party should see - especially a hostile adversary in an employment termination action wherein retaliatory conduct has been demonstrated. Given the complete lack of probative evidence showing that I engaged in any misconduct regarding and/or any misappropriation of Astreya trade secrets, it is clear to me that Astreya is using its written discovery requests to try and dig up dirt on me to use in the wrongful termination action. For this reason, the court should not allow Astreya access to any personal storage devices or online storage accounts which I may maintain. 21. I believe this lawsuit is frivolous and is a tactic by Astreya and Miller to create undue emotional and financial stress for a single mother of two. Specifically, Astreya and Miller are intentionally creating unnecessary litigation to saddle me with huge legal expenses, time commitment, and cause me emotional distress from a threat of being fired from Milestone, lack of access and inability to work at and with Google, and damage to my reputation in the industry. IL... -----·--··-- 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 All of this is to force me into dropping my wrongful termination and stock manipulation arbitration actions against Astreya and Miller. All of these things are yet another demonstration of the harassment and retaliation l was exposed to while at Astreya. I declare under penalty of perjury under the laws of the State of California that the foregoing is true and correct. Executed this first day of October, 2018 at Danville, California. Natalie Heroux 10 ---------------- ----------------- DECLARATION OF NATALIE HEROUX 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 PROOF OF SERVICE I am a citizen of the United States, and over the age of 18 years. I am not a party to the within above-~ntitled action; my business address is 50 California Street, 15th Floor, San Francisco, CA 94111. I am readily familiar with Spector & Bennett's practice of collection and processing of correspondence to be deposited for delivery via the US Postal Service, as well as other methods used for delivery of correspondence. On October 1, 2018, in the manner indicated, I caused the within document(s) entitled: DECLARATION OF NATALIE HEROUX IN SUPPORT OF MOTION FOR PROTECTIVE ORDER AND REQUEST FOR SANCTIONS to be served on the party(ies) or their (its) attorney( s) of record in this action via: (By Mail) Each envelope, with postage fully paid to be placed in the United States mail at San Francisco, California. (By Hand) Each envelope to be delivered by hand to the address( es) listed below. 16 XX (By Email) to: sean@jobslaw.org 17 (By Fax) to 18 19 20 21 22 23. 24 25 26 27 28 Each envelope, with postage fully paid to be sent by FED EX addressed as follows: Sean Bothamley, Esq. Advocacy Center for Employment Law 2084 Alameda Way San Jose, CA 95126 declaration was executed on October 1, 2018. M. Waal EXHIBIT A HI I Confidential Natalie H to Joanne, Anne, Natalie Confidential Hi Joanne I Anne, Apr 16 (2 days ago) Since arrival of our new executive team, with all of the re-orgs since November and recent management and reporting changes, as well as my interactions over the last 3+ months with our CEO Edwin and now my new manager Jay, my work environment has become hostile. I need to discuss with you. Who will take the lead on this? Thank you, Natalie Natalie Heroux : Google Account I www.astreya.com Tel. 510-305-8257 nheroux@astreya.com I Passion Adaptability I Creativity I Excellence I Living Our Values Joanne Lewis to me, Anne Hi Natalie - Apr 16 (2 days ago) I can meet with you to discuss your concerns. Please let me know when you are free to meet. I can come onsite or we can VC. Joanne Lewis Human Resources 408-387-627 4 Astreya Partners, Inc. jlewis@astreya.com Natalie H Apr 16 (2 days ago) Thanks Joanne ... It is possible we could meet onsite, but my schedule is absolutely packed Mon-Wed back to back. Let me carve out some time on Thu or Fri for onsite or VC. I will set something up tomorrow .. Thanks .. Natalie H to Joanne, Anne By the way ... I know HR currently reports to Monica. Apr 16 (2 days ago) Given the nature of my concerns, I would ask you to keep this to yourselves, at least for now until we talk. I am concerned that Monica would immediately tell Edwin and this would make my situation even worse than it already is, Thank you. Joanne Lewis to me, Anne Yes, this is understood. Let me know when you are free on Thurs/ Fri. Apr 16 (2 days ago) EXHIBIT B HI I DocuSign Envelope ID: 604EA88B-A7B4-401A-A734-E041 BEE658AB 3970 Freedom Circle, Suite 110, Santa Clara, CA 95054 Separation Notice ____ N.atalie Heroux _______ _ ___ CSZ001755 _____ _ Employee Name Employee Number Your employment status has changed for the reason checked below: Voluntary quit effective _____________ _ Date Layoff effective ___________________ _ Date Separation effective --~April 20, 2018 ___________ _ Date Reason for separation of employment: ___ Termination of Employment. ______________ _ See attached checklist for any company assets to be returned. Supervisor Signature Date ~~ April 19, 2018 Date I received a copy of this notice: Employee Signature Date EXHIBIT C HIBI May 16, 2018 STEVEN PAUL COHN ADVOCACYCENTERFOREMPLOYMENTLAW 2084 Alameda Way San Jose, California 95126 (408) 557-0300 Fax: (408) 557-0309 VIA U.S. CERTIFIED MAIL & EMAIL Natalie Heroux 165 Ramona Rd. Danville, CA 94526 Email: ntlhrx@gmail.com Re: Notice of Post-Employment Obligations to Astreya Partners, Inc. & Demand for Return of Astreya Partners, Inc. Property Dear Ms. Heroux: I am an attorney for Astreya Partners, Inc., ("Astreya"), and have been informed of your recent employment with Milestone, a competitor to Astreya, following your April 20, 2018 termination of employment with Astreya, as well as of your lack of action in returning Astreya Company equipment to the Company post termination. Incident to your former position at Astreya as a General Manager, you had access to Astreya's confidential and proprietary information, including its statutorily-protected trade secret information, such as BOD presentations on strategy, Astreya sales pipeline, pricing, and the number of placed technical staff and salary information by program. As a condition of your employment with Astreya, you signed an Employment Agreement, Offer of Employment letter, and a Confidential & Proprietary Information Agreement, enclosed for your reference, portions of which remain in effect following the termination of your employment with Astreya. Specifically, these agreements prohibit you from engaging in certain conduct following the termination of your employment with Astreya. Among these prohibitions, the Confidential & Proprietary Information Agreement at Section 2 requires that you not divulge any of Astreya's "Confidential Information'', which includes, but is not limited to: [A]ll information and any idea in whatever form, tangible or intangible, pertaining in any manner to the business of [Astreya], or any Affiliate, or its employees, contractors, clients, consultants, or business associates, which was produced by any Natalie Heroux May 16, 2018 Page2 employee/contractor of [Astreya] in the course of his or her employment or otherwise produced or acquired by or on behalf of [Astreya]... not generally known outside of [Astreya]'s organization, [which] shall include, but not be limited to: (i) formulas, teaching and development techniques, processes, trade secrets, computer programs, electronic codes, inventions, improvements, and research projects; (ii) information about costs, profits, markets, sales, and lists of customers or clients; (iii) business, marketing, and strategic plans; and (iv) employee/contractor personnel files and compensation information. Intentional, unauthorized use and/or divulgence of such statutorily-protected confidential and proprietary information will result not only in civil damages, including punitive damages, attorneys' fees, and court costs assessed against the violator, but may result in criminal felony prosecution. See California Civil Code § 34 26, et seq., and California Penal Code § 499( c ). The Confidential & Proprietary Information Agreement, at Section 4, further requires that, for a period of one (1) year after termination of your employment, you will not, directly or indirectly, (i) divert or attempt to divert from Astreya or any of its affiliates1 any business of any kind in which Astreya is engaged; (ii) employ or recommend for employment any person employed by Astreya or any of its affiliates; or (iii) engage in any business activity that is or may be competitive with Astreya or any of its affiliates, unless you can prove that any action taken in contravention of this subsection was done without the use in any way of Confidential Information. The Confidential & Proprietary Information Agreement, at Section 1, further requires you to return all Astreya property to Astreya following the termination of your employment. You have failed to return both the Astreya laptop and badge assigned to you during your employment. Astreya has repeatedly demanded the return of these items, and has forwarded to you a pre-paid shipping label and box from FedEx to facilitate their return. Your continued refusal to return these items to Astreya will be viewed not only as breach of the Confidential & Proprietary Information Agreement, entitling the company to seek damages and attorneys' fees incurred in recovering same by way of legal action, but as a theft which will be reported to law enforcement should these materials not be returned within seven (7) days of the date of this letter. Additionally, if company material has been found to have been exported, sent, or removed to an external source from Astreya's laptop during your post-employment possession of this property, this will be viewed as an active misappropriation of Astreya's proprietary confidential information which you will need to immediately address to the undersigned. We will look forward to hearing from you in these regards, and you may contact Astreya Human Resources 1 "Affiliate" means any person or entity that directly or indirectly controls, is controlled by, or is under common control with Astreya. Natalie Heroux May 16, 2018 Page3 with further questions, or for additional assistance in returning Astreya's property. Astreya takes its obligation to prevent the unauthorized use and disclosure of its Confidential Information, and violations of its former employee's contractual post-employment responsibilities, very seriously, and reserves the right to seek all remedies allowed by law to ensure such compliance. We hope and trust that you are fully aware of your post-employment obligations to Astreya. Should you have any questions regarding the above, you are again directed to contact the undersigned or call Astreya' s Human Resources for further guidance. Thank you for your attention and anticipated professionalism. Enclosures cc: Client EXHIBIT D HIBI 9 Demand for Arbitration Form Instructions for Submittal of Arbitration to JAMS ONS Please 3ubrnit this forrn tr.J your local JAlvlS Resolution Center. Once the below items a:e received, a JAMS p;-ofessional will contact all p2,rties to commence and coordinate frte cirbitration process, including the appointment of an arbitrator and scheduling a date. \... 1-800-352-JAMS ~ www.jamsadr.com lf you v:ish to proceed v;ith an arbitration by executing and serving a Demand for Arbitration on the appropriate pa se subrni= the following items to JJ\MS with the requested number of copies: A. Demand for Arbitration (2 copies) B. Proof of service of the Demand on the appropriate party (2 copies) C. Entire contract containing the arbitration clause (2 copies) " To tiw extent there are any court orders or stipu1aticms relevant to this arbitration denrnnd, e.g. an order com· orbitrntion, pleo.se ajso inciude ttuo copies. D. Administrative Fees • For two- nwtters, the Filing Fre is $1,500. For matters involving three or more parties, the filincJ Jee is The entire Filing Ft>2 must be paid in full to expedite the commencement of the proceedings. Thereafter, F~c of 12% wil! be assessed against al! Professionai Fees, including tin1e spent for pre crncl post-hearing reeding t1rnl research and award preparation. }AMS also charges a $1.,500 for c:'.:unti>rc:iaims. For matters inuoluing consurners, the conswner is only required to pay $250. See Pohcv on ConsuYner A_rtritr~nions Pursuant to Pre-Dispute Clauses. For rnatters based Ol1 a ciause or ·'"'°or 1·s r>q·1i·1·c-~ ·'- " "'"'•ri1r1·"!' ,o··wc1'"j'Y1°rt t}p en1n'1ov 0 e ;S 0~ 1 ·1 r9m11.red '"O ~"'" "4r·O c;,,n 'il1"!.S '..11,. _ . t'. [. ~ · .. IJ ;..t :J I.< l. ;.• f' t ..... '·' t '-· r, ·I- v 1 i... fl'-, ~. ! c .. I. i:' j .._ t, t U j , .... '""l;... !. £-' U J ,:P • V . :... ~ C ) .1. t.1\ s. Arbitrotiom, Mininrnm Standords of Fairness. " $600 will be issued if the matter is withdrawn within five days ofji!ing. After jive days, the filing non -refund ab i.e. Once completed, please submit to your local JAMS Resolution Center. Resolution Center 1ccations can be found on the JAMS website llt: http://www.iamsadr.com/focations!. D.:..::rn::tnd fc•r 1\.rbitraticn Forrn Page 1 of7 Demand for Arbitration Form (continued) Instructions for Submittal of Arbitration to JAMS {PARTY ON WHOM DEMAND FOR ARBITRATION IS MADE) REsroNoENr Astreya Partners Inc NAME ' " mREss 2099 Gateway Place, Suite 140 CITY San Jose Add more r2sp:.mdcnts en page 6. PHONE (800) 224-1117 FAX EMAIL edwin.miller@astreya.com RESPONDENT'S REPRESENTATIVE OR ATTORNEY (IF KNOWN) REPREsrnrrnmmoRNu Unknown FIRM/ COMPANY ADDRESS CITY PHONE CLAIMANT NAME AO DRESS CITY PHONE FAX . ,. } Natalie Heroux 165 Ramona Road Danville (510) 305-8257 FAX CLAHVIANT'S REPRESENTATIVE OR ATTORNEY {IF KNOWN) REmmrAmE1moRm Ross A. Spector, Esq. STATE EMA!l STATE CA EMAIL FIRM/ COMPANY Spector & Bennett, A Professional Corporation ADDRESS 50 California Street, 15th Floor CITY San Francisco STATE CA . ...... .. .. ..... . . ...... , ... , .... ,,~·::,·:.;··· Add mon~ claimant.:' on page 7 . ZIP 94526 ZIP 94111 rHoNE (415) 439-5390 FAx (415) 707-2064 EMAIL ross.spector@spectorandbennett.com Page 2 of 7 Demand for Arbitration Form (continued) Instructions for Submittal of Arbitration to JAMS "''QI' ! ! 1;\l If mediation in advance of the arbitration is desired, please check here and a JAMS Case Manager will assist the pa:ties in coordinating a mediation session. I LI Y C M CLAIMANT HEREBY DEMANDS THAT YOU SUBMIT THE FOLLOWING DISPUTE TO FINAL AND BINDING ARBITRATION. A MORE DETAILED STATEMENT OF CLAIMS MAY BE ATTACHED IF NEEDED. Natalie Heroux asserts the following claims against Astreya Partners, Inc. and Edwin Andrew Miller related to their firing of Ms. Heroux effective April 20, 2018: Wrongful Termination; Wrongful Retaliation; Wrongful Sexual Harassment; Failure to Take Reasonable Steps to Prevent Harassment or Discrimination; Breach of Contract; Breach of Implied Covenant of Good Faith and Fair Dealing; Specific Performance; Declaratory Relief; Intentional Infliction of Emotional Distress; Negligent Infliction of Emotional Distress Forthcoming will be Ms. Heroux's detailed claim statement pertaining to her unlawful firing. Said detailed claim statement will be accompanied by a detailed statement of resulting damages, including, but not limited to, salaries owed, bonuses owed, the value of lost stock options, and damage to Ms. Heroux's reputation and dignity. For clarity's sake, it is intended that the time within which Respondents may respond to the within Demand for Arbitration (in accordance with Rule 9 of the JAMS Employment Arbitration Rules & Procedures) shall not begin to run until after Respondents are served with Claimant's above-referenced detailed claim. ' AMOUNT IN CONTROVERSY (US DOLLARS) $3,000,000.00 ··········--·-······---··----------·-·--·------------------------------ Page 3 of7 Demand for Arbitration Form (continued) Instructions for Submittal of Arbitration to JAMS '"'P"'"''A-.-ir "1 AGR,-t:ME!'>.n DI! K. ! 1Ul"i t~ l'H This demand is made pursuant to the arbitration agreement which the parties made as follows. Please cite location of arbitra- tion provision and attach two copies of entire agreement. ARBITRATION PROVISION LOCATION See paragraph 21 of the attached Employment Agreement. The respondent may file a response and counter-claim to the above-stated claim according to the applicable arbitration rules. Send the original response and counter-claim to the claimant at the address stated above with two copies to JAMS. REQUEST FOR HEARING REQUESTED UJCATION San Jose, California ON FOR EXPEDITED PR OCED u RES (iF COMPREHENSIVE RULES APPLY) See: Comprehensive Ru.le 16.1 By checking the box to the left, Claimant requests that the Expedited Procedures described in JAMS Compre- 0 hensive Rules 16.1and16.2 be applied in this matter. Respondent shall indicate not later than seven (7) days from the date this Demand is served whether it agrees to the Expedited Procedures. /I '"'!:Q;ili;ss10N jtdFi1l!~ 1A~lQ ,)i...n..J!V~· " d'lf v~·d\li 1 t I I S16NllTURE , · \,,... " ' llATE June 14, 2018 ··----- ··-~-- ·----·· ....... _._ .. _ ·- -·-··-- ·~ ··~ ...... -·· ···------ ~- ----- '-~·- .... ,,~ .. NAME (PRINT/TYPED) Spector & Bennett, A Professional Corporation I Ross A Spector, Esq. I Attorneys for Natalie Heroux )1\~,,15 De:nar:d for lu0oitration Form Page 4of7 Demand for Arbitration Form (continued) Instructions for Submittal of Arbitration to JAMS Completion of this section is r_gq:yj_red for:_91lJ:opsumer or employ_ment claims. Lil B ''."! N Please indicate if this is a CONSUMER ARBITRATION. For purposes of this designation, and whether this case will be ad- ministered in California or elsewhere, JAMS is guided by California Rules of Court Ethics Standards for Neutral Arbitrators, St.a.ndard 2(d) and (e), as defined below, and the JAMS Consumer and Employment Minimum Standards of Procedural Fair- ness: 0 YES, thi:: is a CONSUMER ARBITP/\T!ON. 0 NO, this is not a c:ONSUMrn ARBITRAT'.ON. ··cone: .rn~er a:bitraticn" means an arbitr3tion conducted under a pre .. dispute arbitration provision contained in a contract that n;er:t:: t.r:.E c:i.tcria listed in paragraphs through (3) be!.ow. "Consumer arbitration" excludes arbitration proceedings conduct- un,ler or out of pub1ic cir pr£--.rc.te sector labor-relations Ja·ws, regul2tions, charter provisions, ordinances 1 statutesi or T11c contract is \v.:th 2 consu·rTJ::-r party. as defneG. ln these standards; L. rLc contract \.vas drafted by or on behalf of the no!l.-consun:er party; and 3. ·rhe consurr1er party was required to dccept. the arbitrat:on provision in the contract. • .. o:-,:;u:r:er party" i:o J pJrty to an cdbitotion agreer-cent who. in the context of that arbitration agreement, is any of the follow .. . ~ng. An inC:ividmd who :;eeks or accpires, mcluding by le2.se, any goods c·r services primarily for personal, family, or hcuseholcl purposes including, but no~ limited to, financial services, insurance, and other goods and services as deLned in 'iecticrn 1761 of the Civil Code; 2. An individua·; who is an enrollee. a subscriber. or im:ured in a health-care service plan within the meaning of sec- c.ir:in ~345 of the Eea.ith and Co:ie or he2.lth-c2,re insurance plan within the meaning of section 106 of the lnsur~:,nce Code; 3. An indivic:ua.i •,vith <; medical m clair:-1 that :s subject to the arbitration agreement; or 4. An or an appiicant for empioyment in a disv1te arising out of or relating to the employc0 e's employment prospective that is subject to the arbitration agreement. :;drLt:to'l, JAMS is ~:uided by its C:c.nsumer lv':inirr:um Stanchrds and Employment Minimum Stand::nds \'iihen determining v/he-:-ht?:r a. rnattf.Y is a consutr:er rnatter. If Respondent disagrees with the assertion of Claimant regarding whether this IS or IS NOT a CONSUMER ARBITRATION, Re- spondent should communicate this objection in writing to the JAMS Case Manager and Claimant within seven (7) calendar days of service of the Demand for Arbitration. y If this an EMPLOYMENT matter, Claimant must complete the following information: Private arbiL at.ion are required to collect ancl certain inforrnation at least quarterly, and make it available the in a computer-searchable format. ln tcrnployment cases, this includes the amount of the employee's annual wage. :nc: 's narne wi.11 not appear :n t.'.'ie database, but the ernployer"s name will be published. Please check the applicable Lex belovl: 0 Less than $100,000 D $100,000 to $250,000 0 More than $250,000 0 Decline to State ·:;. ITRt\TI FE S In certain states (e.g. California), the law provides that consumers (as defined above) with a gross monthly income of less than 300% of the federal poverty guidelines are entitled to a waiver of the arbitration fees. In those cases, the respondent :rL1c:: ~;ay .i.00%. of Lie fees. C:onsumeis inust sCJbmit a declaration under oath stating the consumer's monthly income and the nu:n'.Jer Df pC'.r:>ons in his or her household. Ple ,• '· •• '< ._." >; ' STATE ZIP . - , ·-·-·--. --~~·--··-~' ·····-······- • .. ,.•;;;'!,"::' -:·~>~·"'"":.:c::::-.c--;:;;>-<,··.·o< ·-''>'.'=":>:-:'.':"-.'%':-=·~ ... ·."'-·;:;:ii'.""": '·'"""\(.-:><·· ••. - . ·.·1: ·. EMAIL .... - ,,. ·<°""<:>·:·~· ,<><·iR.'; .~. ;<>·• <,_·,~· ,·· .o.-;,,;-''~i:¥ .·~•'·'V· :~ ,0 .•. ·: <,• R Esp 0 ND ENT # 3 (PARTY ON WHOM DEMAND FOR ARBITRATION IS MADE) ...... .. ..... . ................................................. . RESPONDENT NAME ADDRESS . ................................................... ························- ............................................... - ................... -........................................................ ,_, ................... . .................................................................................................. ············· ··--········· .............................................................. .. CITY PHONE FAX RESPONDENT'S REPRESENTATIVE OR ATTORNEY (IF KNOWN) REPRESENTATIVE/ATTORNEY FIRM/ COMPANY ADDRESS CITY PHONE }l\.~vlS Demand for Arbitration Form FAX ;···.xc·· ·:·":':"'<.'"''"' "- :·"~ --.:¥.-.~·~·-. '",".':"'';';'•...,.,.;~:<'r.""'zy.;;,...,,~~-"'!;·""."~··r·<:'.""'":<''""' ~ ,._,,,,~-:·.'~~~ .. , , ,,.,, .. ,. -, - STATE ZIP EMAIL ........................................................................................... .. , -.. "'.j-:;-'.--,,,_ ·&.'."{,"'." >::·:.:;··;;,.-..;t .. ';:.~ ·-~:::'.,..-.-- ... _,..,,..,..,,,.,,. •. ..,....~,,,,, ...................................................................... ., ............ -........... -... ............. .. ....................... -................ _ ,,·":"">:-r >'.~'Y'; i)V\ ~":":' '""""" ·~: ~,'..,v':', ,-., °"..t\o<"''o''(",C: < <~,.,,.._. .. ~..,,.~.,·~'.,-,."Y'f'"-"•'> STATE ZIP EMAIL Page 6of7 Demand for Arbitration Form (continued) Instructions for Submittal of Arbitration to JAMS CLAIMANT NAME ADDRESS CITY PHONE FAX CLAIMANT'S REPRESENTATIVE OR ATTORNEY (IF KNOWN) RE PRE SENT ATIVEIATTOR NEY FIRM/ COMPANY ADDRESS CITY PHONE CLAIMANT NAME ADDRESS c !TY PHONE fAX FAX CLA!MANT'S REPRESENTATIVE OR ATTORNEY (IF KNOWN) REPRESENTATIVE/AHO R NEY FIRM/ COMPANY AO DRESS CITY PHONE FAX STATE ZIP EMAIL STATE ZIP EMAIL STATE ZIP EMAIL STATE ZIP EMAIL Page 7 of7 1 PROOF OF SERVICE 2 I am a citizen of the United States, and over the age of 18 years. I am not a party to the 3 within above-entitled action; my business address is 50 California Street, 15th Floor, San 4 Francisco, CA 94111. I am readily familiar with Spector & Bennett's practice of collection and 5 processing of correspondence to be d~posited for delivery via the US Postal Service, as well as 6 other methods used for delivery of correspondence. On June 14, 2018, in the manner indicated, I 7 caused the within document(s) entitled: 8 Demand for Arbitration 9 to be served on the party(ies) or their (its) attorney( s) of record in this action via: 1 O (By Mail) Each envelope, with postage fully paid to be placed in the United States mail at San Francisco, California. 11 12 13 14 (By Hand) Each envelope to be delivered by hand to the address( es) listed below. XX (By UPS Air) to Each envelope, with postage fully paid addressed as follows: Edward Andrew Miller 15 Astreya Partners, Inc. 2099 Gateway Place, Suite 140 16 San Jose, CA 951 IO 17 f 18 I declare under penalty of perjury that the forego~g .. {~ 19 declaration was executed on June 14, 2018. \ 1 1 20 21 22 23 24 25 26 27 28 M. Wruil that this \ EXHIBIT E XHIBI DocuSign Envelope ID: EA2A2C3C-C51 A-4A66-89D6-1 AD70ECF9C3F . ATTACHMENT III NOTICE OF EXERCISE Astreya Partners, Inc. Date of Exercise: b /! 15 / 2o/c:/) Ladies and Gentlemen: This constitutes notice under my Option that I elect to purchase the number of shares for the price set forth below. Type ofoption (check one): Stock option dated: Number of shares as to which option is exercised: Certificates to be issued in name of: Total exercise price: Cash or check payment delivered herewith: Incentive 0 $ _____ _ $ _____ _ Nonstatutory ~ Sepferriber Z.2, 'V:>/£ 6151£ AJ Al/TL-JG H. €-fl-0 .l).le $ lo, 5 '{ (, . 3 3 $ _____ _ By this exercise, I agree (i) to provide such additional documents as you may require pursuant to the terms of the Astreya Partners, Inc. 2016 Equity Incentive Plan, (ii) to provide for the payment by me to you (in the manner designated by you) of your withholding obligation, if any, relating to the exercise of this Option, and (iii) if this exercise relates to an incentive stock option, to notify you in writing within fifteen (15) days after the date of any disposition of any of the shares of Common Stock issued upon exercise of this Option that occurs within two (2) years after the date of grant of this Option or within one (1) year after such shares of Common Stock are issued upon exercise of this Option. I hereby make the following certifications and representations •.vith respect to the number of shares of Common Stock of the Company listed above (the "Shares"), which are being acquired by me for my own account upon exercise of the Option as set foi:th above: I acknowledge that the Shares have not been registered under the Securities Act of 1933, as amended (the "Securities Act"), and are deemed to constitute "restricted securities" under Rule 701 and Rule 144 promulgated under the Securities Act. I warrant and represent to the Company that I have no present intention of distributing or selling said Shares, except as permitted under the Option Agreement (as defined in the Stock Option Grant Notice executed by me), Securities Act and any applicable state securities laws. · I further acknowledge that I will not be able to resell the Shares except as otherwise permitted in the Option Agreement, and for at least ninety days (90) after the stock of the Company becomes publicly traded (i.e., subject to the reporting requirements of Section 13 or 15(d) of the Securities Exchange Act of 1934, as amended) under Rule 701 and that more restrictive conditions apply to affiliates of the Company under Rule 144. DOCS J 22600-000DO 1/2494944.4 DocuSign Envelope ID: EA2A2C3C-C51A-4A66-89D6·1AD70ECF9C3F l further acknowledge that all certificates representing any of the Shares subject to the provisions of the Option shall have endorsed thereon appropriate legends reflecting the foregoing limitations, as well as any legends reflecting restrictions pursuant to the Option Agreement, the Company's Certificate of Incorporation, Bylaws and/or applicable securities laws. I further agree that, if required by the Company (or .a representative of the underwriters) in connection with the first underwritten registration of the.offering of at)y securities of the Company under the Securities Act, I will not sell, dispose of, transfer, make any short sale of, grant any option for the purchase of, or enter into any hedging or similar transaction with the same economic effect as a sale, any shares of Common Stock or other securities of the Company for a period of one hundred eighty (180) days following the effective date of a registration statement of the Company filed under the Securities Act or such longer perfod as necessary to pennit compliance the FINRA Rule ofConduct or Rule 472(t)(4) of the New York Stock Exchange, as amended, or any similar or successor regulatory rules and regulations (the "Lock Up Period"). I further agree to execute and deliver such other agreements as may be reasonably requested by the Company and/or the underwriter(s) that are consistent with the foregoing or that are necessary to give further effect thereto. In order to enforce the foregoing cbvenant, the Company may impose stop-transfer instructions with respect to securities subject to the foregoing restrictions until the end of such Lock Up Period. Very truly yours, DOCS 122600-000001/2494944.4 EXHIBIT F HI I STEVEN PAUL COHN, ESQ. ADVOCACY CENTER FOR EMPLOYMENT LAW 2084 Alameda Way July 12, 2018 VIA U.S. MAIL Department of Human Resources Milestone Technologies, Inc. 3101 Skyway Court Fremont, CA 94539 San Jose, California 95126 (408) 557-0300 Fax: (408) 557-0309 Re: LEGAL HOLD NOTICE Astreya Partners, Inc. v. Natalie Heroux, et al To Whom It May Concern: This office represents Astreya Partners, Inc. with regard to claims it maintains against Natalie Heroux, including for breach of her Confidential & Proprietary Information Agreement with Astreya Partners, Inc., and with respect to misappropriation of Astreya Partners, Inc. 's confidential and proprietary trade secret information. Please be advised that Milestone Technologies, Inc. and its owners, directors, officers, and managing agents are hereby notified to suspend their document and electronic data (including, but not limited to, electronic metadata) destruction practices and to retain and preserve all writings (as that term is defined by California Evidence Code § 250), data, metadata, and electronic devices (including, but not limited to, phones, computers, and hard-drives) maintained by, used by, or in the possession of its employees, including Natalie Heroux. This includes the suspension of any document, video, or data deletion practices of the above-referenced individuals and entities. You are to preserve said data and materials as potential evidence in relation to claims arising from Natalie Heroux's former employment at Astreya Partners, Inc., which may also include claims against Milestone Technologies, Inc. directly. Please be advised that destruction of these materials shall be viewed as spoliation of evidence for which we will pursue sanctions, including the striking of defenses and the entering of a default judgment of any related lawsuit. See Creative, Inc. v. Creative Cotton, Ltd. (1999) 75 Cal App 4th 486; see also California Evidence Code§ 413. Cc: Client Ross A. Spector, Esq., (via email: Ross.Spector@spectorandbennett.com) EXHIBIT G XHIBI July 12, 2018 VIA EMAIL STEVEN PAUL COHN ADVOCACY CENTER FOR EMPLOYMENT LAW 2084 Alameda Way San Jose, California 95126 (408) 557-0300 Fax: (408) 557-0309 Ross A. Spector, Esq. Spector & Bennett, APC Email: Ross.Spector@spectorandbennett.com Re: CEASE & DESIST I DEMAND FOR RETURN OF COMPANY PROPERTY I LEGAL HOLD NOTICE Astreya Partners, Inc. v. Natalie Heroux, et al. Dear Mr. Spector: Our office represents Astreya Partners, Inc., ("Astreya") with respect to the above-referenced matter. This follows our letter Ms. Heroux of May 16, 2018, advising her of the post- employment obligations which she owes to Astreya with respect to all confidential information covered by the Confidential & Proprietary Information Agreement that she signed as a condition of her employment with Astreya. A copy of this letter and its attachments are enclosed for your reference. Ms. Heroux confirmed receipt of same by way of an email to our office on May 23, 2018. We have since learned that, on April 18, 2018, upon learning of the termination of her employment with Astreya, Ms. Heroux intentionally and knowingly accessed and downloaded from her company laptop approximately 2.232 gigabytes of confidential and proprietary documents and information belonging to Astreya, using a personal Google Drive account and external drive. Astreya views this conduct as a clear breach of Ms. Heroux's Confidential & Proprietary Information Agreement, as well as misappropriation of Astreya's trade secrets in violation of California Civil Code § 3426, et seq., exposing Ms. Heroux to both civil and criminal penalties for each unauthorized access. Accordingly, Ms. Heroux is hereby directed to immediately perform the following actions: 1. CEASE AND DESIST all further access, use, and/or transfer of any and all Astreya property currently in her possession, custody, and/or control; 2. Contact our office by telephone no later than 5:00 PM, Friday, July 13, 2018, Ross A. Spector, Esq. July 12, 2018 Page2 with the identification of any and all electronic devices which she has used to transfer, access, or store any Astreya property on or after April 18, 2018, in order to arrange for the immediate production of these devices to our digital forensic analyst as soon as possible. This includes, but is not limited to, any personal or employment-provided laptops, personal computers (PCs), smart phones, CDs, USB drives, and/or external hard drives; and 3. Return to our office any and all other, non-electronic Astreya property currently in her possession, custody, and/or control. Ms. Heroux's failure to timely respond as directed will be viewed as a refusal to cooperate, and Astreya will proceed with litigation to obtain her compliance by Court order. LEGAL HOLD NOTICE Please also be advised that Ms. Heroux is hereby notified to suspend her document and electronic data (including metadata) destruction practices and to retain and preserve all writings (as that term is defined by California Evidence Code§ 250), data, metadata, and electronic devices (including phones, computers, and hard-drives) maintained by, used by, or in the possession of herself or anyone acting on her behalf, as well as her current employer. This includes the suspension of any document, video, and data deletion practices of the above- referenced individuals and entities. Ms. Heroux is to preserve said data and materials as potential evidence in relation to the above- referenced claims. Please be advised that destruction of these materials shall be viewed as spoliation of evidence for which we will pursue sanctions, including the striking of defenses and the entering of a default judgment of any related lawsuit. See Creative, Inc. v. Creative Cotton, Ltd. (1999) 75 Cal App 4th 486; see also California Evidence Code § 413. We require your immediate response. Yours very truly, ~ STEVEN P. COHN, ESQ. Enclosures cc: Client EXHIBIT H HIBI DocuSign Envelope ID: 5DDD634E-7028-4A72-8FFB-D931A8FA636A Aug. 1,2018 [VIA OVERNIGHT COURIER] Natalie Heroux 165 Ramona Road Danville, CA 94526 Re: Repurchase of Astreya Partners, Inc. Common Stock Dear Ms. Heroux: Astreya Partners, Inc. 2099 Gateway Place, Suite 140 SanJose, CA 95110 As you are aware, your employment relationship with Astreya Partners, Inc. (the "Company") terminated effective April 20, 2018 (the "Termination Date"). We subsequently received a correspondence from you dated June 14, 2018 whereby you exercised an option to purchase 6,318 shares of common stock of the Company (the "Exercise Date"). We acknowledged your exercise and processed said request on June 26, 2018 As you acknowledged in your correspondence of June 14, 2018, you had ninety (90) days from the Termination Date, or until July 19, 2018, to exercise your option to purchase your remaining 34,295 vested shares of common stock. As of July 19, 2018, you failed to exercise your option to purchase your remaining vested option shares and, as such, your right to exercise any remaining option shares has expired and you have no further right to said option shares. Further, Section 7 of your Stock Option Agreement (the "Option Agreement") provides that the Company retains a right of repurchase of option shares issued pursuant to an option exercise notice (the "Right of Repurchase"). The Company may exercise its Right of Repurchase within ninety (90) days after the Exercise Date at the "Fair Market Value" of said option share on the date the Company exercises its Right of Repurchase. Per the Option Agreement, "Fair Market Value" shall be as determined in good faith by the Company's Board of Directors. Accordingly, the Company has elected to exercise its Right of Repurchase with respect to all 6,318 of your exercised option shares at the current Fair Market Value of $2.44 per share, as determined by the Board of Directors which, among other things, considered the current 409A valuation report of the Company provided by an independent, third party valuation firm. Therefore, in accordance with the terms of the Option Agreement, the Company has enclosed a check in the amount of $15,415.92 in order to repurchase the 6,318 shares of stock (the "Repurchased Shares") that you previously purchased. With the delivery of the enclosed check, the Company exercises its Right of Repurchase (as DocuSign Envelope ID: 5DDD634E-7028-4A72-8FFB-D931 A8FA636A Astreya Partners, Inc. 2099 Gateway Place, Suite 140 San Jose, CA 95110 defined in the Option Agreement) and repurchases all of the Repurchased Shares. Please contact me if you wish to discuss any of the items listed above. Sincerely, 1€J:i~ed ~lli,r L6986CAO?:\]D5483 ... Edwin Mil er, CEO Astreya Partners, Inc. 8/2/2018 Enclosures: A. Option Agreement B. Check for repurchase price EXHIBIT I HI I | Ross Spector From: Sent: To: Cc: Subject: Dear Mr. Spector, Sean Friday, August 10, 2018 9:20 AM Ross Spector 'Steven' Astreya Partners, Inc. v. Natalie Heroux - 18CV331864 - Notice of 8/13/18 Ex Parte Application for Discovery Order For OSC Re: Preliminary Injunction This confirms a voicemail I left with your office this morning at approximately 9:17 AM. This email is to provide you notice of our intent to appear ex parte on the morning of Monday, August 13, 2018, on Petitioner Astreya Partners, Inc.' s behalf for the above-referenced matter, seeking a discovery order permitting Petitioner to seek specific discovery prior to the preliminary injunction Hearing, which has not yet been set for this matter, and including, but not limited to, requests for production of all electronic storage devices in Ms. Heroux's possession, custody, or control from April 18, 2018 to present, and production of Ms. Heroux's access credentials for all online storage accounts in her possession, custody, or control from April 18, 2018 to present, and deposition ofMs. Heroux. Attorney Steven Cohn and/or myself will be appearing Monday, August 13, 2018 in Santa Clara County Superior Court, located at 191 North First Street, San Jose, CA 95113, at 8:15 AM, or as soon thereafter as it may be heard, in Department 13 or as otherwise assigned by the Calendaring office, to argue this application. Please let us know if you intend to object/oppose this application, or whether we can reach a stipulation to this. I can be reached by this email or by phone or fax, the numbers for which are listed in my email signature, below. Yours very truly, Sean Bothamley Advocacy Center for Employment Law Office: ( 408) 557-0300 Fax: (408) 557-0309 The information contained in this e-mail message is ATTORNEY PRIVILEGED AND CONFIDENTIAL INFORMATION intended for the use of the person or entity named above, only. If the reader of this message is not the intended recipient, or the employee or agent responsible to deliver it to the intended recipient, you are hereby notified that any dissemination, distribution, copying or other unauthorized use of this communication is strictly prohibited. If you have received this communication in error, please immediately contact us by telephone and destroy the original message. 1 EXHIBIT J HI I 1 STEVEN P. COHN, ESQ. SBN 96808 SEAN BOTHAMLEY, ESQ. SBN 300100 2 ADVOCACYCENTERFOREMPLOYMENTLAW 2084 Alameda Way 3 San Jose, CA 95126 Tele_phone (408) 557-0300 4 Facsimile (408) 557-0309 5 Attorneys for Petitioner ASTREYA PARTNERS, INC. 6 7 8 9 SUPERIOR COURT OF THE STATE OF CALIFORNIA COUNTY OF SANTA CLARA 10 11 ASTREYA PARTNERS, INC., a California 12 Corporation, 13 14 15 vs. Petitioner, 16 NAT ALIE HEROUX, an individual, 17 18 Respondent. Case No.: 18CV331864 PETITIONER'S SPECIAL INTERROGATORIES TO RESPONDENT, SET ONE 19 PROPOUNDINGPARTY: 20 RESPONDING PARTY: 21 SET NUMBER: Petitioner ASTREYA PARTNERS, INC. Respondent NATALIE HEROUX ONE 22 23 24 Pursuant to the provisions of California Code of Civil Procedure§§ 2030.010, et seq., 25 Petitioner ASTREYA PARTNERS, INC. ("Petitioner") hereby propounds the following Special 26 Interrogatories to Respondent NAT ALIE HEROUX ("Respondent"). Petitioner requests that 27 Respondent provide written responses to the following special interrogatories in a manner 28 consistent with its obligations under California Code of Civil Procedure§ 2030.010, et seq. Petitioner's Special Interrogatories to Respondent, Set One Case No.18CV331864 Page 1 1 Responses shall be made fully in writing and under oath, and served within thirty (30) 2 days of the date of service of these written discovery requests, by mailing said responses to the 3 Law Offices of Steven P. Cohn, Esq., located at 2084 Alameda Way, San Jose, California 95126. 4 SPECIAL INTERROGATORIES 5 SPECIAL INTERROGATORY NO. 1: 6 IDENTIFY ("IDENTIFY", as used herein, means (1) with respect to an individual, state 7 the person's name, title at the time in question, employer and business address at the time in 8 question, employer and business address at the time in question and dates of employment (if an 9 employee of YOURS), and current or last known employer, business address, and home address; 1 O (2) when used in reference to documents, describe specifically the document, including a 11 description of its type (e.g., letter, memorandum, telegram, chart, etc.) and state its date, author, 12 addressee, title, file identification number or symbol, and state the present location and the name 13 and last-known address of the present custodian of such document. If any such document is no 14 longer in your possession or subject to your control, state what disposition was made of it and the 15 date of such disposition, identifying the person having knowledge of its content; and (3) with 16 respect to a fact, recognize and name) ANY and ALL (as used herein, "ANY" should be 17 understood to include and encompass "ALL," and vice versa, as necessary to bring within the 18 scope of a particular interrogatory any information which might otherwise be construed to be 19 outside its scope) access credentials including, but not limited to, login identities, userna.mes, 20 PIN codes, and passwords, for all ELECTRONIC STORAGE DEVICES ("ELECTRONIC 21 STORAGE DEVICES" means: any device that is capable of electronic storage and/or transfer of 22 DOCUMENTS, including, but not limited to, computers, laptops, tablets, internet-connected 23 cellular phones, USB memory sticks, and external hard and/or solid-state drives) in YOUR 24 ("YOU" and "YOUR", as used herein, mean Respondent NATALIE HEROUX and any of her 25 agents, representatives, or any other person authorized to act on her behalf) possession, custody, 26 or control from April 18, 2018 to present. 27 28 Petitioner's Special Interrogatories to Respondent, Set One CaseNo.18CV331864 Page2 I SPECIAL INTERROGATORY NO. 2: 2 IDENTIFY ANY and ALL access credentials including, but not limited to, login 3 identities, usernames, PIN codes, and passwords, for ANY and ALL online storage accounts 4 including, but not limited to, cloud-based storage accounts such as GoogleDrive, in YOUR 5 possession, custody, or control from April 18, 2018 to present. 6 SPECIAL INTERROGATORY NO. 3: 7 IDENTIFY ANY and ALL PERSONS ("PERSON", as used herein, means natural 8 persons, entities, employees, former employees, clients, agencies, commissions, firms, 9 associations, institutes, organizations, joint ventures, partnerships, businesses, trusts, 10 corporations, public entities, authorities or representatives thereof, or other form(s) of legal 11 entity) who have had possession, custody, or control of the MACBOOK ("MACBOOK", as used 12 herein, means the MacBook Air laptop computer with serial number CIMMRLZRH3QF, which 13 Respondent was provided by Petitioner incident to her employment), from April 1, 2018 to 14 present. 15 SPECIAL INTERROGATORY NO. 4: 16 IDENTIFY ANY and ALL PERSONS to whom YOU gave access credentials for the 17 MACBOOK. 18 SPECIAL INTERROGATORY NO. 5: 19 IDENTIFY ANY and ALL PERSONS who had possession, custody, or control, from 20 April 18, 2018 to present, of any ELECTRONIC STORAGE DEVICES produced in 'response to 21 Plaintiffs Requests for Production of Documents to Respondent, Set One, served herewith. 22 23 24 25 26 27 28 Dated: August 27, 2018 ADVOCACYCENTERFOREMPLOYMENTLAW Petitioner's Special Interrogatories to Respondent, Set One Case No. 18CV331864 Page3 EXHIBIT K HI I 1 STEVEN P. COHN, ESQ. SBN 96808 SEAN BOTHAMLEY, ESQ. SBN 300100 2 ADVOCACY CENTER FOR EMPLOYMENT LAW 2084 Alameda Way 3 San Jose, CA 95126 Tele:phone (408) 557-0300 4 Facsmtlle (408) 557-0309 5 Attorneys for Petitioner ASTREYA PAR1NERS, INC. 6 7 8 9 SUPERIOR COURT OF THE STATE OF CALIFORNIA COUNTY OF SANTA CLARA 10 11 ASTREYA P AR1NERS, INC., a California 12 Corporation, 13 14 15 vs. Petitioner, 16 NATALIE HEROUX, an individual, 17 18 Respondent. Case No.: 18CV331864 , PETITIONER'S REQUESTS FOR PRODUCTION OF DOCUMENTS TO RESPONDENT, SET ONE 19 PROPOUNDING PARTY: 20 RESPONDING PARTY: 21 SET NUMBER: Petitioner ASTREYA P AR1NERS, INC. Respondent NATALIE HEROUX ONE 22 Pursuant to the provisions of California Code of Civil Procedure §§ 2031.010 - 2031.320, 23 Petitioner AS TREY A P AR1NERS, INC. ("'Petitioner") hereby propounds the following 24 Requests for Production of Documents to Respondent NATALIE HEROUX ("Respondent"). 25 Petitioner requests that Respondent identify in writing and produce to Petitioner for inspection 26 and photocopying the tangible things, documents and electronically stored information identified 27 below that are in Respondent's possession, custody or control, in compliance with Code of Civil 28 Procedure section 2031.210, et seq. Petitioner's Requests for Production of Documents to Respondent, Set One Case No. I8CV331864 Page I I Responses must be served and tangible things, documents, and electronically stored 2 information must be produced within thirty (30) days of the service date of this request for 3 production, by mailing or delivering the written responses and responsive items to the Law 4 Offices of Steven P. Cohn, Esq., located at 2084 Alameda Way, San Jose, California 95126. 5 DEFINITIONS AND INSTRUCTIONS 6 As used in these requests for production of documents, the following words have the 7 following meanings. Please refer to these definitions to assure a full and complete response. 8 1. The terms "YOU'', "YOUR'', and "RESPONDENT" mean: Respondent 9 NATALIE HEROUX, and any of her agents, representatives, or any other person authorized to 10 act on her behalf. 11 12 2. 3. The term "PETITIONER" means: Petitioner ASTREYA P AR1NERS, INC. The terms "DOCUMENT" or "DOCUMENTS" mean: all "writings" as that term 13 is defined in California Evidence Code§§ 250, 255 and 260, and include the original or a copy 14 of handwriting, typewriting, printing, photostating, photocopying, and every other means of 15 recording upon any tangible thing, any form of communication or representation, INCLUDING 16 letters, words, pictures, sounds, or symbols, or combinations thereof, INCLUDING without 17 limitation, correspondence, memoranda, notes, diaries, statistics, letters, telegrams, minutes, 18 contracts, reports, studies, checks, statements, receipts, returns, summaries, pamphlets, books, 19 charts, maps, inter-office and intra-office communications, electronic mail (E-mail), notations of 20 any sort of conversation, bulletins, printed matter, computer printouts, teletypes, telefax, 21 worksheets and drafts, alterations, modifications, changes or amendments of any of the 22 foregoing, graphic or aural records or representations of any kind (INCLUDING without 23 limitation, photographs, charts, graphs, microfiche, videotape, recordings, motion pictures) and 24 electronic, mechanical or electric records or representations of any kind (INCLUDING without 25 limitation: tapes, cassettes, mag cards, discs and recordings). 26 4. The term "ELECTRONIC STORAGE DEVICES" means: any device that is 27 capable of electronic storage and/or transfer of DOCUMENTS, including, but not limited to, 28 Petitioner's Requests for Production of Documents to Respondent, Set One Case No. 18CV331864 Page2 1 computers, laptops, tablets, internet-connected cellular phones, USB memory sticks, and extyrnal 2 hard and/or solid-state drives. 3 5. The terms "COMMUNICATION'' or "COMMUNICATIONS" mean; any contact 4 between two or more persons, companies or other entities. COMMUNICATION shall include, 5 without limitation, written contact by such means as letters, memoranda, e-mails, text messages, 6 instant messages, online chats, phone bills and call records, and other electronic 7 COMMUNICATIONS without limitation, INCLUDING blog entries, Facebook, Linkedin, and 8 Twitter postings and the like, telegrams, telex, or by any other DOCUMENTS, and oral contact 9 INCLUDING, without limitation, face-to-face meetings, telephone conversations, audio 10 recordings, or other oral COMMUNICATIONS. 11 6. As used herein, "ANY'' should be understood to include and encompass "ALL," 12 and vice versa, as necessary to bring within the scope of a particular interrogatory any 13 information which might otherwise be construed to be outside its scope. 14 7. Whenever appropriate, the singular form of a word should be interpreted in the 15 plural and vice versa. All words and phrases shall be construed as masculine, feminine, or gender 16 neutral, according to the context. "And" as well as "or" shall be construed either disjunctively or 17 conjunctively as necessary to bring within the scope of this request any information which might 18 otherwise be construed to be outside of the scope. 19 8. In producing DOCUMENTS and things, furnish all DOCUMENTS or things 20 known or available to YOU, regardless of whether such DOCUMENTS or things are possessed 21 directly by YOU or YOUR agents, employees, representatives, investigators or by YOUR 22 attorneys or their agents, employees, representatives or investigators. If a Document has been 23 prepared in several copies, or additional copies have been made and the copies are not identical 24 (or by reason or subsequent modifications, are no longer identical), each non-identical copy is a 25 separate "DOCUMENT." 26 9. If any requested DOCUMENT was, but is no longer in YOUR possession, 27 custody and/or control, or is no longer in existence, YOU must identify the DOCUMENT and 28 state whether: (i) it has been destroyed; (ti) it has been lost, misplaced or stolen; or (iii) it has Petitioner's Requests for Production of Documents to Respondent, Set One Case No. 18CV331864 Page3 1 never been, or is no longer in YOUR possession, custody and/or control, in which case the name 2 and address of any PERSON known <;>r believed to have possession, custody or control of that 3 DOCUMENT or category of DOCUMENTS should be identified. In each such instance, YOU 4 should explain the circumstances surrounding the disposition of the DOCUMENTS and identify 5 all PERSONS who have knowledge of such disposition. 6 10. If any DOCUMENT covered by any discovery request is withheld by reason of a 7 claim of privilege and/or privacy right, a list is to be furnished at the time the DOCUMENTS are 8 due to be produced, identifying any such DOCUMENT for which the privilege and/or privacy 9 right is claimed, together with the follo~g information for such document: 10 11 a. b. The author(s) of the DOCUMENT; The addressee(s), if any, and those PERSONS, if any, specified in the 12 DOCUMENT to receive a copy thereof; 13 14 15 16 17 18 19 20 c. d. e. £ g. h. j. k. All known recipients of the DOCUMENT; The sender of the DOCUMENT; The title of the DOCUMENT; Whether there are, or were indicated, blind copies of that DOCUMENT; The date the DOCUMENT was created; The date on which the DOCUMENT was sent or received; The general subject-matter of the DOCUMENT; and The specific privilege(s) and/or privacy right(s) that YOU contend apply to the 21 DOCUMENT, e.g., attorney-client privilege, attorney work product or other applicable privilege. 22 11. If YOU object to production of any DOCUMENT on any other ground, such 23 objection must be fully and specifically stated, including the grounds therefor. 24 12. Form of production. Unless otherwise agreed upon, the format of production 25 shall be as follows: With the exception of Documents to be produced in native format, 26 Documents shall be produced in image format (e.g., pdf) and named with sequential Bates 27 numbering with each page branded in the lower right-hand corner with sequential Bates 28 numbering. Excel spreadsheets, multimedia files (i.e., audio and video), and other similar files Petitioner's Requests for Production of Documents to Respondent, Set One Case No. 18CV331864 Page4 (e.g., .csv) shall be produced in native file format named with sequential Bates numbering, 2 except where image format is required for purposes of redaction. For all Documents produceJ in 3 native format, a single-paged image (pdf) placeholder with Bates numbers shall be provided. 4 REQUESTS FOR PRODUCTION OF DOCUMENTS 5 REQUEST FOR PRODUCTION NO. 1: 6 ANY and ALL ELECTRONIC STORAGE DEVICES in YOUR possession, custody, or 7 control from April 18, 2018 to present. 8 REQUEST FOR PRODUCTION NO. 2: 9 ANY and ALL DOCUMENTS evidencing COMMUNICATIONS between YOU and 10 any current and/or former Astreya Partners, Inc. employees, including, but not limited to, 11 Linkedln messages, text messages, phone call records, and phone bills, from February 18, 2018 12 to present. 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Dated: August 27, 2018 ADVOCACYCENTERFOREMPLOYMENTLAW B~~ SEAN BOTHAMLEY, ESQ. Attorneys for Petitioner ASTREY AP ARTNERS, INC. Petitioner's Requests for Production of Documents to Respondent, Set One Case No. 18CV331864 Pages EXHIBIT 3 I I 1 DECLARATION OF NATALIE HEROUX - REPLY 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 ROSS A. SPECTOR, ESQ. (CSB #135949) SPECTOR & BENNETT A Professional Corporation 50 California Street, 15th Floor San Francisco, CA 94111 Telephone: (415) 439-5390 Facsimile: (415) 707-2064 ross.spector@spectorandbennett.com Attorneys for Respondent, Natalie Heroux SUPERIOR COURT OF THE STATE OF CALIFORNIA COUNTY OF SANTA CLARA ASTREYA PARTNERS, INC., a California corporation, Petitioner, v. NATALIE HEROUX, an individual, Respondent ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) Case No. 18CV331864 DECLARATION OF NATALIE HEROUX IN SUPPORT OF REPLY TO OPPOSITION TO MOTION FOR PROTECTIVE ORDER AND REQUEST FOR SANCTIONS Date: April 2, 2019 Time: 9:00 a.m. Dept.: 10 Electronically Filed by Superior Court of CA, County of Santa Clara, on 3/26/2019 3:54 PM Reviewed By: A. Floresca Case #18CV331864 Envelope: 2674457 18CV331864 Santa Clara - Civil A. Floresca 2 DECLARATION OF NATALIE HEROUX - REPLY 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 I, Natalie Heroux, am the respondent in the above entitled action. I make the following declaration based on my own knowledge, and, if called upon, I could and would give competent testimony thereto. 1. At all times relevant to these proceedings, and namely April 1, 2018 through and including May 21, 2018, I was not in Clear Lake, California or anywhere within 100 miles of Clear Lake. 2. At all times relevant to these proceedings, and namely April 1, 2018 through and including May 21, 2018, the MacBook Air laptop computer (the “laptop”) which is a subject of the within proceedings was located at my parents’ vacation home in Clear Lake. 3. At all times relevant to these proceedings, and namely April 1, 2018 through and including May 21, 2018, I did not remotely, or by any other means, access or connect to the laptop in any manner whatsoever. 4. As I previously testified to in my October 1, 2018-filed declaration submitted in support of the within motion, I did not use the laptop for Astreya Partners, Inc. (“Astreya” or “API”) business for at least 12 months prior to the time Astreya terminated me on April 18, 2018. 5. My father, Alexander Tetelbaum, used the laptop frequently when he was in residence at the Clear Lake house for personal matters such as tracking his personal investments and downloading photographs. 6. I am informed and believe that my father was at the Clear Lake house every day from April 1, 2018 through and including May 21, 2018. Notwithstanding the foregoing, my father brought the laptop to the Bay Area on May 21, 2018 so that I could return it to Astreya. 7. In her January 2019 declaration Lynell Phillips references a couple of documents at paragraph 35 and paragraph 23, respectively, namely “Terminations-2015-04-xlsx” and “Facebook Edge Roles - Recruiting Tracker.gsheet”. I have no access to and did not download these documents. The documents were not created by me, and thus I could only open them if access was expressly given to me by a request and permission process. I have no recollection as to that ever occurring. In any event, I would not have had access to the “Terminations” document as it concerns human resources issues and in any event predates my hiring at Astreya. I had no access to the Facebook document as I did not work on the Facebook account. 3 DECLARATION OF NATALIE HEROUX - REPLY 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 8. Notwithstanding that I had no credentials to open the Facebook document, Ms. Phillips, at paragraph 11 of her January 2019 declaration, states that the Facebook document was modified on “4/18/18 at 2:14:19 PM”, and talks about a file access at 3:25 PM. At 2:14 pm on April 18, 2018 I was meeting with Jeffrey Reifers at the Google location in Sunnyvale, California, as can be readily verified by the Google visit logs. It is my understanding that there likely is surveillance video of Jeff Reifers and I meeting in a Google cafeteria. At 3:25pm on that same date I was meeting in a Google cafeteria with Edwin Miller (CEO) and Jay Preston (SVP) of Astreya, getting terminated (after which I no longer maintained possession of the Chromebook issued me by Google, and my access credentials to Google Drive were terminated). Video of this meeting is almost certainly available from Google. After Mr. Miller and Mr. Preston terminated me Mr. Miller walked me to my car and confiscated the Chromebook. 9. At paragraph 13 of her January 2019 declaration, Ms. Phillips discussed files that “were created and last written on 4/18/18 between 12:05 PM and 12:09 PM”. During this time I was at Faz Restaurant dining with Bernd Schlotter. 10. Further to my testimony at paragraph 8 herein, at paragraph 14 of her January 2019 declaration Ms. Phillips discusses file access beginning at “1:57 PM and spanning almost two and a half (2.5) hours”. This could not have occurred as I, as mentioned above, was attending the termination meeting with Mr. Miller and Mr. Preston, which commenced at 3pm and concluded with Mr. Miller walking me to my car to confiscate the Chromebook (as I didn’t have it on my person and thus could not have been using it anyway). 11. At paragraph 20 of her January 2019 declaration, Ms. Phillips states that on April 16, 2018 I accessed and forwarded a resume (not identified) from my company email account to a personal email account, nheroux@google.com. I believe that Ms. Phillips is not being truthful. Said google.com account was a work email issued to me by Google, which in my view, given what she does for a living, Ms. Phillips knows because the account is not a gmail.com. I also believe that Astreya knows that the google.com email address was not a personal email account as all Astreya employees working at /on the Google account had such email accounts. As I was an Astreya employee assigned to the Google account it was not uncommon for me to forward emails between the two business accounts for ease of access. On April 16, 2018 I was still an Astreya employee with authorized access and had no knowledge that I was about to be fired. Ms. Phillips alleges that before my termination (in my view it is odd that no specific dates or times are provided 4 DECLARATION OF NATALIE HEROUX - REPLY 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 notwithstanding that they would be known to Ms. Phillips from her alleged investigation) I sent “email transfers” from my Astreya email account to ntlhrx@gmail.com and ntlhrx@yahoo.com. As I am informed and believe that all such emails originated from the Astreya email account they are readily ascertainable, i.e. the emails themselves and any attachments, from Astreya’s server, in my view this is additional evidence of bad faith and yet a further reason why Astreya should not be given access to my most private information. When Ms. Phillips is saying that the resume is “not identified” she is either not telling the truth or for some reason will not look at the resume. Astreya obtaining this information in-house would be faster, easier, less expensive and wholly less intrusive on my privacy. In my view Ms. Phillips / Astreya prefer not to identify the subject of the resume because it illustrates their questionable motives. The resume in question is of Prince Pai, a former Astreya employee that left the company approximately one year before I was fired. At the time I was an employee of Astreya and did not know that I was going to be terminated two days later. He was looking for a new position at Astreya and wanted to know if I could help him. I forwarded the email to my nheroux@google.com business account. I forwarded the resume to my Google business account (for easy distribution to others within Google) to see if a spot could be found for Mr. Pai on one my teams within Google. I do not have access to the nheroux@google.com account as it was a work account related to the Google work I did for Astreya. Astreya should be directing such discovery to Google, not me. There is no scenario under which Astreya does not know this and thus their seeking of this discovery from me is the epitome of bad faith litigation tactics. To further illustrate the complete disregard which Astreya has for the truth and the rule of law, and Ms. Phillips’ lack of honesty and/or competence, I attach as Exhibit A a full and complete set of the subject 2017 emails sent to ntlhrx@yahoo.com from nheroux@astreya.com. The reader of this exhibit will learn that Edwin Miller, CEO of Astreya, agrees that I was “doing a great job” at Astreya and was deserving of compensation higher than my peers, how to make “Yummy Parmesan Meatballs”, and how to treat diarrhea. Attached as Exhibit B is full and complete set of the subject 2018 emails sent from nheroux@astreya.com to ntlhrx@gmail.com. Among the things that can be learned from these emails is that Mr. Miller is aware of my “dedication, work ethic and intelligence”, that I occasionally like to send myself reminders, and that Astreya’s Global Recruiting Leader from 2014 to 2018 doesn’t think much of Anita Nunes, Astreya’s Senior Vice President of Sales (and a former Milestone Technologies employee). I would reiterate that these 5 DECLARATION OF NATALIE HEROUX - REPLY 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 items are readily available to Astreya on it’s own server, and that this entire episode constitutes a ruse to attempt to gain access to my most private, personal information in furtherance of Astreya’s retaliation against me for making a complaint to Astreya’s Human Resources Department two days before I was fired, and to dissuade me from pursuing my claim for sexual harassment, retaliation, defamation, securities fraud, and other matters. A true and correct copy of my claim is attached hereto as Exhibit C. 12. When Astreya received the laptop from me on May 23, 2018 it did not possess my password. I am informed and believe that an administrative password needed to be used to access the laptop and the Google Drive files. I am informed and believe that Jenny Hayes (Astreya’s Senior Human Resources Manager) logged on as me using her administrative privileges. Given that my access to Astreya cloud files was cut off during mid-afternoon on April 18, 2018, the cloud files at issue in Ms. Phillips’ declarations necessarily would need to have been accessed by Astreya at all times thereafter. 13. Astreya goes to great lengths to talk about my “data access” on the afternoon of April 18, 2018 prior to the termination (as well as after the termination, even though I no longer had cloud access to Astreya materials, no longer had the Chromebook, and the laptop was four hours away in Clear Lake). However, April 18, 2018 was an extremely busy day for me, both before and after I was fired, and I in any scenario did not have the time or ability to engage in the conduct I am accused of. Attached hereto as Exhibit D is a true and correct copy of a recitation of my day from 7:00 am until 11:20 pm, complete with witnesses that may be contacted for verification. 14. As to the “Astreya Org.pptx” file identified in paragraph 35 of Ms. Phillips’ January 2019 declaration, Ms. Phillips claims the file was accessed on the laptop on May 4, 2018. However, as noted, I was not in Clear Lake where the laptop was located on May 4, 2018. In fact I was home with my daughter in Danville, California on May 4, 2018. My recollection is that the file at issue was authored by me and is likely an organizational chart focused on what at the time was my Google organization. It is likely a document that Mr. Miller and Mr. Preston would want to see after my termination, but as I recall they likely did not have access/permission to view it. That being said, Ms. Hayes as administrator would have the ability to grant persons such as Mr. Miller and Mr. Preston the required permissions. Notwithstanding the foregoing, regarding the May 4, 2018, 9:24 am time listed in paragraph 35 of Ms. Phillips’ January 2019 declaration, I attended a 90 minute hot yoga class from 9:30am - 11:00 am, arriving somewhere between 10-30 EXHIBIT A All E Mails sent from nheroux@astreya.com in 2017 to ntlhrx@yahoo.com (no e mail found from nherou @a treya com in 2018) Part 1 (emails 1 6, all actual emails included below) from:nheroux@astreya‘com v I_ii Messages j Photos Documents ‘ 0V smv «<4.» i n fi 0»- X 2°17 Fwd: One on one... “W ”W Naialie H 12/23/2017 , FWdi One 0n 0mm a Natalie H ’ nheroux.nz‘astreya.com . E. Dec 28 2017 m 5 m PM---------- Forwarded message --------- From: Edwin“. To; ntlhrx@yahoo.com Nmalie H 12/27/2017 t . ---------- Forwarded message --------- "p From: Edwin Miller call Zurich hotel 7 transporation from airport caH cre... Date: Thu, Dec 28, 201 7 at 4:21 PM Subject: One on one,,, . To: Natalie Heroux Natalie H 12/21/2017 Fwd: our conversation __________ Forwarded message _________ From: Edwmm What time on Tuesday of next week can you have a catch up call? Iwant to dlscuss your comp and the future. Natalie H 12/12/2017 Warm regards, Dublin E walkable trmity col‘ege Gumess tour Raise a glass t." ' Natalie H 11/8/2017 EdWi” Mille’ I , ‘ CEO | Astreya P ease 9”” (C) 703.447.2168 Receipt‘ Monte Vls‘a Hugh Schoolpdf Na‘ahe Her... (s) EdwinAndrewMiller (E) Edwin.Miller@Astreya,com (W) www.astreya.com Nalalie H 11/6/2017 __ Slow cooker - tri lip sandwiches Natalie Heroux \ Google Account | www,astreya,com | ad", W . . A, "m4 A Av, ‘ ,. r A r .U r L ‘ Tm Rmxmkmv I nhnmmrmnumw mm< Emall 1 ---------- Forwarded message --------- From: Edwin Miller Date: Thu, Dec 28, 2017 at 4:21 PM Subject: One on one... To: Natalie Heroux What time on Tuesday of next week can you have a catch up call? | want to discuss your comp and the future. Warm regards, E. Edwin Miller CEO | Astreya (C) 703.447.2168 (S) EdwinAndrewMiller (E) Edwin.Mi||er@Astreya.com (W) www.astreya.com Email 2 ----- Forwarded Message ----- From: Natalie H To: Natalie ; "ntlhrx@yahoo.com" Sent: Wednesday, December 27, 2017, 1:29:55 PM PST Subject: trip call zurich hotel - transporation from airport call credit cards -- access code... travel advisory Natalie Heroux | Google Account | www.astreya.com | Tel. 510-305-8257 | nheroux@astreya.com [ Passion l Adaptabilityl Creativity | Excellence | Living Our Values | Email 3 ---------- Forwarded message --------- From Edwin Miller edwin miller@a treya com Date: Thu, Dec 21, 2017 at 5:31 AM Subject Re our conver ation To: Natalie Heroux Totally agree with all of your tatement You are doing a greatjob Warm regard , E Edwin Miller CEO | A treya (C) 703.447.2168 (S) EdwinAndrewMiIler (E) Edwin.MiIIer@Astreya.Com (W) www a treya com On Dec 21, 2017, at 1:09 AM, Natalie H wrote: Hi Edwin, l want to articulate and add a bit of color to our discussion earlier today around my comp being higher than that of my peers. 1) I manage the largest % of company's business, (40-45%), which also happens to be the most diverse and complex, with dozens of teams and almost 200 clients and 70+ contracts 2) I do the work of 2+ people: - although the board approved hiring a Global NetOps Manager,a- + bonus, | opted not to fill this role and have been managing NetOps. This includes managing recovery / turn-around of a very complex business, which was greatly understaffed and neglected. A business where we have been on the edge of being thrown out. I am also managing a Service Improvement plan - a FT job - in addition to my regularjob, | managed NetOps TCC for 4 months until Ricardo was hired (and I had to personally 'sell him"), and for the next 3 months - managed side by side with him. l am still personally involved in developing, reporting and management of SLOs/KPls and development of monthly and quarterly reviews. As a side note, before Ijoined, none of our programs (except NetCo) had structure and service discipline of regular cadence with clients and readout on metrics/results - something that is now almost uniformly in place - I personally manage NOC (15 globally) and Service Delivery(19+) teams and associated turn-around and growth. We almost lost both of these teams, but are now in full recovery and even modest growth. BTW, the board approved hiring of a NOC Manager,- and hiring of a SD manager (min-). - I personally managed team for 7 months, while also re-negotiating our contract that took us from margin, going from a place where they were about to throw us out, to a point where they waved SLAs/penalties and were willing to sign a multi-year contract and now referring other business to us - i actively help I drive transition to Managed Services for. and re-alignment of our delivery capability to recover margin (sold at.) and improve quality of service / client satisfaction - a very complex project we are in the middle of now - I personally managed g-tech ramp up l transition, successfully launching this new team and already anticipating growth in early 2018. We have also just been named a preferred vendor there So, yes, my comp may be higher, but I am also doing a work of easily 2+ people (while saving the company a min of 500K), personally selling / bringing in new business, and most importantly - delivering growth and results across all of my programs, in a complex turn-around situation with very little support from our prior management in the last 18 months. Thank you for reading through this. Natalie Heroux | Google Account 1 wwwa treya com | Tel. 510-305-8257 | nheroux@astreya.com | Passion | Adaptability| Creativity| Excellence | Living Our Values | Email 4 ----- Forwarded Message ---- From Natalie H nherou @a treya com To: "ntlhrx@yahoo.com" ; Natalie ; Natalie Heroux nherou @a treya com Sent: Tuesday, December 12, 2017, 10:04:41 AM PST Subject Dublin walkable trinity college Guine tour o Raise a glass to Dublin's most famous son, James Joyce, in a pub, or visit theW. o Head to Iflnixngllgae to see the stunning Long Room in ‘he Old Library. It is also home to the medieval, illuminated Book of Kells. o Start at Mminn§guaLe and walk around the city's Georgian district before ending your day in one of the city's stylish restaurants for a taste of new Irish cuisine. httD //wwwfodor com/world/europe/ireland/dublin DUB ignt https://www.fodors.com/world/europe/ireland/dublin/thinqs-to-do/siqhts Jameson or Guiness Tour Trinity College Office This hotel is just in front of 1GC office, or find some other hotel nearby G address, 1 Grand Canal Plaza Dublin 2 Natalie Heroux | Google Account | wwwa treya com | Tel. 510-305-8257 | nheroux@astreya.com | Passion | Adaptabilityl Creativityl Excellence | Living Our Values | Email 5 Forwarded Me age From: Natalie H To: "ntlhrx@yahoo.com" ; "nika_heroux@yahoo.com" Sent: Wednesday, November 8, 2017, 5:28:26 PM PST Subject: please print m Receipt l Monte Vista Hiqh Schoo|.pdf Natalie Heroux | Google Account | www.astreya.com | Tel 510 305 8257 | nheroux@a treya com ] Passion | Adaptabilityl Creativity] Excellence | Living Our Values | Email 6 ----- Forwarded Message ---- From: Natalie H To: "ntlhrx@yahoo.com" Sent: Monday, November 6, 2017, 7:49:44 PM PST Subject: Slow cooker - tri tip sandwiches Seasoning salt * 1 trimmed tri-tip * (7‘5- 2.5 lb) 5 french rolls sliced open 5 table poon mayonnai e u e Ie 1 1/4 cup (5 ounces) shredded cheddar cheese“ (opt. mix with meat) 3/4 cup barbecue sauce Instructions 1. Sprinkle seasoning salt over the entire tri-tip. Cook in the slow cooker on high for 3 to 4 hours or low 6 to 8. The meat is done when you can easily pull it apart with a fork. Use two forks to shred the meat in the slow cooker. 2 Preheat the oven to 400°F Spread mayonnai e overthe in ide ofthe roll and top with the hredded tri-tip and shredded cheese. Bake for five minutes and then turn the broiler on high for1 to 2 minutes. Cook until bread is toasted and cheese bubbly. Do not leave sandwiches unattended under the broiler. They can burn very quickly! 3 Add BBQ auce and enjoy! Recipe Notes *lf you don't have ea oning alt, mix together 2 tea poon each of alt, pepper, and garlic powder Natalie Heroux | Google Account | www.astreya.com | Tel. 510-305-8257 | nheroux@astreya.com | Passion | Adaptabilityl Creativity | Excellence | Living Our Values | Part 2 (emails 7 12) 2°17 Whole pork loin Natalie H 10/4/2017 ‘ w~>mn,w _ »V Fwd:@nsumerHeaItMSpending Account(CHSA... w Name" ‘V‘W r UN «‘w H =1 ‘ ‘ ‘ ‘To ntlhrx@yahoo.com Natahe Heroux \ Goog‘e Accoum \ www.astreyaco... 1. Preheat oven k0 400 degrees, Natalie H 9/5/2017 . . , . . _ 2‘ rub pork wnth olive 0II, salt, pepper, garlic and onion powders on Cancun trlp June . all Sides. Cancun 2018 Summer Trwp \nformanonal Sheet Wh. . . . . 3. place In roasting pan fat Side up. . Natalie“ :1 4‘ |cook at: 400 degrees for 1O mln‘ kf 2 ‘IYummy Parmesan Mea‘bans __ cook dnnewanm a 5. 'orver Ie‘at to 350dde1gergeds and coo or 0 per pound untl 2 lbs ground beef 2 ‘ablespoons chopped garlic 1... m ema emp rea S egrees‘ Natalie H 9/2/2017 fl (fl § '" STUFFED FRENCH BREAD (ground beef) 1 loaf french bread 1 pound \ean ground beef 2 Tabl... o Natalie H 9/2/2017 Chile - 5 ingredients INGREDIENTS 1 \b ground beeforturkey‘ 1 small Natalie H 6/2812 Treating mosquioto bites fi Email 7 Forwarded Me age From: Natalie H To Natalie ntlhr @gmail com ;"nt|hr @yahoo com" ntlhr @yahoo com ; Natalie Herou Sent Wedne day, October4, 2017, 6 03 48 PM PDT Subject: Fwd: Consumer Health & Spending Account (CHSA) Systems Transition from ADP to WageWork Natalie Heroux | Google Account | www.astreya.com | Tel. 510-305-8257 | nheroux@astreya.com | Passion l Adaptabilityl Creativity I Excellence | Living Our Values | ---------- Forwarded message ---------- From: WageWorks Service Notice Date: Wed, Sep 27, 2017 at 2:02 PM Subject: Consumer Health & Spending Account (CHSA) Systems Transition from ADP to WageWorks To: nheroux@astreya.com Dear Participating Employee, WageWorks, Inc. completed its acquisition of ADP, LLC’s Consumer Health and Spending Account (CHSA) business last November. We‘ve successfully transitioned most operations to WageWorks, and we’re now preparing to move the acquired ADP systems onto WageWorks’ infrastructure. The systems migration is scheduled between 9 p.m. ET on Friday, October 6, 2017, and 5 a.m. ET on Monday, October 9, 2017. All systems, including email, websites, automated phone systems (IVRs) and internal service platforms, will be unavailable during the migration window. Please review the information below and plan accordingly to ensure a smooth transition. Email 8 ----- Forwarded Message ---- From: Natalie H To: "ntlhrx@yahoo.com" ; Natalie Sent: Tuesday, September 5, 2017, 1:46:41 PM PDT Subject: Cancun trip June Cancun 2018 Summer Trip nformational Sheet Where Moon Palace Golf and Spa Resort Cancun (Rivera Maya), Mexico Phone # 011-52-998-881-6000 or Toll Free 1-877-883-3696 httgz/lwww.galaceresortscom/ When June 5 - 10, 2018 (5 nights) Cost Cost oftrip per student is $2010 and includes round trip air, ground transfers, 5 nights stay based on double occupancy, all meals, all alcoholic and non-alcoholic drinks, nightly entertainment, wireless internet, 24 hour room service, and non-motorized sports. Each student also receives $750 in resort credit that can be used for swimming with the dolphins on property, outside group excursions that wi|| pick them up and drop them off at the resort’s front lobby, golf and spa treatments. Additional Cost - Tax on $750.00 resort credit if used by your child maximum $150.00 Deposits will be taken starting tonight until we reach capacity. We have 100 spots reserved on United Airlines Deposits cover Room, Airline, and T-shirts for a total of $275 until the 100 seats are taken. Email 9 ----- Forwarded Message ---- From: Natalie H To: "ntlhrx@yahoo.com" Sent: Sunday, September 3, 2017, 10:12:04 AM PDT Subject: Yummy Parmesan Meatballs -- cook dnnevr and freeze extra for next time 2 lb ground beef 2 table poon chopped garlic 1/2 cup grated Parme an chee e 1/2 cup of Raqu Traditional Soaahetti Sauce 1/2 cup Panko Bread Crumb 3 table poon Italian ea oning For topping 1/4 cup Mozzarella Chee e Stable poon of fre h par Iey chopped finely Overto 350 Mi all the ingredient Shape the mixture into ball (~35, put into a baking di h metal) Bake for 10 min Poure ce fatout and bake 10 more (or 12/8) Cool Take e tra meatball and freeze in ziploc bag (4/5 meatball per erving) Add about 2 cup of Raqu Traditional Spaqhetti Sauce into a pan, or killet | u ed a beautiful ca tiron killet Add a many meatball a you need, about 4 5 per per on, to the killet, and then top each meatball with a good prinkle of Parme an chee e, then a few prinkle of mozzarella chee e Sprinkle on your chopped par ley a well Then put back in the oven for another 15 20 minute at350 degree until hotand the chee ei melted http://creativemeinspiredvou.com/mouthwaterinq-parmesan-meatbalIs/ Natalie Heroux | Google Account l www.astreya.com | Tel. 510-305-8257 | nheroux@astreya.com | Passion | Adaptabilityl Creativity | Excellence | Living Our Values | Email 10 ----- Forwarded Message ----- From Natalie H nherou @a treya com To: "ntlhrx@yahoo.com" Sent Saturday, September 2, 2017, 5 50 33 PM PDT Subject: STUFFED FRENCH BREAD (ground beef) 1 loaf french bread 1 pound lean ground beef 2 Tablespoons finely chopped onion 1/2 cup chopped celery 1 teaspoon minced garlic 1 can cream of mu hroom oup 2 Tablespoons milk 2 teaspoons Worcestershire sauce salt and pepper, to taste 1 1/2 cup hredded cheddar chee e 1/2 Tablespoon chopped parsley (optional) 1. Preheat oven t0 350° F. Slice the french bread in half, lengthwise, so you have two equal piece Scoop out the bread in the center of each piece Place bread in a large bowl and tear into small chunks. Set the two halves of french bread onto a large baking sheet. Set aside. 2. Brown the ground beef and onion in a large skillet, over medium-high heat. Drain any grease. Add the celery and garlic to skillet. Cook a few minutes until celery is tender. Next, add oup, milk and Worce ter hire auce Sea on with altand pepper Stir and cook mixture until heated; another 5 minutes or so. 3. Add the beef mixture to the bread in the large bowl. Stir to combine. Pour mixture into the center 0f one half of the french bread. Spread out evenly. Top the mixture with the shredded chee e Top with the other half of bread 4. Bake for 10 to 15 minutes, or until cheese is melted. Remove from oven and let stand 5 minutes before slicing and serving. Enjoy! Natalie Heroux | Google Account | www.astreya.com | Tel. 510-305-8257 | nheroux@astreya.com | Passion | Adaptabilityl Creativity] Excellence | Living Our Values | Email 11 Forwarded Me age From: Natalie H To "ntlhr @yahoo com" ntlhr @yahoo com Sent: Saturday, September 2, 2017, 5:45:58 PM PDT Subject Chile 5ingredient INGREDIENTS: 1 lb. ground beef or turkey* 1 mall white onion, diced 3 (15 oz.) cans diced tomatoes with green chiles 2 (15 oz ) can bean ,drained (black bean , kidney bean ,a combo, orwhatever you like) 2 Tbsp. chili powder (optional topping hredded chee e, chopped green onion , our cream, cilantro, etc) DIRECTIONS 1. In a large stocont, cook ground beef or turkey over medium-high heat until browned, stirring frequently. Using a slotted spoon, transfer the cooked beef or turkey to a separate plate and set aside. Reserve 1 tablespoon of grease in the stockpot, and discard the rest. 2. Add the onion to the stockpot and saute for 4'5 minutes, or until soft. 3. Add remaining ingredients and the cooked beef or turkey to the stockpot, and stir to combine. Bring to a boil, then reduce heat to medium-Iow, cover, and simmer for 1O minutes. 4. Serve immediately garnished with optional toppings if desired. Or, store in a sealed container for up to 3 days. Natalie Heroux | Google Account | www.astreya.com | Tel. 510-305-8257 | nheroux@astreya.com | Passion | Adaptabilityl Creativity] Excellence | Living Our Values | Email 12 ----- Forwarded Message ---- From Natalie H nherou @a treya com To: Natalie ; "ntlhrx@yahoo.com" Sent Wedne day, June 28, 2017, 10 41 45 AM PDT Subject: Treating mosquioto bites Make an oatmeal paste by mixing equal amounts of oatmeal and water in a bowl to create a paste-Iike substance Spoon some paste onto a washcloth and hold it paste-side down 0n t0 irritated skin for about ten minutes. Then rinse the area. baking soda paste that you can use in a similar mannerto oatmeal paste. Mix one tablespoon of baking soda with just enough waterto create a paste Apply it to the bug bite forten minutes before washing away Cold pack (crushed ice) Honey - a small drop on an itchy bite Aloe vera - anti-inflammatory properties, and can help to heal minor wounds or calm infections Dry bar of soap Lime jiuce (or lemon juice) Garlic / onion Aloe vera 1% hydrocortisone cream may help relieve sunburn symptoms like pain, itch, and swelling. OTC pain relievers such as ibuprofen (Advil, Motrin) or nagroxen(Aleve) t0 help relieve sunburn pain and inflammation. 1. pply cool, not cold, milk with a clean cloth to your sunburned skin. The milk wi|| create a protein film that helps ease sunburn discomfort 2. Like milk, yogurt applied to sunburned skin also can be soothing. Apply freshly brewed tea after it has cooled to sunburnt skin using a clean cloth 1. Apply teabags soaked in cold waterto sunburned eyelids to soothe the burn and reduce inflammation ************* Sunburn: cool compress cold shower Natalie Heroux | Google Account | wwwa treya com | Tel. 510-305-8257 | nheroux@astreya.com | Passion | Adaptabilityl Creativity | Excellence | Living Our Values | Part 3 (emails 13 18) 2°17 meds to buy Na1a|ie H Toe::;:1:u:for selfrlrealmem of dlarrhea and azxt,“ E w 'f‘atznaela’lje Hgoux. Nat‘lalwe‘i-leroux, E1 ‘ r mlhrx@yahoo.com. Na‘ahe Natalie H 5/17/2017 32::53232 400 degrees rub pork vmh ohve OH Loperamlde for Self_ treatmel azithromycin t0 add if diarrhc Re: Unfortunate news V My apo‘ogwes.,, \ though NOC ro‘e was m CA (auho. antlceptlc (apply t0 wounds/ 22:33:”; » telephone Nave! appointment. Call 92:??2017 (sun and lip prOteCti0n( IA‘ec, thanks for the qllesuon We have a navel chn. . . arrange adequate medlcal an< Natalie H 5/12/2017 2:::::::;:;ie::::*piiiigi‘nfiwW. Carry a llst 0f contact Inform company, keeping it accessib medical A _ ._4 _ _ _ _ yword=1rom%253Anheroux%254035!reya.com&accoumlds=Wmessages/ALvmijAmFqWVKFogYDEPDqFSM?reason=mvahdfired Email 13 ----- Forwarded Message ---- From: Natalie H To: Natalie Heroux ; Natalie Heroux ; "ntlhrx@yahoo.com" ; Natalie Sent: Tuesday, June 27, 2017, 9:19:46 AM PDT Subject: meds to buy Loperamide for self-treatment of diarrhea and azithromycin to add if diarrhea is severe anticeptic (apply to wounds/bites afterwashing with water) (sun and lip protection( arrange adequate medical and evacuation insurance Carry a list of contact information for hometown medical providers, health insurance carriers, and a medical assistance company, keeping it accessible at all times Prepare a compact medical kit that includes the following: Simple first-aid supplies, such as bandages, auze, gemostatic gauze, antiseptic, antibiotic ointment, butterfly bandages, skin glue, and splinter forceps, a thermometer, antipyretic agents, antifungal creams, cough and cold remedies, antacids, hydrocortisone cream, and blister pads. o Pack a spare pair of eyeglasse. prophylaxis with 200 mg of doxycycline once per week antiseptic ophylaxis with 200 mg of doxycycline once per week Bandades Hats fpr adventure Apply sunscreen first. then 30 min later, insect spray spray evening & night Carry hand SOAP!!!! (diarrea.. water..) ~M- Risk from jellyfeash, corals, sea urchins ..... bring rubber gloves also?? ***Get from Trader Joe‘s Air..protechtion meds (travel days... avoid peole that cough) don't eat seafood Boots & long pants (snake bites) don't go barefoot on beaches frequented by cats & dogs \**Meds and treatment are bad.. For a private ambulance, call Belize Emergency Response Team (BERT) at [+501] 2-23-3292. For a public ambulance, call 911. Natalie Heroux | Google Account | www.astreya.com | Tel. 510-305-8257 | nheroux@astreya.com | Passion | Adaptabilityl Creativity] Excellence | Living Our Values | Email 14 ----- Forwarded Message ---- From Natalie H nherou @a treya com To: "ntlhrx@yahoo.com" Sent Saturday, June 17, 2017, 4 03 35 PM PDT Subject: Whole pork loin Preheat oven to 400 degrees. rub pork with olive oil salt pepper garlic and onion powders on all sides place in roasting pan fat side up. cook at 400 degrees for 1O min lower heat to 350 degrees and cook for 20 per pound until internal temp reads 160 degrees. w4>9>Ne Email 15 Helping former employee who was fired ----- Forwarded Message ----- From: Natalie H To: Basman Yousif Sent: Wednesday, June 14, 2017, 7:48:17 AM PDT Subject: Re: Unfortunate news My apologies... | though NOC role was in CA (although the comp for that is significantly lower than what you are at right now), but | just double Checked and it is in Ireland. |wi|| look at your resume -- please give me until the end of the week. Best Regards, N. Natalie Heroux | Google Account l wwwa treya com | Tel. 510-305-8257 | nheroux@astreya.com | Passion | Adaptability| Creativity | Excellence | Living Our Values | On Tue, Jun 13, 2017 at 9 49 PM, Ba man You if ba man you if@yahoo com wrote Hi Ma'am, Thank you very much for checking with recruiting, your help means a lot to me and | really appreciate it. may | a k where i that NOC po ition ba ed at?, | don't really pay attention on what level it i right now, my main Idea is to keep busy and working till something more fit comes Up. It's definitely an honor for me if you can review my resume and give me feed back within your convenient time (No ru h at all) thatwould be great, ldid attached it here Thank you, On Tuesday, 13 June 2017, 19:32, Natalie H wrote: Hi Good to know on relocation | talked to recruiting today and there i nothing currently open on networking side that would be a fit (there is a NOC role but it is for a veryjunior person). Openings change often a new opportunitie come up | will keep my eye and ear open and reach out ifl ee anything that may work for you. Meanwhile, if you need a recommendation for any other role, | am happy to help. Also, | can review and give you feedback on your re ume if you want to hare it with me Best regards, Natalie Natalie Heroux | Google Account ] www a treya com | Tel. 510-305-8257 | nheroux@ astreya.com | Passion | Adaptability| Great ivity | Excellence | Living Our Values | Email 16 ----- Forwarded Message ----- From Natalie H nherou @a treya com To: Natalie ; "ntlhrx@yahoo.com" Sent Tue day, May 30, 2017, 5 02 21 PM PDT Subject: Apt Belize - telephone travel appointment. Call 925-857-5050 i Alec, thanks for the question. We have a travel clinic that can look at everyone's vaccines to see if there are any travel need Mom can call the Call Center then they wi|| review both of your travel need Sounds like lots of fun. Please set up a telephone travel appointment. Call 925-857-5050 to make the appt Rick Weisser Medical Summary General Information Belize is a developing nation but is in the upper half of the world's economies. Located south of Mexico in Central America, it climate i tropical Travel Immunization Hepatiti A Recommended for all traveler Typhoid fever Recommended for mo ttraveler ,e peciallytho ewith adventurou dietary habit ;tho ewithout consistent access to safe food and water; prolonged stays; travel (especially in rural areas) outside of common touri tpackage and other pre arranged fi ed itinerarie Con iderfor all ri k aver etraveler de iring ma imum pre travel preparation Influenza Risk exists from May through August and from December through January, although off-season transmission can occur. Recommended for: all travelers during transmission season due to demonstrated influenza risk in this group. Travelers not already immunized with the currently available vaccine formulation should be vaccinated. Travelers immunized with the current formulation > 6 months earlier should consider revaccination because immunity may have declined. Consider oseltamivir as standby therapy, especially for those who are at high risk for complications from influenza or inadequately vaccinated. Hepatitis B Recommended for: prolonged stays; frequent short stays in this or other high risk countries; adventure travelers; the possibility of acupuncture, dental work, or tattooing; all health care workers; the possibility of a new sexual partner during the stay; injection drug users; and travelers with high potential to seek medical care in local facilities. Increased awareness is recommended regarding safe sex and body fluid/blood precautions. Yellow fever Requirement (for entry, per WHO): A vaccination certificate is required for travelers 1 year of age and older coming from countries with risk of YF transmission. Note: This applies to airport layovers in these countries. Recommendation (for health protection): not recommended for any traveler unless it is officially required for entry. Measles, mumps, rubella Indicated for those born in 1957 or later (1970 or later in Canada and U.K.; 1966 or later in Australia) without evidence of immunity or of 2 countable doses of live vaccine at any time during their lives. Also indicated for those born before 1970 (in Canada) without evidence of immunity or previous vaccination with 1 countable dose of measles-containing vaccine. No preventive measures are necessary (no evidence of transmission exists): Belmopan, Belize City, Corozal, and all other urban areas not mentioned above; islands that are frequently visited by tourists, including Ambergris Caye. Preventive measures: Evening and nighttime insect precautions are essential in areas with any level of transmission. Chloroquine and other antimalarials (atovaquone-proguanil, doxycycline, and mefloquine) are protective in this country. Drug choice depends on personal factors discussed between the traveler and medical provider. No preventive measure is 100% effective. Immediate medical attention is necessary for fever or influenza-Iike illness within 3 months after travel in a malaria risk area. Include mention of travel history. Natalie Heroux | Google Account l wwwa treya com | Tel. 510-305-8257 | nheroux@astreya.com | Passion | Adaptability| Creativity | Excellence | Living Our Values | Email 17 Forwarded Me age From: Natalie H To Natalie ntlhr @gmail com ;"nt|hr @yahoo com" ntlhr @yahoo com Sent: Friday, May 12, 2017, 8:16:49 PM PDT Subject Travel In urance(BeIize) 596C C1FC Order Confirmation Print Policv Summarv . Your purchase was successful. o Please remember, if you change your mind for any reason before 05/26/2017, we will be delighted to refund your purchase o Disdaimer' Thls document is a summary of coverage. The documentaflon you will receive from the msurance provider replaces and supersedes this document. If you do not receive separaTe confirmation directly from the insurance provider, you may not be covered Please refer to the certificate for full policy details as conditions may apply. Please Check your policy exclusmns and make sure this policy provides adequate coverage. Also, p‘ease refer To The "Money Back Guarantee" benefit below which explains the number of days you have to cancel your policy‘ Email 18 ----- Forwarded Message ---- From: Natalie H To: "ntlhrx@yahoo.com" Sent: Tuesday, May 2, 2017, 8:01 :03 AM PDT Subject: Fwd: Beilze http://www.belizeadventure.ca/ traveI-tips/ http://www.nomadicmatt.com/ traveI-quides/belize-travel- tiDs/ Belize inland adventures usually require camera with extra batteries, binoculars, day pack, water bottle, sun glasses, Iong/short pants and Iong-sleeved shirts, strong hiking boots, and a bathing suit. Insect repellant and sunscreen is also necessary but can be purchased at most, gift shops or supermarkets in the country. FIashIight/headlamp may also be required to explore the numerous caves. This is often provided by the tour operator or resort but can also be bought in any hardware store or supermarket. Early mornings and late evenings may become cool in the mountainous regions, so a simple jacket or sweater should also be packed. Visitors headed for the beach need only bring along their favorite swimsuits. Most dive resorts and dive shops provide visitors with all snorkeling and scuba gear in the cost. Sunscreen, sun-tanning oils, nice straw hats, bug repellant and beach towels are all available at most gift shops inland and offshore. Most important don’t forget to bring your medication and glasses prescription. Take a look at some incredible places that exist in this beautiful country: 5 Incredible Places You Won‘t Believe Exist in Belize! 1) Mayflower Bocawina National Park is located in the Stann Creek District and offers beautiful views of the Maya mountains, waterfalls, walking trails, swimming holes and small Maya sites. About 200 species of birds have been recorded and a vast amount of wildlife spotted in the park such asjaguars, pumas, black howler monkeys, tapirs, pacas, peccaries and anteaters. You may also want to take advantage of the longest zip-Iine course in Belize located in the park. 2) Great Blue Hole is a large underwater sinkhole off the coast of Belize in the middle of the Lighthouse Reef Atoll. Formed some 10,000 years ago when jungle and forest covered what is now water. This almost perfectly circular hole is a world-renowned dive site visited by many who are awed at the spectacular stalagmites and stalactites. On a lucky dive you wi|| spot Reef Sharks, Hammer Heads, Lemon Sharks or even Bull Sharks. “accessible from Northern cayes and atools (Ambergris Caye and Caye Caulker, 3) Chiquibul Cave System is the longest known network of caves in Central America, and includes the largest known cave room in the Western hemisphere. The caves were carved out by the Chiquibul River which originates in the Maya Mountains of Belize, submerges underground and then re-emerges in Guatemala. 4) Ray Alley is located in the Hol Chan Marine Reserve which is amongst the most Qopular diving/snorkeling sites in all of Belize. It may sound a bit scary but the nurse sharks and southern sting rays are pretty harmless as they are already used to people petting and feeding them. You wi|| be amazed by large schools ofjacks, groupers, snappers and barracuda swimming in just a short distance away. 5) Actun Mukhai.. (speling) The ATM cave as it is locally know is on top ofthe list of “Sacred Places of a Lifetime" by National Geographic which lists the top ten caves from exotic destinations around the world. This is one of the most impressive and artefact-rich Maya ceremonial caves ever found. The ATM Cave is home to the famous “Crystal Maiden" the intact skeleton of a young female that, due to a covering of calcium carbonate, sparkles eerily in the lamp light. It is one of Belize’s most impressive adventure experiences. Other: mayan ruins 1-day trip to Guatemala (Tikal) snorkeling, ziplining, kayakin... Barrier reef Frommers' guide: httgzllwwwfrommers. com/destinations/belize/ glanning-a-triQ/regions-in- brief Regions: - Cayes (beaches; bring your own towels; almost no sand - sunbathe on dock; call hotels directly - may get up to 20% discount; some hotels have kitchenettes - check) - Placentia - has best beaches - Toledo area - past Placenta -- have same types of reefs but far less crowded Cayo District (west, moutans) - caves, most impressive mayan ruins; forest, swimming rivers, kayaking (Caracol - largest uncovered Mayan City)... San Ignacio - main town in area has smaller runs Xunadunuch.. Tikal (short trip into Guatemala, over W border from Cayo district) - "wonder of the world" -- most spectacular rion Sugggested 1 week itinerary: 1) Day 1: Arrive & Head to Placencia Arrive into Belize City and grab a quick connecting flight to Placencia. Spend the afternoon strolling along the beach and the town's famous sidewalk. Head back to the sidewalk after dark, and enjoy some time mingling with locals and tourists alike at the Barefoot Beach Bar. 2) Day 2: Way Down upon the Monkey River Take a tour on the Monkey River, where you're sure to see a rich array of wildlife. In the afternoon you can treat yourself to a spa treatment, get some snorkeling in, or try a seaweed shake. For dinner, head to the French Connection. **+1day Take a norkel trip to Laughing Bird Caye and enjoy a picnic lunch on thi tiny little gem of an island. In the afternoon, visit the small Garifuna village of Seine Bight. Day 3: Cayo Calling Fly back to Belize City and pick up a rental car for the drive to the Cayo Di trict Stop at the Belize Zoo or for a cave tubing adventure near Jaguar Paw en route. Settle into one of the hotels in San Ignacio or one ofthe lodge located out on the way to Benque Viejo If there' time, take an afternoon tour to the ruins at Xunantunich. ** +1/2 days Take a 2-day/1-night trip to Tikal. Stay at one of the lodges right at the ruins. Get an early start in order to beat the crowds and because the ruins here are so extensive. Make sure you set aside plenty of time to explore the amazing ruins here, but also schedule some time to enjoy the quaint little island city of Flores. Return to Belize in the afternoon, and head to the Mountain Pine Ridge area, staying either at Blancaneaux Lodge or Five Sisters Lodge. Day 4 Climbing Caana Wake up very early and head to the Mayan ruins at Caracol, stopping at the Rio on Pools and Rio FrI’o Cave on your way back to San Ignacio. Day 5 & 6 Fly to the Caye Head for the cayes. Choose between Caye Caulker, with its intimate funky charm, or Ambergris Caye, with its wide choice of hotels, resorts, and restaurants. A whole range of activities and adventures awaits you here. Be sure to try the snorkel trip to Hol Chan Marine Reserve and Shark-Ray Alley. You can also just chill in the sun and sand. Day 7: Going Home Finish your trip off with some decadent pampering at the Maruba Resort Jungle Spa, before heading home from Belize City. Return to Belize City in time for your international connection. If you have time, stop off at the Belize Tourism Village to do some last minute shopping before you go. .. see frommers for more.. heck out the International Student Travel Confederation (ISTC) (www.istc.org) website for comprehensive travel services information and details on how to get an International Student Identity Card (|S|C), which qualifies students for substantial savings on rail passes, plane tickets, entrance fees, and more. It also provides students with basic health and life insurance and a 24-hour helpline. The card is valid for a maximum of 18 months. You can apply for the card online or in person at STA Travel (tel. 800/781 -4040 in North America; Natalie Heroux | Google Account | www.astreya.com | Tel. 510-305-8257 l nheroux@astreya.com | Passion | Adaptabililyl Creativity | Excellence | Living Our Values | EXHIBIT B All E Mails sent from nheroux@astreya.com in 2018 to nheroux@gmail.com Q from:(nheroux@astreya.com) >< V D v C 3 1-50 oi abom 55 < > Qfl E Hangaul with Natalie l Stan a video call wi‘h Na‘alie Na‘alie. me 2 lnbox Fwd: Renewals @G r r Forwarded message 7777777777 From: Edwm Miller wrote: working on adding details to previous response.. found this.. ---------- Forwarded message --------- From: Natalie H Date: Fri, Nov 3, 2017 at 12:08 PM Subject: Fwd: Renewals @G To: Natalie ---------- Forwarded message ---------- From: Edwin Miller Date: Fri, Nov 3, 2017 at 10:25 AM Subject: Renewals @G To: Natalie Heroux Cc: Greg Colaluca , Anita Nunes Hi there, how are we doing on the action plan to right the ship at G? We have 6 weeks to make a big impact, is there anything Ican do to help? Warm regards, E. Edwin Miller CEO | Astreya (C) 703.447.2168 (S EdwinAndrewMiIler (E Edwin.Mi|Ier@Astreya.com ( W) www.astreyacom vv Email 2 our conver ation ---------- Forwarded message --------- From: Natalie H Date: Thu, Dec 21, 2017 at 6:35 AM Subject: Fwd: our conversation To: Natalie , ntlhrx@yahoo.com ---------- Forwarded message --------- From: Edwin Miller Date: Thu, Dec 21, 2017 at 5:31 AM Subject: Re: our conversation To: Natalie Heroux Warm regards, E. Edwin Miller CEO | Astreya (C) 703.447.2168 (S) EdwinAndrewMiIler (E) Edwin.Mi|Ier@Astreya.com (W) www.astreyacom On Dec 21, 2017, at 1:09 AM, Natalie H wrote: Hi Edwin, Iwant to articulate and add a bit of color to our discussion earlier today around my comp being higher than that of my peers. 1) | manage the largest % of company's business, (40-45%), which also happens to be the most diverse and complex, with dozens ofteams and almost 200 clients and 70+ contracts 2) | do the work of 2+ people: - although the board approved hiring a Global NetOps Manager, a- + bonus, | opted not to fill this role and have been managing NetOps. This includes managing recovery / turn-around of a very complex business, which was greatly understaffed and neglected. A business where we have been on the edge of being thrown out. | am also managing a Service Improvement plan - a FTjob - in addition to my regularjob, | managed NetOps TCC for 4 months until Ricardo was hired (and l had to personally 'sell him"), and for the next 3 months - managed side by side with him. | am still personally involved in developing, reporting and management of SLOs/KPls and development of monthly and quartedy reviews. As a side note, before Ijoined, none of our programs (except NetCo) had structure and service discipline of regular cadence with clients and readout on metrics/results - something that is now almost uniformly in place - I personally manage NOC (15 globally) and Service Delivery (19+) teams and associated turn-around and growth. We almost lost both of these teams, but are now in full recovery and even modest growth. BTW, the board approved hiring of a NOC Manager,- and hiring of a SD manager (min-). - I personally managed team for 7 months, while also re-negotiating our contract that took us from margin, going from a place where they were about to throw us out, to a point where they waved SLAs/penalties and were willing to sign a multi-year contract and now referring other business to us - i actively help I drive transition to Managed Services for. and re-alignment of our delivery capability to recover margin (sold at.) and improve quality of service / client satisfaction - a very complex project we are in the middle of now - I personally managed g-tech ramp up l transition, successfully launching this new team and already anticipating growth in early 2018. We have also just been named a preferred vendor there So, yes, my comp may be higher, but I am also doing a work of easily 2+ people (while saving the company a min of 500K), personally selling / bringing in new business, and most importantly - delivering growth and results across all of my programs, in a complex turn-around situation with very little support from our prior management in the last 18 months. Thank you for reading through this. Natalie Heroux | Google Accountl www.astreya.com | Tel. 51 0-305-8257 | nheroux@astreya.com | Passion | Adaptabilityl Creativity| Excellence | Living Our Values | Email 3 Red Team / SWOT Team ---------- Forwarded message --------- From: Natalie H Date: Mon, Mar 26, 2018 at 8:09 AM Subject: Fwd: Red Team / SWOT Team To: Natalie Natalie Heroux | Google Account | www.astreya.com | Tel. 510-305-8257 | nheroux@astreya.com | Passion | Adaptabilityl Creativity | Excellence | Living Our Values | ---------- Forwarded message ---------- From: Edwin Miller Date: Sat, Mar 24, 2018 at 2:12 PM Subject: Re: Red Team / SWOT Team To: Natalie Heroux Cc: Monica Hushen Warm regards, E. Edwin Miller CEO | Astreya (C) 703.447.2168 (S) EdwinAndrewMiIler (E) Edwin.Mi|Ier@Astreya.com (W) www.astreya.com On Mar 24, 2018, at 3:16 PM, Natalie H wrote: | have a usual line up of client meetings and internal meetings to get the ball moving in the right direction. Can try to get out ofthe client meeting if this has higher urgency, but, we are covered in escalations and really the best thing to do is to continue fixing/improving service so there is less noise. PS. Gave "Scott's replacement" more thought: - wi|| update req | have (Scott's replacement) - we have admin on the team already - | can get Scott to start training her on billing... This wi|| not raise red flags the way Desiree would - wi|| see what Anita comes back with, but if not, lthink Matt (from Brian) or an expert like that would be a good fit for BA team |wi|| also bring in additional clients to the company and cat swap people to it to help our margin if needed. Finally, | expect that with VISA filing fiasco we are dealing with, | have up to 5 people that would quit on their own in 2-4 months. If anything, | need to expedite hiring in India to be in front ofthat ball and keep things from browing up. Finally.. We had HR and recruiting fiasco's with team leaders at TCC getting visibility in how much their peers and new hires are making. |wi|| send a separate e-mail, but we need to discuss if we want to remedy that situation and increase planned raise for a resource in question Finally, | am just back from morning meetings with clients and need to deal with my personal issue. So, H am going to take the rest ofthe weekend off. Regards Natalie Natalie Heroux | Google Account l wwwa treya com | Tel. 510-305-8257 | nheroux@astreya.com | Passion | Adaptabilityl Creativity | Excellence | Living Our Values | On Fri, Mar 23, 2018 at 7:05 PM, Edwin Miller wrote: What do you have on Tue day? Edwin Miller CEO | Astreya edwin miller@a treya com www.astreya.com c 703 447 2168 On Mar 23, 2018, at 9:11 PM, Natalie H wrote: | cannot do it on Tuesday. You can meet without me if Tuesday is a requirement. Natalie Heroux l Google Account | www.astreya.com l Tel 510 305 8257 | nherou @a treya com | Passion | Adaptability | Creativity | Excellence | Living Our Values | Email 4 Confidential ---------- Forwarded message --------- From: Natalie H Date: Mon, Apr 16, 2018 at 12:29 AM Subject: Confidential To: Joanne Lewis , Anne Hajjarian Confidential Hi Joanne / Anne, | need to discuss with you. Who wi|| take the lead on this? Thank you, Natalie Email 5 - Forwarded me age From Natalie ntlhr @gmail com Date Sun, Apr 15, 2018 at 11 25 PM Subject Fwd chedule Nate, Naga, Stephen Alec dentail To Natalie ntlhr @gmail com Forwarded me age From Natalie H nherou @a treya com Date Fri, Apr 13, 2018 at 12 06 PM Subject chedule Nate, Naga, Stephen Alec dentail To Natalie ntlhr @gmail com Natalie Heroux | Google Account | www.astreya.com | Tel. 510-305-8257 | nheroux@astreya.com | Passion l Adaptabilityl Creativity | Excellence | Living Our Values l Email 6 matching donation ? ---------- Forwarded message --------- From: Natalie H Date: Thu, Mar 29, 2018 at 7:46 AM Subject: Fwd: matching donations? To: Natalie Natalie Heroux l Google Account l www.astreya.com | Tel. 510-305-8257 | nheroux@astreya.com | Passion | Adaptability | Creativity | Excellence | Living Our Values | ---------- Forwarded message ---------- From: Natalie H Date: Thu, Mar 29, 2018 at 7:45 AM Subject: Re: matching donations? To: Jim Christenson ihear you... they are detached... ifthat makes sense... ihad to plead for them to not talk about how well we are doing financially the way they did last time when our people are not paid adequately and | have to fight for every penny... thanks for feedback... you know | appreciate it and try to influence them, at least a |itt|e.. sometimes it's an uphill climb.. Natalie Heroux | Google Account | wwwa treya com | Tel. 510-305-8257 | nheroux@astreya.com | Passion | Adaptabilityl Creativity | Excellence | Living Our Values | On Wed, Mar 28, 2018 at 9 36 PM, Jim Chri ten on jchri ten on@a treya com wrote||||gE Just a thought for next All Hands. | think it would be great if Edwin didn'tjust tell us how great the San Jose staff are, but concentrate on the bu ine mo tof hi taff are in and pend time talking aboutAPAC with APAC, EMEA etc The generally feeling after the AII Hands was everything from, what does that mean for me? to Do they even know we work here? Am i getting my healthcare, that | need? Great for an internal Rah Rah with Managers, employees don't think it resounded. Email 7 Jay Pre ton --------- Forwarded message --------- From: Natalie H Date: Mon, Mar26, 2018 at 12:44 PM Subject: Fwd: Jay Preston To: Natalie Natalie Heroux | Google Account | www.astreya.com | Tel. 510-305-8257 | nheroux@astreya.com | Passion | Adaptabilityl Creativity | Excellence | Living Our Values | ---------- Forwarded message ---------- From Edwin Miller edwin miller@a treya com Date: Sat, Mar 24, 2018 at 8:22 AM Subject Jay Pre ton To: Natalie Heroux Edwin Miller CEO | A treya edwin.mi|ler@astreya.com www a treya com c. 703.447.2168 Email 8 Thank you Forwarded me age From NatalieH nherou @a treya com Date Mon, Mar 26, 2018 at 8 08 AM Subject Fwd Thank you To Natalie ntlhr @gmail com Natalie Heroux | Google Account | www.astreya.com | Tel. 510-305-8257 | nheroux@astreya.com | Passion | Adaptabilityl Creativity | Excellence | Living Our Values | ---------- Forwarded message ---------- From Natalie H nherou @a treya com Date: Sat, Mar 24, 2018 at 2:20 PM Subject Fwd Thank you To: Edwin Miller Cc Monica Hu hen mhu hen@a treya com Thought | would forward to you so there is no doubt in your minds we actually work on weekends“ including client meeting when needed Natalie Heroux | Google Account | www.astreya.com | Tel. 510-305-8257 | nheroux@astreya.com | Passion | Adaptabilityl Creativity | Excellence | Living Our Values | ---------- Forwarded message ---------- From: Natalie H Date: Sat, Mar 24, 2018 at 12:08 PM Subject: Thank you To: David Yarnevich Cc: Muhammad Hanif Thank you for giving up your Saturday morning to meet with us.... :-) Here are the main things we wi|| focus on next week while you are covering for Asib internally and with your help: - escalations (bottom up from engineers and tops down: Asib/Bassam "joined at the hip" concept) - escalations tracking - changes to weekly reporting (and ops reporting monthly) - further enhancements on status updates - co-pilot time entry/ reporting - on-going metrics development (internal and Google facing) Thanks again! Natalie Heroux | Google Account | wwwa treya com l Tel. 510-305-8257 | nheroux@astreya.com | Passion | Adaptabilityl Creativity| Excellence | Living Our Values | Email 9 Ed Bailey ---------- Forwarded message --------- From: Natalie H Date: Thu, Mar 22, 2018 at 2:01 PM Subject: Ed Bailey To: Natalie Scorecard preparation Help with kwon issue. What is needed in. Us analytics side Email 10 Update ---------- Forwarded message --------- From: Natalie H Date: Mon, Feb 26, 2018 at 7:46 AM Subject: Fwd: Updates To: Natalie Natalie Heroux | Google Account ] wwwa treya com | Tel. 510-305-8257 | nheroux@astreya.com | Passion | Adaptabilityl Creativity | Excellence | Living Our Values l Forwarded me age From: Jim Christenson Date Sun, Feb 25, 2018 at 7 51 PM Subject: Re: Updates To Natalie H nherou @a treya com Natalie, Thanks, been wondering why he hasn't responded..lo| Smith's Lake Photos On Mon, Feb 26, 2018 at1 17 PM, Natalie H nherou @a treya com wrote forgot to tell you.. Neil is out.. probably since you left for vacation... speaking of vacation. what was the name of the place you went to? Natalie Herou | Google Account | www a treya com | Tel. 510-305-8257 | nheroux@astreya.com | Passion | Adaptability| Creativity] Excellence | Living Our Values 1 Email 11 - From: Natalie H Date: Sun, Feb 25, 2018 at 6:42 PM Subject: Schedule MASSAGEl! Thu or Fri? To: Natalie Natalie Heroux | Google Account | wwwa treya corn | Tel. 510-305-8257 | nheroux@astreya.com | Passion l Adaptability| Creativity| Excellence | Living Our Values | Email 12 New Salarie & Review A treya Partner From: Natalie H Date: Tue, Jan 30, 2018 at 4:37 PM Subject: Fwd: New Salaries & Reviews: Astreya Partners To: Natalie Natalie Heroux | Google Account | www.astreya.com | Tel. 510-305-8257 | nheroux@astreya.com | Passion | Adaptability | Creativityl Excellence | Living Our Values | --------- Forwarded message --------- From: Glassdoor Updates Date: Tue, Jan 30, 2018 at 12:10 PM Subject: New Salaries & Reviews: Astreya Partners To: nheroux@astreya.com glassdoor Upgrade to unlimited access for 12 months Wham or Add_afialam to get unlimited acce for 12 month to million of salaries and reviews. Everything you post is completely anonymous. Salary Updates 404 NewlT Service indu tm alarie Email 13 Small “radosti” ---------- Forwarded message -------- From Natalie H nherou @a treya com Date: Tue, Jan 30, 2018 at 10:07 AM Subject Fwd Small “rado ti" To: Natalie Natalie Heroux | Google Account | www.astreya.com | Tel 510 305 8257 | nheroux@a treya com [ Passion | Adaptability| Creativity | Excellence | Living Our Values | Forwarded me age From Natalie ntlhr @yahoo com Date Tue, Jan 30, 2018 at 9 53 AM Subject Small “rado ti" To Natalie Herou nherou @a treya com )thi i from ourlead recruiter Q Manju Upadhyay It 2+ 7‘ india for all india hiring ’ recruiting reports to anila .1 -fl yeew ‘ ' Sent from my iPhone EXHIBIT C denied might et seq. et seq. et seq. EXHIBIT D 4/18 Timeline - Natalie 7-8 am Conference video call with Google managers (Sebastian and Thomasz, ICE team) 8-9 am Daily conf call for SD team (analytics) 9:15- 10:30 Drive to Google for meetings and take calls en-route (talked to several people) 10-10:30 Scheduled call with TCC consultant. Brian Dubos was supposed to dial me in, but the call didn’t come through in the car - have his message that he tried to dial me in 9:24- 9:30 Scott Zimmer - en route calls/ prep for monthly review with Google at 10:30 am 10:30 - 11:30 Scheduled critical monthly ICE program status meeting (with clients) - Positive email/feedback from Yarnie immediately during/after that meeting - forwarded positive feedback to Jay / other Astreya leaders ~11 - 11:30 Jay texts me at 11:10-11:26 to see if I am coming to HC. Respond that I can come to HC @3, after scheduled meetings. Time incorrectly listed in Jay’s declaration as 1 pm. 12 - ~1:40 Lunch at Faz with Berndt Schlotter. Left Google around 11:40 to drive to lunch; then left Faz ~1:40 to go back to Google to meet Jeff Reifers 2pm ~ - 2:50 Coffee with Jeff Reifers at Google/MP5 (he checked in the lobby as my guest). Google would have record of him signing in as my guest and possibly video as we sat in a cafeteria 2:50 - 3:00 Drive from Google MP5 to TC6 (building names). Waiting ~16 min for Jay/Edwin in the lobby. 3 - 3:30 Termination meeting with Jay/Edwin. Took notes. They walked me to the car to get my Chromebook. ~3:40- 6:15 Talked/texted with numerous people (DB, SZ, JS, MD, R, etc.) - full record available showing non-stop conversations / texts ~ 5-6:15 pm Drove to SJ Hilton to pick up Tom Y for in advance scheduled dinner. Texts to Tom confirming bad traffic and estimated arrival / delays. Also other texts to that effect 6:15-10 pm Drive to Santana Row / dinner with Tom Y. ~10:45 Drive Tom back to Hilton San Jose ~11:20 Drive home EXHIBIT 4 HI I 1 DECLARATION OF ALEXANDER TETELBAUM - REPLY 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 ROSS A. SPECTOR, ESQ. (CSB #135949) SPECTOR & BENNETT A Professional Corporation 50 California Street, 15th Floor San Francisco, CA 94111 Telephone: (415) 439-5390 Facsimile: (415) 707-2064 ross.spector@spectorandbennett.com Attorneys for Respondent, Natalie Heroux SUPERIOR COURT OF THE STATE OF CALIFORNIA COUNTY OF SANTA CLARA ASTREYA PARTNERS, INC., a California corporation, Petitioner, v. NATALIE HEROUX, an individual, Respondent ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) Case No. 18CV331864 DECLARATION OF ALEXANDER TETELBAUM IN SUPPORT OF REPLY TO OPPOSITION TO MOTION FOR PROTECTIVE ORDER AND REQUEST FOR SANCTIONS Date: April 2, 2019 Time: 9:00 a.m. Dept.: 10 Electronically Filed by Superior Court of CA, County of Santa Clara, on 3/26/2019 3:54 PM Reviewed By: A. Floresca Case #18CV331864 Envelope: 2674457 18CV331864 Santa Clara - Civil A. Floresca 1 2 Hft'~tne~m.tneat>ovc~attim. Imtethe~wmg~baed• l myown~aad.ifalled·~IaM!damt~.give,~~~" 5. Fm: m m:enof mte: ~priG'Cto MaJ' 21" 2011 lhwenc~ afMi. &omi 14 mmglle~. 1&.~Jm~abdmeto~.mymt~.to~Pxt!aemJ 15 Jm:.\~j.~t>utaimitat·m,~·~~m:~ 16 • Bb.i to A.sRya 11 6. OnMay20 •. 20.11. m~ etlle bptopbemgfftnmfd m~Iwpied.cm 18 a USBmemmy~~mypenom1 file& After~• ww:e~totheUSBaa~ 19 ~~I~llellesfmmlle~. Attadldlmrdon~Aa~tme:mde 20 lXlllYofthelmoffiBftiatI~:mdda,~ 2t I dtdetmda'pmdtyefpajmymda~ la.tn efthe!tate of~ tat the 22 ~- tmeudcmm:t. 23 ~IU2Pdajof~2019atWu.tQeek;,Caifomia. 24 2) 26 21 EXHIBIT A Memory stick w/ copied Folder MAC_downloads (copy made on 5/20/2018): Files/Folders in Folder MAC_downloads: '-' Removable Disk [E:J EH9 Edit Elew Favorites 100‘s flelp eBack ' L) a pSearch ngders ngdress - m Name File and Fulder Tasks fi3_13_2019_2pm B Make a new Folder fiINVESTfiacademy B Publish this Fuldar tn the fiDMV Web a Share this Fuldar @2017709708 4 System Volume Information 4 ‘Spothght-VIUU Other Places aRM-StUFF fiNartDn a My Computer A ‘Trashes a My Datum“; anachagma-m-m Q My Network Places fiMAC-downloads 4 ‘fseventsd fiMACanx Details fiPrthotos fizmajnx 'Luxury Waterfront Estate.doc @Centurion Air Warrior 2006.d0cx 'Things for sale Craiglist.doc @housejrontiaJPG @huusejrunLhJPG @OnejalmJPG mpelicansiail .JPG @palimnsjjJPG @pellcansjjJPG Jim_Fa\r_share_For_Centurion. .. wCenturion_Trai\er_so|d_to_D. .‘ ECenturionjrai‘erisolditoiD. .‘ aCEntLIriun_Trai\er_hi||§_uF_sal. ‘. @wel\s_fargo_checks.]pg m|akehouse_view_From_|ake.jpg m..." N. M... 4.. < Remuvable Disk (E:) Removable Disk lee System: FAT Size 38 KB 17 KB 20? KB SD KB 7D KE 159 KB 66 KB 4E KE BU KB 14 KB 688 KB 661 KB 785 KE 218 KB 102 KB Type lee Fo‘der lee Fo‘der lee Fo‘der lee Fo‘der lee Fo‘der lee Fu‘der lee Fo‘der lee Fo‘der lee Fo‘der lee Fo‘der lee Fu‘der lee Fo‘der lee Fo‘der lee Fo‘der lee Fo‘der lee Fu‘der Microsoft Ward Doc... MicrosoFt Office Wo‘ .. Microsoft Ward Doc... JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image MicrosoFt Excel Won .. JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image m...___:..‘._..4 n" Date Modified A 21-12-2012 9114 AM 0570472017 11:19 AM 24-04-2017 3:41 PM 20-08-2017 9118 AM 0370972017 10:00 AM 08-09-2017 10:03 AM 17-09-2017 314D AM 17-11-2017 11:12AM 17-11-2017 11:26 AM 2171172017 9:49 AM 16-04-2013 3:33 AM ZU-UE-ZUIS 5133 AM 20-05-2013 6:01 AM 20-05-2018 6101 AM 2270572018 10:35 AM ZD-DE-ZDIQ 10:01 AM 08-04-2018 3116 PM 10-04-20139141 AM 10-04-2018 9144 AM 10704720189151 AM lD-D‘I-ZDIS 9:52 AM IU-U‘l-ZUIS 9152 AM 10-04-2013 9:53 AM lD-D‘I-ZDIS 9:53 AM IU-U‘l-ZUIS 9154 AM 10-04-2013 11:02 AM 11-04-2018 6144 AM 1170472018 6:45 AM 11-04-2013 6:45 AM 11-04-2013 6145 AM 11-04-2013 6:54 AM VIIGO Date Plcl 26703720 26-03-20 16-12-20 16-12-20 17-12-20 17-12-20 A |< F‘ MAC_dawnloads EH6 gdwt ylew ngorwtes 100‘s fle‘p 63.33 ' J a #flj Search %Fnlders Address a E:\MACfinwnlnads Name a Pitture Tasks fiSXB-Cream-w @mashaJJPG f3 View as a slide show @mashaJJpG g Order prints nnlme @Rental Agreement‘dutx fl Pnnt pldures Qtnverjagegamplate‘ppt @natjmsterdaijPG File and Fnlder Tasks @"atfimterdamj‘JPG @natjmsterdamfiJPG a make a new Fade" @natjmsterdaijPG a Puhlwsh this fn‘der tn the @natiamsterdamj‘JPG WEb @natjmsterdaijPG E Share this Folder @natjmsterdamjm @abxfiriverjitenceJPG @wineJackJPG @boatiwheelJPG w Removab‘e Dwsk (E:) @BDmhaV-tahle'JpG @BumbayjablejJPGg My chtures a . JCAPs,dock.JPG a M” cumpum @majicmps fl MY ”BMW" P‘a‘es @Homitu_tube_1 ‘JPG @Hornltoitubej‘JPG @Wakehnard_l_nataheJPG a\akehuuseJiewjrumJake‘ipg MAE-dnwnlflads ahandleidoorimlcrowave‘lpg Fxle Folder @FenderSJ .JPG Date Modified: Sunday, May ZD, @FendeVSJ-JPG 2015. 5:38 AM @ntmmang .JPG @uttumangJPG @beeg ‘JPG @GInhngPG 4 Other Plates Details E YesNojuzz‘esiGamDownlo. .‘ Size 551 KB 5J731 KB 15 KB 151 152 KB gar: KB 793 KB 462 KB s73 KB 122 KB 120 KB 109 KB 21547 KB 141 KB 21457 KB 316w KB 92 KB 103 KB 166 KB 143 KB 157 KB 121 KB 155 KB 102 KB 60 KB 165 KB 107 KB 175 KB 175 KB 163 KB 153 KB IHI Type lee Folder JPEG Image JPEG Image Microsuft Office Wu‘ .. Adobe Acrobat 7.0 MicrnsnFt inerPni. ‘. JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image Date Modwfled 20-05-2018 5:49 AM 02-05-2017 10:34 AM 0270572017 10:35 AM 23-05-2017 1:31 PM ZU-ll-ZUIT 9:10 FM 2071172017 11:05 PM 11-01-2018 9:37 AM 11-01-2018 9:37 AM 1170172018 9:38 AM 11-01-2018 9:38 AM 11-01-2018 9:35 AM 1170172018 9:38 AM 11-01-2018 9:35 AM 1670272018 9:37 AM 04-04-2018 7:04 AM 04-04-2018 7:04 AM 1070472018 8:25 AM 10-04-2018 8:25 AM 1004-2018 8:43 AM 1070472018 8:43 AM 10-04-2018 8:44 AM 1004-2018 8:44 AM 1070472018 8:44 AM 11-04-2018 6:50 AM 11-04-2018 10:55 AM 1170472018 2:12 PM 11-04-2018 2:12 FM 1370472018 11:18 AM 13-04-2018 11:18 AM 13-04-2018 11:19 AM 1370472018 11:19 AM Date Picture Taken |) 27-04-2017 4:35 PM 3070972016 1:27 AM 07-01-2018 6:23 PM 07-01-2015 6:24 PM 0770172018 6:25 PM 06-01-2018 6:58 PM UE-Ul-ZUIB 7:01 PM 0670172018 7:02 PM 04-01-2015 10:03 PM 1670272018 8:31 AM 28-03-2018 8:44 AM 25-03-2015 5:45 AM 0570472018 8:57 AM 05-04-2018 9:00 AM 07-04-2015 3:04 PM 0970472018 8:20 AM 09-04-2018 8:21 AM 09-04-2015 5:22 AM 0970472018 4:51 PM 1170472018 8:50 AM 11-04-2015 5:50 AM 1370472018 8:36 AM 13-04-2018 8:36 AM 13-04-2015 5:37 AM 1370472018 8:37 AM v > F‘ MAC_dawnloads gdwtEH6 63.33 ' J a #flj Search %Fnlders ylew ngorwtes 100‘s fle‘p Address a E:\MACfinwnlnads Name @GIubLzJPG @cellmgilampiglass‘JPG @hnatjtmewheeIJPG @BykefilearlakeJPG @wakeboard-Z-SJPG @5144 .JPG @ski-zJpG @skn-MPG @wakehnardrlrl .JPG @wakebuard-l-ZJPG @wakeboard-l-SJPG @wakehnardrzl .JPG @wakeboard-Z-ZJPG @abxjackjssuejJPG @malLkayaijPG @smalLkayakj‘JPG @smaILkayakJ ‘JPG @tandemfiJPG @tandemiz‘JPG @tandemt ‘JPG @trailar du‘lyJPG @Tmlet Sean ‘JPG @Tmlet saatJPG @AkvalangJPG MAE dnwnlnads @Akvalangl'JPG Fxle Fadar @AkvalangZJPG Date Modified: Sunday, May zn, @Ak‘falanfi-JPG 2015. 5:35 AM @Gas blnwarJPG @655 blowarl .JPG @benchJPG @hancm .JPG 4 a Pitture Tasks f3 View as a slide show g Order prints nnlme 3‘2] Print pictures File and Fnlder Tasks a Make a new Folder a Puhlwsh this fn‘der tn the Web E Share this Folder >>Other Plates w Removab‘e Dwsk(E:) g My chtures a My Computer Q My Network P‘aces >>Details Size 153 KB 136 KB 198 KB 162 KB 130 KB 137 KB 133 KB 171 KB 131 KB 120 KB 113 KB 131 KB 165 KB 65 KB 209 KB ZUB KB 125 KB 189 KB 165 KB 185 KB 142 KB 202 KB 17D KB 132 KB 104 KB 110 KB 123 KB 188 KB 136 KB 156 KB 151 KB nu Type JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image Date Modwfled 13-04-2018 11:19 AM 13-04-2018 11:20 AM 1370472018 11:32 AM 18-04-2018 7:44 PM 24-04-2018 7: 13 FM 2470472018 7:36 PM 24-04-2018 7:36 PM 24-04-2018 7:36 FM 2470472018 7:36 PM 24-04-2018 7:36 PM 24-04-2018 7:36 FM 2470472018 7:36 PM 24-04-2018 7:37 FM 2670472018 8: 14 PM 04-05-2018 9:23 AM 04-05-2018 9:23 AM 0470572018 9:23 AM 04-05-2018 9:25 AM 04-05-2018 9:25 AM 0470572018 9:25 AM 04-05-2018 5:25 PM 07-05-2018 8:41 AM 0770572018 8:41 AM 07-05-2018 9:21 AM 07-05-2018 9:21 AM 0770572018 9:21 AM 07-05-2018 9:21 AM 0770572018 3:37 PM 07-05-2018 3:38 PM UE-US-ZUIB 3:55 FM 0870572018 3:56 PM Date Picture Taken 2 13-04-2018 8:37 AM 11-04-2015 11:25 AM 2870372018 8:45 AM 18-04-20131 ' 24-04-20151 . 24-04-20181 ' 24-04-20151 . 24-04-20181 ' 24-04-20151 . 2470472018 11:05 AM 24-04-2015 11:04 AM 2570472018 1:05 PM 04-05-2018 8:50 AM 04-05-2015 5:50 AM 0470572018 8:51 AM 04-05-2018 8:50 AM 04-05-2015 5:50 AM 0470572018 8:50 AM 04-05-2018 4:07 PM 04-05-2015 12: 18 PM 0470572018 4:06 PM 04-05-2018 4:06 PM 04-05-2015 4:07 PM 0470572018 4:07 PM 04-05-2015 4:07 PM 0770572018 3:29 PM 07-05-2018 3:29 PM UE-US-ZUIB 3:30 PM 0870572018 3:30 PM v > F‘ MAC_dawnloads gdwtEH6 ylew ngorwtes 100‘s fle‘p 63.33 ' J a pfiaarch %Fnlders Address a E:\MACfinwnlnads Name a Pitture Tasks @bfiflthl JPG @benchmpe f3 View as a slide show @mini Daddle'png fl Order prints nnlme EContactsheet-omjpg 3‘2] print pictures @Contactsheet-Uuz Jpg @j CnntactSheetrDD 'pg Q] Contactsheet-om . jpg File and Fnlder Tasks @Contactsheet-UUSJDQ @hnatl .JPG a Make a new Folder @buatzlJpG a Puhhsh this fn‘der tnthe @boatsJPG Web @IMG_0327.JPG @Contactsheet-UUSJDQE Share this Folder @Laddempe @Ladderz‘JPG v Removab‘e Dwsk(E:) @LadderfiJPG g M @Ladderq‘JPGy chtures - @LaddermPG a My Computer _ @Laddersqpc Q My Network P‘aces @Ladders‘JPG @Ladder extensionJPG _ @‘aserl .JPG Data's @‘aserJPG MAE dnwnlnads asa'I'JPG Fxle Fadar @Paddle Harmony‘JPG Date Modified: Sunday, May ZD, @Paddle H‘JFG 2015. 5:35 AM @Kayak paintedJPG @Kayak p.JPG @Kayak pa.JPG @Banth Tabla Saw‘JPG 4 Other Plates I NataheHarnux r Letter Re‘ 4D. .‘ Size 151 KB 136 KB 51 KB 11746 KB 11712 KB 21275 KB 21354 KB 21267 KB 113 KB 129 KB 120 KB 129 KB 21036 KB 74 KB 153 KB 143 KB 135 KB 146 KB 164 KB 164 KB 153 KB 190 KB 164 KB 149 KB 167 KB 146 KB 116 KB 201 KB 195 KB 196 KB 157 KB nu Type JPEG Image JPEG Image PNG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image Adobe Acmhat 7.0 JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image Date Modwfled 08-05-2018 3:56 PM UE-US-ZUIB 3:57 FM 1070572018 8:37 AM 11-05-2018 1:29 PM 11-05-2018 1:29 FM 1170572018 1:29 PM 11-05-2018 1:30 PM 11-05-2018 1:30 FM 1170572018 2:28 PM 11-05-2018 2:28 PM 11-05-2018 2:25 FM 1170572018 2:30 PM 11-05-2018 3: 15 FM 1170572018 4:08 PM 12-05-2018 6:28 AM IZ-US-ZUIB 6:25 AM 1270572018 6:28 AM 12-05-2018 6:28 AM IZ-US-ZUIB 6:29 AM 1270572018 6:29 AM 12-05-2018 6:29 AM IZ-US-ZUIB 9:42 AM 1470572018 8:03 AM 14-05-2018 8:03 AM 14-05-2018 8:03 AM 1470572018 10:11 AM 14-05-2018 10:12 AM 1470572018 10:12 AM 14-05-2018 10:12 AM 14-05-2018 10:15 AM 1470572018 3:32 PM Date Picture Taken 1 08-05-2018 3:30 PM UE-US-ZUIB 3:30 PM 1170572018 8:37 AM 11-05-2018 8:37 AM ll-US-ZUIB 5:44 AM 1170572018 8:37 AM - 11-05-2018 4:36 PM ll-US-ZUIB 4:36 PM 1170572018 4:36 PM 11-05-2018 4:36 PM ll-US-ZUIB 4:39 PM 1170572018 4:41 PM 11-05-2018 4:41 PM IZ-US-ZUIB 9:41 AM 1370572018 3:42 PM 13-05-2018 3:43 PM 13-05-2015 3:48 PM 1470572018 9:57 AM 14-05-2015 9:57 AM 1470572018 9:57 AM 14-05-2018 9:57 AM 14-05-2015 9:58 AM 1470572018 3:02 PM v > F‘ MAC_dawnloads gdwtEH6 63.33 ' J a pfiaarch %Fnlders ylew ngorwtes 100‘s fle‘p Address a E:\MACfinwnlnads Name a pitture Tasks @Banth Tabla Saw‘JPG @Grass MowJPG @Banth table sawl ‘JPG @Misten .JPG @Mustermpe @Mistempc @Hammer‘JPG File and Fnlder Tasks @Ladderlfia‘JPG @Laddermjpc a Make a new Folder @Ladderlfib‘JpG a Puhlwsh this fn‘der tn the @Horsesher‘JPG WEb @hnrseshnel .JPG E Share this Folder @Horseshoe‘JPG @Bnntsq‘JPG @Buutss‘JPG Other Plates @BDDEZ‘JPG v Removab‘e Dwsk(E:) @BDDELJPG @Buuts‘JPGg My chtures a _ JpatloikonoctlJPG a M” cumpum ELetter m N.Hernux 5.15.13de fl My Network P‘aces @IMGJZSDIJPG @IMGJZSU (1)3126 @tircular sanPG @Eircular sawl .JPG @IMGJSIBJPG @circular sawZJPG @Projectorl .JPG @PrnjettnrJPG Ly. Prujectur‘JPG La .icwrcular sawl ‘JPG La twrcular sawZ‘JPG 4 f3 View as a slide show g Order prints nnlme 3‘2] Print pictures >>Details MAE_dnwnlnads lee Folder Date Modified: Sunday, May ZD, 2015, 5:35 AM Size 157 KB 166 KB 151 KB 170 KB IUB KB 153 KB 147 KB ZUB KB ZDD KB 170 KB 194 KB 187 KB 154 KB 144 KB 144 KB 99 KB 121 KB 146 KB 306 KB 244 KB 142 KB 142 KB 154 KB 106 KB 121 KB 113 KB 179 KB 171 KB 4 KB 4 KB 4 KB nu Type JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image Adobe Acmhat 7.0 JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image Date Modwfled 14-05-2018 3:32 PM 14-05-2018 3:32 FM 1470572018 3:32 PM 17-05-2018 8:18 AM 17-05-2018 8:15 AM 1770572018 8:18 AM 17-05-2018 8:19 AM 17-05-2018 8:19 AM 1770572018 8:19 AM 17-05-2018 8:20 AM 17-05-2018 9:56 AM 1770572018 9:56 AM 17-05-2018 9:56 AM 1770572018 10:38 AM 17-05-2018 10:38 AM 17-05-2018 10:35 AM 1770572018 10:38 AM 17-05-2018 10:38 AM 17-05-2018 4:06 FM 1870572018 8:15 AM 18-05-2018 8:46 AM 15-05-2018 8:46 AM 1870572018 8:46 AM 18-05-2018 8:46 AM 15-05-2018 8:46 AM 1870572018 8:46 AM 15-05-2018 9:05 AM 1870572018 9:05 AM 20-05-2018 5:40 AM ZU-US-ZUIB 5:40 AM 2070572018 5:40 AM Date Picture Taken 1 14-05-2018 3:02 PM 14-05-2015 3:03 PM 1470572018 3:02 PM 15-05-2018 8:46 AM 15-05-2015 5:46 AM 1570572018 8:46 AM 15-05-2018 8:48 AM 15-05-2015 9:07 AM 1570572018 9:07 AM 15-05-2018 9:07 AM 17-05-2015 9:53 AM 1770572018 9:53 AM 17-05-2015 9:53 AM 1770572018 10:27 AM 17-05-2018 10:27 AM 17-05-20151 ' 17705720181 . 17-05-2018 10:30 AM ZU-US-ZUIU 11:36 AM 30-04-2018 4:27 PM 3004-2015 4:27 PM 1870572018 8:42 AM 18-05-2018 8:42 AM 15-05-2015 5:42 AM 1870572018 8:42 AM 17-05-2015 4:22 PM 1770572018 4:23 PM I< "'- MAC_dawnloads EH6 gdwt ylew ngorwtes 100‘s fle‘p aflack ' LJ a psaarch %Fnlders Address a E:\MACfinwnlnads Name a pitture Tasks a ._c\r:u|ar saWZ‘JPG LE. IMGJWQJPG f3 View as a slide show @,_pmjecmr1‘jpg g Order prints nnlme a ._c\r:u|ar saw‘JPG LE. IMGJZSU (1).JPG ta. MG_nzsn.JPG " _Latter tu N.Haruux 5.16‘13.“ File and Fnlder Tasks La. BootlePG flj ._Bnnts.JPG a Make a ”9W F0”? Lajatiujunucmm a Puhhsh this fn‘der tn the LE. BootsZJPG WEb flj ._Bnnt53.JPG a Share this Folder a Boots4'JpG la ._Hnrseshna.JPG La ._hursashuel ‘JPG LE .iHorseshDEZJPG v Removab‘e Dwsk(E:) ?'JaddenE‘h-JPG a My Mums J_LaddensJPG . La.iHammer.JPG a M” cumpum flj ._Ladder15a.JPG Q My Network P‘aces a I_M‘5ter‘JPG LE .im‘sterl ‘JPG flj ._M‘ster2JPG La ._Ben:h tab‘e sawl .JPG MAE dnwnlnads a .jench Table SanPG Fxle Fadar a ._Grass MowJPG Date Modified: Sunday, May ZD, @.,Kayak pa‘JPG 2015, 5:35 AM ugljayakpjpg La ._Kayak painted‘JPG LE .jadd‘e H.JPG la _Padd\e HarmnnyJPG 4 5J2] Print pictures Other Plates Details Size 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB nu Type JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image Adobe Acrubat 7.0 JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image Date Modwfled A 20-05-2018 5:40 AM ZU-US-ZUIB 5:40 AM 2070572018 5:40 AM 20-05-2018 5:40 AM ZU-US-ZUIB 5:40 AM 2070572018 5:40 AM 20-05-2018 5:40 AM ZU-US-ZUIB 5:40 AM 2070572018 5:40 AM 20-05-2018 5:40 AM ZU-US-ZUIB 5:40 AM 2070572018 5:40 AM ZU-US-ZUIB 5:40 AM 2070572018 5:40 AM 20-05-2018 5:40 AM ZU-US-ZUIB 5:40 AM 2070572018 5:42 AM 20-05-2018 5:42 AM ZU-US-ZUIB 5:42 AM 2070572018 5:42 AM 20-05-2018 5:42 AM ZU-US-ZUIB 5:42 AM 2070572018 5:42 AM 20-05-2018 5:42 AM ZU-US-ZUIB 5:42 AM 2070572018 5:42 AM ZU-US-ZUIB 5:42 AM 2070572018 5:42 AM 20-05-2018 5:42 AM ZU-US-ZUIB 5:42 AM 2070572018 5:42 AM Date Picture Taken A I< "'- MAC_dawnloads EH6 gdwt ylew ngorwtes 100‘s fle‘p aflack ' LJ a psaarch %Fnlders Address a E:\MACfinwnlnads Name a pitture Tasks a ._Padd\e HarmunyJPG LE. laserl ‘JPG f3 View as a slide show gdager‘jpg g Order prints nnlme a ._sa\|.JPG LE. LadderSJPG flj ._Ladder5.JPG 53 ._Ladder7.JpG LE. Ladder extensmn‘JPG flj ._Ladder4.JPG a Make a new Folder Lal_Ladder6IJpG a Puhhsh this fn‘der tn the LE. Ladderl .JPG WEb flj ._Ladder2.JPG a Share this Folder H la ._Cnntact5heetrflfls.]pg 53 ._buat2.JPG LE .iboatste v Removab‘e Dwsk(E:) aj-JMGEQIJPG a My chtures LEJJWUJPG _ a .7Contact5heet-UUSJDQ a My cumwtgr a ._Cnntact5heetrflfl4.]pgQ MY ”BMW" P‘a‘es 53 ._cUntactsheet-003.Jpg LE .7Contact5heet-UUZJDQ la ._Cnntact5heetrflfll .Jpg La ._m\ni padd‘e‘png MAE_dnwnlnads a 'rbenChZ ‘ JPG Hie Folder u'fl ._bench1 ‘JPG Date Modified: Sunday, May ZD, La-ibSHCh‘JPG 2015. 5:35 AM @._Gas b\nwerl‘JPG La ._Gas b\uwer‘JPG LE .jkva‘angZ‘JPG la _Akva\angEJPG 4 5J2] Print pictures File and Fnlder Tasks Other Plates Details ,NatalleHeroux - Letter Re. Size 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB nu Type JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image Adobe Acrobat 7.0 JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image PNG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image Date Modwfled A 20-05-2018 5:42 AM ZU-US-ZUIB 5:43 AM 2070572018 5:43 AM 20-05-2018 5:43 AM ZU-US-ZUIB 5:43 AM 2070572018 5:43 AM 20-05-2018 5:43 AM ZU-US-ZUIB 5:43 AM 2070572018 5:43 AM 20-05-2018 5:43 AM ZU-US-ZUIB 5:43 AM 2070572018 5:43 AM ZU-US-ZUIB 5:43 AM 2070572018 5:43 AM 20-05-2018 5:43 AM ZU-US-ZUIB 5:43 AM 2070572018 5:43 AM 20-05-2018 5:44 AM ZU-US-ZUIB 5:44 AM 2070572018 5:44 AM 20-05-2018 5:44 AM ZU-US-ZUIB 5:44 AM 2070572018 5:44 AM 20-05-2018 5:44 AM ZU-US-ZUIB 5:44 AM 2070572018 5:44 AM ZU-US-ZUIB 5:44 AM 2070572018 5:44 AM 20-05-2018 5:44 AM ZU-US-ZUIB 5:44 AM 2070572018 5:44 AM Date Picture Taken A I< "'- MAC_dawnloads EH6 gdwt ylew ngorwtes 100‘s fle‘p aflack ' LJ a psaarch %Fnlders Address a E:\MACfinwnlnads Name a Pitture Tasks a 'JkVa‘anga‘JPG LE. Akva‘angl ‘JPG f3 View as a slide show a ,qumang‘jpg g Order prints nnlme a ._Tui|et seat‘JPG LE. Toilet Sean .JPG flj ._tandem_1 .JPG La ._trai|ar dul‘y‘JPG File and Fnlder Tasks La. tandeijPG flj ._tandem_3.JPG a Make a new Folder a I_5ma“_kayak_1 .JPG a Puhlwsh this fn‘der tn the La smalLkay-akiszg WEb g.gmafljaayaijPG a Share this Felder a .ialexibackgssuejJPG la ._wakehnard7272.JPG La ._wakebuard-1 -3.JPG LE .iwakeboard-Z-l .JPG la ._wakehnardrl {.JPG a My p‘ctmes J.JNakebuard 1 1.JPGLBJHGJPG a My Computer a S illijQ My Network P‘aces a SHQIJPG LE.jyke7C\ear\ake.JPG la ._wakehnard7273.JPG La ._buat_stiring_wheel.JPG MAE-dnwnlflads La.icewlmgilampimassJPG Hie Folder u'fl ._GIobe_2.JPs Date Modified: Sunday, May Zn, LaJenderstPG 2015, 5:35 AM [a ._G|Dha_1 .JPG 53 ._uttuman_1 .JPG LE .iottamangJPG la _fenders_1.JPG 4 5J2] Print pictures Other Plates v Removab‘e Dwsk (E:) Details Size 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB nu Type JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image Date Modwfled A 20-05-2018 5:44 AM ZU-US-ZUIB 5:44 AM 2070572018 5:44 AM 20-05-2018 5:44 AM ZU-US-ZUIB 5:44 AM 2070572018 5:45 AM 20-05-2018 5:45 AM ZU-US-ZUIB 5:45 AM 2070572018 5:45 AM 20-05-2018 5:45 AM ZU-US-ZUIB 5:45 AM 2070572018 5:45 AM ZU-US-ZUIB 5:45 AM 2070572018 5:45 AM 20-05-2018 5:45 AM ZU-US-ZUIB 5:45 AM 2070572018 5:45 AM 20-05-2018 5:45 AM ZU-US-ZUIB 5:46 AM 2070572018 5:46 AM 20-05-2018 5:46 AM ZU-US-ZUIB 5:46 AM 2070572018 5:46 AM 20-05-2018 5:46 AM ZU-US-ZUIB 5:46 AM 2070572018 5:46 AM ZU-US-ZUIB 5:46 AM 2070572018 5:46 AM 20-05-2018 5:46 AM ZU-US-ZUIB 5:46 AM 2070572018 5:46 AM Date Picture Taken A I< Memory stick w/ copied Folder 5x8_Cream_30 within MAC_downlods: "'- MAC_dawnloads EH6 gdwt ylew ngorwtes 100‘s fle‘p aflack ' LJ a psaarch %Fnlders Address a E:\MACfinwnlnads Name a Picture Tasks La -_G|UbB_2-JPG La. fendersizdPG f3 View as a slide show @,_G|gha_1ljpg g Order prints nnlme La ._uttuman_1 .JPG La. ottomangJPG a ._fenders_1 .JPG La ._hand\e_duur_micruwava.jpg File and Fnlder Tasks La. HornltoitubejJPG 3‘2] Print pictures a Make a "9"“ War 53._Wakebuard_1_natalia.JPG a Puhlwsh this fn‘der tn the LE. HornltoitubeilJPG WEb BE ._Tu3_shce.JPG a SharethisFolder a CAPS dock‘JPG @._Bnmhay_tah\eJPG La._Bumbay_tab\e_2JPG La.iboatiwhee\‘JPG a._a|ax_drwer_\icanteJPG a My P‘Etures La._nat_amstardam.JPG . a .inatiamsterdaijPG a My cumwtgr |a._wwne_rack.JPG fl MY Newark mates La._nat_amstardam_3.JPG La .inatiamsterdaijPG a ._nat_amstardam_5.JPG La ._nat_amstardam_6.JPG MAE dnwnlflads ifl.icoverjageitemwateppt Fxle Fadar a nat_amsterdam_7.JPG Date Modified: Sunday, May ZD, 2015. 5:35 AM E ._5x8_Cream_3D =fl ._Renta| Agreementducx La .imashail .JPG a ._masha_2.JPG 4 Other Plates v Removab‘e Dwsk (E:) Details a ._|akehnusa_wew_fmm_lake. . ‘. YesNoiPuzzlesiGamDownl. ‘. Size 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB nu Type JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image JPEG Image MicrosDFt PowerPoI. ‘. JPEG Image Adobe Acrobat 7.0 _5><3_CREAM_30 File Microsuft Office Wu‘ .. JPEG Image JPEG Image Date Modwfled A 20-05-2018 5:46 AM ZU-US-ZUIB 5:46 AM 2070572018 5:46 AM 20-05-2018 5:46 AM ZU-US-ZUIB 5:46 AM 2070572018 5:46 AM 20-05-2018 5:46 AM ZU-US-ZUIB 5:46 AM 2070572018 5:46 AM 20-05-2018 5:46 AM ZU-US-ZUIB 5:46 AM 2070572018 5:46 AM ZU-US-ZUIB 5:47 AM 2070572018 5:48 AM 20-05-2018 5:48 AM ZU-US-ZUIB 5:45 AM 2070572018 5:48 AM 20-05-2018 5:48 AM ZU-US-ZUIB 5:45 AM 2070572018 5:48 AM 20-05-2018 5:48 AM ZU-US-ZUIB 5:45 AM 2070572018 5:48 AM 20-05-2018 5:48 AM ZU-US-ZUIB 5:45 AM 2070572018 5:48 AM ZU-US-ZUIB 5:45 AM 2070572018 5:49 AM 20-05-2018 5:49 AM ZU-US-ZUIB 5:49 AM 2070572018 5:49 AM Date Picture Taken A |<| Memory stick w/ copied Folder MAC_alex (copy made on 5/20/2018): 5x8_Cream_30 EH6 gdwt ylew ngorwtes 100‘s fle‘p °Back ' O a psaarch EFnlders Address a E:1MAC_dnwnlnadiifixfijreamfifl Name Size Type Date Modwfled A Date Picture Taken a pitture Tasks ESXBfireamijdf 83 KB Adobe Acrubat 7.0 12-1 1-2016 5: 14 AM @Sxfiicreamjtlpng 236 KB PNG Image 12-11-2016 1:51 FM a \I'Iew as a sllde show 5x3_Cream_3n.pdf 4 KB Adobe Acrobat 7.0 2070572013 5:49 AM fl Order prints nnlme J ._5X8_Cream_30.png 4 KB PNG Image 20-05-2018 5:49 AM fd‘fl Print pictures File and Fnlder Tasks g Make a new Folder a Puhlwsh this fn‘der tn the Web Share this Folder Other Plates fi Mncidownbads a My chtures a My Computer g My Network P‘aces Details 5H8_Eream_3l] lee Folder Date Modified: Sunday, May ZD, 2015, 5:49 AM ml ) Memory stick w/ copied Folder DAC_2018_confirmation_files within MAC_alex: : 7“ MAC_alex EH6 gdwt ylew ngorwtes 100‘s fle‘p aflack ' Q a pfiaarch %Fnlders Address fi E:\MACjIeX Name File and Fulder Tasks A fiDAcgu1a_chfirmatiun_fi\es g Make a new Folder fiRM’ZUHJICtures _ @nasdaqfincx e 5:335" “1'5 fD‘dE' t” the Emcgu1a_chfirmatiun.html Share this Folder J.iDACjEIlBjonflrmatlonhtml g ._DAC_2ma_CnnfirmatinnjiIas ' _nasdau‘dutx Other Plates v Removab‘e Dwsk(E:) D My Documents j My Computer a My Netwnrk P‘aces Details MAE_aIEH lee Folder Date Modified: Sunday, May ZD, 2015, 6:01 AM Size 97 KB 12 KB 4 KB 4 KB 4 KB Type lee Folder lee Folder MicrnsnFt Office Wn‘ .. Chrume HTML Ducu. .‘ Chrome HTML Doc _DAC_2ma_CONFL .. Microsuft Office Wu‘ .. Date Modwfled A 20-05-2018 6:04 AM ZU-US-ZUIB 6:06 AM 1471272017 3:48 PM 22-03-2018 12:17 PM ZU-US-ZUIB 6:04 AM 2070572018 6:04 AM 20-05-2018 6:04 AM Memory stick w/ copied Folder RM_2017_pictures within MAC_alex: F‘ D C_201 8_Confirmation_files EH6 gdwt ylew ngorwtes 100‘s fle‘p aflack ' Q a psaarch %Fnlders Address a E:\MACjIeXlDACjDlfi_CnnFirmatinn_flles File and Fulder Tasks a Make a new Folder a wish this fu‘der tuthe gg‘ubamss a Share this Folder E Loadcss'aSDX ESSDACjagHeader‘png uuary-ldU‘me‘is Other Plate; Emlopenitrackhtml .Png a Mflcfilex ifl. ssonc_RegHeader.png D My Documents . css a My Computer -_555(1) g My Netwnrk P‘aces "ga'lsglnhalfis quary-1‘10.2.min.js k .iLDadcss‘aspx j. m‘npen_tra:k.htm| DAE_ZIJIB_Eunlirmatiun_fill fl .Jnng lee Folder Date Modified: Sunday, May ZD, 2015, 6:04 AM Details Size 2 KB 2 KB 46 KB ID KB 7 KB 21 KB 91 KB 1 KB 3 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB 4 KB Type lee lee JScript Script Fila Cascading Style Sh. ‘. ASPX FI‘e PNG Image JScript Script File Chrome HTML Docu. .‘ lee PNG Image ,CSS FI‘e _CSS(1) lee JScrlpt Script File Castading Style Sh. ‘. JScript Script File ASPX FI‘e Chrome HTML Docu. .‘ _PNG File Date Modwfled A 22-03-2018 12:17 PM 22-03-2018 12:17 FM 2270372018 12:17 PM 22-03-2018 12:17 PM 22-03-2018 12:17 FM 2270372018 12:17 PM 22-03-2018 12:17 PM 22-03-2018 12:17 FM 2270372018 12:17 PM 20-05-2018 6:04 AM ZU-US-ZUIB 6:04 AM 2070572018 6:04 AM ZU-US-ZUIB 6:04 AM 2070572018 6:04 AM 20-05-2018 6:04 AM ZU-US-ZUIB 6:04 AM 2070572018 6:04 AM 20-05-2018 6:04 AM Memory stick w/ copied Folder Misc within Folder RM_2017_pictures: F‘ RM_201 ?_pictures EH6 gdwt ylew ngorwtes 100‘s fle‘p 63.33 ' L) a psaarch %Fnlders Agdress a E:\MAc_aIex1RM_2ntunictures Name Size Type Date Modwfled A Date Picture Taken a pitture Tasks fiMis: lee Folder 20-05-2018 6:06 AMEmma; 11137 KB JPEG Image 01-09-2005 12:00 AM 73 Vlew as a sIIde show Emaajpc 11mg. KB JPEG Image 0170972005 12mm AM g Order prints nnlme EDDSJPG B45 KB JPEG Image 08-09-2017 10:13 AM J2] print pictures @uuMPG 595 KB JPEG Image 05-09-2017 10:13 AM @nnaJPG 721 KB JPEG Image 0370972017 10:14 AM @010.ij 575 KB JPEG Image 08-09-2017 10:15 AM Fug and aner Task; Emma; 550 KB JPEG Image 05-09-2017 10:16 AM Emmc am KB JPEG Image 0370972017 10:15 AM a Make a "9"“ F0”? @013JPG 945 KB JPEG Image 08-09-2017 10:17 AM a Puhhsh this fn‘der tn the Emma; 557 KB JPEG Image 05-09-2017 10:17 AM WEb Emmpc 745 KB JPEG Image 0370972017 10:19 AM a Share this Md” Emma; 934 KB JPEG Image 05-09-2017 10:19 AM Enzmpc 931 KB JPEG Image 0370972017 10:20 AM EUZZJPG B47 KB JPEG Image 08-09-2017 10:21 AM nth" Plates @UZMPG 735 KB JPEG Image 05-09-2017 10:22 AM a MACJIEX EDZSJPG 111m KB JPEG Image 0370972017 10:23 AM a My Mums @026JPG 795 KB JPEG Image 08-09-2017 10:23 AM _ @uzaJPG 925 KB JPEG Image 05-09-2017 10:26 AM a M” cumpum EDZQJPG 11051 KB JPEG Image 0570972017 10:25 AM Q MY Natwwk P‘aces @030.ij L055 KB JPEG Image 08-09-2017 10:27 AM EuazJPG 712 KB JPEG Image 05-09-2017 10:25 AM EThumhsdh 1m KB Data Ease Fi‘e 0870972017 10:48 AM fl .Ds_stura 7 KB Ds_STORE Fi‘e 20-05-2018 6:00 AM Daistore 4 KB DSjTORE Fne 2005-2015 6:06 AM Details RM_2I]11_pittures lee Folder Date Modified: Sunday, May ZD, 2015, 6:06 AM ml ) EH6 gdwt ylew ngorwtes 100‘s fle‘p a °Back ' Q a psaarch EFnlders Address a E:\MACjIeXlRMjD[?JictureslMisc V ‘ Name Size Type Date Modwfled A Date Picture Taken a Pitt.” Tasks EUZUJPG 995 KB JPEG Image 01-09-2005 12:00 AM @UUSJFG BB? KB JPEG Image 05-09-2017 10:13 AM U Vlew as a sIIde show @nnmpc 495 KB JPEG Image 0570972017 10:15 AM g Order prints nnlme @UISJPG 869 KB JPEG Image 08-09-2017 10:18 AM J2] print pictures EmaJPG BID KB JPEG Image 05-09-2017 10:20 AM EDERJPG 725 KB JPEG Image 0870972017 10:25 AM @DBIJPG 963 KB JPEG Image 08-09-2017 10:27 AM File and Fnlder Tagk; E Thumbsdb 6 KB Data Base FI‘e 08-09-2017 10:42 AM a Make a new Folder a Puhlwsh this fn‘der tn the Web Share this Folder Other Plates fi RM72017jwctures a My chtures a My Computer q My Network P‘aces Details Mist lee Folder Date Modified: Sunday, May ZD, 2015, 6:06 AM EXHIBIT 5 I I ROSS SPECTOR, ESQ. (CSB #135949) 1 SPECTOR & BENNETT A Professional Corporation 2 . 50 California Street, 15th Floor San Francisco, CA 94111 3 Telephone: (415) 439-5390 Facsimile: (415) 707-2064 4 ross.spector@spectorandbennett.com. 5 Attorneys for Respondent, Natalie Heroux 6 7 8 9 SUPERIOR COURT OF THE STATE OF CALIFORNIA COUNTY OF SANTA CLARA 10 11 12 ASTREYA PARTNERS, INC., a California corporation, 13 14 15 v. Petitioner~ 16 NAT ALIE HEROUX, an individual,. Respondent ) Case No. 18CV331864 ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) DECLARATION OF DONALD VILFER IN SUPPORT OF RESPONDENT'S MOTION FOR PROTECTIVE ORDER AND REQUEST FORSANCTIONS Date: January 31, 2019 (earliest date available from Court) Time: 9:00 a.m. Dept.: D-13 17 18 19 20 21 22 23 24 25 26 27 28 ~~~~~~~~~~~~~~-) DECLARATION OF DONALD VILFER Electronically Filed by Superior Court of CA, County of Santa Clara, on 10/1/2018 5:17 PM Reviewed By: E. Fang Case #18CV331864 Envelope: 2009843 18CV331864 Santa Clara - Civil E. Fang 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 -1- DECLARATION OF DON VILFER DECLARATION OF DONALD VILFER I, Donald Vilfer, declare as follows: 1. I am the current head of the computer forensics division within the VAND Group, LLC, a computer forensics and litigation support company headquartered in Roseville, California. I am a non-practicing attorney and former Supervisory Special Agent with the Federal Bureau of Investigations, last in charge of the White Collar Crime and Computer Crimes unit in Sacramento, including the Computer Forensics team. I have over 30 years of experience as an investigator and expert and have provided expert testimony in over 100 cases before Federal and state courts, administrative bodies and the International Trade Commission. I am also a lecturer for the University of California Davis Masters in Forensic Science program where I teach a class on Digital Forensics. I regularly provide Continuing Legal Education instruction for attorneys on the topics of Digital Forensics and eDiscovery. 2. I received a J.D. degree from Ohio State University College of Law in 1986 and am a member of the Ohio State Bar (inactive). I received a Bachelor of Science degree from Bowling Green State University in 1982. 3. My training includes four months of training at the FBI Academy; completion of the FBI’s Advanced White Collar Crime courses; completion of a computer crimes course for FBI Supervisors; completion of the FBI Security class; completion of a 50-hour Certified Fraud Examination Course, which covered investigation, computer crime, law, and accounting; and ongoing advanced computer forensics training, and several advanced courses in Computer Forensics. 4. I have earned the certification of Access Certified Examiner, a computer forensics certification issued by AccessData. I have earned the certification as a Certified Fraud Examiner from the Association of Certified Fraud Examiners. 5. I have investigated and provided sworn testimony on dozens of cases involving allegations of theft of trade secrets, for both plaintiffs and defense. I have personal knowledge of 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 -2- DECLARATION OF DON VILFER the facts stated in this Declaration and, if called as a witness, could and would testify competently to those facts. 6. In August of 2018, I was retained by the law firm Spector and Bennett to provide digital forensics services, including forensic examination of a forensic image obtained from a laptop computer previously used by Natalie Heroux during her employment at Astreya Partners. 7. I have reviewed the Declarations of Lynell Phillips (the consultant hired by Plaintiff) submitted in this matter in support of an application for a preliminary injunction and temporary restraining order. I have also done preliminary review of the forensic image acquired by Phillips from the MacBook Air thought to have been used by Heroux while at Astreya Partners. To do this review, I processed the image using forensic tools to facilitate examining the forensic image for evidence. 8. Phillips stated in her declaration that the MacBook Air uses the system.log file to record artifacts associated with the mounting of USB devices. This is not true for this version of the Mac operating system. She went on to detail that she attempted to find evidence of USB use with the computer but there was no system.log record older than May 21, 2018. The Operating System for this MacBook laptop was what Apple calls Sierra. With this operating system, Apple changed features and storage locations for some artifacts related to computer use. With the Sierra operating system, USB usage data is no longer stored in the system.log file, but instead within unified logs to allow for sharing of user activity information between multiple Apple devices. Thus, the fact that Phillips found no system.log files for dates of interest to her review is not relevant. I reviewed the unified logs for this laptop and found no USB record coinciding with the dates Phillips opines copying of Astreya data must have taken place. 9. Files stored on a computer typically contain individual properties reflecting the date on which the file or document was created, modified, and last accessed. This is referred to as the metadata of those files, or data about the data. In addition to user activity, many processes can update create, access and modify times to files on a computer. One cannot assume that an actual user accessed a file because the metadata shows the file was accessed on a particular date. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 -3- DECLARATION OF DON VILFER 10. Plaintiff’s expert has incorrectly concluded that there is no explanation for updated file access times on April 18, 2018 other than “bulk copying by USB or someone synchronizing the MacBook Air’s Google Drive folder with another device…” My analysis has identified many instances of alternative explanations for the file access highlighted by Phillips. File access times can be updated on a computer system by user activity or via automated processes by computer programs that are accessing the files, often in quick succession as seen on this computer. Phillips acknowledged in her declaration that automated processes such as a virus scan could cause file access metadata to be updated, but concluded that there was no evidence such a process was running on April 18, 2018. However, I located records on the drive of automated processes that were likely responsible for updating the file access dates for the Google Drive files on that date. In fact, on April 18, 2018 at 2:24 PM, two Google Drive files related to indexing of files on the Google Drive were updated or modified. This evidences another automated process running related to the Google Drive files to index them for the user dictionary. It is this scanning of the files by Google Drive itself that may have caused the file access metadata to be updated for the Google Drive files. 11. Additionally, I observed that files related to Apple’s Malware Removal Tool (MRT) were created and modified prior to the Google Drive activity on April 18, 2018. Similar to a virus scan, the MRT will access and scan files, updating the access time metadata, as it scans for malware. It is thus possible the MRT program is responsible for the Google Drive file access times being updated. 12. Google Drive files residing on the MacBook Air are most often not the actual files, but only JavaScript Object Notation (JSON) files that reference the location of the actual files or documents in the Google Drive cloud location. When a user opens a file within their Google Drive folder on their laptop, they may not know whether the file is stored locally on their machine or in the cloud-it simply opens on their computer if connected to the internet. Phillips asserts in her declaration that the MacBook Air was not syncing with the Google Drive account and describes that she was unable to get the laptop to sync with the Google Drive cloud location when she had possession of it. Without supporting evidence, she concluded that a user on the computer copied 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 -4- DECLARATION OF DON VILFER the Google Drive files to a USB or another Google Drive account. Accessing and copying all of the files in the Google Drive folder without accessing the cloud would not result in copying all of the actual files themselves, but only the JSON pointers to the cloud files along with whatever files happen to be stored locally on the computer. Phillips states in her declaration that there were 2,012 files “in the Google Drive folder on the MacBook” (Phillips Supporting Declaration of July 24, 2018 para 4(b)). This number is inaccurate. I observe 2,620 files in that same folder and have been unable to determine how Phillips came to her number. Processing the forensic image with multiple tools, including the tool used by Phillips (EnCase) did not result in a number close to that used by Phillips. Of the 2,620 files and folders within the Google Drive folder on this computer, only 872 were files that resided on the MacBook Air-the others were pointers to files in the cloud. It thus makes little sense that a user would attempt to copy files to a USB without connecting to the internet and the Google Drive cloud site first to facilitate copying all of the files. In that Phillips’ own declaration informs us that files on the Google Drive cloud had not been accessed since before April 18, 2018, we know that the files themselves were not all accessed and copied (Phillips Supporting Declaration of July 24, 2018 para 6(b)). Phillips offers no evidence to support her theory that files were copied to a USB drive or another Google Drive account. 13. Absent specific evidence of the attachment of any USB device, Phillips also speculates that perhaps the files were synchronized with another Google Drive account of “unknown identification” (Phillips Supporting Declaration of July 24, 2018 para7). The Apple operating systems use a database called keychain to store login and sometimes password information for accounts accessed on the computer. I searched this file and located one record for a Google Drive account and it was for the account associated with nheroux@astreya.com. I found no evidence of access to another Google Drive account that would have synchronized with the Astreya account. In fact, I located a log of synchronization activity on the MacBook Air and reviewed the activity for April 18, 2018. The log shows that the Google Drive application was actively accessing files and syncing with the cloud on that date-yet another instance of access to 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 -5- DECLARATION OF DON VILFER files by an automated process. The log also documents that the Google Account was nheroux@astreya.com, not another account of “unknown identification.” 14. I also observed that the user of the Google Drive seemed to be actively working on files on the evening of the 17th of April and morning of the 18th. There were several Google Drive files that were modified during this time, meaning that changes were made to them. This work on the files appears to have stopped around 9:13AM until the user returned to working on files around 1:43PM. In that the MacBook Air was actively syncing with the Google Drive cloud account that day as detailed above, it is possible that Ms. Heroux was conducting this work on another device and the account was updating the files on the MacBook Air as part of the sync process. Further to this, it is my information and belief that on April 17 and 18 of 2018, Ms. Heroux was still employed by Astreya and was conducting work on her company issued Chromebook while the Apple MacBook Air was located at the Clearlake California vacation home of her parents. I have been informed the Chromebook is the device she did all of her Astreya related work on for at least the 12 months prior to April 18, 2018. This device would be helpful to examine in tandem with the information I have observed on the MacBook Air to further define the observed Google Drive activity. I have been told this has been requested by counsel but not yet provided. 15. Phillips’ speculation that the computer user must have been engaging in wholesale copying of Google Drive files to a USB or ghost Google Drive account is just not supported by the evidence. As detailed above, the forensic evidence shows what appears to be normal work and access of selected files on the 17th and 18th of April along with routine access to files by automated processes. One of those processes was the synchronization of files between devices. Had there been a wholesale copy effort, Phillips would likely have seen recent access to all of the Google Drive files on the cloud location rather than many files not recently opened as she reports in her declaration. There is also no evidence of copying to USB to support the speculation that such is what caused file access dates to be updated. 16. I reviewed FedEx documentation provided to me in this matter and observed that the MacBook Air was delivered to Astreya on 5/23/2018. I observed on the forensic image that 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 -6- DECLARATION OF DON VILFER access was later made to the laptop in a non-forensic manner. Typically steps are taken to prevent changing evidence once received. This is done by using specialized tools to read the data on the drive without modifying the evidence and to create a forensic image for later review. The improper access by Astreya and/or their expert updated the last accessed dates and times to over 21,000 files on the laptop. One of the files modified was a file that logs Google Drive activity. It is not possible to determine how that file was modified, but the log does show that there were errors connecting to the Google Drive account on June 25, 2018 while in the possession of Astreya. Over 8,000 files were accessed the very day the forensic image was created. 17. I also observed that the file related to logging of Avira antivirus activity was accessed and modified approximately ten minutes before the creation of the forensic image, with only activity for that date being in the log. This sort of mishandling of the evidence can make expert conclusions more difficult or suspect, particularly the conclusion by Phillips that she observed no anti-virus scans for April 18, 2018. 18. I have also reviewed the July 26, 2018 Supplemental Declaration submitted by Phillips in this matter. She stated in this declaration that a person continued to access Google Drive files on the laptop on six additional occasions across three dates. Phillips again speculates that a person must have copied the files to a USB or moved them to a different Google Drive account, but offers no evidence of such. In fact, I observed automated processes that again are likely responsible for the file access. The first additional date she mentions in her declaration is May 4, 2018. I examined activity for that date on the forensic image and found an automatic update operation had been run that day on the computer, which would update metadata about accessed, created and modified files related to the system update. 19. As for the May 19, 2018 access to a spreadsheet reported in the Phillips supplemental declaration, I verified the Terminations-2015-04.xlsx spreadsheet noted by Phillips in her declaration had an update to the file access metadata that day, along with 42 other files, including system files. The spreadsheet was not modified and there was no indication it had been printed or saved on May 19, 2018. The metadata within the spreadsheet showed it was last saved 1 2 3· 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 by Jacquelyn Loran in May of2015 and had not been printed. There is no evidence to explain for certain what caused file access that day for the files, but there was extensive activity involving a TD Ameritrade program. I have been informed that Heroux's father was using the computer at the Clearlake vacation home that day and managing his online portfolio activity. 20. Phillips asserts that there were four "accesses" on May 21, 2018. My review showed that there were Google Drive files accessed that day, along with approximately 13,356 files starting at 3:36 AM. It is not possible to say the access was due to a person using the computer. Multiple automated processes were running on the computer that day that likely accessed thousands of files. To select four files from the over 13,000 files accessed that day and assert the access was performed by a human user without corroborating evidence or artifacts is inappropriate. In fact, there is evidence of automated processes running that likely caused the file access, including the A vira anti- virus program. As noted above, when an anti-virus program scans files on a hard drive, it accesses the files to search for viruses or malware, updating the access times for those files. I also noted that there was again access to online trading websites on May 21, 2018 and have been told Heroux's father was using the computer for such at the Clearlake vacation home. In fact, I was also told he had put a photo of himself with his bike on the computer that day and I located two photos of a man with a bicycle created on the drive on May 21, 2018. 21. My investigation and forensic analysis of the relevant information is ongoing and may uncover additional relevant information. I declare under penalty of perjury under the laws of the State of California that the foregoing is true and correct, and that this declaration was executed on September 28, 2018 in Roseville, California. Donald Vilf~ -7- DECLARATION OF DON VILFER IN SUPPORT OF 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 PROOF OF SERVICE I am a citizen of the United States, and over the age of 18 years. I am not a party to the within above-entitled action; my business address is 50 California Street, 15th Floor, San Francisco, CA 94111. I am readily familiar with Spector & Bennett's practice of collection and processing of correspondence to be deposited for delivery via the US Postal Service, as well as other methods used for delivery of correspondence. On October 1, 2018, in the manner indicated, I caused the within document( s) entitled: DECLARATION OF DONALD VILFER IN SUPPORT OF RESPONDENT'S MOTION FOR PROTECTIVE ORDER AND REQUEST FOR SANCTIONS to be served on the party(ies) or their (its) attorney( s) of record in this action via: (By Mail) Each envelope, with postage fully paid to be placed in the United States mail at 16 San Francisco, California. 17 (By Hand) Each envelope to be delivered by hand to the address( es) listed below. 18 19 20 21 22 23 24 25 26 27 28 (By Email) to: sean@jobslaw.org (By Fax) to Each envelope, with postage fully paid to be sent by FED EX addressed as follows: Sean Bothamley, Esq. Advocacy Center for Employment Law 2084 Alameda Way San Jose, CA 95126 I declare under penalty of perjury that the foregoin declaration was executed on October 1, 2018. EXHIBIT 6 HI I 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 -1- DECLARATION OF DON VILFER - REPLY ROSS SPECTOR, ESQ. (CSB #135949) SPECTOR & BENNETT A Professional Corporation 50 California Street, 15th Floor San Francisco, CA 94111 Telephone: (415) 439-5390 Facsimile: (415) 707-2064 ross.spector@spectorandbennett.com Attorneys for Respondent, Natalie Heroux SUPERIOR COURT OF THE STATE OF CALIFORNIA COUNTY OF SANTA CLARA ASTREYA PARTNERS, INC., a California corporation, Petitioner, v. NATALIE HEROUX, an individual, Respondent ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) Case No. 18CV331864 DECLARATION OF DONALD VILFER IN SUPPORT OF REPLY TO OPPOSITION OF RESPONDENT’S MOTION FOR PROTECTIVE ORDER AND REQUEST FOR SANCTIONS Date: April 2, 2019 Time: 9:00 a.m. Dept.: 10 Electronically Filed by Superior Court of CA, County of Santa Clara, on 3/26/2019 3:54 PM Reviewed By: A. Floresca Case #18CV331864 Envelope: 2674457 18CV331864 Santa Clara - Civil A. Floresca 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 -2- DECLARATION OF DON VILFER - REPLY I, Donald Vilfer, declare as follows: 1. I am one of the owners at Vilfer & Associates, Inc., dba Digital Evidence Ventures, a computer forensics and litigation support company headquartered in Roseville, California. I am a non-practicing attorney and former Supervisory Special Agent with the Federal Bureau of Investigations, last in charge of the White Collar Crime and Computer Crimes unit, including the Computer Forensics team. I have over 30 years of experience as an investigator and expert and have provided expert testimony in over 100 cases before Federal and state courts, administrative bodies and the International Trade Commission. I have personal knowledge of the facts stated in this Declaration and, if called as a witness, could and would testify competently to those facts. 2. In August of 2018, I was retained by the law firm Spector and Bennett to provide digital forensics services, including forensic examination of a forensic image from a laptop computer previously used by Natalie Heroux during her employment at Astreya Partners. 3. I have reviewed the Declarations of Lynell Phillips (the consultant hired by Plaintiff) submitted in this matter in support of an application for a preliminary injunction and temporary restraining order. I have also done preliminary review of the forensic image acquired by Phillips from the MacBook Air thought to have been used by Heroux while at Astreya Partners. To do this review, I processed the image using forensic tools to facilitate examining the forensic image for evidence. 4. Phillips stated in her most recent declaration that the unified logs I spoke of in my previous declaration had an entry of ““2 USB Descriptions Managed” on 5/20/18 at 8:45:17” (Phillips declaration of January 17, 2018 (presumably meant to be 2019) para 8). Phillips offers no information as to what types of USB devices this references, whether a mouse and keyboard or hard drives. 5. Phillips went on to say in her declaration that in the unified logs 16 Kernel processes were generated which recorded the use of USBMC devices between 5/20/2018 at 14:29 and 5/2/2018 at 19:44 (Phillips declaration para 9). Again, there is no information as to specifically what these devices were or what processes were involved. Nowhere in her original declaration or 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 her supplemental declaration did she allege any copying 0f Astreya data had occurred 0n either May 20th 0r May 215‘. In fact, I have reviewed the declaration 0f Alexander Tetelbaum, father 0f Natalie Heroux, wherein he stated he attached a USB device 0n 5/20/2018 t0 copy personal files. Neither Phillips nor myself have found evidence of copying 0f Astreya documents 0n that date. 6. In her most recent declaration, Phillips agrees with my assertion that Malware Removal Tool (MRT) files were created and modified prior to Google Drive activity she observed on April 18, 2018 (Phillips declaration para 14). Yet she goes on to speculate that had the MRT been responsible for the file access, the files would have been accessed in a more systematic way. When Virus scans and malware removal tools are in use, not every file is accessed at once. Each tool seems to follow its own pattern that is likely only understood by the developers 0f the tool. That being said, on April 18, 2018 over 2300 files and folders had their access time updated in very rapid succession which is what would occur with the MRT process. While this included many files from the Google Drive, it also included system files and databases, including 36 files related to the MRT. In fact, a review 0f these files revealed they were created that date as well and contain new definition information 0r updates. This was likely due t0 a security update that was installed that date as documented in a system file 0n the computer. It was following the creation 0f these Malware T001 files that access to the other files occurred, making it highly likely this was the cause 0f the access t0 the over 2000 files and folders. That is, the system downloaded a security update and ran a scan updating access to over 2000 files. There is no evidence these files were copied onto another device and a user would have n0 reason to access 0r copy the included system files. 7. Phillips reasserts in her most recent declaration that nheroux§a>astreya.com had not “directly accessed the Google Drive since 4/13/18” (Phillips declaration para 24). She goes on to report that the files modified on the Heroux laptop were actually “a result of the synchronization 0f thirteen files shared by others With the nheroux@astreya.com Google Drive account. Phillips is now saying the changes t0 these files were the result of the actions of others that then synchronized With this device. This highlights the complexity of cloud storage and the risk involved with attributing access t0 Google Drive files on a laptop to exfiltrating the files. While I do not have -3- DECLARATION OF DON VILFER - REPLY 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 access to the Google Drive account referenced by Phillips, the laptop examined shows modification to the Google Drive files for selected work documents and a synchronization with the cloud storage. If Phillips is saying this was due t0 the work 0f others, what is t0 say other file access was not similarly caused? 8. Phillips states in her most recent declaration that wholesale download 0f files would be very time consuming, which is Why there is n0 evidence of this having occurred on the Astreya computer (Phillips declaration para 26 and 27). Phillips suggests that some files were not accessed because it would take too long t0 copy everything. Phillips offers that she used a forensic tool called Paraben E3 t0 attempt to download the nheroux@astreya.com Google Drive files and that 100 files had taken over four hours to preserve. I am familiar with the Paraben E3 tool and have received training in Paraben tools and served as an instructor for their annual conference. Using a forensic tool t0 preserve the files during download is much different and much slower than a simple download that any user can perform. The tool will analyze each file during the download and run an algorithm against the contents 0f the file t0 produce what is called a hash value for that file. The hash value is commonly referred t0 as a digital fingerprint. The tool will then run the same algorithm against the downloaded file and confirm that the values match, proving the downloaded file is a bit-for-bit copy 0f the one stored in the cloud. This process requires a significant cost 0f time during the download far beyond the time required to simply download the files. In fact, I uploaded 199 client files and 22 folders to Google Drive as a test, loosely replicating the sorts of files in the Astreya Google Drive in the form of Word documents, spreadsheets and pdfs. I then tested the download speed for those files. The files and folders downloaded in two minutes and two seconds. By Phillips’ calculations, this should have taken about eight hours. I stand by my earlier assertion in my previous declaration that had there been a Wholesale copy effort, Phillips would have seen access t0 all or most files on the Google Drive cloud location (to Which I d0 not have access and must rely on Phillips’ observations that only some files were accessed). The argument that it would have been prohibitively slow to download hundreds of files is without merit. Phillips confirms in her declaration that Astreya made access t0 the computer prior t0 a forensic exam of -4- DECLARATION OF DON VILFER - REPLY 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 -5- DECLARATION OF DON VILFER - REPLY the device (Phillips declaration Para 31). While the access may not have been nefarious, changes were made to the evidence prior to a forensic image being made by Phillips, including those I pointed out in my prior declaration, and some records or artifacts are no longer available. 9. Phillips attempts to overcome my assertion that the use of the computer by Astreya and Phillips prior to the creation of the forensic image may have resulted in the loss of anti-virus log information by stating in her declaration there are additional Antivirus logs containing information about antivirus activity (Phillips declaration para 34). Unfortunately, each of these files was created on 6/26/2018 while the laptop was in the possession of Ms. Phillips. Many processes on a Mac will create compressed versions of old logs as new ones are created. This is likely what happened when the Mac was in the possession of Astreya and Phillips and was not shut down prior to the forensic preservation. New instances of the anti-virus software running occurred on those dates according to the logs, likely resulting in the deletion of older compressed logs and the creation of new compressed files. The new compressed files contain three days of log detail, two of those days being June 25th and 26th while with Astreya or Phillips. One of the compressed files has log detail from 5/21/2018, but no files remain for the earlier dates Phillips suspects Natalie Heroux accessed files. Files related to Google Drive were among those accessed just before imaging. 10. Phillips states that access to Natalie Heroux’s personal email is necessary to get to the bottom of file access. Yet, Astreya has the emails sent from the Astreya account and presumably has set forth everything they have seen sent from that account to her personal account, which seems to only be a resume which was forwarded, and they have the resume. If they are alleging items were copied to USB, those items would not be in her email. 11. My investigation and forensic analysis of the relevant information is ongoing and may uncover additional relevant information. I declare under penalty of perjury under the laws of the State of California that the foregoing is true and correct, and that this declaration was executed on ________________ in Roseville, California. Donald Vilfer March 26, 2019
