3.Cory Gaddis — Direct/Cross
214 linesDIRECT EXAMINATION BY MR. RAYMOND:
MR. RAYMOND: Mr. Gaddis, where do you work?
CORY GADDIS: I work at Google.
MR. RAYMOND: What is your title at Google?
CORY GADDIS: I'm a records custodian.
(Continued on next page)
MR. RAYMOND: How long have you worked at Google?
CORY GADDIS: A little over three years now.
MR. RAYMOND: What are your responsibilities as a records custodian?
CORY GADDIS: I respond to legal processes from government agencies, such as subpoenas, search warrants, and court orders.
MR. RAYMOND: You said you respond to legal process. What do you do in response to legal process?
CORY GADDIS: I take a search of a particular record that they are looking for, make a copy of that, and return that to the requesting government agency.
MR. RAYMOND: Have you ever testified in a court before?
CORY GADDIS: Yes.
MR. RAYMOND: As part of your duties, do you sometimes cross-check Google systems to confirm that certain documents were in fact provided by Google?
CORY GADDIS: Yes.
MR. RAYMOND: In your role as a custodian of records, have you become familiar with records maintained by Google?
CORY GADDIS: Yes.
MR. RAYMOND: Did you learn what kind of services Google offers its customers?
CORY GADDIS: Yes.
MR. RAYMOND: What are those?
CORY GADDIS: Internet services such as email, file sharing.
MR. RAYMOND: Are you familiar with the product called Google Workspace?
CORY GADDIS: Yes.
MR. RAYMOND: What is Google Workspace?
CORY GADDIS: Google Workspace is a collection of products for our enterprise customers, such as Google Docs, Google Sheets.
MR. RAYMOND: You mentioned Google Docs. What is Google Docs?
CORY GADDIS: It's a word-editing software similar to like Microsoft Word.
MR. RAYMOND: Can users share documents in Google Docs with others?
CORY GADDIS: Yes.
MR. RAYMOND: Can a user allow others to view a Google Doc?
CORY GADDIS: Yes.
MR. RAYMOND: Can a user allow others to edit a Google Doc?
CORY GADDIS: Yes.
MR. RAYMOND: You also mentioned Google Sheets. What is Google Sheets?
CORY GADDIS: It's a data-entry software, such as like Microsoft Excel.
MR. RAYMOND: And can a user share a Google Sheet with another user?
CORY GADDIS: Yes.
MR. RAYMOND: Can a user allow others to view a Google Sheet?
CORY GADDIS: Yes.
MR. RAYMOND: Can a user allow others to edit a Google Sheet?
CORY GADDIS: Yes.
MR. RAYMOND: In the course of your duties as a records custodian, have you learned the type of information Google stores about its users?
CORY GADDIS: Yes.
MR. RAYMOND: What are those types of information?
CORY GADDIS: That would be like subscriber information, metadata, and user content.
MR. RAYMOND: You mentioned metadata. What is metadata?
CORY GADDIS: Metadata would be like transactional information associated with a particular file.
MR. RAYMOND: So what type of information is that?
CORY GADDIS: That might be things such as who created the document, where it was uploaded from, where it was edited.
MR. RAYMOND: Does a user manually enter metadata or is it generated automatically?
CORY GADDIS: It would be generated automatically.
MR. RAYMOND: Does Google then store the metadata?
CORY GADDIS: Yes.
MR. RAYMOND: Taking a Google Doc as an example, does Google generate metadata when a Google Doc is first created?
CORY GADDIS: Yes.
MR. RAYMOND: What type of metadata does Google generate?
CORY GADDIS: That would be such as where it was created from, who created it.
MR. RAYMOND: How frequently thereafter would the metadata on such a Google document upload, update?
CORY GADDIS: At the time or shortly thereafter.
MR. RAYMOND: At the time or shortly thereafter what?
CORY GADDIS: That document was created or edited.
MR. RAYMOND: So each time it's edited, the metadata is expanded?
MR. EVERDELL: Objection.
JUDGE KAPLAN: Sustained. Form.
MR. RAYMOND: How frequently does the metadata update?
CORY GADDIS: At the time of and shortly thereafter.
MR. RAYMOND: Does Google systems save new information each time a record is accessed or changed?
CORY GADDIS: Yes.
MR. RAYMOND: In your role as a records custodian, do you know of whether this process of saving information on an ongoing basis occurs automatically, at or soon after the time the metadata is changed?
CORY GADDIS: Yes.
MR. EVERDELL: Objection.
JUDGE KAPLAN: Overruled.
MR. RAYMOND: Does Google then store that metadata?
CORY GADDIS: Yes.
MR. RAYMOND: Does Google maintain that metadata in the course of its regularly conducted activity?
CORY GADDIS: Yes.
MR. RAYMOND: Is that regularly conducted activity a regular practice of Google's?
CORY GADDIS: Yes.
MR. RAYMOND: Under what circumstances does Google provide a customer's Google Docs or sheets to a U.S. Government agency?
CORY GADDIS: Pursuant to a search warrant.
MR. RAYMOND: When Google produces a Google Doc in response to a search warrant, what file format does the Google Doc come in?
CORY GADDIS: It would typically come in a doc format, such as like a DOCX.
MR. RAYMOND: Do you understand, is that accessible through Microsoft Word?
CORY GADDIS: Yes.
MR. RAYMOND: How about when Google produces a Google Sheet, what format does that come in?
CORY GADDIS: That would come in an Excel format or a CSV file.
MR. RAYMOND: When Google produces documents in response to a search warrant, does it also provide the metadata associated with those documents?
CORY GADDIS: Yes.
MR. RAYMOND: When Google provides the metadata, what file format does the metadata come in?
CORY GADDIS: Typically, comes in a JSON file.
MR. RAYMOND: What is a JSON file?
CORY GADDIS: It's an extension for a particular file type, typically contains the metadata on there.
MR. RAYMOND: How is that information provided in response to legal process?
CORY GADDIS: It's provided alongside the requested content that's being sought.
MR. RAYMOND: Your Honor, may I approach to give the witness a thumb drive?
JUDGE KAPLAN: Yes.
MR. RAYMOND: Mr. Gaddis, do you recognize that thumb drive?
CORY GADDIS: Yes.
MR. RAYMOND: How do you recognize it?
CORY GADDIS: I saw the files being added to that thumb drive.
MR. RAYMOND: Does it have your initials on it?
CORY GADDIS: Yes.
MR. RAYMOND: Did you have an opportunity to review the contents of the thumb drive prior to it being shown to you in court today?
CORY GADDIS: Yes.
MR. RAYMOND: What is on the thumb drive?
CORY GADDIS: Records pursuant to a search warrant that we received.
MR. RAYMOND: Have you reviewed whether the documents on the thumb drive have been marked with government exhibit numbers?
CORY GADDIS: Yes.
MR. RAYMOND: Have you reviewed whether those are Government Exhibit numbers 5M, 5F, 18M, 18F, 19M, 19F, 28M, 28F, 42M, 42F, 44M, 44F, 50M, 50F, 325M, 325F, and 340M, 340F?
MR. EVERDELL: Objection, your Honor.
JUDGE KAPLAN: What is the objection?
MR. EVERDELL: It's leading.
JUDGE KAPLAN: Do you want him to remember the numbers without being prompted? Is that the point?
MR. EVERDELL: Your Honor, just simply lodging the objection.
JUDGE KAPLAN: I understand. Overruled.
MR. RAYMOND: Thank you, your Honor.
MR. RAYMOND: Mr. Gaddis, do you know whether the documents contained on this thumb drive were the ones that Google in fact maintained and produced to the government?
CORY GADDIS: Yes.
MR. RAYMOND: How do you know that?
CORY GADDIS: I ran a hash script on the original zip folders that these filed were provided from.
MR. RAYMOND: Did you review whether the files actually uploaded to that thumb drive came from the zip folder you mentioned?
CORY GADDIS: Yes.
MR. RAYMOND: And did they?
CORY GADDIS: Yes, they did.
MR. RAYMOND: And were the files on the thumb drive created -- was the data of the thumb drive entered or transmitted by the user and were those records kept in the course of Google's ordinary course?
MR. EVERDELL: Objection. Form.
JUDGE KAPLAN: Sustained. Form.
MR. RAYMOND: Your Honor, my colleague just passed me a note. I don't think the witness answered the question about the list of government exhibits I asked him about. Is it possible to have that question read back? Without all the details, maybe.
JUDGE KAPLAN: We will do it without commercials.
Would you read back the list of exhibits to the witness.
(Record read).
CORY GADDIS: Yes.
MR. RAYMOND: Mr. Gaddis, moving on to the files on the thumb drive, have you reviewed whether Google servers recorded information about those documents at the time the documents were created?
CORY GADDIS: Yes.
MR. RAYMOND: And were they?
CORY GADDIS: Yes.
MR. RAYMOND: And is maintaining that data kept in the course of Google's regularly conducted activity?
CORY GADDIS: Yes.
MR. RAYMOND: And was it made by regularly conducted activity as a regular practice of Google's?
CORY GADDIS: Yes.
MR. RAYMOND: Your Honor the government offers -- I'm happy to read them again, your Honor: Government Exhibits 5M, 5F, 18M, 18F, 19M, 19F, 28M, 28F, 42M, 42F, 44M, 44F, 50M, 50F, 325M, 325F, 340M, 340F.
JUDGE KAPLAN: Any objection, Mr. Everdell?
MR. EVERDELL: No objection.
JUDGE KAPLAN: Received.
(Government Exhibits 5M, 5F, 18M, 18F, 19M, 19F, 28M, 28F, 42M, 42F, 44M, 44F, 50M, 50F, 325M, 325F, 340M, 340F received in evidence)
MR. RAYMOND: Thank you, your Honor.
JUDGE KAPLAN: Did you mean to offer the thumb drive too?
MR. RAYMOND: No, your Honor.
JUDGE KAPLAN: Good.
MR. RAYMOND: Mr. Bianco can you pull up Government Exhibit 44M.
MR. RAYMOND: Mr. Gaddis, what is this document?
CORY GADDIS: This is a JSON file.
MR. RAYMOND: JSON file, what does that mean again?
CORY GADDIS: This is a file containing metadata for one of the files that we have produced in response to that search warrant.
MR. RAYMOND: Mr. Bianco, can you pull up Government Exhibit 44F and put it next to 44M.
MR. RAYMOND: Mr. Gaddis, looking at 44M, do you see where it says email address?
CORY GADDIS: Yes.
MR. RAYMOND: It says caroline@alameda-research.com?
CORY GADDIS: Yes.
MR. RAYMOND: Right above that it says: Gaia ID.
What is that?
CORY GADDIS: Gaia ID is a unique identifier for a Google account.
MR. RAYMOND: You said it's unique. Can a single person have multiple Gaia IDs?
CORY GADDIS: Yes.
MR. RAYMOND: How could that happen?
CORY GADDIS: It could be through various emails. So one email may have one Gaia ID and then another email would have a completely different one.
MR. RAYMOND: For example, if a person had multiple email accounts, would they potentially have multiple Gaia IDs?
CORY GADDIS: Correct, yes.
MR. RAYMOND: Are Gaia IDs typically associated with email addresses?
CORY GADDIS: Typically, yes.
MR. RAYMOND: Mr. Bianco, if you go to control F in 44M for the word Sam. I think it's row 3043.
MR. RAYMOND: Mr. Gaddis, do you see it says: Email address: Sam@alameda research.com?
CORY GADDIS: Yes.
MR. RAYMOND: You see above there is a Gaia ID ending in 8013?
CORY GADDIS: Yes.
MR. RAYMOND: Now, Mr. Bianco, can you scroll all the way to the top and look for a Gaia ID ending in 8013, which is in row 1636. Scroll up a little.
MR. RAYMOND: Mr. Gaddis, is that the same Gaia ID?
CORY GADDIS: Yes.
MR. RAYMOND: A couple of rows above that, what does it say under time?
CORY GADDIS: It says 2022 June 19 at 11:49:37 UTC.
MR. RAYMOND: Mr. Gaddis, just to confirm, the information you have read in this exhibit was created at or near the time it was generated by Google systems.
CORY GADDIS: Yes.
MR. EVERDELL: Sorry, your Honor. Did the witness say 11:49?
Oh, yes. Just translating UTC time. I understand.
MR. RAYMOND: No further questions.
JUDGE KAPLAN: Thank you.
Cross-examination.
MR. EVERDELL: Just one moment, your Honor.
JUDGE KAPLAN: Please proceed.
MR. EVERDELL: Thank you, your Honor.
CROSS-EXAMINATION BY MR. EVERDELL:
MR. EVERDELL: Good afternoon, Mr. Gaddis.
You were testifying about the JSON files that you were given, correct?
CORY GADDIS: Yes.
MR. EVERDELL: And we were looking at one of the JSON files in particular that pertained to -- I believe GX-44M was the JSON file, is that right?
CORY GADDIS: Yes.
MR. EVERDELL: I think you were shown -- let me step back.
The metadata includes certain fields, is that right?
CORY GADDIS: Yes.
MR. EVERDELL: And those fields can have meaning, depending on what the field is called, right?
CORY GADDIS: Yes.
MR. EVERDELL: There is a field that is called view, is that right?
CORY GADDIS: Yes.
MR. EVERDELL: What does the view field mean?
CORY GADDIS: I believe that means that it's viewed.
MR. EVERDELL: You believe it means it's viewed?
CORY GADDIS: Yes. I'm not super familiar with all the intricacies in all of the fields.
MR. EVERDELL: You are not familiar with what the fields mean?
CORY GADDIS: No, not all of the fields.
MR. EVERDELL: What is your responsibility at Google, Mr. Gaddis?
CORY GADDIS: I respond to legal process such as search warrants, subpoenas, and court orders.
MR. EVERDELL: How much experience do you have with metadata on certain files?
CORY GADDIS: Not particularly any good amount of experience with it.
MR. EVERDELL: So you are not someone sort of steeped in the tech of metadata, so to speak?
CORY GADDIS: No, I'm not.
MR. EVERDELL: Give me one moment.
No further questions, your Honor.
JUDGE KAPLAN: Anything else for the witness, Mr. Raymond?
MR. RAYMOND: No. Thank you very much.
JUDGE KAPLAN: Mr. Gaddis, you're excused.