Case 5:21-cv-03080-NC Document 64 Filed 05/06/22 Page 1 of 26
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`LIEFF CABRASER HEIMANN &
`BERNSTEIN, LLP
`Michael W. Sobol (SBN 194857)
`msobol@lchb.com
`Melissa Gardner (SBN 289096)
`mgardner@lchb.com
`Ian R. Bensberg (pro hac vice)
`ibensberg@lchb.com
`275 Battery Street, 29th Floor San
`Francisco, CA 94111-3339
`Telephone: 415.956.1000
`Facsimile: 415.956.1008
`LIEFF CABRASER HEIMANN &
`BERNSTEIN, LLP
`Nicholas Diamand (pro hac vice)
`ndiamand@lchb.com
`Douglas Cuthbertson (pro hac vice)
`dcuthbertson@lchb.com
`250 Hudson Street, 8th Floor New
`York, NY 10013 Telephone:
`212.355.9500
`Facsimile: 212.355.9592
`Counsel for Plaintiffs and the Proposed Class
`
`UNITED STATES DISTRICT COURT
`FOR THE NORTHERN DISTRICT OF CALIFORNIA
`SAN JOSE DIVISION
`
`
`JONATHAN DIAZ and LEWIS
`BORNMANN, on behalf of themselves
`and all others similarly situated,
`Plaintiffs,
`
`v.
`GOOGLE LLC,
`
`Defendant.
`
` Case No.: 5:21-cv-03080-NC
`
`
`PLAINTIFFS’ BRIEF IN SUPPORT OF
`PRELIMINARY SETTLEMENT
`APPROVAL
`
`
`
`
`
`PLAINTIFFS’ BRIEF IN SUPPORT OF
`PRELIMINARY SETTLEMENT APPROVAL
`CASE NO.: 5:21-CV-03080-NC
`
`

`

`Case 5:21-cv-03080-NC Document 64 Filed 05/06/22 Page 2 of 26
`
`TABLE OF CONTENTS
`
`
`Page
`
`IV. 
`V. 
`VI. 
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`NOTICE OF MOTION AND MOTION FOR PRELIMINARY APPROVAL OF CLASS
`ACTION SETTLEMENT ................................................................................................... 1 
`MEMORANDUM OF POINTS AND AUTHORITIES ................................................................ 2 
`I. 
`INTRODUCTION .............................................................................................................. 2 
`II. 
`FACTUAL BACKGROUND ............................................................................................. 2 
`III. 
`PROCEDURAL HISTORY ................................................................................................ 5 
`A. 
`Pleadings, Motion Practice, and Early Discovery ................................................... 5 
`B. 
`The Parties Design a Collaborative and Rigorous Early Resolution Process
`to Explore Resolving Plaintiffs’ Claims. ................................................................ 6 
`The Parties Mediate before Judge Ambler. ............................................................. 7 
`C. 
`THE SETTLEMENT .......................................................................................................... 7 
`LEGAL STANDARD ....................................................................................................... 10 
`THE SETTLEMENT IS FAIR, REASONABLE, AND ADEQUATE. ........................... 10 
`A. 
`The Class Has Been Vigorously Represented. ...................................................... 11 
`B. 
`The Settlement Was Negotiated at Arm’s Length. ............................................... 11 
`C. 
`The Settlement Provides Meaningful Relief to the Settlement Class. .................. 12 
`1. 
`The Costs, Risks, and Delay of Trial And Appeal .................................... 12 
`2. 
`Counsel Will Seek Reasonable Attorneys’ Fees and Expenses. ............... 14 
`The Settlement Treats Class Members Equitably. ................................................ 14 
`The Settlement Satisfies the District’s Procedural Guidance. .............................. 15 
`The Releases Mirror the Allegations in the Amended Complaint
`1. 
`(Procedural Guidance 1(c)) ....................................................................... 15 
`Settlement Administration Selection Process (Procedural Guidance
`2) ............................................................................................................... 16 
`The Proposed Notice Plan (Procedural Guidance 3 & 5). ........................ 17 
`3. 
`Service Awards (Procedural Guidance 7) ................................................. 18 
`4. 
`CAFA Notice (Procedural Guidance 10) .................................................. 19 
`5. 
`Electronic Versions (Procedural Guidance 12) ......................................... 19 
`6. 
`VII.  THE SETTLEMENT CLASS WARRANT CERTIFICATION. ..................................... 19 
`1. 
`Rule 23(a) is Satisfied ............................................................................... 19 
`2. 
`The Requirements of Rule 23(b)(2) are Satisfied ..................................... 21 
`VIII.  PROPOSED SCHEDULE FOR NOTICE AND FINAL APPROVAL ........................... 21 
`IX. 
`CONCLUSION ................................................................................................................. 22 
`
`D. 
`E. 
`
`2. 
`
`
`
`
`
`
`
`- i -
`
`PLAINTIFFS’ BRIEF IN SUPPORT OF
`PRELIMINARY SETTLEMENT APPROVAL
`CASE NO.: 5:21-CV-03080-NC
`
`

`

`Case 5:21-cv-03080-NC Document 64 Filed 05/06/22 Page 3 of 26
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`TABLE OF AUTHORITIES
`
`
`CASES 
`
`Page(s)
`
`Armstrong v. Davis,
`275 F.3d 849 (9th Cir. 2001)...................................................................................................... 20
`Beltran v. Olam Spices & Vegetables Inc., 2021 WL 2284465, at *14 (E.D. Cal. June 4, 2021),
`report and recommendation adopted by 2021 WL 4318141 (E.D. Cal. Sept. 23, 2021) .......... 12
`Camilo v. Ozuna,
`2020 WL 1557428(N.D. Cal. Apr. 1, 2020) .............................................................................. 12
`Campbell v. Facebook,
`315 F.R.D. 250 (N.D. Cal. 2016) ............................................................................................... 21
`Campbell v. Facebook,
`No. 4:13-05996-PJH-SK (N.D. Cal. Apr. 26, 2017) .................................................................. 21
`Churchill Vill. L.L.C. v. Gen. Elec.,
`361 F.3d 566 (9th Cir. 2004)...................................................................................................... 18
`In re Bluetooth Headset Prods. Liab. Litig.,
`654 F.3d 935 (9th Cir. 2011)................................................................................................ 10, 12
`In re Facebook Biometric Info. Privacy Litig.,
`326 F.R.D. 535 (N.D. Cal. 2018) ............................................................................................... 20
`In re Vizio, Inc., Consumer Privacy Litig.,
`No. 8:16-ml-02693 (C.D. Cal. Jan. 4, 2019) .............................................................................. 20
`In re Volkswagen “Clean Diesel” Mktg., Sales Practices & Prods. Liab. Litig.,
`2017 WL 672727 (N.D. Cal. Feb. 16, 2017) ............................................................................. 20
`In re Yahoo! Inc. Customer Data Sec. Breach Litig.,
`2019 WL 387322 (N.D. Cal. Jan. 30, 2019) .............................................................................. 18
`Jordan v. Los Angeles Cty.,
`669 F.2d 1311 (9th Cir. 1982).................................................................................................... 20
`Matera v. Google Inc.,
`No. 5:15-cv-04062-LHK (N.D. Cal. Aug. 31, 2017) ................................................................. 21
`Rodriguez v. Hayes,
`591 F.3d 1105 (9th Cir. 2010).................................................................................................... 21
`Rodriguez v. W. Publ’g Corp.,
`563 F.3d 948 (9th Cir. 2009)...................................................................................................... 19
`Roes, 1–2 v. SFBSC Mgmt. LLC,
`944 F.3d 1035 (9th Cir. 2019).............................................................................................. 10, 12
`Saucillo v. Peck,
`25 F.4th 1118 (9th Cir. 2022) .................................................................................................... 10
`The Civil Rights Educ. & Enf’t Ctr. v. RLJ Lodging Tr.,
`2016 WL 314400 (N.D. Cal. Jan. 25, 2016) .............................................................................. 19
`Wal-Mart Stores, Inc. v. Dukes,
`564 U.S. 338 (2011) ............................................................................................................. 17, 20
`
`
`
`
`
`
`
`- ii -
`
`PLAINTIFFS’ BRIEF IN SUPPORT OF
`PRELIMINARY SETTLEMENT APPROVAL
`CASE NO.: 5:21-CV-03080-NC
`
`

`

`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`Case 5:21-cv-03080-NC Document 64 Filed 05/06/22 Page 4 of 26
`
`
`
`TABLE OF AUTHORITIES
`(continued)
`
`Page
`
`STATUTES 
`28 U.S.C. § 1715 ............................................................................................................................ 19
`RULES 
`Fed. R. Civ. P 15(a)(1) ..................................................................................................................... 5
`Fed. R. Civ. P. 23 ........................................................................................................................... 17
`Fed. R. Civ. P. 23(a)(2) .................................................................................................................. 20
`Fed. R. Civ. P. 23(a)(3) .................................................................................................................. 20
`Fed. R. Civ. P. 23(a)(4) .................................................................................................................. 20
`Fed. R. Civ. P. 23(b)(2) .................................................................................................................. 21
`Fed. R. Civ. P. 23(c)(2) ............................................................................................................ 17, 18
`Fed. R. Civ. P. 23(e)(1)(B) ............................................................................................................. 10
`Fed. R. Civ. P. 23(e)(1)(B)(ii) ........................................................................................................ 19
`Fed. R. Civ. P. 23(e)(2) .................................................................................................................. 10
`Fed. R. Civ. P. 23(e)(2)(C) ............................................................................................................. 12
`Fed. R. Civ. P. 23(e)(2)(C)(ii) ........................................................................................................ 12
`Fed. R. Civ. P. 23(e)(2)(C)(iv) ....................................................................................................... 12
`Fed. R. Civ. P. 23(e)(4) .................................................................................................................. 10
`Fed. R. Civ. P. 23(e)(5) .................................................................................................................. 10
`Fed. R. Evid. 408 ............................................................................................................................. 6
`Local Civil Rule 7.2(c) ................................................................................................................... 21
`
`
`
`
`
`
`
`
`
`- iii -
`
`PLAINTIFFS’ BRIEF IN SUPPORT OF
`PRELIMINARY SETTLEMENT APPROVAL
`CASE NO.: 5:21-CV-03080-NC
`
`

`

`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`Case 5:21-cv-03080-NC Document 64 Filed 05/06/22 Page 5 of 26
`
`
`
`NOTICE OF MOTION AND MOTION FOR PRELIMINARY APPROVAL OF CLASS
`ACTION SETTLEMENT
`
`PLEASE TAKE NOTICE that on June 22, 2022 at 1:00 p.m. by Zoom webinar, Plaintiffs
`will and hereby do move the Court for an order granting preliminary approval of the proposed
`settlement with Defendant in this action.
`Plaintiffs request that the Court: (1) find it will likely approve the Settlement; (2) find it
`will likely certify the Settlement Class; (3) appoint Plaintiffs as Class Representatives for the
`Settlement Class for purposes of disseminating notice; (4) appoint Michael W. Sobol and Douglas
`I. Cuthbertson of Lieff, Cabraser, Heimann & Bernstein, LLP as counsel for the Settlement Class;
`(5) direct notice to the Settlement Class in connection with the Settlement, and approve the form
`and manner thereof; (6) authorize retention of KKC LLC as Settlement Administrator; and (7) set
`a schedule for final approval of the Settlement and Class Counsel’s request for attorneys’ fees and
`expenses. This motion is supported by the attached Memorandum of Points and Authorities, the
`attached Declarations of Douglas I. Cuthbertson, David R. Choffnes, and Carla A. Peak, as well
`as all papers and records on file in this matter, and such other matters as the Court may consider.
`
`
`
`
`
`
`
`
`
`- 1 -
`
`PLAINTIFFS’ BRIEF IN SUPPORT OF
`PRELIMINARY SETTLEMENT APPROVAL
`CASE NO.: 5:21-CV-03080-NC
`
`

`

`Case 5:21-cv-03080-NC Document 64 Filed 05/06/22 Page 6 of 26
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`I.
`
`MEMORANDUM OF POINTS AND AUTHORITIES
`INTRODUCTION
`Plaintiffs respectfully submit for the Court’s approval a proposed Class Action Settlement
`Agreement (the “Settlement”), which resolves Plaintiffs’ claims against Defendant Google LLC
`(“Google” or “Defendant”), alleging that Google fundamentally erred when it unlawfully exposed
`confidential medical information and personally identifying information through its digital
`contract tracing system designed by Google to slow or stop the spread of COVID-19 on mobile
`devices using Google’s Android operating system.
`The Settlement satisfies the requirements for preliminary approval. It balances immediate
`injunctive relief with the risks of further litigation, and members of the Settlement Class will
`release no monetary claims. Further, the Settlement is well-informed by a comprehensive pre-
`filing investigation that included a detailed forensic analysis, as well as a novel early resolution
`process involving Plaintiffs and Plaintiffs’ consulting expert’s review of highly confidential
`information from Google, which generated legally-binding representations and warranties by
`Google that form a core component of the Settlement. Finally, the Settlement is the product of
`arm’s length, non-collusive negotiations aided by experienced mediator, Judge Read Ambler
`(Ret.). While class notice is not mandatory under Rule 23(b)(2), the parties propose a robust
`online notice campaign and a settlement website. The Settlement should be approved.
`
`II.
`
`FACTUAL BACKGROUND
`In 2020 when COVID-19 spread throughout the globe, public health authorities in the
`United States and elsewhere worked to protect the public, including by implementing “contact
`tracing,” a method of discerning possible exposure to persons who contracted the virus so that the
`exposed persons could take precautions for their safety and the safety of others. See Dkt. 25 (Am.
`Compl.) ¶¶ 6-9. Generally speaking, contact tracing is a process used to identify people who
`have come into contact with an infected person in order to observe them for signs of infection
`and, if necessary, to isolate and treat them, and to prevent the spread of disease to others. Id.,
`¶¶ 10-11. Effective contact tracing requires the voluntary participation of members of the general
`public who are willing to share, on a strictly confidential basis, their health status and location
`
`
`
`
`
`
`
`- 2 -
`
`PLAINTIFFS’ BRIEF IN SUPPORT OF
`PRELIMINARY SETTLEMENT APPROVAL
`CASE NO.: 5:21-CV-03080-NC
`
`

`

`Case 5:21-cv-03080-NC Document 64 Filed 05/06/22 Page 7 of 26
`
`
`
`information.
`Defendant Google, together with Apple, Inc., developed a system for digital “contact
`tracing,” called the Google-Apple Exposure Notification System for use with the many mobile
`devices that use either Google’s Android or Apple’s IOS operating systems. Id., ¶ 12. Google
`made its Exposure Notification system available to public health authorities in May 2020 for use
`in Android devices (referred to herein as the “EN System”).1 See Am. Compl., ¶ 13. The EN
`System allowed state-level public health authorities to build mobile contact tracing applications
`(“Contact Tracing Apps”), which users could then download and use to identify possible
`exposure to persons infected with COVID-19. Id., ¶¶ 14-15, 18, 20. As of March 2021, more
`than 28 million people had downloaded Contact Tracing Apps in the United States or otherwise
`activated exposure notifications on their mobile devices. Id., ¶ 19.
`In general, the EN System works as follows. First, users who activated the system will
`automatically cause their mobile devices to regularly broadcast and record unique, random-
`seeming sequences of characters and device identifiers via their Bluetooth radio to other
`participating users within Bluetooth range (approximately 30 feet). Id., ¶¶ 26-35. Second, any
`user who receives a positive COVID-19 diagnosis from a medical professional, with approval
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`
`
`1 The Settlement Agreement defines the EN System as Google’s Exposure Notifications APIs
`and/or Google’s Template EN Express App. See Cuthbertson Decl., Ex. 1 (Settlement
`Agreement), ¶ 1.5.
`
`
`
`- 3 -
`
`PLAINTIFFS’ BRIEF IN SUPPORT OF
`PRELIMINARY SETTLEMENT APPROVAL
`CASE NO.: 5:21-CV-03080-NC
`
`

`

`Case 5:21-cv-03080-NC Document 64 Filed 05/06/22 Page 8 of 26
`
`
`
`from the local public health authority, may choose to input her positive diagnosis into her device,
`alerting the EN System. Id., ¶ 37. For example, the app used in California (“CA Notify”) would
`display the following screen to allow a user to “[s]hare [her] COVID-19 test result.” Id., ¶ 38.
`Third, other EN System users who previously came into contact with the COVID-19-positive user
`will receive an anonymous “exposure notification,” so that they may seek treatment and take
`steps to limit the virus’s spread. Id., ¶¶ 39-43.
`By its nature, the EN System requires that its users allow use of their sensitive health
`information, general location information, and information about users’ relative location to
`infected persons. To facilitate the mass voluntary participation that the EN System requires to be
`effective, the EN System was ostensibly designed to ensure the confidentiality and privacy of
`users’ sensitive and private information. Id., ¶ 46. Google represented that any data generated by
`the EN System never left a user’s Android device and that the identities of users and their
`COVID-19 status would remain anonymous, and would not be collected by Google or shared
`with other users. Id., ¶¶ 44-45, 47-48. The efficacy and reliability of the EN System depended
`on the truth of these statements.
`Plaintiffs allege, however, that Google fundamentally erred in its design and
`implementation of its EN System by leaving users’ private health information unprotected on
`Android device “system logs” 2 to which Google and third party app developers had routine
`access. Id., ¶¶ 50-51, 55-59, 69. Google did so even though it recognized that it was a best
`practice to not log sensitive or personally identifiable information to system logs unless necessary
`for app functionality. Id., ¶¶ 71, 74. Based on detailed forensic analysis (see Cuthbertson Decl.,
`¶ 3), Plaintiffs described specific data comprising personally identifiable information and data
`showing positive COVID-19 diagnoses that were logged on Android system logs and transmitted
`side-by-side to Google’s servers from users who participated in the EN system. See Am. Compl.,
`¶¶ 91-111. By virtue of this fundamental error, Google breached its commitments regarding user
`privacy, which were necessary for ensuring users’ participation and thus the efficacy of the EN
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`
`
`2 System logs store information on individual mobile devices for a variety of purposes, including
`for “crash reporting.” Id., ¶¶ 50-51, 56-59.
`
`
`
`- 4 -
`
`PLAINTIFFS’ BRIEF IN SUPPORT OF
`PRELIMINARY SETTLEMENT APPROVAL
`CASE NO.: 5:21-CV-03080-NC
`
`

`

`Case 5:21-cv-03080-NC Document 64 Filed 05/06/22 Page 9 of 26
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`System. See id. ¶¶ 91-111.
`Plaintiffs alleged that although Google became aware of this problem in or around
`February 2021, it failed to inform the general public or to satisfactorily address the security flaws
`to prevent the problems moving forward. Id., ¶¶ 115-23.
`
`III.
`
`PROCEDURAL HISTORY
`A.
`Pleadings, Motion Practice, and Early Discovery
`Plaintiffs filed their initial complaint on April 27, 2021. See Dkt. 1. On June 29, 2021,
`Google filed a motion to dismiss (see Dkt. 18), and on July 20, 2021, Plaintiffs filed an amended
`complaint as of course pursuant to Fed. R. Civ. P 15(a)(1). Both the initial and amended
`complaints defined the class as “[a]ll natural persons in the United States who downloaded or
`activated a contact tracing app incorporating the Google-Apple Exposure Notification System on
`their mobile device,” and included a California subclass, defined as “[a]ll natural persons in
`California who are members of the Class.” See Dkt. 1 (Compl.), ¶ 93, Dkt. 25 (Am. Compl.), ¶
`143. Both complaints included common-law privacy claims for intrusion upon seclusion and
`public disclosure claims under California law and the California Constitution, as well as one
`statutory claim providing for statutory damages, under California’s Confidentiality of Medical
`Information Act (CMIA). See Dkt. 1 (Compl.), ¶¶ 98-146, Dkt. 25 (Am. Compl.), ¶¶ 148-198.
`The Parties conducted a Rule 26(f) conference on July 6, 2021 and Plaintiffs served
`formal discovery on August 20, 2021, after the Court issued a limited case management
`scheduling order allowing discovery to proceed. See Dkt. 34. The Parties then negotiated (and
`partially litigated) a protective order and ESI protocol, which the Court granted. See Dkts. 46 &
`50. The Parties agreed to stay formal discovery pending the early resolution efforts described
`below.
`On August 25, 2021, Google filed its motion to dismiss the amended complaint and an
`accompanying request for judicial notice. See Dkts. 37 & 38. Shortly before Plaintiffs were to
`file their motion to dismiss opposition brief, the Court agreed to extend the remaining motion to
`dismiss deadlines to provide the Parties the opportunity to develop “an informal but collaborative
`discovery process that may resolve many of the pending issues raised in Google’s motion to
`
`
`
`
`
`
`
`- 5 -
`
`PLAINTIFFS’ BRIEF IN SUPPORT OF
`PRELIMINARY SETTLEMENT APPROVAL
`CASE NO.: 5:21-CV-03080-NC
`
`

`

`Case 5:21-cv-03080-NC Document 64 Filed 05/06/22 Page 10 of 26
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`dismiss.” Dkt. 48. The Court subsequently extended those deadlines to facilitate the process
`described below that resulted in the proposed settlement. See Dkts. 52, 54, 56, 58.
`
`B.
`
`The Parties Design a Collaborative and Rigorous Early Resolution Process to
`Explore Resolving Plaintiffs’ Claims.
`In August 2021, the Parties began to explore early resolution of this matter, after Google
`explained that it believed it had resolved the privacy concerns stemming from the alleged design
`flaw of the EN System that formed the basis of Plaintiffs’ claims. See Cuthbertson Decl., ¶ 4; see
`also id., Ex. 1 (Settlement Agreement), ¶ 3.1 (“Google has taken several measures to remedy
`what Plaintiffs allege to be a security vulnerability in its EN System made known to Google and
`then raised by Plaintiffs in their Amended Complaint in this Lawsuit.”). As part of that process,
`Plaintiffs demanded extensive factual disclosure necessary to reach an informed judgment about
`Google’s understanding and investigation of the issue and whether Google made the
`technological changes necessary to remedy the alleged fundamental error in the EN System.
`Cuthbertson Decl., ¶ 5.
`In September 2021, Plaintiffs proposed that their consulting expert be allowed to speak
`with and question a Google representative on a number of highly relevant technical issues in an
`informal setting under the auspices of F.R.E. 408. Id., ¶ 6. This would allow for a more efficient
`and expeditious exchange of information than a formal deposition, while ensuring that any
`confidential information conveyed by Google would remain protected as a settlement
`communication. Id. Google agreed, and in September and October 11, 2021, the Parties
`negotiated the scope of and procedures for this informational session, including the list of topics
`Plaintiffs’ consulting expert could address. Id., ¶ 7. Plaintiffs’ consulting expert conducted the
`session on November 22, 2021, where he asked and had answered numerous technical questions
`concerning Plaintiffs’ allegations, the past and current architecture of the EN System, and
`Google’s practices relating to the treatment of data generated by the EN System. See id., ¶ 8;
`Declaration of David R. Choffnes (“Choffnes Decl.”), ¶ 3.
`In December 2021 and January 2022, upon Plaintiffs’ request, Google provided additional
`highly confidential written information and materials in response to follow-up questions asked by
`
`
`
`
`
`
`
`- 6 -
`
`PLAINTIFFS’ BRIEF IN SUPPORT OF
`PRELIMINARY SETTLEMENT APPROVAL
`CASE NO.: 5:21-CV-03080-NC
`
`

`

`Case 5:21-cv-03080-NC Document 64 Filed 05/06/22 Page 11 of 26
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`Plaintiffs’ counsel in consultation with their consulting expert. Id., ¶ 4. After reviewing and
`analyzing those written materials, as well as the information conveyed during the November
`exchange, Plaintiffs determined that there was sufficient grounds to attempt to mediate this
`matter. Cuthbertson Decl., ¶ 9.
`
`C.
`The Parties Mediate before Judge Ambler.
`The Parties agreed to mediate this case before the Hon. Read Ambler (Ret.) of JAMS.
`Cuthbertson Decl., ¶ 10. After submitting their respective mediation statements, the Parties
`conducted three mediation sessions remotely via Zoom on January 31, 2022, February 7, 2022,
`and February 11, 2022, exchanging proposed terms of the Settlement with Judge Ambler’s
`guidance. Id., ¶ 11. Between mediation sessions, the Parties continued to exchange proposals on
`outstanding points of dispute via Judge Ambler, who provided continued direction and
`supervision of the Parties’ efforts. Id., ¶ 12. The Parties reached a tentative agreement on
`February 18, 2022, and notified the Court of the same. See Dkt. 59. The Court then stayed the
`case pending approval of the Settlement. See Dkt. 60.
`
`IV.
`
`THE SETTLEMENT
`The proposed settlement with Google provides meaningful business practice changes and
`critical future commitments that address the fundamental error in the EN System alleged in
`Plaintiffs’ Amended Complaint as to Google. See Section II. above (describing Plaintiffs’
`allegations). Crucially, Plaintiffs’ and their expert’s opinion that Google has satisfactorily
`investigated and remedied any consequences of the alleged security vulnerabilities is based on
`legally-binding representations and warranties from Google that form a critical part of this
`Settlement. As explained above (see section III. B.), Plaintiffs’ consulting expert’s live exchange
`of information with Google and subsequent exchange and analysis of highly confidential written
`information and materials, provided Plaintiffs with the ability and opportunity to craft an effective
`settlement. See Choffnes Decl., ¶ 5 (“After reviewing and analyzing [Google’s] written
`materials, and in reliance upon what I learned during the [live] exchange, as well as the
`representations and warranties made by Google . . . , I believe that the remedial measures taken
`by Google and the injunctive relief agreed to as part of the proposed settlement address Plaintiffs’
`
`
`
`
`
`
`
`- 7 -
`
`PLAINTIFFS’ BRIEF IN SUPPORT OF
`PRELIMINARY SETTLEMENT APPROVAL
`CASE NO.: 5:21-CV-03080-NC
`
`

`

`Case 5:21-cv-03080-NC Document 64 Filed 05/06/22 Page 12 of 26
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`alleged security vulnerabilities in Google’s EN System as to Google.”).
`First, Google has taken several measures to remedy the security vulnerabilities in its EN
`System made known to Google and then raised by Plaintiffs in their complaints. These remedial
`measures, which Google acknowledges were taken in response to the issues concerning the EN
`System that are the same as those raised by Plaintiffs, include: (1) software code changes Google
`rolled out to EN System users on April 21, May 5, and May 26, 2021, to improve how technical
`information is logged to Android system logs to provide additional privacy protection for users of
`contact tracing apps, and (2) implementing and completing a process designed to search for and
`eliminate EN System data Google may find within its databases. See Cuthbertson Decl., Ex. 1
`(Settlement Agreement), ¶ 3.1. These measures, as confirmed by Plaintiffs’ consulting expert,
`would prevent the alleged logging and collection of personally identifying information alongside
`EN System users’ COVID-19 status.
`Second, upon execution of the Settlement Agreement, Google will represent and warrant
`that the following statements are true:
` Google does not place any data in Android mobile device system logs generated
`by Google’s EN System from which a particular user’s health status could be
`inferred, even if another party knew to whom the system log belongs. This
`includes representing that “log lines” created by the EN System would not allow a
`third party to understand or infer any meaning concerning a user’s COVID status.
`See id., ¶ 4.1;
` Google has implemented and completed a process designed to review its system
`for the information alleged in Plaintiffs’ Amended Complaint and eliminate EN
`System data it may find within its databases, as noted above. See id., ¶ 4.2;
` Google issued a “Partner Security Advisory” to third parties that may have had
`access to Android mobile device system logs, explaining that Google had been
`advised of the vulnerabilities alleged by Plaintiffs, that Google had issued a
`relevant “fix,” that Google “had no indication that these identifiers were used
`inappropriately, such as to identify any users of Exposure Notifications,” and that
`
`
`
`
`
`
`
`- 8 -
`
`PLAINTIFFS’ BRIEF IN SUPPORT OF
`PRELIMINARY SETTLEMENT APPROVAL
`CASE NO.: 5:21-CV-03080-NC
`
`

`

`Case 5:21-cv-03080-NC Document 64 Filed 05/06/22 Page 13 of 26
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`Google had advised these third parties to eliminate any potentially sensitive
`information collected without explicit user consent. See id., ¶ 4.3.
` Google has evaluated the likelihood of access to and subsequent misuse of EN
`System data logged to users’ devices, and identified no evidence of abuse or
`misuse by anyone of EN System data that was logged to device system logs. See
`id., ¶ 4.4.
` Google conducted an investigation revealing that no team at Google sought to or
`attempted to link EN and non-EN System data contained in Android mobile device
`system logs for any such use by Google, and that the investigation revealed no
`attempts by Google employees or any unauthorized persons to connect EN System
`data with any personally identifying information of any user for use by Google.
`See id., ¶ 4.5.
`Third, as consideration for the complete and final settlement of this action, Google will
`agree to and implement the following injunctive relief:
` Google shall not revert the software code changes described above. See id., ¶ 5.1.
` Google shall confirm in writing that, after a good-faith, thorough search, it has
`identified no EN System data on its internal systems from which any employee
`could draw any inference about the health status of an EN user. See id., ¶ 5.2.
` Google shall edit the following Google webpage on the EN System,
`http://www.google.com/covid19/exposurenotif