Case 1:23-cv-00758-JLH Document 59-3 Filed 05/13/24 Page 1 of 13 PageID #: 1503
`Case 1:23-cv-00758-JLH Document 59-3 Filed 05/13/24 Page 1 of 13 PagelD #: 1503
`
`EXHIBIT 2
`
` EXHIBIT 2
`
`

`

`Case 1:23-cv-00758-JLH Document 59-3 Filed 05/13/24 Page 2 of 13 PageID #: 1504
`
`IN THE UNITED STATES DISTRICT COURT
`FOR THE DISTRICT OF DELAWARE
`
`C.A. No. 23-758 (JLH)
`
`)))))))))
`
`
`)
`)
`
`))
`
`ORCA SECURITY LTD.,
`
` Plaintiff,
`
` v.
`
`WIZ, INC.,
`
` Defendant.
`
`STIPULATION AND ORDER REGARDING DISCOVERY OF
`ELECTRONICALLY STORED INFORMATION
`
`Except as otherwise incorporated into this Court’s Scheduling Order (D.I. 33) with respect
`
`to Paragraph 4 of this Court’s Default Standard For Discovery, the parties stipulate that this Order
`
`replaces the Default Standard For Discovery and therefore governs the parties’ discovery of
`
`electronically stored information (“ESI”).
`
`1.
`
`General Provisions
`
`a.
`
`Preservation of Discoverable Information. A party has a common law obligation
`
`to take reasonable and proportional steps to preserve discoverable information in the party’s
`
`possession, custody or control.
`
`(i)
`
`Absent a showing of good cause by the requesting party, the parties shall
`
`not be required to modify, on a going-forward basis, the procedures used by them in the ordinary
`
`course of business to back up and archive data; provided, however, that the parties shall preserve
`
`the non-duplicative discoverable information currently in their possession, custody or control.
`
`(ii)
`
`Absent a showing of good cause by the requesting party, the categories of
`
`1
`
`

`

`Case 1:23-cv-00758-JLH Document 59-3 Filed 05/13/24 Page 3 of 13 PageID #: 1505
`
`ESI identified in Schedule A attached hereto need not be preserved.
`
`b.
`
`Privilege.
`
`(i)
`
`The parties will serve logs for documents produced from the parties’ agreed-
`
`upon custodians and responsive to requests for production that are withheld or redacted on the
`
`basis of any privilege or protection, such as attorney-client privilege, work product protection,
`
`common interest or joint defense protection, or other immunities, in accordance with D. Del. LR
`
`26.2. The log of withheld documents shall be due 10 business days after the deadline for
`
`substantial completion of document production. The parties shall identify on their privilege logs
`
`where an author or recipient of a withheld document is an attorney or a representative of the
`
`attorney (e.g., with an asterisk or similar). In the case of e-mail, any email family where the entire
`
`family is withheld in full based on privilege grounds may be logged as a single entry, provided
`
`that the privilege description includes sufficient information to identify both the parent email and
`
`its attachments. Any e-mail chain (i.e., a series of e-mails linked together by e-mail responses and
`
`forwarding) that is withheld or redacted on the grounds of privilege, immunity or any similar claim
`
`shall be logged as one document and shall be identified by the top-most e-mail in the chain that is
`
`withheld or redacted. The parties shall not be required to log identical copies of an e-mail that is
`
`included in a chain that has been logged in accordance with this paragraph. Each member of a
`
`family (i.e., e-mail attaching memorandum) that is withheld or redacted on the grounds of
`
`privilege, immunity or any similar claim shall be identified on the log separately. Privilege logs
`
`shall contain the following columns:
`
`1. Privilege Log ID No.;
`
`2. Production Bates No;
`
`3. Document Type;
`
`2
`
`

`

`Case 1:23-cv-00758-JLH Document 59-3 Filed 05/13/24 Page 4 of 13 PageID #: 1506
`
`4. Date;
`
`5. From/Author;
`
`6. To/Recipient(s);
`
`7. Other Senders and Recipients (or Other Participants);
`
`8. Privilege Asserted: Attorney-Client, Work Product, Joint Defense, etc.;
`
`9. Privilege Description; and
`
`10. Whether the document is redacted.
`
`(ii)
`
`The parties are not required to provide any such information in privilege
`
`logs for the following categories of information: (1) information generated after the filing of the
`
`complaint, (2) correspondence with a party’s Lead Counsel and/or Delaware Counsel in this
`
`Action.
`
`(iii)
`
`Activities undertaken in compliance with the duty to preserve information
`
`are protected from disclosure and discovery under Fed. R. Civ. P. 26(b)(3)(A) and (8).
`
`2.
`
`Specific E-Discovery Issues.
`
`a.
`
`On-site inspection of electronic media. Such an inspection shall not be permitted
`
`absent a demonstration by the requesting party of specific need and good cause.
`
`b.
`
`Search methodology. In certain circumstances, it may be appropriate to use search
`
`terms to locate potentially responsive ESI. If a producing party elects to use search terms to locate
`
`potentially responsive ESI from a non-custodial data source, it shall disclose to the requesting party
`
`the search terms, ESI sources, and discovery requests for which it is using such search terms, and
`
`the requesting party may object to the appropriateness of using search terms for such ESI sources
`
`and discovery requests and, if the parties cannot reach agreement after meeting and conferring,
`
`raise that issue with the Court. Absent a showing of good cause and/or where the Court has deemed
`
`3
`
`

`

`Case 1:23-cv-00758-JLH Document 59-3 Filed 05/13/24 Page 5 of 13 PageID #: 1507
`
`in response to a raised dispute that search terms are not appropriate in the specific circumstance,
`
`each side shall request no more than 10 additional search terms to be used in connection with the
`
`producing party’s search-term based electronic search for each non-custodial data source.
`
`Indiscriminate terms, such as the producing company’s name or its product name, are inappropriate
`
`unless combined with narrowing search criteria that sufficiently reduce the risk of overproduction.
`
`A conjunctive combination of multiple words or phrases (e.g., “computer” and “system”) narrows
`
`the search and shall count as a single search term. A disjunctive combination of multiple words or
`
`phrases (e.g., “computer” or “system”) broadens the search, and thus each word or phrase shall
`
`count as a separate search term unless they are variants of the same word. Use of narrowing search
`
`criteria (e.g., “and,” “but not,” “w/x”) is encouraged to limit the production and shall be considered
`
`when determining whether to shift costs for disproportionate discovery.
`
`Documents hitting on search term may be reviewed for responsiveness in accordance with
`
`the producing party’s served objections to requests for production. Documents identified through
`
`search terms that are responsive but withheld for privilege or other immunity are subject to the
`
`logging requirements of this section. The producing party shall search (i) the non-custodial data
`
`sources identified in accordance with paragraph 3(b) of the Delaware Default Standard For
`
`Discovery; and (ii) other ESI maintained by the custodians identified in accordance with paragraph
`
`3(a) of the Delaware Default Standard For Discovery.
`
`c.
`
`Format. ESI and non-ESI shall be produced to the requesting party as text
`
`searchable image files (e.g., PDF or TIFF). When a text-searchable image file is produced, the
`
`producing party must preserve the integrity of the underlying ESI, i.e., the original formatting, the
`
`metadata (as noted below) and, where applicable, the revision history. The parties shall produce
`
`their information in the following format: single page TIFF images and associated multi-page text
`
`4
`
`

`

`Case 1:23-cv-00758-JLH Document 59-3 Filed 05/13/24 Page 6 of 13 PageID #: 1508
`
`files containing extracted text or OCR with Concordance and Opticon load files containing all
`
`requisite information including relevant metadata.
`
`d.
`
`Native files. The only files that should be produced in native format are files not
`
`easily converted to image format, such as Excel, Access, and PowerPoint files.
`
`e.
`
`Metadata fields. The parties are only obligated to provide the following metadata
`
`for all ESI produced, to the extent such metadata exists: Custodian, File Path, Email Subject,
`
`Conversation Index, From, To, CC, BCC, Date Sent, Time Sent, Date Received, Time Received,
`
`Filename, Author, Date Created, Date Modified, MD5 Hash, File Size, File Extension, Control
`
`Number Begin, Control Number End, Attachment Range, Attachment Begin, Attachment End,
`
`Slack Channel ID, and Slack Channel Name, or the equivalent thereof.
`
`f.
`
`Electronic Correspondence (Email and Instant Messaging Services). General
`
`production requests under Federal Rules of Civil Procedure 34 and 45 shall not include email or
`
`other forms of electronic correspondence, including instant messages from Slack, WhatsApp, and
`
`other non-email messaging applications (collectively “Electronic Correspondence”). To obtain
`
`Electronic Correspondence, parties must propound specific Electronic Correspondence production
`
`requests. Electronic Correspondence production requests shall identify the custodian, search terms,
`
`and time frame. The parties shall cooperate to identify the proper custodians, proper search terms
`
`and proper timeframe. Each requesting party shall limit its Electronic Correspondence production
`
`requests to a total of ten (10) custodians per producing party for all such requests. The parties may
`
`jointly agree to modify this limit without the Court’s leave. The date ranges and search terms need
`
`not be the same for each custodian. By default, absent good cause and/or agreement between the
`
`parties, the parties will limit the number of terms to no more than ten (10) search terms, subject to
`
`Section 2.b above, per custodian. The parties agree that Electronic Correspondence production
`
`5
`
`

`

`Case 1:23-cv-00758-JLH Document 59-3 Filed 05/13/24 Page 7 of 13 PageID #: 1509
`
`requests shall be phased to occur after initial non-custodial document productions on the dates set
`
`forth in Section 3 below.
`
`(i)
`
`Email. Email shall be collected in a manner that maintains reliable email
`
`metadata and structure. Whenever possible, email shall be collected from the producing party’s
`
`email store or server. Metadata and “header fields” shall be extracted from email messages. Email
`
`collections shall include calendar meetings and appointments.
`
`(ii)
`
`Instant Messaging Services (e.g. Slack and WhatsApp). Instant
`
`messages, including messages from Slack, WhatsApp, and other non-email messaging
`
`applications, shall be collected in a manner that maintains reliable metadata and structure.
`
`Whenever possible, instant messages shall be collected from the Producing Party’s instant
`
`messaging server. Metadata shall be extracted from the instant messages and produced in
`
`accordance with the metadata described in Section 2.e above. The Producing Party shall only
`
`produce an attachment(s) to instant messages to the extent the messages refer to such an
`
`attachment(s). The Receiving Party shall have the right to request additional attachment(s) to
`
`instant messages if a produced instant message has an attachment that is not produced. Each party
`
`reserves the right to object to or challenge the format in which the other party produces instant
`
`messages. The parties shall produce instant messages in a format consistent with their discovery
`
`obligations and that provides sufficient context in a single thread for any responsive messages
`
`pursuant to the following rule: (1) the parties shall produce the entirety of any conversation
`
`containing 20 or fewer total messages that has at least one responsive message; and (2) the parties
`
`shall produce ten messages above and ten below each responsive message for conversations
`
`containing more than 20 total messages.
`
`g.
`
`De-duplication. ESI shall be de-duplicated globally across all custodians and data
`
`6
`
`

`

`Case 1:23-cv-00758-JLH Document 59-3 Filed 05/13/24 Page 8 of 13 PageID #: 1510
`
`sources (both vertically or horizontally). Hard copy documents should not be de-duplicated. All
`
`custodians who were in possession of a de-duplicated document must be identified. Exact
`
`duplicate documents shall only be identified based on individual document MD5 or SHA-1 hash
`
`values. However, removal of duplicate documents shall be done at the family level (e.g., a
`
`standalone document shall not be removed if it has the exact duplicate as part of an Email family.)
`
`h.
`
`Redaction. If a file that originates in ESI needs to be redacted before production,
`
`the file will be rendered in TIFF, and the TIFF will be redacted and produced. ESI that does not
`
`render well (e.g., spreadsheets) or cannot be rendered in image format (e.g., audio files) can be
`
`redacted in native format. The producing party will provide searchable text for those portions of
`
`the document that have not been redacted.
`
`3.
`
`Discovery Deadlines.
`
`a.
`
`The parties will adhere to the discovery deadlines set forth in the Court’s scheduling
`
`order (D.I. 33). The parties further stipulate to the following interim discovery deadlines:
`
`(i)
`
`By May 10, 2024, Wiz will substantively respond to Orca’s Interrogatory
`
`Nos. 1-3, 6, 7, 11, and 14-16, including producing any responsive documents that Wiz relies on
`
`pursuant to Fed. R. Civ. P. 33(d).
`
`(ii)
`
`By May 24, 2024, each Party will have substantially completed production
`
`of documents, except for Electronic Correspondence (see Section 2.f. above), that are responsive
`
`to the requesting Party’s first set of requests for production, subject to the producing Party’s
`
`objections, from non-custodial data sources that are identified as containing non-duplicative,
`
`discoverable information. For the avoidance of doubt, the Parties agree:
`
`(a) Orca will have substantially completed production of documents, other than
`
`Electronic Correspondence, that are responsive to Wiz’s First Set of Requests
`
`7
`
`

`

`Case 1:23-cv-00758-JLH Document 59-3 Filed 05/13/24 Page 9 of 13 PageID #: 1511
`
`for Production (Nos. 1-60) dated February 14, 2024 from the following data
`
`sources: Confluence, Jira, GitHub, Google drive, Google Docs, Google Sheets,
`
`and Electronic data and documents stored in a central repository.
`
`(b) Wiz will have substantially completed production of documents, other than
`
`Electronic Correspondence, that are responsive to Orca’s First Set of Requests
`
`for Production (Nos. 1-83) dated February 21, 2024 from the following data
`
`sources: OneDrive, Box, GitHub, Notion, Confluence, SharePoint, and Jira.
`
`(iii)
`
`By May 31, 2024, each Party may serve Priority Electronic Correspondence
`
`production requests identifying up to four (4) priority custodians (“Priority Requests”). For the
`
`avoidance of doubt, priority custodians count towards a party’s ten (10) total custodians (see
`
`Section 2.f above).
`
`(iv)
`
`By June 21, 2024, each Party will provide unique, deduplicated, hit counts
`
`for each proposed search term and identify objections, if any, to the requesting Party’s Priority
`
`Requests. The parties will confer to try to reach agreement on the search terms to be applied to
`
`each custodian’s ESI.
`
`(v)
`
`By June 28, 2024, to the extent the parties are unable to reach agreement,
`
`the parties may submit Priority Request disputes for resolution using the Court’s motion for
`
`teleconference procedure set forth in Section 8(g) of the Scheduling Order (D.I. 33) and pursuant
`
`to the Court’s local rules.
`
`(vi)
`
`By August 1, 2024, the parties will have substantially completed production
`
`of all non-privileged custodial ESI responsive to the parties’ Priority Requests, subject to any
`
`unresolved objections.
`
`(vii) On or after August 8, 2024, each Party may serve additional Electronic
`
`8
`
`

`

`Case 1:23-cv-00758-JLH Document 59-3 Filed 05/13/24 Page 10 of 13 PageID #: 1512
`
`Correspondence production requests (“Non-Priority Requests”). Within 30 days of receipt of any
`
`Non-Priority Requests, a producing party will provide unique, deduplicated, hit counts for each
`
`proposed search term and identify objections, if any, to the requesting Party’s Non-Priority
`
`Requests. The parties will confer to try to reach agreement on the search terms to be applied to
`
`each custodian’s ESI and the timing of any such productions.
`
`9
`
`

`

`Case 1:23-cv-00758-JLH Document 59-3 Filed 05/13/24 Page 11 of 13 PageID #: 1513
`
`SCHEDULE A
`
`1. Deleted, slack, fragmented, or other data only accessible by forensics.
`
`2. Random access memory (RAM), temporary files, or other ephemeral data that are difficult to
`
`preserve without disabling the operating system.
`
`3. On-line access data such as temporary internet files, history, cache, cookies, and the like.
`
`4. Data in metadata fields that are frequently updated automatically, such as last(cid:173) opened dates.
`
`5. Back-up data that are substantially duplicative of data that are more accessible elsewhere.
`
`6. Voice messages.
`
`7.
`
`Instant messages that are not ordinarily printed or maintained in a server dedicated to instant
`
`messaging.
`
`8. Electronic mail or pin-to-pin messages sent to or from mobile devices (e.g., iPhone and
`
`Blackberry devices), provided that a copy of such mail is routinely saved elsewhere.
`
`9. Other electronic data stored on a mobile device, such as calendar or contact data or notes,
`
`provided that a copy of such information is routinely saved elsewhere.
`
`10. Logs of calls made from mobile-devices.
`
`11. Server, system or network logs.
`
`12. Electronic data temporarily stored by laboratory equipment or attached electronic
`
`equipment, provided that such data is not ordinarily preserved as part of a laboratory report.
`
`13. Data remaining from systems no longer in use that is unintelligible on the systems in use.
`
`10
`
`

`

`Case 1:23-cv-00758-JLH Document 59-3 Filed 05/13/24 Page 12 of 13 PageID #: 1514
`
`IT IS SO STIPULATED, THROUGH COUNSEL OF RECORD.
`
`Dated: May 13, 2024April 30, 2024
`
`OF COUNSEL:
`Douglas E. Lumish
`Lucas Lonergan
`LATHAM & WATKINS LLP
`140 Scott Drive
`Menlo Park, CA 94025
`(650) 328-4600
`
`Blake R. Davis
`LATHAM & WATKINS LLP
`505 Montgomery Street,
`Suite 2000
`San Francisco, CA 94111
`(415) 391-0600
`
`Kristina D. McKenna
`LATHAM & WATKINS LLP
`200 Clarendon Street
`Boston, MA 02116
`(617) 948-6000
`
`OF COUNSEL:
`
`Jordan R. Jaffe
`Catherine Lacey
`Callie Davidson
`Alex Miller
`WILSON SONSINI GOODRICH & ROSATI,
`P.C.
`One Market Plaza
`Spear Tower, Suite 3300
`San Francisco, CA 94105
`(415) 947-2000
`
`MORRIS, NICHOLS, ARSHT &TUNNELL LLP
`
`/s/
`Jack B. Blumenfeld (#1014)
`Rodger D. Smith II (#3778)
`1201 North Market Street
`P.O. Box 1347
`Wilmington, DE 19899-1347
`(302) 658-9200
`jblumenfeld@morrisnichols.com
`rsmith@morrisnichols.com
`
`Attorneys for Plaintiff Orca Security Ltd.
`
`RICHARDS, LAYTON & FINGER, P.A.
`
`/s/______________________________
`Frederick L. Cottrell, III (#2555)
`Kelly E. Farnan (#4395)
`Christine D. Haynes (#4697)
`One Rodney Square
`920 N. King Street
`Wilmington, DE 19801
`(302) 658-6541
`cottrell@rlf.com
`farnan@rlf.com
`haynes@rlf.com
`
`Attorneys for Defendant Wiz, Inc.
`
`11
`
`

`

`Case 1:23-cv-00758-JLH Document 59-3 Filed 05/13/24 Page 13 of 13 PageID #: 1515
`
`SO ORDERED.
`
`Dated:
`
`
`
`__________________________________
`The Honorable Jennifer L. Hall
`United States District Court Judge
`
`12
`
`