`
`THE TRUSTEES OF COLUMBIA UNIVERSITY IN THE CITY OF
`NEW YORK
`v.
` SYMANTEC CORPORATION
`
` ___________________________________________________
`
`PEREIRA, SHANE, 30(B)(6) ‐ Vol. 1
`September 24, 2014
`
` ___________________________________________________
`
`
`CONFIDENTIAL ‐ OUTSIDE COUNSEL ONLY
`
`-1-
`
`Columbia Ex. 2013
`Symantec v. Columbia
`IPR2015-00375
`
`
`
`CONFIDENTIAL - OUTSIDE COUNSEL ONLY
`SHANE PEREIRA, 30(B)(6) - 9/24/2014
`
`Page 1
`
` IN THE UNITED STATES DISTRICT COURT
` FOR THE EASTERN DISTRICT OF VIRGINIA
` RICHMOND DIVISION
`
`THE TRUSTEES OF COLUMBIA )
`UNIVERSITY IN THE CITY OF )
`NEW YORK, )
` Plaintiff, ) Case No.
` vs. ) 3:13-cv-00808
`SYMANTEC CORPORATION, ) JRS
` Defendant. )
` )
`
` CONFIDENTIAL - OUTSIDE COUNSEL ONLY
`
` 30(B)(6) DEPOSITION OF SHANE PEREIRA
` TAKEN ON
` WEDNESDAY, SEPTEMBER 24, 2014
`
`Reported by: PHILIP D. NORRIS
` CSR NO. 4980
`
`Merrill Corporation
`800-826-0277
`www.deposition.com/southern-california.htm
`
`-2-
`
`Columbia Ex. 2013
`Symantec v. Columbia
`IPR2015-00375
`
`
`
`CONFIDENTIAL - OUTSIDE COUNSEL ONLY
`SHANE PEREIRA, 30(B)(6) - 9/24/2014
`
`Page 2
`
` 30 (b)(6) Deposition of Shane Pereira,
`taken on behalf of Plaintiff, at 1800 Avenue of the
`Stars, Los Angeles, California, on Wednesday,
`September 24, 2014, at 9:13 a.m., before Philip D.
`Norris, CSR No. 4980, pursuant to Notice.
`
`APPEARANCES:
`FOR THE PLAINTIFF:
` IRELL & MANELLA
` BY: JASON SHEASBY, ESQ.
` 1800 Avenue of the Stars
` Suite 900
` Los Angeles, California 90067-4276
` (310) 277-1010
`FOR THE DEFENDANT:
` QUINN EMANUEL
` BY: NATHAN HAMSTRA, ESQ.
` 500 West Madison Street
` Suite 2450
` Chicago, Illinois 60661
` (312) 705-7400
`ALSO PRESENT:
` THOMAS W. BARR
` STEPHEN SMITH (Videographer)
` DAVID MAJORS, ESQ.
`
`1
`2
`3
`4
`5
`
`6 7
`
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`
`Merrill Corporation
`800-826-0277
`www.deposition.com/southern-california.htm
`
`-3-
`
`Columbia Ex. 2013
`Symantec v. Columbia
`IPR2015-00375
`
`
`
`CONFIDENTIAL - OUTSIDE COUNSEL ONLY
`SHANE PEREIRA, 30(B)(6) - 9/24/2014
`
`Page 5
`
` LOS ANGELES, CALIFORNIA; WEDS, SEPTEMBER 24, 2014
` 9:13 A.M.
`
` THE VIDEOGRAPHER: Here begins Volume I,
`Videotape No. 1, in the deposition of Shane Pereira,
`in the matter of The Trustees of Columbia University
`in the City of New York versus Symantec, in the
`United States District Court for the Eastern
`District of Virginia, Richmond Division. Case
`number is 1313-cv-00808-JRS (sic).
` Today's date is September 24, 2014. Time
`on the video monitor is 9:13. The video operator
`today is Stephen Smith, contracted by Merrill
`Deposition Services at 20750 Ventura Boulevard,
`Suite 205, Woodland Hills, California 91364.
` This video deposition is taking place at
`Irell & Manella LLP, 1800 Avenue of the Stars, Suite
`900, Los Angeles, California 90067, and was noticed
`by Jason Sheasby of Irell & Manella.
` Counsel, please voice identify yourselves
`and state whom you represent.
` MR. SHEASBY: Jason Sheasby for Columbia.
`With me is Thomas Barr.
` MR. HAMSTRA: Nathan Hamstra, Quinn
`
`08:50:51
`08:50:59
`08:50:59
`09:12:52
`09:12:52
`09:13:03
`09:13:06
`09:13:11
`09:13:15
`09:13:17
`09:13:21
`09:13:26
`09:13:32
`09:13:36
`09:13:41
`09:13:43
`09:13:48
`09:13:52
`09:13:57
`09:14:03
`09:14:05
`09:14:07
`09:14:08
`09:14:11
`09:14:13
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`
`Merrill Corporation
`800-826-0277
`www.deposition.com/southern-california.htm
`
`-4-
`
`Columbia Ex. 2013
`Symantec v. Columbia
`IPR2015-00375
`
`
`
`CONFIDENTIAL - OUTSIDE COUNSEL ONLY
`SHANE PEREIRA, 30(B)(6) - 9/24/2014
`
`Page 6
`
`09:14:19
`09:14:19
`09:14:19
`09:14:20
`09:14:23
`09:14:25
`09:14:27
`
`09:14:39
`09:14:39
`09:14:40
`09:14:41
`09:14:41
`09:14:45
`09:14:46
`
`09:14:47
`09:14:47
`09:14:51
`
`Emanuel, for Symantec and the witness.
` MR. MAJORS: David Majors, Symantec
`in-house counsel.
` THE VIDEOGRAPHER: Court reporter today is
`Philip Norris, Merrill Deposition Services.
` Would the reporter please swear in the
`witness.
`
` SHANE PEREIRA,
` having been first duly sworn, was
` examined and testified as follows:
`
` EXAMINATION
`
`BY MR. SHEASBY:
` Q. Good morning, sir.
` A. Morning.
` Q. I'm handing you what I've marked as Pereira
`Exhibit 1.
` (The document referred to was marked by the
`reporter as Exhibit 1 for identification and is
`attached hereto.)
`BY MR. SHEASBY:
` Q. Sir, this is a 30 (b)(6) notice which was
`served by Columbia University on Symantec, and
`
`1
`2
`3
`4
`5
`6
`7
`
`8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`
`Merrill Corporation
`800-826-0277
`www.deposition.com/southern-california.htm
`
`-5-
`
`Columbia Ex. 2013
`Symantec v. Columbia
`IPR2015-00375
`
`
`
`CONFIDENTIAL - OUTSIDE COUNSEL ONLY
`SHANE PEREIRA, 30(B)(6) - 9/24/2014
`
`Page 153
`
`25
`
` Q. And what's your position at Symantec?
`
`13:34:12
`
`Merrill Corporation
`800-826-0277
`www.deposition.com/southern-california.htm
`
`-6-
`
`Columbia Ex. 2013
`Symantec v. Columbia
`IPR2015-00375
`
`
`
`CONFIDENTIAL - OUTSIDE COUNSEL ONLY
`SHANE PEREIRA, 30(B)(6) - 9/24/2014
`
`Page 154
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`
` A. I'm a distinguished engineer.
` Q. And what level of -- what is the level of
`that in the hierarchy of engineers at Symantec?
` A. It's one level below fellow, which is the
`highest position on -- on the engineering ladder.
` Q. And so on the engineer side there's fellow
`and there's distinguished engineer; correct?
` A. Correct.
` Q. How many fellows are there?
` A. Four, five, somewhere in that range.
` Q. And how many distinguished engineers are
`there?
` A. I don't know. I don't know. Probably be
`in the teens, I would guess.
`
`13:34:13
`13:34:17
`13:34:20
`13:34:24
`13:34:27
`13:34:29
`13:34:33
`13:34:34
`13:34:34
`13:34:37
`13:34:39
`13:34:41
`13:34:42
`13:34:44
`
`Merrill Corporation
`800-826-0277
`www.deposition.com/southern-california.htm
`
`-7-
`
`Columbia Ex. 2013
`Symantec v. Columbia
`IPR2015-00375
`
`
`
`CONFIDENTIAL - OUTSIDE COUNSEL ONLY
`SHANE PEREIRA, 30(B)(6) - 9/24/2014
`
`Page 280
`
`25
`
` You agree that humans can identify the same
`
`17:16:42
`
`Merrill Corporation
`800-826-0277
`www.deposition.com/southern-california.htm
`
`-8-
`
`Columbia Ex. 2013
`Symantec v. Columbia
`IPR2015-00375
`
`
`
`CONFIDENTIAL - OUTSIDE COUNSEL ONLY
`SHANE PEREIRA, 30(B)(6) - 9/24/2014
`
`Page 281
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`
`types of patterns as machine learning; correct?
` A. Did you say "can" or "can't"?
` Q. Can. They can.
` A. I --
` MR. HAMSTRA: Objection. Outside the
`scope.
` THE WITNESS: I don't think that's -- I
`don't think that's -- that's possible.
`BY MR. SHEASBY:
` Q. You believe that machine -- you believe
`that machine-learning classification sets are very
`similar to the type of heuristic rule sets that
`humans create; correct?
` MR. HAMSTRA: Objection. Calls for legal
`conclusion, outside the scope, calls for expert
`testimony.
` THE WITNESS: If they were similar we
`probably wouldn't do it. We believe they are --
`they are superior to what a human can do in the same
`amount of time and resources.
`BY MR. SHEASBY:
` Q. Heuristic human classification rule sets
`are really in the same field as these
`machine-learning rule sets that you're constructing;
`correct?
`
`17:16:44
`17:16:50
`17:16:51
`17:16:53
`17:17:04
`17:17:05
`17:17:08
`17:17:11
`17:17:15
`17:17:16
`17:17:22
`17:17:26
`17:17:31
`17:17:32
`17:17:33
`17:17:34
`17:17:44
`17:17:46
`17:17:47
`17:17:53
`17:17:55
`17:17:56
`17:18:00
`17:18:04
`17:18:07
`
`Merrill Corporation
`800-826-0277
`www.deposition.com/southern-california.htm
`
`-9-
`
`Columbia Ex. 2013
`Symantec v. Columbia
`IPR2015-00375
`
`
`
`CONFIDENTIAL - OUTSIDE COUNSEL ONLY
`SHANE PEREIRA, 30(B)(6) - 9/24/2014
`
`Page 282
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`
` MR. HAMSTRA: Objection. Calls for legal
`conclusion, outside the scope, calls for expert
`testimony.
` THE WITNESS: Again, I don't know what is a
`heuristic human classification.
`BY MR. SHEASBY:
` Q. You've heard of heuristics; correct?
` A. Yes.
` Q. Heuristics are rules constructed by humans;
`correct?
` A. Not necessarily.
` Q. Well, you agree that one class of
`heuristics are those constructed by humans; correct?
` A. Yes.
` Q. And you agree that human heuristics are
`comparable and similar to machine-learning
`classification sets; correct?
` MR. HAMSTRA: Objection. Calls for legal
`conclusion, outside the scope, calls for expert
`testimony.
` THE WITNESS: Comparable in what way?
`BY MR. SHEASBY:
` Q. They're interchangeable information and
`design strategies that you use for the human
`heuristics are easily applicable in the
`
`17:18:07
`17:18:08
`17:18:11
`17:18:11
`17:18:13
`17:18:18
`17:18:18
`17:18:19
`17:18:19
`17:18:23
`17:18:24
`17:18:26
`17:18:29
`17:18:32
`17:18:33
`17:18:39
`17:18:43
`17:18:44
`17:18:45
`17:18:48
`17:18:48
`17:18:48
`17:18:50
`17:18:53
`17:18:55
`
`Merrill Corporation
`800-826-0277
`www.deposition.com/southern-california.htm
`
`-10-
`
`Columbia Ex. 2013
`Symantec v. Columbia
`IPR2015-00375
`
`
`
`CONFIDENTIAL - OUTSIDE COUNSEL ONLY
`SHANE PEREIRA, 30(B)(6) - 9/24/2014
`
`Page 283
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`
`machine-learning context; correct?
` MR. HAMSTRA: Objection. Outside the
`scope, calls for legal conclusion, calls for expert
`testimony.
` THE WITNESS: They aren't interchangeable
`in the sense that I've never seen a human create a
`heuristic that was also generated by a
`machine-learned classifier.
`BY MR. SHEASBY:
` Q. And you agree that executable attachments
`sent over e-mail are structured in the same way as
`executable attachments saved on a local disk;
`correct?
` MR. HAMSTRA: Objection. Calls for legal
`conclusion, outside the scope, calls for expert
`testimony.
` THE WITNESS: That's a very broad
`assertion. They're not always the case. They could
`be backed differently, for example.
`BY MR. SHEASBY:
` Q. Well, executable attachments sent over
`e-mail use MIME format; correct?
` MR. HAMSTRA: Objection. Outside the
`scope, calls for legal conclusion, calls for expert
`testimony.
`
`17:18:58
`17:19:00
`17:19:01
`17:19:04
`17:19:11
`17:19:15
`17:19:19
`17:19:21
`17:19:23
`17:19:25
`17:19:28
`17:19:33
`17:19:35
`17:19:36
`17:19:38
`17:19:40
`17:19:40
`17:19:42
`17:19:46
`17:19:47
`17:19:48
`17:19:51
`17:19:54
`17:19:55
`17:19:58
`
`Merrill Corporation
`800-826-0277
`www.deposition.com/southern-california.htm
`
`-11-
`
`Columbia Ex. 2013
`Symantec v. Columbia
`IPR2015-00375
`
`
`
`CONFIDENTIAL - OUTSIDE COUNSEL ONLY
`SHANE PEREIRA, 30(B)(6) - 9/24/2014
`
`Page 284
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`
` THE WITNESS: That is not always true.
`Incorrect.
`BY MR. SHEASBY:
` Q. But sometimes they use MIME format;
`correct?
` A. Correct.
` MR. HAMSTRA: Objection. Outside the
`scope.
`BY MR. SHEASBY:
` Q. And the fact that they use MIME format is
`irrelevant; right? Because even if they use MIME
`format, their structure will be the same as the
`structure of executable attachments saved on local
`disks; correct?
` MR. HAMSTRA: Objection. Outside the
`scope, calls for expert testimony.
` THE WITNESS: Again, the -- the -- depends
`what you mean by "structure." The structure of
`executables can vary between e-mail or any other
`mechanism just by the way they're packed, the way
`they're constructed.
`
`17:19:58
`17:20:01
`17:20:01
`17:20:01
`17:20:04
`17:20:05
`17:20:05
`17:20:07
`17:20:07
`17:20:07
`17:20:10
`17:20:13
`17:20:16
`17:20:19
`17:20:20
`17:20:22
`17:20:23
`17:20:26
`17:20:29
`17:20:38
`17:20:42
`
`Merrill Corporation
`800-826-0277
`www.deposition.com/southern-california.htm
`
`-12-
`
`Columbia Ex. 2013
`Symantec v. Columbia
`IPR2015-00375
`
`
`
`CONFIDENTIAL - OUTSIDE COUNSEL ONLY
`SHANE PEREIRA, 30(B)(6) - 9/24/2014
`
`Page 286
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`
`BY MR. SHEASBY:
` Q. Analysis of unauthorized user access to a
`system is -- strike that.
` Detecting an unauthorized user access to a
`system is very similar to detecting a malicious
`executable; correct?
` MR. HAMSTRA: Objection. Outside the
`scope, calls for legal conclusion, calls for expert
`testimony.
` THE WITNESS: That's incorrect.
`BY MR. SHEASBY:
` Q. And determining whether a particular event
`is anomalous is very similar to determining whether
`a sequence of events is anomalous; correct?
` MR. HAMSTRA: Objection. Outside the
`scope, calls for legal conclusion --
` THE WITNESS: Again, that's --
` MR. HAMSTRA: -- calls for expert
`testimony.
` THE WITNESS: That's incorrect.
`BY MR. SHEASBY:
` Q. Records of user commands provide similar
`information to records of executables and other
`processes that run on a computer; correct?
` MR. HAMSTRA: Objection. Outside the
`
`17:22:25
`17:22:36
`17:22:40
`17:22:42
`17:22:45
`17:22:48
`17:22:49
`17:22:50
`17:22:53
`17:22:56
`17:22:56
`17:22:56
`17:22:58
`17:23:02
`17:23:04
`17:23:05
`17:23:07
`17:23:07
`17:23:08
`17:23:10
`17:23:11
`17:23:13
`17:23:16
`17:23:23
`17:23:25
`
`Merrill Corporation
`800-826-0277
`www.deposition.com/southern-california.htm
`
`-13-
`
`Columbia Ex. 2013
`Symantec v. Columbia
`IPR2015-00375
`
`
`
`CONFIDENTIAL - OUTSIDE COUNSEL ONLY
`SHANE PEREIRA, 30(B)(6) - 9/24/2014
`
`Page 287
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`
`scope, calls for legal conclusion, calls for expert
`testimony.
` THE WITNESS: Sorry, that was a long
`sentence. Could you repeat that, please?
` (Whereupon the record was read as follows:
` "Q. Records of user commands provide
` similar information to records of executables
` and other processes that run on a computer;
` correct?")
` THE WITNESS: That's incorrect.
`BY MR. SHEASBY:
` Q. Determining whether a file system access is
`anomalous is really comparable to monitoring a
`particular file or registry location to see whether
`a change has been made; correct?
` MR. HAMSTRA: Objection. Outside the
`scope, calls for legal conclusion, calls for expert
`testimony, incomplete hypothetical.
` THE WITNESS: I'm sorry, I'm going to have
`to ask you to repeat it again. I'm losing my train
`of thought.
` (Whereupon the record was read as follows:
` "Q. Determining whether a file system
` access is anomalous is really comparable to
` monitoring a particular file or registry
`
`17:23:26
`17:23:28
`17:23:29
`17:23:31
`17:23:35
`17:23:13
`17:23:15
`17:23:23
`17:23:25
`17:23:50
`17:23:51
`17:23:59
`17:24:01
`17:24:06
`17:24:09
`17:24:11
`17:24:12
`17:24:14
`17:24:19
`17:24:27
`17:24:31
`17:24:31
`17:23:59
`17:24:01
`17:24:05
`
`Merrill Corporation
`800-826-0277
`www.deposition.com/southern-california.htm
`
`-14-
`
`Columbia Ex. 2013
`Symantec v. Columbia
`IPR2015-00375
`
`
`
`CONFIDENTIAL - OUTSIDE COUNSEL ONLY
`SHANE PEREIRA, 30(B)(6) - 9/24/2014
`
`Page 288
`
`1
`2
`3
`4
`5
`
` location to see whether a change has been made;
` correct?")
` MR. HAMSTRA: Same objections.
` THE WITNESS: They're two completely
`different things. Incorrect.
`
`17:24:08
`17:24:11
`17:24:48
`17:24:53
`17:24:55
`
`Merrill Corporation
`800-826-0277
`www.deposition.com/southern-california.htm
`
`-15-
`
`Columbia Ex. 2013
`Symantec v. Columbia
`IPR2015-00375
`
`
`
`/(V
`
`CONFIDENTIAL - OUTSIDE COUNSEL ONLY
`
`SHANE PEREIRA, 30(B)(6)
`
`- 9/24/2014
`
`Page 313
`
`STATE OF CALIFORNIA
`
`COUNTY OF LOS ANGELES
`
`I, Philip D. Norris, a Certified shorthand
`
`Reporter for the State of California, do hereby
`
`certify:
`
`I am the deposition officer that
`
`stenographically recorded the testimony in the
`
`foregoing deposition;
`
`Prior to being examined the deponent was
`
`first duly sworn by me;
`
`The foregoing transcript is a true record
`
`of the testimony given;
`
`Before completion of the deposition,
`
`review
`
`of the transcript
`
`[ x ] was
`
`[
`
`] was not requested.
`
`If requested, any changes made by the deponent
`
`(and
`
`provided to the reporter) during the period allowed
`
`are appended.
`
`m.L\
`
`Philip D. Nor is
`CSR NO. 4980
`
`800-826-027]
`Merrill Corporation
`www.deposition.com/soU%hern-California.htm
`C0hHnbH1EX.2013
`Symantec V. Columbia
`IPR201 5-003 75
`
`-16-
`
`Columbia Ex. 2013
`Symantec v. Columbia
`IPR2015-00375