Case 5:15-md LHK Document Filed 04/06/17 Page 1 of 10

Transcription

1 Case :-md-0-lhk Document - Filed 0/0/ Page of 0 0 Craig A. Hoover, SBN E. Desmond Hogan (admitted pro hac vice) Peter R. Bisio (admitted pro hac vice) Michelle A. Kisloff (admitted pro hac vice) Allison M. Holt (admitted pro hac vice) Thirteenth Street, NW Washington, DC 00 Tel: () -00 Fax: () -0 craig.hoover@hoganlovells.com desmond.hogan@hoganlovells.com peter.bisio@hoganlovells.com michelle.kisloff@hoganlovells.com allison.holt@hoganlovells.com Michael M. Maddigan, SBN 0 Avenue of the Stars, Suite 00 Los Angeles, CA 00 Tel: (0) -00 Fax: (0) -0 michael.maddigan@hoganlovells.com Attorneys for Defendants Anthem, Inc. and related parties Additional Defendants and Defendants Counsel Listed on Signature Page IN RE ANTHEM, INC. DATA BREACH LITIGATION UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF CALIFORNIA SAN JOSE DIVISION Case No. :-MD-0-LHK DEFENDANTS NOTICE OF MOTION AND MOTION TO EXCLUDE TESTIMONY OF JAMES VAN DYKE The Honorable Lucy H. Koh Date: June, Time: :0 p.m. Courtroom:, th Floor [Declaration of Jasmeet K. Ahuja and [Proposed] Order Filed Concurrently Herewith] REDACTED VERSION OF DOCUMENT SOUGHT TO BE SEALED Case No. -MD-0-LHK

2 Case :-md-0-lhk Document - Filed 0/0/ Page of 0 0 NOTICE OF MOTION AND MOTION TO ALL PARTIES AND THEIR ATTORNEYS OF RECORD: PLEASE TAKE NOTICE THAT Defendant Anthem, Inc. ( Anthem ) and Defendants Blue Cross and Blue Shield of Georgia, Inc., Blue Cross Blue Shield Healthcare Plan of Georgia, Inc., Anthem Insurance Companies, Inc., Blue Cross of California, Anthem Blue Cross Life and Health Insurance Company, Rocky Mountain Hospital and Medical Service, Inc., Anthem Health Plans, Inc., Anthem Health Plans of Kentucky, Inc., Anthem Health Plans of Maine, Inc., HMO Missouri, Inc., RightCHOICE Managed Care, Inc., Healthy Alliance Life Insurance Company, Anthem Health Plans of New Hampshire, Inc., Empire HealthChoice Assurance, Inc., Community Insurance Company, Anthem Health Plans of Virginia, Inc., HealthKeepers, Inc., Blue Cross Blue Shield of Wisconsin, Compcare Health Services Insurance Corporation, Amerigroup Corporation, Amerigroup Services, Inc., Amerigroup Kansas, Inc., HealthLink, Inc., UniCare Life & Health Insurance Company, Caremore Health Plan, The Anthem Companies, Inc., and The Anthem Companies of California, Inc.; Defendants Blue Cross and Blue Shield of Alabama, USAble Mutual Insurance Company, d/b/a Arkansas Blue Cross and Blue Shield, California Physicians Service d/b/a Blue Shield of California, Blue Cross Blue Shield of Florida, Inc. d/b/a Florida Blue, CareFirst of Maryland, Inc., Blue Cross and Blue Shield of Massachusetts, Inc., Blue Cross and Blue Shield of Michigan, BCBSM, Inc. d/b/a Blue Cross and Blue Shield of Minnesota, Horizon Healthcare Services, Inc., Blue Cross and Blue Shield of North Carolina, Highmark Inc. f/k/a Highmark Health Services, Blue Cross Blue Shield of Vermont, Health Care Service Corporation, a Mutual Legal Reserve Company, d/b/a Blue Cross and Blue Shield of Illinois and Blue Cross and Blue Shield of Texas; and Blue Cross Blue Shield Association (collectively, Defendants ) will and hereby do move to exclude the testimony of James Van Dyke. The hearing on this Motion will be held on June, in the Courtroom of the Honorable Lucy H. Koh, located at the Robert F. Peckham Federal Building & United States Courthouse, 0 South First Street, th Floor, San Jose, California. Defendants bring this Motion pursuant to Federal Rule of Evidence 0 and Daubert v. Merrell Dow Pharms., Inc., 0 U.S. (). - i - Case No. -MD-0-LHK

3 Case :-md-0-lhk Document - Filed 0/0/ Page of 0 Defendants base this Motion on this Notice of Motion, the attached Memorandum of Points and Authorities, the supporting declaration of Jasmeet K. Ahuja and the exhibits filed therewith, the complete files and records of this action, and such other matters and arguments as may come before the Court, including those raised in connection with reply briefing and oral argument relating to this Motion. Dated: April, By: /s/ Craig A. Hoover Craig A. Hoover Attorney for Anthem and related parties 0 - ii - Case No. -MD-0-LHK

4 Case :-md-0-lhk Document - Filed 0/0/ Page of 0 0 MEMORANDUM OF POINTS AND AUTHORITIES Defendants respectfully request that the Court exclude the opinions and reports of Plaintiffs designated expert James Van Dyke because his opinions: () are irrelevant to Plaintiffs theory of the case; () provide no evidence showing that Plaintiffs can prove their claims through common proof; and () employ an unscientific and unreliable methodology. For each of these reasons, Defendants motion should be granted. Fed R. Evid. 0; Daubert v. Merrell Dow Pharmaceuticals, Inc., 0 U.S. () ( Daubert I ). I. VAN DYKE S OPINONS ARE NOT RELEVANT. Van Dyke s entire theory is summarized in his opinions that [i]ndividuals whose personal data is compromised are subject to increased risk because of that compromise and that the risk increases with each compromise and with the sensitivity of the compromised information. Ex. (Van Dyke Rep.),. This opinion fails the fundamental test that an expert s opinion be relevant. Fed. R. Evid. 0; Daubert, 0 U.S. at - (expert testimony must fit and be relevant to the task at hand ). Plaintiffs proffer Van Dyke as their expert on the loss of value of PII, but Van Dyke admitted that he do[es]n t bring expertise in that subject. Ex. (Van Dyke Depo.) at. Indeed, far from being an expert, Van Dyke was unable to even say what loss of value of PII means, characterizing it as a legal term. Id. at. Instead, admitting he has nothing to say on the lost value of PII, Van Dyke described himself as an expert in how risk is increased when data is breached. Id. at. But that is different in kind from Plaintiffs theory that their PII diminished in value. Plaintiffs contend that the information stolen as a result of the Anthem Data breach has value, and that Plaintiffs should be compensated for the loss and diminution in value. Dkt. 0 at. By his own admission, however, Van Dyke offers no expertise or opinions about the alleged value of Plaintiffs information or how that value diminished the very theory Plaintiffs offer his testimony to support. His opinions therefore fail to logically advance a material aspect of Plaintiffs case, are irrelevant, and should be excluded. Cooper v. Brown, 0 F.d 0, (th Cir. 0); Daubert v. Merrell Dow Pharms., Inc., F.d, n. (th Cir. ) ( Daubert II ) (expert evidence must be excluded unless it speaks clearly and directly to an issue - - Case No. -MD-0-LHK

5 Case :-md-0-lhk Document - Filed 0/0/ Page of 0 0 in dispute in the case.... ). II. VAN DYKE S OPINIONS OFFER NO MEANS OF PROVING CAUSATION OR INJURY ON A CLASSWIDE BASIS. Van Dyke s opinions also should be excluded because he offers no evidence that can establish injury or causation on a classwide basis. Remarkably, Van Dyke admits that he has no opinion even that any particular class member suffered injuries from the Anthem cyberattack. Ex. at, -0. Moreover, he acknowledges that the majority of the purported class members never will suffer any identity theft or fraud caused by the attack. Id. at 0 ( I would fully expect that the majority of people who had their data exfiltrated in the Anthem breach will not become victims of fraud. ). As a result, Van Dyke s opinion amounts to nothing more than the superficial conclusion that there is a correlation between PII exposure and fraudulent activity. Id. at 0. And even that very limited opinion is based primarily on the Identity Theft Survey Report, a generic annual consumer research survey conducted by his former company, Javelin Strategy & Research, from which he draws the conclusion that Ex.,. This opinion cannot prove causation or classwide injury for three reasons. First, the Javelin surveys do not provide a sound basis for opining about common injury in this case because the most common form of theft reflected in the surveys, credit card information, was not breached in the Anthem cyberattack. Ex. at, 0. Thus, Van Dyke s basic framework of more disclosed information=greater risk of misuse does not fit this case. Second, even though Van Dyke s entire theory is that the risk of future harm increases as the nature and type of information disclosed about a person increases, he utterly fails to consider Plaintiffs individual histories, as his own theory demands. For example, Van Dyke cannot distinguish between the supposedly increased risk that the Anthem Data Breach poses to someone whose Social Security Number has been stolen twice before and someone whose credit card information has been stolen twice before. He likewise cannot distinguish between someone whose data first was misappropriated in 0 and someone whose data was part of the recent OPM breach. He treats all types of data and all types of incidents the same for the purpose of his - - Case No. -MD-0-LHK

6 Case :-md-0-lhk Document - Filed 0/0/ Page of 0 testimony, even while admitting that the type of breached data and the number of times that data is breached matters in terms of risk of fraud. Id. at. His theory simply does not work. Third, Van Dyke admitted that he do[es]n t really have an opinion about the motivation behind the Anthem cyberattack. Id. at. But the motivation behind an attack is highly relevant to assessing any claim for injuries or any risk of future injury, and it illustrates the problems with contending that any data incident necessarily causes injury. Indeed, even Javelin itself noted in one of the same reports that Van Dyke cites extensively that data breaches 0 Ex. ( Identity Fraud: Fraud Hits an Inflection Point, Javelin Strategy & Research, Feb. ) at. Van Dyke s embrace of Javelin s methodology and his claim to have authored all of Javelin s publications preclude him from selectively disavowing this finding. Ex. at, -,. Regardless, it is uncontroversial that the risks of identity theft and fraud imposed by a criminal group who steals credit card numbers for financial gain are simply not the same as those from a nation-state actor hacking for espionage purposes. Ex. (ANTMMDL-0) at ( In CrowdStrike s experience, attacks associated with this foreign government have not resulted in PII being transferred to non-state actors. ). Plaintiffs therefore are wrong to suggest that classwide injury can be established by Van Dyke s flimsy correlation without considering (a) the primary type of data (credit card) stolen in the surveys that provide the purported basis for that correlation, (b) the different types of data stolen for the various class members in the Anthem cyberattack, (c) the nature and timing of earlier data breaches, or (d) the Plaintiffs individual information security practices. III. VAN DYKE S METHODOLOGY IS UNRELIABLE. Van Dyke s proposed expert opinion also is unreliable. He did no independent research or analysis, conducted no consumer surveys of his own, and made no independent assessment of the risks posed to consumers by the Anthem cyberattack. He did not evaluate whether Plaintiffs themselves actually were victims of any fraudulent activity. Ex., ; Ex. at ( The only thing I have an opinion on is that there is increased risk of the exfiltrated data being used for - - Case No. -MD-0-LHK

7 Case :-md-0-lhk Document - Filed 0/0/ Page of 0 0 economic gain.). He did not survey any of the Plaintiffs or read any of their deposition transcripts to determine what harm they allege they encountered as a result of the Anthem cyberattack. Ex. at 0-,. He also did not rest his conclusions on the attacker s identity. Indeed, he readily conceded that he made no efforts to tailor his general analysis to the Anthem cyberattack in particular or to consider the types of information disclosed in the cyberattack. Id. at -. There is nothing expert about this methodology indeed, it is not a methodology at all. For example, when asked to explain why he believes that all impacted Anthem members should be afforded years of credit monitoring protection, Van Dyke said that it was the particular eight-record fields breached in the attack and the estimated persistence of those fields that led to his conclusion, but he was unable to explain how they did so. Id. at -. This failure is particularly glaring because Van Dyke contends that the theft of one s SSN poses the highest risk of fraud, but still concedes that that risk falls to nearly zero after four years. Id. at 0. Van Dyke also assumed that the same records were taken for all Plaintiffs even though they were not. Id. at,. Ex. (N. Colton Decl.) at. Van Dyke simply assumed for the purposes of his recommendation that each Plaintiff s data contained a perfect, complete packet[] of information and conceded that he did not even consider that there may be inaccuracies or differences in the stolen data. Ex. at,. Daubert demands more more methodology and more rigor. Van Dyke s expert testimony is not grounded in his own independent work, in the methods of science, or in scientifically valid principles. Daubert I, 0 U.S. at ; Daubert II, F.d at. It thus falls below the requirements of Rule 0. United States v. Finley, 0 F.d 000, 00 (th Cir. 0) (citing Fed. R. Evid. 0); see also Gbarabe v. Chevron Corp., WL, at * (N.D. Cal. ) (finding inadmissible an expert report which was unsupported by any scientific data analysis and whose expert admitted he had no opinion about causation). CONCLUSION For the reasons stated above, Defendants respectfully request that the Court exclude Van Dyke s reports and opinions in their entirety. - - Case No. -MD-0-LHK

8 Case :-md-0-lhk Document - Filed 0/0/ Page of 0 0 Respectfully submitted, CRAIG A. HOOVER E. DESMOND HOGAN PETER R. BISIO MICHELLE A. KISLOFF ALLISON M. HOLT Dated: April, By: /s/ Craig A. Hoover Craig A. Hoover (SBN ) craig.hoover@hoganlovells.com E. Desmond Hogan (admitted pro hac vice) desmond.hogan@hoganlovells.com Peter R. Bisio (admitted pro hac vice) peter.bisio@hoganlovells.com Michelle A. Kisloff (admitted pro hac vice) michelle.kisloff@hoganlovells.com Allison M. Holt (admitted pro hac vice) allison.holt@hoganlovells.com Thirteenth Street, NW Washington, DC 00-0 Telephone: () -00 Facsimile: () -0 Michael Maddigan (SBN 0) michael.maddigan@hoganlovells.com Avenue of the Stars, Suite 00 Los Angeles, CA 00 Telephone: (0) -00 Facsimile: (0) -0 Attorneys for Defendants Anthem, Inc., and certain of its affiliates that have been named as defendants in the Fourth Amended Complaint (collectively, Anthem ) and Defendants Blue Cross and Blue Shield of Alabama, USAble Mutual Insurance Company d/b/a Arkansas Blue Cross Blue Shield and BlueAdvantage Administrators of Arkansas, California Physicians Service d/b/a Blue Shield of California, Blue Cross and Blue Shield of Florida, Inc. d/b/a Florida Blue, CareFirst of Maryland, Inc., Blue Cross and Blue Shield of Massachusetts, Inc., Blue Cross and Blue Shield of Michigan, Blue Cross and Blue Shield of Minnesota, - - Case No. -MD-0-LHK

9 Case :-md-0-lhk Document - Filed 0/0/ Page of 0 0 Horizon Healthcare Services, Inc., Blue Cross and Blue Shield of North Carolina, Highmark Health Services, and Blue Cross and Blue Shield of Vermont TROUTMAN SANDERS CHAD R. FULLER Dated: April, By: /s/ Chad R. Fuller Chad R. Fuller (SBN 00) chad.fuller@troutmansanders.com El Camino Real, Suite 00 San Diego, CA 0 Telephone: () 0-0 Facsimile: () 0-00 Attorney for Anthem NELSON MULLINS RILEY & SCARBOROUGH JOHN D. MARTIN LUCILE H. COHEN Dated: April, By: /s/ John D. Martin John D. Martin (admitted pro hac vice) john.martin@nelsonmullins.com Lucile H. Cohen (admitted pro hac vice) lucie.cohen@nelsonmullins.com Main Street, th Floor Columbia, SC Telephone: (0) - Facsimile: () -00 Attorneys for Anthem KIRKLAND & ELLIS BRIAN P. KAVANAUGH KATHERINE WARNER JESSICA STAIGER LUKE C. RUSE TIM PICKERT Dated: April, : By: /s/ Brian P. Kavanaugh Brian Kavanaugh (admitted pro hac vice) brian.kavanaugh@kirkland.com - - Case No. -MD-0-LHK

10 Case :-md-0-lhk Document - Filed 0/0/ Page 0 of 0 0 Katherine Warner (admitted pro hac vice) kate.warner@kirkland.com Jessica Staiger (admitted pro hac vice) jessica.staiger@kirkland.com Luke C. Ruse (admitted pro hac vice) luke.ruse@kirkland.com Tim Pickert (admitted pro hac vice) tim.pickert@kirkland.com 00 N. LaSalle Chicago, IL 0 Telephone: () -00 Facsimile: () -00 Attorneys for The Blue Cross Blue Shield Association and Health Care Service Corporation, a Mutual Legal Reserve Company, d/b/a Blue Cross and Blue Shield of Illinois and Blue Cross and Blue Shield of Texas - - Case No. -MD-0-LHK