Subject: RE: MLP investigation - preliminary findings
From: "Swayze, Melissa" <[email-masked]>
To: "Gianetti, Ed" <[email-masked]>
Cc: "Kim, Julia" <[email-masked]>
Date: Wed, 15 Nov 2017 17:15:19 -0500

There is not much. Basically, the agreement states that DHX will “cooperate and provide such assistance as may be reasonably necessary to engage [Hasbro] to successfully prosecute…”  Under the agreement DHX did represent that they would
“prevent unauthorized internet access…by using firewall or disconnecting such computers from the internet until a firewall has been installed” This is vague, and the only portion of the agreement that mentions breaches in confidential information.

I am writing a script of what Steve will tell DHX and will be referencing this language. While we do not currently have any plans to prosecute, these steps will be to build a case against any person, so we will ask DHX to cooperate so that
we can build such case.  Let me know if there is specific language you have for the steps you will be using once Steve has spoken to DHX that we may need to inform them of beforehand.

Best,

Swayze

From: Gianetti, Ed

Sent: Wednesday, November 15, 2017 2:02 PM

To: Swayze, Melissa <[email-masked]>

Subject: RE: MLP investigation - preliminary findings

Hi Swayze,

Can you provide us with a brief on the DHX contract language so we can develop a plan on how or what we are allowed to do to approach DHX?

Thanks,

Ed

From: Swayze, Melissa

Sent: Monday, November 13, 2017 1:51 PM

To: Gianetti, Ed <[email-masked]>

Cc: LaPorte, Jaime <[email-masked]>; Langston, Elizabeth <[email-masked]>; Boulanger, Caroline <[email-masked]>;
Fantini, Rob <[email-masked]>; Matlach, Nicholas <[email-masked]>

Subject: Re: MLP investigation - preliminary findings

Hi Ed,

I have spoken with Steve and he will be the one to reach out to DHX.  I would like to discuss with you what IT needs in place in order to work with DHX to look at their system so that Steve can inform DHX of these needs in his initial call
and so that IT can be ready to initiate such steps as soon as possible.

Best,

Swayze

Attorney, Business & Legal Affairs

Hasbro Studios LLC

3333 W Empire Ave. 5th Fl.

Burbank, CA 91504

818-478-4494

On Nov 9, 2017, at 5:44 AM, Gianetti, Ed <[email-masked]> wrote:

Hi Swayze,

Below please find some preliminary information uncovered by B&M regarding the MLP leak. This information appears to back-up the information we found and the course of action we were leaning towards.

Prior to moving forward can you:

o             ID the senior-most exec at DHX that we can contact to inform them of the situation…DO NOT contact them at this point.

o             Provide a brief on the DHX contract language as noted below (Reco #4).

We are still working with B&M regarding the recommended approach and will advise you ASAP.

Thanks,

Ed

From: Meyerhoff, Lisa [mailto:[email-masked]]

Sent: Wednesday, November 08, 2017 12:02 PM

To: Gianetti, Ed <[email-masked]>

Subject: MLP investigation - preliminary findings

Importance: High

ATTORNEY-CLIENT PRIVILEGED

Hi Ed,

My apologies for the brief delay – I was waiting to receive some additional information. Below is a summary of what we’ve found so far, with several recommendations (in red)
for follow up.

Based on what we’ve found so far, I believe there has been a hacker and that DHX may be a victim, and the weak link the hacker used to obtain the MLP information.

Let me know what you think - happy to discuss.

Regards,

Lisa

My Little Pony Investigation

Ponychan.net Route

Ponychan.net WHOIS search led to registrant and admin. contact Zachary Johnson.

1230 N LBJ DR., SAN MARCOS TX 78666 US

Phone: +1.6169142485

Email: [email-masked]

We weren’t able to find much else on him. The last update was 2015, so the WHOIS information may be outdated. But it doesn’t really matter exactly who Zachary Johnson is, because Ponychan lists
contact information for plenty of other people. Zachary Johnson is a moderator. He goes by the name
Twilight Sparkle; is also known as Astra!!RoyalGuard; and has the Skype handle
astrabolt. But the contact list gives information about the website owner and developers as well, and there are plenty of others we can contact for additional information.

Recommendation 1:
Contact
Ponychan.net to get more information on bighckintosh. The “rules”
of Ponychan specifically state, “Do not use this website for planning or conducting any activities which violate United States law.” Bighckintosh certainly broke that rule when he posted about what to do with 2 TB of Hasbro’s confidential information. Perhaps
they will be willing to cooperate, and provide more information on bighckintosh.

romesilvanus.io Route

Whoever is behind
iwatchitfortheplot.romesilvanus.io (“Rome Silvanus”) apparently is a little more cautious about protecting his identity. He used a domain name registration service called
Gandi SAS, a French company. But that doesn’t necessarily mean that Rome Silvanus is French. He could just as well be German, as he used
syncwerk (based in Weisentheid, Germany) to invite bighckintosh to upload the leaked MLP files.

According to Twitter,
@rome_silvanus is in Vienna, Austria. He’s indicated Vienna as his location elsewhere as well:

https://www.facebook.com/people/Rome-Silvanus/100014304376988

http://steamcommunity.com/id/rome_silvanus

https://www.furaffinity.net/user/romesilvanus/

NSFW (not suitable for work)
http://tumblr.romesilvanus.io/

https://bandcamp.com/rome_silvanus

He appears to have attended an MLP convention called
Nightmare Nights Dallas (Oct. 27–29, 2017) despite being banned by another brony,
@scopeguardpony:

Hasbro’s copyright counsel (Carin G. Reynolds of
Reynolds Law PLLC) contacted Rome Silvanus and his hosting service, Hetzner Online GmbH, on October 11, 2017. He posted both C&D letters on his website, and he has taken off the offending content according to Hasbro’s
10/17/27 intelligence memo. But we see lots of questionable materials still on the website,
e.g.,
here,
here, and
here.

He also posted this on 4chan, but when we click on it, it gives a 404 error.

As you know, BTSync means Bit Torrent Sync. He may have taken it off of his website, but it looks like he just took it where it’s more difficult to find but still as accessible to bronies.

Recommendation 2: Ed, did Ms. Reynolds receive any response from Rome Silvanus (or was it simply a takedown as requested without
any response)?

Recommendation 3: Contact
@scopeguardpony. The theory is that an enemy of an enemy is a friend, and he is an enemy of Rome Silvanus. Perhaps he has more information on
Silvanus.

DHX Route

It does not appear that DHX is the leaker. Instead, it seems more likely that DHX is the victim and the weak link that bighckintosh targeted to get the treasure trove of MLP information.

If Hasbro really wants to track down the “Russian hacker,” it’s important that DHX’s computer systems be immediately archived and forensically examined as soon as possible. As you know, if a hacked computer is shut down, it will wipe
out the volatile memory where the malware operates and you will lose important data on how the connection was established. Since it’s already been several weeks, evidence could have already been inadvertently destroyed.

Recommendation 4: Review the Hasbro/DHX  agreement. Is there language requiring DHX’s cooperation in a situation like this? Does
it allow Hasbro to conduct periodic audits, etc.?

Lisa H. Meyerhoff

Partner, Intellectual Property

Baker & McKenzie LLP

700 Louisiana, Suite 3000

Houston, Texas 77002

U.S.A.

+1 713 427 5005 (Houston)

+1 214 978 3035 (Dallas)

Cell + 1 713 816 1231

Fax +1 713 427 5099

[email-masked]

RANKED BAND 1 FOR IP 2009 – 2016:

CHAMBERS GLOBAL

This message may contain confidential and privileged information. If it has been sent to you in error, please reply to advise the sender of the error and then immediately delete this message. Please
visit www.bakermckenzie.com/disclaimers for other important information
concerning this message.