Subject: Re: MLP investigation - preliminary findings
From: "Meyerhoff, Lisa" <[email-masked]>
To: "Gianetti, Ed ([email-masked])" <[email-masked]>
Date: Mon, 20 Nov 2017 07:49:55 +0000

Hi Ed,

Sure - happy to provide some preliminary thoughts.

Hasbro/DHX Contract

I believe you said that no one had talked yet with DHX.  Before you contact them, you need to know Hasbro's rights under the contract, how hard you can push against DHX, if necessary, etc.

So the first step should be to review the Hasbro/DHX contract. What does it say about audits by Hasbro (any advance notice, how often, etc.). Are there any exceptions to the standard audit protocol for special circumstances like this?  If no mention of audits, is there some other language in the contact that would allow Hasbro to come in and access/copy the contents of the relevant computers? Does the contract allow Hasbro to bring in its own IT people if necessary? Is DHX required to cooperate re access, etc. for any review of its computers, etc.?

If written notice to DHX is required, should send that letter right away, advising that DHX should preserve all computers, servers, networks, email accounts, etc. that were involved or might have been involved in the breach. Need to disable any automatic, document deletion/destruction feature, confirm DHX will not allow any overwrites on computers, servers, networks, email accounts, etc. May need to disable network access to those computers, servers, individual accounts, etc. May need to reset passwords to computers, servers, email accounts, etc.

Questions for DHX

Has DHX done any investigation, written any reports, talked with any of the individuals, secured any documents, etc., recorded any interviews, etc.? You want to be able to see all interview notes, reports, etc.

Need to know about employees' use of laptops, home computers, iPads, etc. to work. What is DHX's policy about those? If it provides the laptops, etc. to its employees or lets them use their own computers, can it require them to bring in the computers for review, copying, analysis, etc. or can it only do that if the employee consents?

Need to confirm as much as possible re what was taken. Need to protect other data not yet hacked. What has DHX done proactively to do that, etc.?

You want to know every person who had authorized access to the servers, computers, etc. You want HR files for the employees whose computers were involved/implicated, including for any temporary or contract employees. Are there any privacy issues under Canada law?

Are any files encrypted? What encryption devices does DHX use? For how long? What are DHX's protocols for deciding what is encrypted, etc.? What are DHX's protocols for access to servers, networks, confidential information, etc.? Any manuals or other written materials that IT uses? Or re employees' access?  How often are passwords changed, etc.?

How does DHX back up its servers? How often? Does DHX use remote servers? Where are they located? Same instructions as above re disabling overwrite features, etc.

Proposed Protocol

Generally, the IT personnel who will be preserving the files, etc. will be focused on:

identifying each system, its physical location, and its role on DHX's network
acquiring the relevant data
preserving the evidence in its current form
verifying the integrity of the acquired data
determining when the files were created, modified, accessed
determining what files were downloaded, executed; what accounts, browsers, external  media used
analyzing the process paths
recovering and analyzing deleted files, as necessary

Logistics

Once you've identified exactly which computers, servers, networks, etc. are/may be involved, we need to preserve the relevant files from those computers, servers, networks, etc. How we copy the contents of the files depends on the number of files, how much data is on the files, etc.  You need all passwords for servers, networks, etc.

You need an IT person(s) on site supervising the imaging of the files, asking follow-up questions,. etc.  The IT person(s) must be able to try every password, etc. while there to know they can access later.

After the files, etc. are imaged, there will be more questions to DHX. After the IT people see how much data is on the files, they can begin running some searches to eliminate data, be able to identify what they will be able to analyze, etc.

DHX will likely want its representatives to watch the preservation efforts. It may even want its counsel there to observe.

Happy to discuss.

Regards,
Lisa

From: Gianetti, Ed [mailto:[email-masked]]
Sent: Wednesday, November 15, 2017 3:59 PM
To: Meyerhoff, Lisa
Subject: RE: MLP investigation - preliminary findings

Hi Lisa,

Thanks for your comments below. Can you at least for now provide your thoughts on some of the protocols to preserve records/data and then we can explore further with CGI. We just need a starting point.

Thanks,
Ed

From: Meyerhoff, Lisa [mailto:[email-masked]]
Sent: Tuesday, November 14, 2017 9:22 PM
To: Gianetti, Ed <[email-masked]<mailto:[email-masked]>>
Subject: RE: MLP investigation - preliminary findings

HI Ed,

We can assist as you requested. See specific comments below.

Regards,
Lisa

From: Gianetti, Ed [mailto:[email-masked]]
Sent: Thursday, November 09, 2017 7:44 AM
To: Meyerhoff, Lisa
Subject: RE: MLP investigation - preliminary findings

Hi Lisa,

Thanks for the update below. Your information backs-up the information we discovered and the course of action we were leaning towards.

In addition can you:

o             Provide guidance on your recommended methodology to preserve the noted DHX data. We have some thoughts on a proposed protocol, but also suggest a call with the company we use for more specific suggestions to ensure complete preservation of the records.
o             Provide guidance on any 3rd party firms that you could recommend to provide these services...in the event that DHX does not have this capability. We use an excellent company, CGI. It's a heavy hitter in this area; is actually based in Montreal, so would be a good fit re DHX.
o             If DHX does have these capabilities, we'd like someone from your team or a recommended 3rd party to provide oversight to the process. We are happy to have someone on our team there for oversight at DHX, or can  have the company provide the oversight, or both  (you choice). Perhaps we can have a call to discuss.
o             Is there someone on your team or a recommended 3rd party that can provide technical consultation during the notification call to DHX? Yes. I think it would be best if the company we use provide the specific technical support. If there is an initial call with DHX, we can assist with that.

Thanks,
Ed

From: Meyerhoff, Lisa [mailto:[email-masked]]
Sent: Wednesday, November 08, 2017 12:02 PM
To: Gianetti, Ed <[email-masked]<mailto:[email-masked]>>
Subject: MLP investigation - preliminary findings
Importance: High

ATTORNEY-CLIENT PRIVILEGED

Hi Ed,

My apologies for the brief delay - I was waiting to receive some additional information. Below is a summary of what we've found so far, with several recommendations (in red) for follow up.

Based on what we've found so far, I believe there has been a hacker and that DHX may be a victim, and the weak link the hacker used to obtain the MLP information.

Let me know what you think - happy to discuss.

Regards,
Lisa

My Little Pony Investigation

Ponychan.net Route

Ponychan.net WHOIS search led to registrant and admin. contact Zachary Johnson.

1230 N LBJ DR., SAN MARCOS TX 78666 US
Phone: +1.6169142485
Email: [email-masked]<mailto:[email-masked]>

We weren't able to find much else on him. The last update was 2015, so the WHOIS information may be outdated. But it doesn't really matter exactly who Zachary Johnson is, because Ponychan lists contact information<https://urldefense.proofpoint.com/v2/url?u=https-3A__vintage.ponychan.net_chan_index.html-253Fp-3Dcontact.html&d=DwMFAg&c=ptMoEJ5oTofwe4L9tBtGCQ&r=Ikfs1Gq1cB14epH5PbqtyZc3koYKMMRcqeGi49s8644&m=g05rw42y2mOjPdBh0ynazkTjuBN50aR2IcfzmVVBuPU&s=0dBBQ-57xZy7HzB9I0_giO67z2K0T-oSS-foK1KrklU&e=> for plenty of other people. Zachary Johnson is a moderator. He goes by the name Twilight Sparkle; is also known as Astra!!RoyalGuard; and has the Skype handle astrabolt. But the contact list gives information about the website owner and developers as well, and there are plenty of others we can contact for additional information.
Recommendation 1: Contact Ponychan.net to get more information on bighckintosh. The "rules<https://urldefense.proofpoint.com/v2/url?u=https-3A__vintage.ponychan.net_chan_index.html-253Fp-3Drules.html&d=DwMFAg&c=ptMoEJ5oTofwe4L9tBtGCQ&r=Ikfs1Gq1cB14epH5PbqtyZc3koYKMMRcqeGi49s8644&m=g05rw42y2mOjPdBh0ynazkTjuBN50aR2IcfzmVVBuPU&s=nocRkhdgr6or_nTicJ3k6IyU0Dc_IYMV7AjQs8A8xNY&e=>" of Ponychan specifically state, "Do not use this website for planning or conducting any activities which violate United States law." Bighckintosh certainly broke that rule when he posted about what to do with 2 TB of Hasbro's confidential information. Perhaps they will be willing to cooperate, and provide more information on bighckintosh.
________________________________

romesilvanus.io Route

Whoever is behind iwatchitfortheplot.romesilvanus.io ("Rome Silvanus") apparently is a little more cautious about protecting his identity. He used a domain name registration service called Gandi SAS, a French company. But that doesn't necessarily mean that Rome Silvanus is French. He could just as well be German, as he used syncwerk (based in Weisentheid, Germany) to invite bighckintosh to upload the leaked MLP files.

According to Twitter, @rome_silvanus<https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_rome-5Fsilvanus-3Flang-3Den&d=DwMFAg&c=ptMoEJ5oTofwe4L9tBtGCQ&r=Ikfs1Gq1cB14epH5PbqtyZc3koYKMMRcqeGi49s8644&m=g05rw42y2mOjPdBh0ynazkTjuBN50aR2IcfzmVVBuPU&s=3WULNC5zcYS-dK6r7Nuu3yzXdkz2dSr_QA62pKoIX50&e=> is in Vienna, Austria. He's indicated Vienna as his location elsewhere as well:

  *   https://www.facebook.com/people/Rome-Silvanus/100014304376988<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.facebook.com_people_Rome-2DSilvanus_100014304376988&d=DwMFAg&c=ptMoEJ5oTofwe4L9tBtGCQ&r=Ikfs1Gq1cB14epH5PbqtyZc3koYKMMRcqeGi49s8644&m=g05rw42y2mOjPdBh0ynazkTjuBN50aR2IcfzmVVBuPU&s=kPoOmYzQZRCbsXHO2pW9UsBKCSTLlWBrLdyFIj7fxEA&e=>
  *   http://steamcommunity.com/id/rome_silvanus<https://urldefense.proofpoint.com/v2/url?u=http-3A__steamcommunity.com_id_rome-5Fsilvanus&d=DwMFAg&c=ptMoEJ5oTofwe4L9tBtGCQ&r=Ikfs1Gq1cB14epH5PbqtyZc3koYKMMRcqeGi49s8644&m=g05rw42y2mOjPdBh0ynazkTjuBN50aR2IcfzmVVBuPU&s=46c59FQCip9Aa3vcO2mGEz9_bHv7_ScB9O74MVtK0U4&e=>
  *   https://www.furaffinity.net/user/romesilvanus/<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.furaffinity.net_user_romesilvanus_&d=DwMFAg&c=ptMoEJ5oTofwe4L9tBtGCQ&r=Ikfs1Gq1cB14epH5PbqtyZc3koYKMMRcqeGi49s8644&m=g05rw42y2mOjPdBh0ynazkTjuBN50aR2IcfzmVVBuPU&s=7D-ZIcZDdMmkYPQDKaE-9XN6F9NiVOA9ZsBAU9LO8Ik&e=>
  *   NSFW (not suitable for work) http://tumblr.romesilvanus.io/<https://urldefense.proofpoint.com/v2/url?u=http-3A__tumblr.romesilvanus.io_&d=DwMFAg&c=ptMoEJ5oTofwe4L9tBtGCQ&r=Ikfs1Gq1cB14epH5PbqtyZc3koYKMMRcqeGi49s8644&m=g05rw42y2mOjPdBh0ynazkTjuBN50aR2IcfzmVVBuPU&s=YIwCVkT0Mr7yb4JtkVcMo1p6TCJB2EO7svucbNMw6jQ&e=>
  *   https://bandcamp.com/rome_silvanus<https://urldefense.proofpoint.com/v2/url?u=https-3A__bandcamp.com_rome-5Fsilvanus&d=DwMFAg&c=ptMoEJ5oTofwe4L9tBtGCQ&r=Ikfs1Gq1cB14epH5PbqtyZc3koYKMMRcqeGi49s8644&m=g05rw42y2mOjPdBh0ynazkTjuBN50aR2IcfzmVVBuPU&s=_15IvioqbgP-pBtwjWnIemk10chjt8Oy9KdyBcBgVWc&e=>

He appears to have attended an MLP convention called Nightmare Nights Dallas<https://urldefense.proofpoint.com/v2/url?u=http-3A__nightmarenights.net_&d=DwMFAg&c=ptMoEJ5oTofwe4L9tBtGCQ&r=Ikfs1Gq1cB14epH5PbqtyZc3koYKMMRcqeGi49s8644&m=g05rw42y2mOjPdBh0ynazkTjuBN50aR2IcfzmVVBuPU&s=i_ivRWkY-WhIohNRaoFXUE1hb85K2-f4Cj0mEP57540&e=> (Oct. 27-29, 2017) despite being banned by another brony, @scopeguardpony<https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_scopeguardpony-3Flang-3Den&d=DwMFAg&c=ptMoEJ5oTofwe4L9tBtGCQ&r=Ikfs1Gq1cB14epH5PbqtyZc3koYKMMRcqeGi49s8644&m=g05rw42y2mOjPdBh0ynazkTjuBN50aR2IcfzmVVBuPU&s=CLwI7WQpyLFRg1BmOIFmpLOc0lz_mk3Rj-gmlvb2OTM&e=>:

Hasbro's copyright counsel (Carin G. Reynolds of Reynolds Law PLLC<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.reynoldslaw.legal_&d=DwMFAg&c=ptMoEJ5oTofwe4L9tBtGCQ&r=Ikfs1Gq1cB14epH5PbqtyZc3koYKMMRcqeGi49s8644&m=g05rw42y2mOjPdBh0ynazkTjuBN50aR2IcfzmVVBuPU&s=xTbtnI8vdDYLeEVIImtXYwhdfytmdpGyva3-SUs8uFg&e=>) contacted Rome Silvanus and his hosting service, Hetzner Online GmbH, on October 11, 2017. He posted both C&D letters on his website, and he has taken off the offending content according to Hasbro's 10/17/27 intelligence memo. But we see lots of questionable materials still on the website, e.g., here<https://urldefense.proofpoint.com/v2/url?u=https-3A__iwatchitfortheplot.romesilvanus.io_Pony_Flash_Leaked-2520DHX-2520flash-2520puppets_&d=DwMFAg&c=ptMoEJ5oTofwe4L9tBtGCQ&r=Ikfs1Gq1cB14epH5PbqtyZc3koYKMMRcqeGi49s8644&m=g05rw42y2mOjPdBh0ynazkTjuBN50aR2IcfzmVVBuPU&s=JnELph2AuFPY8ZTIQ-tmY3dNlXPXpwmzZTip8cdEEKY&e=>, here<https://urldefense.proofpoint.com/v2/url?u=https-3A__iwatchitfortheplot.romesilvanus.io_Pony_Videos_Official_Leaked-2520official-2520files_&d=DwMFAg&c=ptMoEJ5oTofwe4L9tBtGCQ&r=Ikfs1Gq1cB14epH5PbqtyZc3koYKMMRcqeGi49s8644&m=g05rw42y2mOjPdBh0ynazkTjuBN50aR2IcfzmVVBuPU&s=wqyOYNS6JZ0Ll40dWsUmk2oCUe9X0xdZ35BaM93vEb4&e=>, and here<https://urldefense.proofpoint.com/v2/url?u=https-3A__iwatchitfortheplot.romesilvanus.io_Pony_Videos_Official_Leaked-2520official-2520files_&d=DwMFAg&c=ptMoEJ5oTofwe4L9tBtGCQ&r=Ikfs1Gq1cB14epH5PbqtyZc3koYKMMRcqeGi49s8644&m=g05rw42y2mOjPdBh0ynazkTjuBN50aR2IcfzmVVBuPU&s=wqyOYNS6JZ0Ll40dWsUmk2oCUe9X0xdZ35BaM93vEb4&e=>.

He also posted this on 4chan, but when we click on it, it gives a 404 error.

As you know, BTSync means Bit Torrent Sync. He may have taken it off of his website, but it looks like he just took it where it's more difficult to find but still as accessible to bronies.
Recommendation 2: Ed, did Ms. Reynolds receive any response from Rome Silvanus (or was it simply a takedown as requested without any response)?
Recommendation 3: Contact @scopeguardpony<https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_scopeguardpony-3Flang-3Den&d=DwMFAg&c=ptMoEJ5oTofwe4L9tBtGCQ&r=Ikfs1Gq1cB14epH5PbqtyZc3koYKMMRcqeGi49s8644&m=g05rw42y2mOjPdBh0ynazkTjuBN50aR2IcfzmVVBuPU&s=CLwI7WQpyLFRg1BmOIFmpLOc0lz_mk3Rj-gmlvb2OTM&e=>. The theory is that an enemy of an enemy is a friend, and he is an enemy of Rome Silvanus. Perhaps he has more information on Silvanus.
________________________________

DHX Route

It does not appear that DHX is the leaker. Instead, it seems more likely that DHX is the victim and the weak link that bighckintosh targeted to get the treasure trove of MLP information.

If Hasbro really wants to track down the "Russian hacker," it's important that DHX's computer systems be immediately archived and forensically examined as soon as possible. As you know, if a hacked computer is shut down, it will wipe out the volatile memory where the malware operates and you will lose important data on how the connection was established. Since it's already been several weeks, evidence could have already been inadvertently destroyed.
Recommendation 4: Review the Hasbro/DHX  agreement. Is there language requiring DHX's cooperation in a situation like this? Does it allow Hasbro to conduct periodic audits, etc.?

Lisa H. Meyerhoff
Partner, Intellectual Property
Baker & McKenzie LLP
700 Louisiana, Suite 3000
Houston, Texas 77002
U.S.A.
+1 713 427 5005 (Houston)
+1 214 978 3035 (Dallas)
Cell + 1 713 816 1231
Fax +1 713 427 5099
[email-masked]<mailto:[email-masked]>

RANKED BAND 1 FOR IP 2009 - 2016:
CHAMBERS GLOBAL

This message may contain confidential and privileged information. If it has been sent to you in error, please reply to advise the sender of the error and then immediately delete this message. Please visit www.bakermckenzie.com/disclaimers<http://www.bakermckenzie.com/disclaimers> for other important information concerning this message.