The expert witness report is much less cut and dry: https://www.documentcloud.org/documents/3515476-Declaration-...

I don't think the expert witness report necessarily demonstrates Levandowski intended to steal the Google/Waymo project files. The Goobuntu distro was installed, which necessitates a reformat from NTFS to ext4 or whatever filesystem it uses.

It sure as hell looks like Levandowski meant to steal the files, especially with his copious 5th Amendment testimony refusals, but it's possible he didn't.

A work laptop that was rarely if ever used is the device in question.

TortoiseSVN was installed to access the repo. If the laptop wasn't normally used, that's a fairly regular thing to do if you want to set up the laptop to get access legitimately.

All the data was downloaded, but reading between the lines, that's just a SVN checkout, which is going to get everything in the repo by default unless you request a specific subdirectory.

A few days later a UDB drive is attached for numerous hours.

A few days after that, another operating system is installed, and the laptop is almost never used again.

All of this can be explained away as benign, but it's also possible it was intended to look that way. This could just as easily be explained as someone trying to access thee data and obscure the fact as it could be someone trying to set up a work laptop they plan to use while away from the office for a few days when they haven't bothered for to set it up for years prior because they had no need.

This would look a lot more damning if Google was asserting that Levandowski was not supposed to have access to the SVN, or had not needed any access to it prior to this point, but unless I'm missing it, they aren't saying that (although they do a good job of making it easy to assume that).

That said, that he set up the company that would later become Otto prior to all this access (with the assurance it would not compete), and also noted to numerous people that he planned to start his own self driving car company prior to the above actions (both according to the original filing though), does cast them in a somewhat different light. That there is evidence of other people that left exporting specific documents from Drive days and/or hours prior to their departure does not look good.

Information omitted that make the testimony one that is obviously presented to do maximum damage:

0) Did Levandowsky have more than one laptop? The testimony cites a laptop he was issue for several months but connected to Google's network only three times over those months he had it. Since he worked at the company during the time, I think it is reasonable to assume that he had more than one laptop and this was one that was issued and never really used.

1) Since this laptop was never really used, it's reasonable that it would get out of date. It's possible that it was used infrequently enough that changes in security policies in the Google autoupdate software would cease to work because it missed a critical security update were a full-reinstall was the simplest path to resolution, especially for a laptop that wasn't well used with data and settings worth preserving. I've seen this situation first hand at prior employers. It especially happens when a critical security update doesn't get applied in time.

2) Was the SVN repository in question one that Levandowsky had a legitimate business need to access? Had he previously accessed that repository on a different laptop that he used more regularly?

3) How many people involved in Google's self driving car program had access to this particular repository? What percent of the self driving engineers does this represent?

4) A Transcend RDF5 card reader was attached to the laptop 3 DAYS AFTER the repository was downloaded. No mention was made about a card inserted into the reader. Was any physical volume ever mounted through the card reader. If so, what kind of physical volume was mounted and how big was it? Was it large enough to store all 9.7 GB of data in the repository? Are there any logs that show files were copied from the laptop to a storage volume, assuming one was ever attached.

5) Was this card reader ever attached to any other device owned by Google that Anthony had access to? Assuming he did attach a storage volume and assuming he did copy files, is it possible that he was just moving files from this device to another one he used? Was this possibility investigated?

6) Five files were exported to his Google Drive on one occasion and another later. The later copied file, a "weekly update", is hardly the type of file that would suggest wrongdoing for anyone whose seen the typical "weekly updates" teams at big companies write. The contents may be sensitive, but they are typically high level and contain few if any details that allow reproducibility. How were those six files accessed later and from what other devices? What's in those files and why are they sensitive/important? How can each file enable a competitor?

There are too many missing dots in that testimony to actually take it seriously, especially since it's been written to maximally insinuate wrongdoing for all three engineers listed.

After reading this testimony, my opinion is that this is absurd and should be dismissed. It's entirely too circumstantial and the forensic "expert" hardly investigated and answered questions that highly relevant to interpreting Levandowsky's actions.

The noted documents that Levandowski "exported to a personal device" happened 22 and 15 days prior to his quitting without notice.

The titles of documents have no bearing on how how damaging they are. This was an assertion of what happened to those documents and when, not what their contents were and how important they were. That should come later. The names themselves should not factor for or against at this point, so it's just as bad to assume they imply innocence as that they imply guilt.

I'm not sure why you are impugning the expert's testimony, I haven't seen anything to imply they were lax in their investigations or were incorrect in their assertions. They testified as to facts they were able to ascertain as to movement of internal private documents, and only as far as they could confirm, which is exactly what they should do. How damaging those documents are and how related they are to the case at hand is for the lawyers to argue.

This is not the entirety of Google case, this is the testimony from one expert witness. How these details interact with other testimony and facts to form a narrative is the important part. A witness could testify "I know nothing" and that doesn't necessarily mean there's no case, just that the witness in question doesn't have much to add. Making an assertion that there is no case because a single witness wasn't as persuasive as you thought they should be is odd.

To the next Lewandowski: "Damn, my laptop got stolen /lost it" Meanwhile hammertime and drop peaces in tens of different trash boxes. Suspicious, but no evidence to prove anything. Stuff happens.

Google Drive logs file downloads, so that's how they got those records.

Plenty of enterprises have certificate-based access to their employee network, none of this seems particularly creepy on Google's part.

Testimony: https://www.documentcloud.org/documents/3515476-Declaration-...