1

4 SELECT COMMITTEE TO INVESTIGATE THE

5 JANUARY 6TH ATTACK ON THE U.S. CAPITOL,

6 U.S. HOUSE OF REPRESENTATIVES,

7 WASHINGTON, D.C.

10

11 DEPOSITION OF: J. DOE

12

13

14

15 Friday, May 20, 2022

16

17 Washington, D.C.

18

19

20 The deposition in the above matter was held via Webex, commencing at 10:04

21 a.m.
 2

2 Appearances:

5 For the SELECT COMMITTEE TO INVESTIGATE

6 THE JANUARY 6TH ATTACK ON THE U.S. CAPITOL:

8 INVESTIGATIVE COUNSEL

9 STAFF ASSOCIATE

10 , PROFESSIONAL STAFF MEMBER

11 FINANCIAL INVESTIGATOR

12 , CHIEF CLERK

13 FINANCIAL INVESTIGATOR

14 , SENIOR INVESTIGATIVE COUNSEL

 3

2 Ms.~ So we will go on the record and commence at 10:04 a.m.

3 This is a deposition of a witness who shall be identified throughout this deposition

4 as "J. Doe," conducted by House Select Committee to Investigate the January 6th Attack

5 on the United States Capitol pursuant to House Resolution 503.

6 This will be a staff-led deposition. The members may choose to ask questions.

7 If any of the members are present, I will note that they have entered, and I'll also note

8 when they leave. If for at any reason at any time you want to check and see if a

9 member is present, you can always just ask us, but their names will usually show up in the

10 participants list.

11 I know it looks like a lot of people are present. That's a number of people who

12 monitor, report. And everybody on the right on the participants list currently is a

13 member of the select committee or an official reporter. If you have any concerns or

14 questions about who somebody is on the participants list, please don't hesitate to ask me,

15 and we can identify them.

16 My name is and I am senior investigative counsel of the select

17 committee. With me from the select committee staff ar professional

18 staff member, and -- she'll be entering shortly - -- for the reporters,

19 that's -- and a number of select committee staff, who are on the

20 right. I'll identify them if they come on screen and ask any questions.

21 Under House deposition rules, neither committee members nor staff may discuss

22 substance of your testimony today unless the committee approves its release.

23 You will have the opportunity to review the transcript, if you want, in order to

24 make corrections.

25 But please note that, under House rules, you may have an attorney present but
 4

1 counsel for other individuals may not be. Same with attorneys for other government

2 agencies. At this time, I'd note for the record that you did not obtain counsel and that

3 counsel is not present.

4 I just want to go over some ground rules for the deposition.

5 As you can see, there are individuals titled "Official Reporter," and they are

6 transcribing our conversation. The reporters' transcription will be the official record of

7 the proceeding, and, as I mentioned, if you want, you'll have a chance to review that to

8 make sure there's no errors.

9 Please wait until each question is completed before you begin to respond, and

10 we'll do our best to wait until your response is complete before we ask the next question.

11 The reporter can't take down multiple people speaking at once, so it's really important

12 that multiple people do not speak at the same time and we wait for each other to finish.

13 The reporter also cannot note nonverbal responses, such as shaking or nodding

14 your head, so it's important that you respond verbally to each question with an audible,

15 verbal response.

16 Please give complete answers to the best of your recollection. If a question is

17 unclear, just ask me for clarification, and if you don't know the answer, please just say so.

18 If a question doesn't make sense, it's likely because I didn't explain it well, so please don't

19 hesitate to just ask me to clarify or rephrase or just say, "I don't understand what you're

20 asking."

21 You can refuse to answer a question but only to preserve a privilege recognized by

22 the select committee. If you refuse to answer a question based on a privilege, we may

23 proceed with the deposition or seek a ruling from the chairman on the objection. If the

24 chairman overrules the objection, you are required to answer the question.

25 Finally, as we do for every witness who testifies before us, I will remind you that it
 5

1 is unlawful to deliberately provide false information to Congress and doing so could result

2 in criminal penalties, including charges under 18 U.S.C. 1001. And I reiterate, we give

3 that warning to every single witness before us.

4 The Witness. Okay.

5 Ms.~ Because this deposition is under oath, would you please raise your

6 right hand to be sworn?

7 The Witness. Yes.

8 The Reporter. Do you solemnly declare and affirm under the penalty of perjury

9 that the testimony you are about to give will be truth, the whole truth, and nothing but

10 the truth?

11 The Witness. I do.

12 Ms.~ Okay.

13 So, logistically, please let us know if you need any breaks, or if you'd like to take a

14 recess to discuss anything off the record, we are happy to accommodate. I can't

15 emphasize that enough. If you need a comfort break, if you need a pause, we are here

16 on your timeline. So I don't want you to hesitate to just say if you need a recess; we can

17 take a recess.

18 As I mentioned before, members may come in. So there may be several people

19 asking questions, between my colleagues here, my colleagues who are remote, and a

20 member, should they appear in the deposition.

21 And, again, if you don't understand a question, please just ask me to repeat it or

22 clarify.

23 Do you have any questions before we begin?

24 The Witness. I do not.

25 Ms- Okay. All staff are present, so we'll continue.

 6

1 EXAMINATION

3 Q On May 5, 2022, you received a subpoena, issued in your legal name, by the

4 select committee, correct?

5 A Correct.

6 Q And that package included the subpoena itself, a cover letter from the

7 chairman, a document schedule with production instructions, and a copy of the House

8 rules and regulations regarding conducting depositions.

9 Can you please confirm that you were the individual that was named in the

10 subpoena that you received?

11 A Yes, I am the named individual in that subpoena.

12 Q And you understand that you're appearing here today pursuant to that

13 subpoena, correct?

14 A Yes, that's correct.

15 Q The subpoena also required the production of documents described in the

16 schedule attached to the subpoena. Understanding that you have left the company in

17 reference, but did you have a chance to search for any documents in your personal

18 possession that might be responsive to those requests?

19 A I did search, and I didn't find anything.

20 Q You did produce one document to us, though, correct?

21 A The one thing I found was a screenshot of a text conversation between

22 myself and my husband surrounding the events, yes, and I did produce that.

23 Q Okay. And we'll discuss that later. The bigger issue was, we just wanted

24 to put on the record that you had searched in response to those requests.

25 A Yes.
 7

1 Q So my goal today is to ask you questions relevant to the select committee's

2 investigation, and if you have an objection or a privilege assertion, we'll ask that you

3 assert it for the record.

4 So, normally, we would ask that you provide your full name and a bunch of

5 biographical information, but for security issues today, we're simply going to use the

6 name "J. Doe." But it would be helpful if you could just explain to us your highest level

7 of education.

8 A I have a bachelor's degree, and I am working on a graduate certificate.

9 Q Okay. And just out of curiosity, what is the graduate certificate in?

10 A Cybe rsecu rity.

11 Q Okay.

12 And can you take me through the last, let's say, 2 or 3 years of your work history?

13 A Two or 3 years would make it 2019?

14 Q Let's start with now. Let's start with where you work now.

15 A Okay. Right now, I work for a small company that is an email service

16 provider. And my role is in both product and people operations, so I am doing two jobs.

17 Do you want me to explain more in terms of what those roles do?

18 Q No, that's okay. We're going to focus on your prior employment. Can you

19 tell me about the job before the one that you have now?

20 A Yes. So, previously, I worked at Salesforce for almost 8 years. In that role,

21 I managed t h ~ so that would mean that I handled anything related to spam

22 complaints, block listings, high bounce rates. Anything that can go wrong with your

23 email, it probably had crossed my desk. And that's specific to -- towards the end, it was

24 Marketing Cloud and Pardot infrastructures.

25 Q Okay. So let's start in the relevant time period. What was your title and
 8

1 position in 2020, at the beginning of 2020?

2 A I was

3 team.

4 Q Okay. And did that role change at any point in 2020?

5 A In 2020, it did not.

6 Q Okay. And I'm sorry, could you say that title one more time?

7 A The

8 Now, I had multiple titles. That was the external title. Internally they called me

9 all kinds of stuff; it was privacy compliance, email compliance, anti-spam, anti-abuse.

10 It's all the same thing, essentially.

11 Q And so, just to be clear, was your position the same in 2020 and leading up

12 until 2021?

13 A Yes.

14 Q Okay. So, during the entire relevant time period, you had the same title at

15 Salesforce.

16 A I did.

17 Q Okay.

18 And I think you said it a moment ago, but was there a division within Salesforce in

19 which you worked?

20 A Hang on. Let me -- can I -- am I allowed to verify -- or can I go off the

21 record and ask a question?

22 Ms.~ We can take a recess, absolutely. We'll take a brief recess and go off

23 the record.

24 [Discussion off the record.]

25 Ms- So we'll come back from recess, and we'll go back on the record at
 9

1 10:14.

2 BYMS. •:

3 Q So, a moment ago, we were talking about your position in 2020, and I think

4 you wanted to clarify what your roles were during the relevant time period.

5 A Yes. team until

6 February 2020, and then I was made

7 Q Okay. And I think --

8 A So --

9 Q Go ahead.

10 A That was a title change, but nothing really changed in terms of my role.

11 Q Did your salary change?

12 A I think a little bit.

13 Q I guess a more important question: Did you consider it a promotion?

14 A Um, yeah.

15 Q Okay.

16 A It was one of those, like, yes and no. Like, I was already doing the work,

17 and -- you know, it was one of those promotions.

18 Q That's fair. Promoted to what you were already doing.

19 A Right.

20 Q So, a moment ago, before the recess, I think you said you were working

21 within a division called Marketing Cloud.

22 A That's correct.

23 Q And can you explain what Marketing Cloud does?

24 A Yes. So Marketing Cloud is owned by Salesforce. I guess you could call it

25 a division or an organization as part of Salesforce. Because it's a bit of a weird setup, I

 10

1 think, in that Marketing Cloud has a CEO but then Salesforce also has a CEO. Salesforce

2 was my first corporate job, so I'm not sure if that's common across the board.

3 But, anyway, Marketing Cloud is an email service provider. So they have clients;

4 those clients will send emails to subscribers, and that's any email addresses on their lists.

5 Q And a moment ago you said Marketing Cloud had its own CEO. Do you

6 happen to remember who that was during 2020 into 2021?

7 A I believe -- so we changed CEOs around that timeframe. Originally, it was

8 Adam Blitzer, and I don't know who the next CEO was. I know, for a while, there was

9 some upheaval where it was kind of unclear.

10 Q And I think a moment ago you said you were in a unit, and I caught "abuse"

11 and "compliance." Is that the title?

12 A That is correct.

13 Q Okay.

14 A The --

15 Q And can you -- go ahead.

16 A The naming of the teams was very loose. You know, it was, as I said,

17 Salesforce privacy and abuse management, it was anti-abuse and privacy, it was -- we just

18 kept renaming, and we never actually settled on a real name.

19 Q What was the name in 2020 that you remember?

20 A We called ourselves Salesforce privacy and abuse management.

21 Q Okay. And did that change at some point in late 2020 or 2021?

22 A It was so fluid. Like, it was never set in stone. So we might've called

23 ourselves that. Mickey might've called us something else to some other team. We

24 never truly formalized on what the team name was. We knew what we did; we just

25 didn't know what to call ourselves.

 11

1 Q Okay. And I think between the titles, privacy and abuse management or

2 abuse and compliance, it seems abuse was consistent in the titles.

3 A It was, yes. That was the one thing we -- yeah, naming-wise, that was the

4 only consistent thing.

5 Q And while you were there in 2020 -- and just so I can be clear for the record

6 and just so that we don't keep saying it, I'm going to say "the relevant time period," and

7 that's going to be, we'll say, mid-2020 through March 2021.

8 A Okay.

9 Q Okay? So, if anything changes during that time, just let me know, but we're

10 really just focusing on mid-2020 through early 2021.

11 So can you tell me who worked with you in your unit, whether it was privacy and

12 abuse management or abuse and compliance? Did you have a pod or a group of people

13 that you worked with?

14 A I did, yes. So I managed two individuals. Should I name them?

15 Q You can.

16 A Okay. So I managed who was a full-time employee, and-who

17 was a contractor. - managed the Pardot side of the infrastructure. -

18 managed the ExactTarget/Marketing Cloud side of the infrastructure. Then I reported

19 up to

20 Q Okay.

21 A Do you want me to take the whole chain?

22 Q We're going to come back to that, so let's pause for a moment.

23 Can you just explain -- you said handled Pardot. What is Pardot?

24 A Pardot was originally how I came into Salesforce. So Pardot was bought in

25 2013 by ExactTarget. ExactTarget got bought by Salesforce. Salesforce renamed

 12

1 ExactTarget to Marketing Cloud. And that was how I came in.

2 So we still had two separate products. There was the Pardot product, which was

3 mostly business to business, or B2B, and there was Marketing Cloud/ExactTarget, which is

4 B2C, business to consumer.

5 Q Okay. And would there be any way to know the difference between

6 ExactTarget and Salesforce functionally for the rest of the world?

7 A In terms of what? In terms of what product you're using or--

8 Q So is ExactTarget the name of a product that Salesforce sells?

9 A It's called Marketing Cloud now, but, yes, you could buy pieces of Marketing

10 Cloud.

11 Q Okay.

12 A Their infrastructure was a little weird, I think, in that you could buy certain

13 pieces that were Marketing Cloud, like Audience Builder, Journey Builder. But, yes, they

14 were different products.

15 Q Okay.

16 A But for Pardot you would just pay for Pardot, and that was the product.

17 Q And just to be clear, are you saying that-handled abuse and compliance

18 for Pardot and-handled abuse and compliance for ExactTarget?

19 A Yes, that's correct.

20 Q Okay. And then you supervised and-

21 A Yes.

22 Q And you reported up to

23 A I did.

24 Q Okay. And is still at Salesforce?

25 A He is not.
 13

1 Q Do you know when he left?

2 A I believe it was this December.

3 Q December 2021?

4 A Yes. Um -- yes, because we're in 2022. Yes.

5 Q And understanding these are ballparks to the best of your recollection, so,

6 you know, if you're wrong -- but we're just asking for your best memory, understanding

7 these are other people's employment dates.

8 Do you happen to know i f . i s still at Salesforce?

9 A She is not.

10 Q When did she leave, to your best recollection?

11 A She left in August.

12 Q Of 2021?

13 A Yes -- sorry, of 2022 -- 2021.

14 Q 2021?

15 A Yes. It was this most recent August, so, yes, 2021.

16 Q And what about -

17 A - because he was a contractor, had to leave in end of May, early, early

18 June of 2021.

19 Q Okay. And so everybody who worked in the abuse and compliance

20 department during the relevant time period is no longer at Salesforce. Is that right?

21 A That is correct.

22 Q And, to the best of your knowledge, have they replaced any of you?

23 A They've replaced one of us -- well, and the contractor, so I guess two.

24 Q But not all four of you.

25 A No.
 14

1 Q Okay.

2 A And the contractor never really got trained, so I don't believe he's quite up

3 to speed.

4 Q And, to the best of your knowledge, do you know why left

5 Salesforce?

6 A Because of what happened w i t h -

7 Q And can you explain that?

8 A I can.

9 So Salesforce has a policy in which, if you hire a contractor, they can only be a

10 contractor for 2 years.

11 Can I pause? Can I go off the record? Should I --

12 Ms.. Wait, wait.

13 We're going to take a brief recess at 10:22 a.m. and go off the record.

14 [Discussion off the record.]

15 Ms.~ So we're going to come back from recess at 10:23, and we're back on

16 the record.

17 BYMS.1111:

18 Q And I believe the question right before we left, you had said something

19 about that had left Salesforce because of an incident w i t h - Can

20 you explain that?

21 A Yes.

22 So Salesforce had a policy that contractors could only be hired for 2 years.

23 Otherwise, they had to go FTE -- that's full-time employment -- or they had to leave.

24 Which, for the abuse desk, is, frankly, absolutely ridiculous because it is a very,

25 very specialized role. It takes a lot of training. It takes a certain person to be able to
 15

1 manage the abuse desk. As you can imagine, there's a lot of stuff that gets thrown at us

2 that's pretty nasty.

3 So we would hire this person for 2 years, put all that energy into training them,

4 and then they had to leave.

5 So, w i t h - we wanted to hire him FTE -- so that's, again, full-time -- because

6 he had the skills, he was very good at his job. And for Marketing Cloud, it's insane that

7 you would have to keep retraining someone every 2 years to manage the entire

8 Marketing Cloud infrastructure of all of their customers.

9 So we were in this process. I kept saying -- trying to be aggressive it with it,

10 saying, "Hey, what's going on? What's with the paperwork," yada, yada, for the last

11 6 months. I kept getting, you know, the sort of pat-pat, - don't you worry, it'll

12 be handled by all t h e . who are older and more experienced than you. So I was like,

13 all right, fine, okay, I guess we'll go from there.

14 End of May, it got to his last week -- I'm sorry -- second-to-last week, and I finally

15 got, "Okay, you can have the headcount." I said, okay, this is great. We're going to

16 start working on salary, you know, kind of, all the paperwork stuff you do with HR.

17 We're in the middle of that email thread, and-boss's boss -- so that would

18 be -- messaged and said, "Oh, I'm so sorry, we actually don't have that

19 headcount. We've got to figure something else out."

20 So their solution -- and air quotes, "solution" -- to this was, just have another

21 contracting company h i r e - t o try and get around this 2-year restriction.

22 The other contracting company looked a t - e s u m e and said, "Oh, he'd be

23 a great employee for us. We would like to maybe hire him instead," to which we said,

24 "That was never on the table. We'd like you to hire him and have him be our

25 contractor." Then they effectively ghosted us, allegedly.

 16

1 And then, 's last week, decides to go move his house, and so he's

2 completely out of office. I am left pretty much holding the bag, just trying to scramble

3 and figure out what is going on with-'s employment.

4 I message Tim, who is Mickey's boss, and ask, "What is going on?" That's-

5 - and say, "What is going on?" -says to me, "Oh, I'm not really sure, but if

6 Forrest wanted to find another job," basically, "we wouldn't take it personally."

7 Which you don't do to somebody. You don't say you have -- it was just such a

8 disaster. And it was all -- and then everybody started blaming everybody. It was,

9 -blamed ■ a n d - - a n d - b l a m e d - I blamed all of them.

10 So then we just realized that Salesforce didn't care about anti-abuse, they didn't

11 care about our team, they weren't investing in any of us, and we were going to leave.

12 Q Was the incident with-the only thing that gave you and your team

13 the impression that Salesforce didn't care about abuse?

14 A No.

15 Q What other incidents or events gave you that concern?

16 A So there was the fact that -- let me back up and say, any reputable email

17 service provider will publish an "abuse@" address, so that if you get unsolicited mail from

18 SendGrid, from Pardot, from Marketing Cloud, you would have an abuse@ -- so

19 abuse@Pardot, abuse@MarketingCloud, abuse@SendGrid, whatever it is.

20 Salesforce did publish an abuse@, so you could email abuse@Salesforce, but, to

21 our knowledge, they didn't actually have an abuse team managing those requests.

22 I was told in, I think it was July 2017 or 2018, that Salesforce had, quote/unquote,

23 "discovered" the abuse in box, like, discovered that they had it, and they were going to

24 manage, like, five cases a week maybe. And, as you can imagine, at the scale of

25 Salesforce's infrastructure, I have a hard time believing they only received five cases a
 17

1 week.

2 So that was kind of an indication, that they had, quote/unquote, "discovered"

3 their own abuse inbox. So, clearly, they didn't care terribly much.

4 And then --

5 Q Let me come back to the abuse@ address box and those issues.

6 You mentioned earlier, and I just want to clarify, the reporting structure. I think

7 you said reported up to an individual n a m e d -

8 A Yes.

9 Q Andthat's-

10 A Yes.

11 Q And do you know what his title was?

12 A I do not.

13 Q And I think you said ■ reported up to somebody named

14 That's ?

15 A That's correct.

16 Q And do you know what ■'s title -- excuse me. Do you know what . , s

17 title was?

18 A His changed, but I think he was a VP or an SVP of something.

19 Q Okay. And both of those individuals, to your knowledge, are still at

20 Salesforce?

21 A Yes.

22 Q Okay.

23 A n d _ , he reported up to somebody namedllll, I believe?

24 A Yes.

25 Q I have no idea how to spell that, so we'll just say common spelling and look it
 18

1 up later.

2 And then do you know who reported up to?

3 A I believe he reported to Adam Blitzer, but I'm not confident of that answer.

4 Q Okay. And do you know who Blitzer would've reported up to?

5 A I also believe Blitzer would've reported to Bret Taylor, but it's possible there

6 was a layer in there that I wasn't aware of.

7 Q And do you remember Mr. Taylor's title?

8 A Something C-level.

9 Q And do you know who Mr. Taylor reported to?

10 A Marc Benioff.

11 Q And what is Mr. -- I'm sorry, is it B-e-n-i-o-f-f?

12 A Yes.

13 Q And it's Marc with a C, isn't it?

14 A Yeah, it is.

15 Q And do you know his title or role?

16 A He's CEO of Salesforce.

17 Q Of all of Salesforce.

18 A All of Salesforce.

19 Q Okay.

20 So there were approximately six levels above to the CEO, Marc

21 Benioff, give or take?

22 A Yeah, I'd say six-ish.

23 Q Okay.

24 A Six or seven or eight. But, yeah, it was not that many.

25 Q Now, earlier -- I want to go back -- you said your role was at

 19

1 some point in February of 2020 -- as of February 2020, you were

2 privacy and abuse management. But I think earlier we talked about that

3 may have used a different title instead, abuse and compliance.

4 Can you explain the difference between abuse versus compliance?

5 A They're kind of the same. I mean, for us, they were sort of the same thing.

6 I know in different industries compliance means something totally different; it's

7 compliance with the law. For us, if you were abusing the system, you were not in

8 compliance with our policies. And I --

9 Q Okay.

10 A And I want to put a lot of emphasis on the word "policies" there.

11 Q And is that because, to your point earlier, normally when people say

12 "compliance," to your point, it's usually with some kind of regulation or statute or an

13 outside obligation, but it sounds like what you were saying was that "compliance" meant

14 with your corporate policies, which could be something like acceptable use practices or

15 agreements between Salesforce and its customers?

16 A Yes, that's exactly it. So, for us, it was compliance with the MSA and with

17 the -- sorry -- Master Subscription Agreement and with the permission-based marketing

18 policy on the Pardot side, the anti-spam policy on the Marketing Cloud side.

19 Q And it sounds like you've been in the email industry for quite a while. How

20 many years have you been doing this?

21 A Eight years.

22 Q Okay.

23 And can you explain, why do -- let me go back for a second. When we're talking

24 about abuse, who are we talking about either being abused or doing the abuse?

25 A Doing the abuse, in our perspective, would be our customers. Being

 20

1 abused would be our infrastructure -- and, in a way, like, their customers, because they're

2 getting unsolicited email.

3 Q So that's what I kind of wanted to parse into, is, when you say you're abused,

4 I'm assuming you're getting complaints.

5 A Yes.

6 Q And those complaints are presumably from the recipients of emails that are

7 coming from your platform.

8 A Yes.

9 Q So, if a customer was using Marketing Cloud and they were sending out

10 millions of emails and there were complaints from the people who were receiving those

11 emails, some of those people might actually come complaining to you, the platform they

12 were getting the email from.

13 A Yes. That's correct.

14 Q Okay.

15 Why do those complaints matter if those individuals aren't your customers?

16 A So that touches on the overall email industry. So we have the CAN-SPAM

17 Act of 2003, which has seven provisions, none of which include that you have to have

18 opt-in permission. So there is a joke in the industry that is: You can spam.

19 But if you want your mail delivered, you have to have permission. And that is

20 Yahoo, Gmail, that is the in box providers of the world saying, "We are not going to deliver

21 your mail if it is not wanted by our customers."

22 So any reputable service provider will publish and enforce a permission policy of

23 some sort -- permission-based marketing policy, anti-spam policy, AUP. Whatever it is,

24 we do not allow spam on the platform.

25 So, in order to abide by those requirements of the industry, we have to actually

 21

1 enforce said policies.

2 Q And just to be clear, earlier I think you used the term "MSA." You said it

3 was a Master Subscription Agreement. This is the contract that Marketing Cloud would

4 have with its customers in terms of the terms by which the customer would have to abide

5 by?

6 A Yes, that's correct.

7 Q And I think there's a term "AUP." What does that stand for?

8 A Acceptable use policy.

9 Q Okay. And is that practices that customers would have to follow?

10 A Yes. So we didn't use "AUP" as a term, but AUP would generally cover how

11 you're allowed to use the services. So I know Marketa called it an AUP, but it was

12 effectively, like, "Don't send spam, and here's what spam is," et cetera.

13 Q What do you call it -- or what did you call it at Salesforce?

14 A For Pardot, it was the permission-based marketing policy. For Marketing

15 Cloud, it was the anti-spam policy. And the reason they were differently named is

16 because we were different companies to begin with and we hadn't merged the policies.

17 Effectively the same thing but just different names.

18 Q Okay. All right.

19 And I think a moment ago you covered this, but I just wanted to make sure I

20 understand this, because we're obviously not email experts. But Salesforce is an email

21 service provider, an ESP?

22 A Salesforce as a whole is a lot more than just an ESP.

23 Q That's fair. But Marketing Cloud, would that qualify as an ESP?

24 A Yes, it would.

25 Q And a moment ago I think you mentioned Google, Yahoo. Those are ISPs,
 22

1 in box service providers?

2 A That's correct.

3 Q Okay.

4 And if I understood you correctly, those companies are very concerned with how

5 much spam gets through to their customers, because if their spam filters don't work, they

6 might go to another company, right?

7 A Yes.

8 I also want to make a point on the language.

9 Q Okay.

10 A The ISPs, we also can use that interchangeably with senders and receivers.

11 So a sender is an ESP; a receiver is an ISP. Sometimes it just helps us clarify the

12 language, because "ISP" could also mean internet service provider, and that confuses

13 people.

14 Q Yes, it does. So that's why I wanted to get the terms correct just in case we

15 started saying ISP, ESP.

16 But that's also super-helpful, to know that Salesforce could be -- or Marketing

17 Cloud -- we'll just say Salesforce -- Salesforce could be the sender and Google could be

18 the receiver or the ISPs would be the receivers.

19 A Yes.

20 Q Okay. Because Salesforce would be sending emails that would go through

21 the infrastructure and platforms of those in box service providers, correct?

22 A That is correct.

23 Q Okay.

24 Now, can you explain what Spamhaus is?

25 A Yes. So Spamhaus is the biggest, most reliable blacklist provider that we

 23

1 have in the industry.

2 Q And let me just clarify for the reporters, it's Spamhaus, h-a-u-s.

3 And can you tell me -- a moment ago, you said it's the -- I'm sorry, say it one more

4 time. It was a blacklist provider?

5 A Yes.

6 Q And what does that mean?

7 A So let me start with language. It used to be called "blacklist." We

8 changed the terminology to "blacklist." So you may see those used interchangeably

9 across the internet. We are trying to change the language to "blacklist."

10 But what Spamhaus does is, they run networks of in boxes, essentially, that just

11 look at what mail is being received. Depending on what they see, they may list an IP

12 address. So that's a list that, when a receiving server gets an email, it'll say, "Okay, can

13 this sending IP address be trusted? Is it a good IP address? I'm going to go check and

14 see if it's on a blacklist anywhere. If it is, I'm going to treat it a certain way."

15 So, because Spam ha us is the biggest, most trusted blacklist we have, if you are

16 listed on Spam ha us, fully 60 to 80 percent of your mail is probably going to get hard

17 bounced.

18 Q And when you say -- you're talking about the sender, right, not an individual

19 email address who says, "Oh, I want to be included on your list"? You're saying

20 Spamhaus actually blocks entire senders for bad practices?

21 A They have the right to. You would have to be a very, very bad sender for a

22 very long time -- maybe not a very long time, but you'd have to be a very bad sender for

23 them to block your entire IP space. Generally Spamhaus will list a single IP.

24 Q Okay.

25 So I guess my question is: I'm an individual. Do I write Spamhaus and say, can
 24

1 you put my email on a list so that nobody sends it? Or is it more for companies to use?

2 A I see. Okay. First of all, you can't write in to Spam ha us and request

3 anything. Spamhaus does their own thing. But it's not email-address-based. So it's

4 IP-based.

5 Q Okay.

6 So is it fair to say they do some kind of assessment on the deliverability of emails

7 based on, like, an evaluation of the performance of an IP, like, how well they're doing in

8 terms of spam rates?

9 A No, that wouldn't be accurate. Spamhaus --

10 Q That's okay. It felt like word salad when it came out, so I'm glad you

11 corrected it.

12 So, like, you tell me in your knowledgeable words, what is it that Spam ha us is

13 doing? Like, what is the service that it provides to the industry?

14 A Okay. So there are these email addresses that are known as spam traps.

15 Q They're known as what?

16 A Spam traps.

17 Q Spam traps.

18 A These are addresses that -- and so there's different types of spam traps.

19 There's pristine traps, there's recycled traps, and there are typo traps.

20 A pristine trap is an email address that never gets published to the internet. It

21 just is an email address that exists.

22 A recycled trap is one where I might have purchased a domain, I will bounce mail

23 from that domain for roughly 12 to 18 months, and then I will recycle whatever addresses

24 were on that domain. They are now a recycled trap.

25 Then there's typo traps. So I might buy Ga mil.com, Gmaill.com, common

 25

1 misspellings of known domains, known email domains.

2 Spam ha us has some combination of traps -- they keep things very, very locked

3 down, very, very secret, but they have some combination of these traps to know, hey, if

4 someone is hitting a pristine trap that has never been published anywhere by anybody,

5 how did they get that address? They clearly got it through means that were not opt-in.

6 So they know, based on those trap hits, that you're doing something you shouldn't

7 be doing. You're buying lists, you're guessing addresses, you're appending -- you're

8 doing something wrong. Based on that data, they will list an IP address.

9 And that -- and let me clarify. That is specific to the SBL. They run multiple

10 lists. So they may see something like from, I don't know, some gambling ring or

11 something, and that's somewhere else. But the list I specifically focused on was the SBL.

12 Q And what does the "SBL" stand for?

13 A Spamhaus Block List, I believe?

14 Q Okay. All right. And we'll drill down into some of the things that you just

15 said.

16 I want to cover, when did you leave Salesforce?

17 A I left in August of 2021.

18 Q And why did you leave?

19 A I left because o f - I left because Salesforce very obviously didn't care

20 about anti-abuse. I left because I was crying at my desk every afternoon right around

21 2:30, and I deserved better. Salesforce had burned me out.

22 Q And a moment ago I think you said that -- we were talking about the abuse@

23 address, and you were talking about that lack of culture.

24 Understanding now that that's part of why you left --

25 A Uh-huh.
 26

1 Q -- can you go back to explaining that abuse@ address? I think you said

2 something to the effect of, that would've been something that would be published

3 somewhere that somebody could find but nobody was on the other side at Salesforce?

4 A Yes. What was the question?

5 Q Well, I guess what I'm trying to figure out is, you had an abuse department.

6 Earlier, we said

7 Were you ever able to determine why the abuse at Salesforce wasn't being forwarded to

8 the abuse department?

9 A There's a couple reasons. And that's a very good question.

10 To start off, Salesforce proper -- so I'm talking core, the core CRM product -- did

11 not have a permission requirement. Salesforce's core product just said, whatever law

12 you need to comply with, you should go ahead and maybe probably comply with that.

13 The law in the U.S. is CAN-SPAM. CAN-SPAM, again, has nothing to do with

14 opt-ins. So you can completely send spam that is CAN-SPAM-compliant.

15 So, even if we did take those complaints, there's nothing we would've really been

16 able to do with them. We could've opted that person out, sure, but there wasn't really

17 an ability to, like, kick people off the platform or really enforce anything.

18 Q Well, when you say kick people off the platform or enforce anything, you're

19 talking about kicking them off the Marketing Cloud platform or enforcing your MSA and

20 acceptable use policies, right?

21 A No. For Salesforce -- this is where it gets confusing, right, is, there's

22 multiple contacts, there's multiple layers to this.

23 Salesforce core did not include a permission requirement in the MSA. So you

24 could feasibly sign up for Salesforce CRM services, you could send -- I think they had, like,

25 you could send 200 emails a day or something. But don't quote me on the 200. That's
 27

1 not exact. But you could just send whatever mail you wanted to out of Salesforce

2 proper. They had their own infrastructure for that.

3 Then you have Marketing Cloud, which does have a permission policy, does have

4 those requirements, has a separate infrastructure than what Salesforce core has.

5 Pardot was the same way. We had a permission-based marketing policy. We

6 actually used Marketing Cloud's infrastructure, so -- when I say infrastructure, I mean

7 servers, kind of all that technical setup -- and we used their infrastructure, so we

8 published the policy.

9 The Salesforce core did none of that.

10 Q And do you think that's partially because, it sounds like, Pardot and

11 ExactTarget or the products that Marketing Cloud was using to send emails allows for

12 thousands, possibly millions, of emails to be sent per day?

13 A That is correct. Because of the scale, yes, we definitely had to comply.

14 Q And so, earlier, when you said the abuse@ address, that was an

15 abuse@Salesforce for all of Salesforce core?

16 A So it got a little weird there. We had abuse@Salesforce that existed.

17 Nobody really knew it existed, or was paying attention, rather.

18 There was a guy who managed email deliverability in Marketing Cloud. His name

19 was- He is no longer there. B u t - w e n t and said, okay, hey, there's

20 the abuse@Salesforce address. I'm going to write -- he wrote some sort of script that

21 would actually look in the abuse in box -- I'm sorry -- the abuse@Salesforce inbox, and if

22 he saw anything related to Marketing Cloud, he would actually forward it on to my team.

23 Q And when do you t h i n k - discovered and did that? What is the

24 timeframe you're talking about that that happened? Before 2020?

25 A It would've been before 2020, yes.

 28

1 Q Okay. And so, during the relevant time period that we are talking about,

2 that already existed.

3 A Yes. To my knowledge, yes.

4 Q So, while you were there during the relevant time period, emails that were

5 sent to abuse@Salesforce that referenced Marketing Cloud would've been

6 auto-forwarded to your team.

7 A Yes, if there was a way to tell that it was from Marketing Cloud.

8 Q Right.

9 A Should I explain how you can tell?

10 Q Yes. That would be helpful.

11 A Okay.

12 The way you can tell if it's sent from Marketing Cloud is if you receive the email

13 headers. Email headers are the information -- basically all of the technical information

14 on how an email got from point A, the sending server, to point B, the receiving sender.

15 So, if you included headers, we had a line in there that was called the X_job. The

16 X_job would tell you the account name and the job the actual server ran. If the X_job

17 was included -- that was a specific header line just for Marketing Cloud. If the X_job was

18 included, we knew it was a Marketing Cloud account.

19 Q So if I'm a recipient of an email that I am sitting here saying "I didn't sign up

20 for this" or "I'm having problems," I could look at that header and theoretically figure out

21 exactly which company sent it to me, complain to that company, the ESP; and if I was able

22 to find the email address, in this case similar to abuse@Salesforce, get my complaint to

23 somebody who could then check the header of my email and say, yes, this did indeed

24 come from us.

25 And if I'm understanding you correctly, not only could you confirm that it came
 29

1 from Salesforce, you could actually confirm that it came from the Marketing Cloud, and

2 you could even confirm which customer on Marketing Cloud that it came from.

3 A Yes. So I could do that. So, for you, if you are a more -- and you have to

4 be more technical to understand headers exist.

5 But let's say you are a more technical user. You go into your inbox; you read

6 headers. You wouldn't know from the X_job that Marketing Cloud had sent it. You

7 would know because we have an X report of the X-report-abuse. And the

8 X-report-abuse would say, oh, it's abuse@ -- I think we were using ExactTarget.com at the

9 time. And so you could just go email that address.

10 You could also know based on the IP address. So you would say, okay, here's the

11 IP address that actually sent the mail, I'm going to go look up that sending IP address, I'm

12 going to figure out what infrastructure sent this mail, and I'm going to go complain to

13 their abuse address.

14 Q That's very helpful.

15 So I want to turn really quickly and ask if you remember dealing with a customer

16 at Marketing Cloud called the Republican National Committee, or the RNC.

17 A I do.

18 Q And was it your understanding that -- well, let me back up for a second.

19 The account name was the RNC, but was it your understanding that they may have been

20 doing work for other entities?

21 A Can you define "other entities"?

22 Q Yeah. So, to the best of your knowledge, do you know if the Trump

23 campaign was working with the RNC and using the RNC's account at Salesforce? If you

24 know.

25 A I don't know.
 30

1 Q Okay.

2 A What I do know is they sent a lot of mail purporting to be from the Trump

3 campaign.

4 Q Okay. So, if you were looking at the content of the emails that were being

5 sent from the RNC campaign -- excuse me -- from the RNC Salesforce account, you would

6 think a number of them were being sent from the Trump campaign?

7 A Yes.

8 Q Okay.

9 And when do you remember first coming to deal with the RNC as a customer at

10 Marketing Cloud?

11 A As a whole, it would've been early on. It would've been early 2020.

12 Q Okay. And do you remember having issues or problems, from an abuse

13 standpoint, with RNC as a customer?

14 A Yes.

15 Q What's the earliest you remember dealing with abuse problems with the

16 RNC?

17 A The earliest, sort of, trickles of abuse would've been early 2020. The

18 deluge of abuse would've started in June-ish.

19 Q And can you explain what you mean, "the deluge of abuse"? Day-luge?

20 Dell-yuge?

21 A The tsunami, we'll just call it.

22 Q The tsunami of abuse. There we go.

23 A Yes. So, because of how many cases we see at the abuse desk, it takes a lot

24 for you to really ping my radar. You have to be pretty up there, in terms of something

25 you're doing -- spamming, Spamhaus, whatever it is -- for me to really take notice.

 31

1 So, in June, the RNC started really having me take notice. So they had quite a

2 few complaints, quite a few issues.

3 Q Okay. And I'm going to come back to what types of complaints, so let's just

4 put a pin in that for right now.

5 What happened -- do you take any action when you see the tsunami of complaints

6 coming in June?

7 A So let me back up, because this is sort of relevant.

8 Back -- and I want to say it was in April -- we had a complaint with the RNC. It

9 was kind of a one-off. We managed it. They gave us kind of a -- not a real answer, but

10 I can't go after people -- even though you can have the sense they're doing -- you can tell

11 they're doing something wrong, you can't feasibly go after them.

12 But in, I want to say it was April,-said to me, "I want to manage

13 all" ---wants to manage all of the RNC's complaints. So, when I started seeing

14 these come across my desk, I would read them, I would verify it was the RNC, and I would

15 send it up t o - .

16 Q I just want to clarify, when you say that happened in about April,.

17 said that he wanted to start handling the communications with the RNC

18 regarding their complaints, but you were still going to conduct the investigations into the

19 complaints?

20 A Lightly. And when I say "lightly," I mean I would verify that it was the RNC,

21 myself a n d - would verify they had been unsubscribed, and then we would send it

22 to-.

23 I say "lightly" because part of an investigation involves going to the customer, in

24 this case the RNC, and saying, "Hey, where did you get this information? How did you

25 get it? Who authorized you getting it?" So you may respond with, okay, it was a form
 32

1 fill on February 15th, and, obviously, the customer had given me -- this person had given

2 me permission to send mail. That was the other half of the investigation t h a t -

3 was supposed to be doing.

4 Q And after said he would take over doing it in April 2020, do you

5 know if he ever, in fact, had any of those conversations with the RNC?

6 A I don't believe he did, but I --

7 Q Okay.

8 A -- can't -- you know, that's to my recollection.

9 Q And before he took over in April 2020, did you ever have conversations with

10 anyone at the RNC about the complaints?

11 A I remember having one.

12 Q Do you remember the individual you spoke with?

13 A I do not. It was some very generic male name.

14 Q Okay. And did you speak with him in person, or was it on the phone?

15 A No. Everything we did was via email.

16 Q Everything was via email.

17 A Everything.

18 Q Okay.

19 A It was exceedingly rare that I would get on the phone, because we knew that

20 abuse cases could be used in, like, legal proceedings and people could sue, et cetera. So

21 we tried to keep as much as humanly possible in writing. And I was very, very intense

22 about that with my team.

23 Q Interesting. Okay.

24 And in the emails when you would raise issues with the RNC -- I think you said you

25 did it once -- what was the tone of their response when you raised a complaint issue with
 33

1 them?

2 A From what I recall, it was fairly indignant, that they couldn't believe we

3 would dare reach out. That's to the best of my knowledge, is that they reacted as if,

4 like, you shouldn't be doing this, how dare you.

5 Q And earlier, a while ago, you said something about bounce rates, I think, was

6 something that you looked at. Did the RNC have high bounce rates?

7 A So, for the Marketing Cloud, they didn't really -- we didn't monitor bounce

8 rates. On Pardot side, we did for a couple of years. We had a job that would run that

9 would actually monitor for client bounce rates. But Marketing Cloud didn't. Marketing

10 Cloud was entirely complaint- and blacklisting-based.

11 Q Okay.

12 And so earlier, a moment ago, you said that in April 2020, this is when-

13 - t a k e s over the communication side of the relationship, and then in June 2020

14 there's a tsunami of complaints.

15 Now, do you go to Mr. Chandler at some point to try to change the relationship

16 between you and the RNC?

17 A In a way, yes. I actually went to - and said, "Look, given what's going

18 on politically and given what I'm seeing, I do not feel comfortable remediating any issues

19 they have. So, if they were to be listed by Spam ha us, I would like to recuse myself."

20 Should I --

21 Q Yeah. Can you explain what that means?

22 A Yes. So my job was to manage the -- any time a client got listed by

23 Spam ha us, it was my domain. I would manage the Spam ha us listing. If the RNC got

24 listed, I was not going to offer remediation. I was going to l e t - to handle it.

25 Q And when you say "remediation," you mean help getting the customer, RNC,
 34

1 out of trouble with Spamhaus?

2 A That is correct, getting them removed from Spamhaus's blacklist, which

3 involves a number of steps to appease Spam ha us to get them off the list.

4 Q And that wasn't a required part of your job; that was kind of like a customer

5 service that you offered for Marketing Cloud customers?

6 A "Required" is an interesting term. Yeah, we did it because Spam ha us

7 generally doesn't interface directly with customers. Spam ha us directly interfaces with

8 the email service provider.

9 So it was kind of just, like, an industry requirement, in that Spam ha us

10 wouldn't -- they wouldn't usually have talked directly to a customer. They would make

11 exceptions in rare cases, but generally it'd be the ESP managing that relationship.

12 And you want the ESP managing that relationship. You do not want customers

13 going to Spam ha us. It does not go well.

14 Q Okay. I can imagine.

15 So you basically tell "I will do the investigations and I will give you

16 the information to be able to talk with the RNC, but I am not going to help remediate any

17 Spamhaus problems they may be having; somebody else can do that."

18 A That's correct. And the reason I did that is because I take a great deal of

19 pride in everything being completely neutral. Doesn't matter -- what I care about is my

20 infrastructure being clean and protected. If I was unable to be neutral, I wanted to be

21 able to step away from it and not be involved at all.

22 Q And what was happening in June of 2020 that made it difficult for you to be

23 neutral with RNC specifically?

24 A Yeah. For me, it was BLM. It was, you know, all of the stuff around, like,

25 women's rights. I think that was around the timeframe Georgia did the whole, like,
 35

1 horrible abortion stuff. And I didn't like what I was seeing.

2 Q To be clear, when you say you didn't like what you were seeing, you didn't

3 like what you were seeing in the RNC emails that were being sent from the Salesforce

4 platform?

5 A This was specific to: I didn't like what I was seeing politically. Externally, I

6 didn't like what I was seeing. I knew the RNC was heavily involved in all of the political

7 stuff. So it was just, "Hey, here's what I'm seeing in terms of what this party is doing.

8 don't want to remediate."

9 Q Okay. So it wasn't that specific. It was, you just didn't like what the RNC

10 was doing, and you didn't want to re mediate if they got in trouble for their emails.

11 A Right. I didn't like what the party was doing, and the RNC is the party, so,

12 you know, I just recused myself from it.

13 Q And that makes sense.

14 A moment ago, we were talking about the complaints that Salesforce received

15 relating to the RNC emails that you would've received from recipients who were able to

16 identify that the email came from Salesforce.

17 A Yes.

18 Q How did they file those complaints with Salesforce other than the

19 abuse@Salesforce email?

20 A Sorry. You're asking, how did they file those complaints with Salesforce?

21 Q Right. So how does a complaint get to you in the abuse department from

22 an email recipient?

23 A The only way you would know is by reading the headers, seeing the abuse@

24 address, and then sending that email to us.

25 You may --1 mean, some people in the industry may have known the RNC was
 36

1 using Marketing Cloud, but you would still verify through the headers. So it was pretty

2 much entirely, you would know based on the headers.

3 But, yeah, it was the abuse address that is how you would know.

4 Q And that was earlier when you discussed almost, like, a tracking mechanism

5 that you embedded in the headers with the X_job, that was specific to Salesforce, that

6 would allow somebody to identify that it came from Salesforce and it came from

7 Marketing Cloud?

8 A Not necessarily. The X_job is something we used internally that we knew

9 about. For you, if you were going to complain to me, as just a random citizen, you

10 would know based on either the sending IP address or you would know based on the

11 X-report-abuse address.

12 Q Oh, okay. So, if there was an X-report-abuse address, I could see that in

13 the header and direct-email it. Or, if I was very technical, I could see an IP address in the

14 X_job, reverse IP lookup, see that it was Salesforce, and contact you?

15 A Clarification: The IP address would not be in the X_job. The IP address

16 would be elsewhere in the headers. But yes.

17 Q I appreciate your specificity and attention to detail.

18 So I want to go back, because you said there were a tsunami of complaints in June

19 of 2020. Tell me what kind of types of complaints the RNC was getting, like, the bucket.

20 Let's just go one by one. Like, what types of complaints? What things are people

21 complaining about?

22 A Yes. So, for them, those complaints mostly involved, "How did you get my

23 email address? I never signed up for this." It was, "I opted out of this. Why am I still

24 getting this mail?"

25 Q All right. So is another way to say the first one that they were getting
 37

1 unsolicited email or spam?

2 A That is correct.

3 Q And the second one, they were putting through unsubscribe requests that

4 didn't get them unsubscribed?

5 A That is correct.

6 Q Did you see unsubscribe requests -- well, let me back up for a second. If

7 they sent that in, were you able to unsubscribe them?

8 A I was, yes.

9 Q And did you ever see somebody that you unsubscribed get resubscribed by

10 the RNC?

11 A I believe so. I didn't think about it at the time, but they would say, "I've

12 already unsubscribed," and we'd just go unsubscribe them. I didn't do any deeper

13 investigation. I probably should've, but I just didn't have the time.

14 Q And were you getting complaints of something called fake headers?

15 A That was not in June, but, yes. A lot closer to the election timeframe was

16 emails where they were sending "from the desk of Kamala Harris."

17 Q When you say closer to the election, are we talking the November 2020

18 election?

19 A We are.

20 Q Okay.

21 And I just want to clarify, when I say "fake header," what does that mean to you?

22 Or what does a fake header mean in the industry?

23 A So that would be any information that isn't accurate. So if you are Amanda

24 Wick and you're sending email as, I don't know, President Biden, you are sending fake

25 email. You're purporting to be President Biden, and that is not who you actually are.
 38

1 So that would be considered false headers.

2 You can also spoof an IP address, which gets into some very highly technical stuff,

3 but you could pretend you're from some other infrastructure. That's a lot rarer and a lot

4 harder to do, as you can imagine.

5 The false headers that I was seeing were pretty basic. It was, the "from" address

6 was saying "from the desk of Kamala Harris."

7 Q Okay. So just to be clear, so this is false header information in commercial

8 electronic mail messages, right?

9 A That's correct.

10 Q And they were pretending to be from Kamala -- Kamala Harris?

11 A Yes, that is correct.

12 Q I'm sorry, I always mispronounce that.

13 Were there any other fake headers that you saw, other than the emails that

14 purported to be from Ms. Harris?

15 A Those were the only fake headers I saw in my entire career.

16 Q Because that's a big deal, isn't it?

17 A It is. It's a huge deal. It is -- I'm not a lawyer, but that is a CAN-SPAM

18 violation through and through. It's also just professionally inappropriate.

19 Q So we'll talk about this in a minute, but, to the best of your knowledge,

20 material false headers are actually in the criminal provisions of the CAN-SPAM Act, aren't

21 they?

22 A Possibly. I --

23 Q If you do not know, like, you can say, "I have no idea. I'm not a lawyer." If

24 you don't know that, I'm not going to put words in your mouth.

25 I'm curious, are you familiar with the fact that false headers are part of the
 39

1 criminal provisions of CAN-SPAM?

2 A I -- it wouldn't surprise me, but, no, I don't know what the criminal

3 provisions -- I just know the main seven -- the top seven things in CAN-SPAM.
 40

2 [11:06 a.m.]

3 BYMS. •:

4 Q And I think you said that was first time you'd seen that in your 8 years in the

5 industry?

6 A It was.

7 Q Because that's a big deal, yes?

8 A Oh, yes.

9 Q Okay.

10 What happened with the fake-header type of complaint? Was there anything

11 different about that when you put that forward to your boss?

12 A There was. To my recollection, I t h i n k - went to legal, a n d -

13 said, "They cannot do this. This is a violation of CAN-SPAM." And I want to say that

14 legal sent the RNC a letter, but I couldn't tell you confidently.

15 Q Okay.

16 A But somebody had to say something to the RNC, because we had to get

17 them to cut it out.

18 Q Okay.

19 And, to be clear, the way that you were able to tell that it was not from Ms. Harris

20 was, the content made it pretty clear that it was, in fact, anti-Ms. Harris and not from

21 desk of Ms. Harris?

22 A It was the content. I mean, the X_job showed me it was from the RNC.

23 I'm quite confident Ms. Harris would not send an email through the RNC. She would

24 have other means. Yeah, it was blatantly obvious.

25 Q Okay.
 41

1 And, just to be clear, to the best of your knowledge, you went to

2 Do you remember whether you emailed him about the fake header issue, or did you go to

3 him in person, or Slack him?

4 A I think it probably would've been one of those, like, "WTF is this" kind of

5 Slacks.

6 Q But you think there's some concern written record of you going to him about

7 the fake header issue.

8 A I believe so.

9 Q Okay.

10 A And, for us, our usage of Slacker versus email would've been, email was very

11 formal. Email is when, if you needed to involve a lawyer, you needed to involve multiple

12 someones. Slack was very much the quick one-off, you're conversing, it's more casual,

13 more fluid.

14 So it probably would've been a, like, "Vo, what is this" kind of Slack message,

15 would be my guess.

16 Q So we were talking about the types of complaints, and we've got sending

17 spam, unsubscribe request issues, fake headers. Were there also complaints related to

18 the content of the emails themselves?

19 A There was.

20 Q And what were the complaints that you received related to the content?

21 A It would've been kind of one-off stuff from people like, "What is this? "This

22 content is" -- you know, "this is awful." It was sort of -- the standard kind of complaint

23 stuff you get, where you're like, "Why are you sending me this? This doesn't make any

24 sense. This is" -- you know, it was just stuff like that.

25 From my perspective, when I would look at the content, because they would send
 42

1 headers and the actual content of the email, I did see an escalation in terms of the

2 language they were using in their emails.

3 Q So --

4 A So, originally, it was -- sorry.

5 Q I'm going to come back to your concerns --

6 A Okay.

7 Q -- and I'm just talking about now the complaints that you received. I got

8 the impression that there was a "what on earth" tone to the complaints of the content.

9 But do you remember any of the complaints that you received ever having concerns

10 about violence in the tone?

11 A Not to my recollection, no.

12 Q Okay. It was more, "What is going on? How did they get my info?

13 never signed up for this"?

14 A Yes, that was -- I would say that was 90 -- I mean, not 90 percent; it was

15 probably 70/30. But, yes, most of it was, "How did they get my info? Why are they

16 sending me email? Why are they sending me so much email?"

17 Q And now going back to your concerns, when you were able to see the

18 content of the emails, what were your concerns regarding the content?

19 A So, originally, the content was kind of the language you would see, like, your

20 boomer grandpa would, like, mention at Thanksgiving and stuff. It was stuff where

21 you're like, okay, whatever, that's weird, but all right.

22 But then it really shifted towards: Join the army, give us money to support the

23 army, fight the libs, fight antifa, they're ruining America -- all of this very inflammatory

24 language that made me uncomfortable.

25 Q Why would the violent tone be a problem in those emails, in the sense that,
 43

1 like, can't a customer send whatever they want, like, free speech?

2 A No. So free speech, yes, but in the MSA we state, you cannot send violent

3 content, you can't send -- I think we say you can't send pornographic conflict, gambling,

4 drugs, like, you know, kind of all that stuff.

5 It's speech in the sense that, like, you can't yell "fire" in a crowded theater. Kind

6 of the same -- it's the same thing here. You can email whatever, but there are

7 guardrails.

8 Q And this goes back to what you were talking earlier with the MSA and the

9 acceptable use policies for Marketing Cloud. There were rules in place, especially given

10 concerns that ISPs might have if those were rules weren't in place.

11 A Yes, that's correct.

12 Q And did Salesforce have something called an ethical and human use

13 department?

14 A They did. The Office of Ethical and Humane Use, OEHU.

15 Q And what did they do?

16 A That is an excellent question.

17 They were just starting up, I want to say, in early 2019, but don't quote me on

18 that. But there was something around, like, how Al is used and, like, the ethical use of

19 Al, like, sort of out in the public. Elon Musk, I think, had some stuff to say about it.

20 And so it became, like, a hot thing to have an ethical and humane use, and, like, how do

21 we humanely use our products and make sure it's not causing damage or whatever.

22 So they were kind of weirdly also -- let me put it to you this way. We had a case

23 with a customer -- this was in deliverability services -- where they had someone in the

24 adult industry, and somebody walked past their laptop, saw what was on screen, and

25 reported it, and Humane and Ethical Use got involved. And I don't super know how, but
 44

1 I know they were -- so it was kind of like an HR thing, kind of like an external, like, "We

2 believe in ethical use."

3 It was kind of -- if my words aren't tell you, it was pretty nebulous, honestly, in

4 terms of, like, what they actually did and what their power was.

5 Q Did you ever have discussions with them about your concerns related to the

6 tsunami of emails that you were -- or, the tsunami of complaints that you were seeing in

7 June 2020 -- starting in June 2020?

8 A The tsunami of complaints, no. The content I was seeing, I believe I did,

9 yes.

10 Q Okay.

11 And let me come back to that complaint -- actually, let's do that now. So what

12 did you do with regards to the content in terms of escalating your concerns?

13 A So, at some point -- I don't recall if it was post-election or pre-election, but it

14 was somewhere in that timeframe -- I sent an email to a couple people and said -- and "a

15 couple people" defined a s - I think-; possibly_, who was Marketing

16 Cloud's lawyer; I thin ; possibly -- basically saying, "Hey, here are

17 some quotes I'm seeing from these emails. This doesn't look right. Like, the tenor of

18 these emails is increasingly concerning."

19 Q And so I want to make sure I understand. So, in June 2020, you see the

20 ramp-up -- and, to be clear, is it in the quantity of the emails and the tenor of the tone

21 that you're concerned?

22 A In June, it was just the quantity.

23 Q The quantity.

24 A The quantity kind of alerted me to, okay, this is possibly going to become a

25 thing. Towards November, it was when the tone sort of shifted in a more violent
 45

1 direction.

2 Q So closer to the election is when the content concerns come.

3 A That is correct.

4 Q Okay.

5 And so, at some point, if I understood, you raised those concerns -- and I'm going

6 to come back to whom -- regarding the violent language. And I think earlier you said the

7 use of the term, it was, like, "army" or "Trump army" or "fight" or something like that?

8 A Yes.

9 Q Okay.

10 A Like, "Join Trump's army."

11 Q And when you send your -- it's an email you send?

12 A Yes. Because it was more formal, there were more people on it, that

13 would've been an email.

14 Q And do you include quotes that gave you concern from the content?

15 A To my recollection, yes.

16 Q Okay. Who did you email -- well, let me back up for a second.

17 Do you think, the timing of that, of when you emailed them, you said it was

18 pre- or post-election, but you don't know; it was sometime around the election?

19 A Yes. I want to say it was post-, but I honestly do not remember.

20 Q Okay.

21 A But I know it was sometime in that, like, fall kind of timeframe.

22 Q Sometime around the election?

23 A Yes.

24 Q Okay. And do you remember who you would've sent that email to?

25 A I believe it would've been -possibly-

 46

1 -- possibly

2 Q And --

3 A - may or may not have been CC'd.

4 Q Hold on one moment. We're going to go through those people.

5 So you said your b o s s , _ ?

6 A Yes.

7 Q Hisboss,_

8 A Yes.

10 A Yes. She's in it. is her boss.

11 Q Okay. You think you emailed one or both of them?

12 A Yes.

13 Q Okay. And I think you s a i d -

14 A Yes.

15 Q And is he legal?

16 A Yes. - is the lawyer I used to send breach notices when I was

17 going to fire a client.

18 Q Okay. And was there anyone --1 think you said somebody else a moment

19 ago.

20 A Possibly-

21 Q Okay.

22

23

24
A

A
-What about

It's possible, becaus was, I think, the main lawyer over Marketing

25 Cloud. I don't remember fully i~was on that email.

 47

1 Q Is there anyone else who might have been on the email, to the best of your

2 recollection?

3 A I don't think so, no.

4 Q Okay. But the gist, from what I can see, is, you copy your supervisor,

5 maybe your supervisor's supervisor maybe two levels up, you copy somebody from legal,

6 you copy somebody from ethical and humane use.

7 A Yes.

8 Q Okay.

9 And it's sometime around the election. You raise the concerns of the violent

10 language that's -- violent/inflammatory -- I don't want to put words in your mouth,

11 but -- content of what you're seeing from the RNC emails.

12 What happens in response to that email?

13 A From what I remember, I kind of got ignored. I don't remember there

14 being a lot of response to it. At least nothing substantial that made me think, oh, okay,

15 Salesforce is taking this seriously. So I think I basically got blown off, from what I recall.

16 Q Okay.

17 Let me go back for one second, because I just want clarify something really

18 quickly. When we were talking about the ethical and humane use department, were

19 they proactive or reactive, in the sense that, like, did people have to come to them with

20 complaints of something unethical or inhumane, or were they kind of out looking for

21 things that might be problematic?

22 A To my knowledge, they were reactive. But I didn't really deal a lot with

23 them, to really be able to answer that super-accurately. But, from my perspective, they

24 were pretty reactive.

25 Q Sitting here today, do you have any awareness of any kind of monitoring or
 48

1 screening function that they would've had at all?

2 A No.

3 Q Okay. And do you remember any kind of employee hotline or anything

4 targeted to employees if you had an ethics or a humane use problem? Was there

5 anything that gave clarity to when employees should contact the ethical and humane use

6 department?

7 A There was a hotline for ethics complaints, but I think it was more of an HR

8 thing. I don't know that it was, you know, this customer is doing something unethical.

9 Q And, really quickly, I just want to go back to something that you mentioned

10 earlier. I think you said something about, there was a concern that -- I think you said in

11 your first interaction with the RNC you were concerned they were buying lists?

12 A Yes.

13 Q And why were you concerned about them buying email lists?

14 A Because the acceptable use policy doesn't allow it. So, if they were buying

15 lists, that would be dangerous to my infrastructure.

16 Q Why? Why does that matter?

17 A Because you're sending spam. You're buying a list -- so, for us, the easiest

18 way to know if you were complying with policy is to ask, does this person know who I am,

19 and are they expecting to hear from me? If you cannot answer that two-part question

20 confidently with "yes," you're probably doing something that is in violation of policy.

21 Buying a list does not satisfy either of those pieces. Those people do not know

22 who you are; they are not expecting to hear from you. You are sending unsolicited

23 email.

24 Politically, it's just sort of known that they buy lists off each other, they trade lists.

25 There's all kinds of deeply poor list practices going on.

 49

1 So you kind of know. But there's also -- with the complaints and stuff, you can

2 tell. Like, if you're saying, "I never opted in for this, I never signed up for this," and they

3 gave me those vague answers in April, you can put two and two together pretty easily.

4 But I can't go after them for it, because customer service.

5 Q So you just answered my next question, which was, did you ask anyone from

6 the RNC about list buying? And I think it sounded like you were saying that was the

7 conversation in April of 2020.

8 A Yeah, I couldn't ask. It had to be pretty blatant, for me to actually be able

9 to go after them for it.

10 Q Wait. Did you ask them if they were list buying?

11 A I did not. Not to my knowledge.

12 Q Oh, okay. Okay.

13 A It wouldn't have been something I would've asked.

14 Q Gotcha.

15 A Especially not so transparently, like, "Are you doing this?" Because I know

16 they -- anyone would just say, "Oh, no, totally not."

17 Q Okay. So you had a lot of reason to believe that they were, and there was a

18 concern that if you asked them, that they would either lie or it would be a bad customer

19 relationship issue.

20 A Yes. Lying to me, at the abuse desk, was not uncommon -- across the

21 board, from RNC or anybody else. But yes.

22 Q So it sounds like -- and correct me if I'm wrong, but it sounds like, at least

23 starting in April 2020 and then the tsunami in June 2020, there was a lot going on before

24 you raised the concerns of violence in or around the time of the election. And it sounds

25 like the RNC was not following the MSA or the acceptable use policies. But they weren't
 50

1 getting kicked off, were they?

2 A That is correct.

3 Q How was that compared to other customers? Would you say that was

4 more lenient treatment than other customers?

5 A Significantly. There's no other client that I can think of that we were that

6 lenient with.

7 Q Did you, in fact -- did you know of other clients getting kicked off the

8 platform for violations of MSA or acceptable use policies?

9 A Yes. It was my job to kick those customers off.

10 Q You did the kicking out?

11 A I did.

12 Q And what reasons were other companies kicked out for?

13 A Purchased-list usage was the highest one. Getting on multiple -- getting

14 Spam- -- we called it "getting Spamhaused," but being listed on Spamhaus multiple times.

15 Those were kind of my two biggest things.

16 Q And the people who got kicked out, would you say they were larger

17 customers or smaller customers?

18 A Generally they were smaller customers.

19 Q The ones who got kicked out, if you had to compare to the conduct of RNC,

20 where did they fall in terms of comparatively to what RNC was doing?

21 A Can you clarify the question?

22 Q What I mean is, you said the RNC got a lot of leniency. For these

23 companies that were kicked out, would you have said the RNC did worse behavior, the

24 same behavior, or better behavior?

25 A Oh, worse. I mean, once they did that false-header stuff, that was, like, top
 51

1 on my list, worst things I've seen a customer do.

2 Q And that was early, right? Because that was April. So then it just gets

3 worse. And then it gets even more worse near the election?

4 A The false-header issue was November-ish -- was after June.

5 Q Oh, that's right, because it was related to the election, so -- I'm back with

6 you.

7 So the false-header thing actually happens around the election. Just out of

8 curiosity, do you think the false-header thing happened before or after you emailed them

9 about the violent-content concern?

10 A I believe it was before.

11 Q Okay.

12 A Because I'm fairly sure that that came up, we resolved it, and then later I

13 sent -- then, timeline-wise, I think then later I sent the violent-content email.

14 Q Okay.

15 And did you try to take any -- so, if I understood you correctly, the false-header

16 situation, takes care of that, talks to legal. You think there may have been a

17 letter sent. You send your email to folks, saying, "Hey, this is violent content, here are

18 some examples." Nothing happened.

19 Did you try to take any other action when your supervisors did nothing in

20 response to your email?

21 A No, I didn't.

22 Q Did you communicate with anyone at Spamhaus?

23 A I did not directly. In the email industry, some of us do have contacts at

24 Spamhaus, so you can talk to them directly about certain things. So I had asked

25 why can't we just -- you know, Spamhaus was certainly seeing stuff. We knew that.
 52

1 We had told -- not "we," but I thin had talked to them. But Spam ha us was

2 seeing issues with the RNC. They were buying lists. It was very obvious. So I asked

3 . , could we get them listed on Spamhaus, by chance?

4 Q And do you know if-reached out to Spamhaus?

5 A I believe so. I believe there were conversations between him and

6 Spamhaus, because he said to me, "They're not going to list. They're afraid."

7 Q They're not -- I'm sorry. They're not going to what?

8 A They're not going to list the RNC on Spamhaus's blacklist. Even though

9 they had plenty of evidence. This wouldn't have been out of band.

10 Q Because they were afraid?

11 A That's correct.

12 Q Afraid of what? Do you know?

13 A Donald Trump.

14 Q In what sense?

15 A That Twitter account was very powerful. You know, you didn't want the

16 Eye of Sauron, really, coming on to you and bringing hell down upon you.

17 There's also -- I know they're very litigious. So I feel like Spam ha us was probably

18 trying to avoid something legally, would be my guess.

19 Q Spamhaus is a European company, right?

20 A To my knowledge, yes. And I think they're mostly volunteer-based.

21 Q Okay.

22 And just to be clear, it's your understanding that had all those

23 conversations with Spamhaus?

24 A From what I remember, yes.

25 Q And do you have any idea when that would've been?

 53

1 A Sometime between June and the election, I think --

2 Q Okay.

3 A -- if I had to put a timeframe on it.

4 Q So I just want to talk really briefly -- I just want you to think, because we've

5 talked about a lot of conversations, and I just want to go over records that you think

6 might be at Salesforce that would reflect those conversations and the discussions you

7 had.

8 So I've got an email to you to regarding your concerns, the violent one.

9 That would've been in and around the time of the election. And we covered the

10 departments that you sent that to, right?

11 A Yes.

12 Q Is there something called "chatter records" in Salesforce?

13 A Yes.

14 So Salesforce used Salesforce, obviously, to manage all of our customers. So we

15 would have a record saying, hey, we have the RNC as a customer; here are all the

16 products the RNC is using. And that would be on the left-hand side of the page; would

17 say, here's their account team, here's all the, you know, paperwork-y info about them.

18 On the right-hand side would be their chatter feed. So that would be things like,

19 I could ping the account executive and say, "Hey, here's what's going on with the account.

20 Please contact them." It would keep a record of the calls and just sort of a feed of

21 activity that went on in the account.

22 Q And did you guys use Slack as a communication method?

23 A We did.

24 Q Did you Slack regarding the RNC being a problem?

25 A Almost definitely, yes.

 54

1 Q Okay.

2 Would you have had conversations -- earlier you said when you had conversations

3 with customers, you tended to do it via email. Do you think there would've been email

4 conversations between either you or , to the extent that they exist in email,

5 between you or and representatives of the RNC?

6 A Not via email, no. We had our own ticketing system. So that would've

7 been through -- our own Service Cloud instance was how we managed all of our customer

8 cases.

9 Q Can you explain that?

10 A In terms of?

11 Q This is the -- I want to be clear that we're talking about the same thing.

12 This is the tickets that you used to deal with customer -- with complaints, or tickets that

13 you used to deal with the RNC?

14 A Both.

15 So we would get a complaint into Service Cloud. We would then create a case,

16 still in Service Cloud. And then we would correspond with the client there. And that

17 was partially to protect my team, so that you wouldn't be sending, like, these emails

18 directly to people, and so that you would have a record.

19 So, like, I could go look at a case, versus me having to, like, go figure out what's in

20 's email or whatever it was. So it was one centralized location, where we all knew

21 the status of a case. We could go in, figure it out -- that kind of stuff.

22 But it was all done -- it was all an email ticketing system, so --

23 Q Okay. So I want to make sure I understand that. So a complaint from an

24 email recipient against the RNC would come in. You would create a ticket in Service

25 Cloud --
 55

1 A No. That automatically creates a ticket.

2 Q Oh, okay. It automatically creates a ticket in Service Cloud.

3 A Yes.

4 Q Okay. And then that would record the customer's complaint.

5 A Yes.

6 Q And, then, that record you could use to communicate with your customer,

7 the RNC.

8 A We would create a separate case. So you'd get the complaint; we would

9 create a new case linked to that complaint --

10 Q And --

11 A -- to direct report someone (ph) with the RNC, yes.

12 Q Got it.

13 And then, in that new case, there could be communications directly with the RNC

14 about the complaint which was in the previous case.

15 A Yes. We would never give -- we didn't usually give the customer the actual

16 content of the complaint, to protect the person who was complaining.

17 Q At some point, didn't you, though, to explain the allegations against them, or

18 no?

19 A We'd give them the email address and say, this email address has

20 complained. But we wouldn't give them the actual content of the complaint.

21 Q Gotcha. Okay.

22 And so you were able to have communications with the RNC through those

23 Service Cloud tickets.

24 A Yes.

25 Q Okay.
 56

1 And was there also a Slack channel called Email Geeks?

2 A That was a -- that was not with Salesforce. That was a -- that's an external

3 Slack thing. It's not a channel, it's an organization.

4 Q Okay. So is that a public organization on Slack?

5 A Semi. I think you have to fill out an application for membership. But it's a

6 free membership; you just have to be in the email industry.

7 Q Do you have to sufficiently prove your email-geekness? Is there a test?

8 A Like a hazing? Not to my knowledge, no.

9 Q Okay.

10 So I want to change gears a little bit and talk about the records that -- just one

11 moment, okay?

12 A Sure.

13 [Pause in proceedings.]

14 Ms.. Sorry about that. We had a little sound issue on our end.

15 Apologies.

16 Okay. So I just want to change gears and talk about -- by the way, let me pause

17 for a moment. How are you doing on comfort? Do you want a break? Are we okay?

18 We both have been drinking coffee. Do we need a comfort break?

19 The Witness. A comfort break would be great. I was just about to request that.

20 Ms.~ I could kind of feel collectively. So let's do this. Let's take -- is

21 5 minutes? Ten minutes? How long would you like?

22 The Witness. Five would be perfectly fine.

23 Ms.~ Okay. So why don't we take -- we'll take 8. We'll go into recess at

24 11:30, and we'll come back at 11:35. And, if you want, you can just turn off your video

25 and your sound, and we'll come back at 11:35.

 57

1 The Witness. Okay. Thank you.

2 Ms- Okay. We'll be off the record and in recess until 11:35.

3 [Recess.]

4 Ms.~ So we'll come back from recess and go back on the record at 11:37.

5 BYMS. •:

6 Q And was there something that you want to clarify from before?

7 A Yes. In terms of the Spam ha us relationship, it wasn't -- just to be

8 ultra-clear on this, it wasn't that I could go to Spam ha us and say, "Hey, will you please list

9 this client that I would like listed?" Spamhaus did not operate -- does not operate that

10 way.

11 You could go to them and say, "Hey, we know we're seeing issues. Are you

12 seeing issues? Can you explain why you're not listing?" Or, you know, "Are you seeing

13 things?" and stuff like that.

14 If they thought it was sufficient to list, they would list. But you couldn't just be

15 like, "Do me a solid. List this." That's not how they operate. They're very, very

16 regimented in terms of that.

17 So I just want to make that super-clear.

18 Q I guess the impression I got from what you were saying was that it was more

19 that you could flag to them somebody that they should look into further to see if that

20 entity would meet the -- put them on the blacklist requirements.

21 A Blacklist, but yes.

22 Q Blacklist.

23 A Sorry. I have to correct it everywhere I go.

24 Q No, no. That television show called "The Blacklist" isn't helping. So

25 apologies for that. I will try to remember it's "blacklist."

 58

1 But I guess -- I didn't get the impression earlier that you were saying we called up

2 Spamhaus and said, kick them off. I got the impression that you went to

3 and said, you could have conversations with them about this and put the RNC on their

4 radar to look at those IP addresses and see if their activity would merit blacklisting.

5 A Okay. Yes, that's accurate. Yeah. It wasn't, please do this for us.

6 Yeah, your interpretation is correct.

7 Q And if I understood you correctly, whatever conversations had

8 with whatever representatives at Spam ha us, to the extent that he did, what he relayed

9 back to you was: They don't want to do that because they're afraid of Trump and the

10 ramifications of taking action against him.

11 A That's correct.

12 Q Okay.

13 So, before the break, I was going to change gears a little bit and ask you about the

14 records that the RNC would've access to as Marketing Cloud customers, what Marketing

15 Cloud metrics they would be able to see when they send out email campaigns.

16 A So, when you send an email, you will get back the bounce rate. So that's

17 how many hard bounces you have. I believe Marketing Cloud does a soft bounce rate.

18 You'd get the number of complaints. You'd get the number of unsubscribes.

19 And engagement data may have been included in Marketing Cloud's reports.

20 never saw how Marketing Cloud actually reported back. But this is standard of

21 any -- any email you send, you would expect to see those results back. That's the whole

22 point.

23 Oh, you'd see opens as well. I'm sorry.

24 Q Okay. So can you walk me through some of the terms that you used there?

25 A I can. Which would you like to start with?

 59

1 Q So I think you said, the first thing was a soft bounce rate?

2 A So there's two different types of bounces. There's a hard bounce, and

3 there's a soft bounce. And that depends on the code that a server sends back.

4 So I might send an email to you. Your receiving server says, "No, there's no one

5 here." That's a hard bounce. "That does not exist. Don't try this again." That

6 usually is a 5 code, so 550, 5-dot-2-dot-1-dot-whatever.

7 Or it could be soft bounce. So let's say your mailbox is full. Let's say there's

8 just some sort of weird temporary error. It would send back -- generally would send

9 back a 4 code, 400-and-some-odd. And that would tell me, okay, the mailbox is full.

10 The address is probably deliverable; there's just something else going on. That is a soft

11 bounce.

12 Hard bounce is: Do not mail again, there is nobody here, cut it out. Soft is:

13 There's something technical, we're not sure, maybe try later.

14 Q And would the RNC get soft and hard bounce rates or just soft?

15 A It would be both. Because hard bounces should opt you out of email

16 settings because the address doesn't exist. So it should mark you as "do not email."

17 Q So you said bounce rates. I think you said -- would they receive open

18 rates?

19 A Yes.

20 Q Okay. And what were the other metrics? I think that you said -- would

21 they receive complaint rates?

22 A Yes. And --

23 Q And that -- go ahead.

24 A To clarify, that is -- clicking "this is spam" in your email client will actually go

25 through what's known as a feedback loop. So you click "this is spam." That goes back
 60

1 and reports back and says, "Hey, this person clicked 'this is spam.' We're going to mark

2 them as 'do not email."'

3 My team was not included in those reports because ours was directly email-based.

4 You wouldn't have any way of technically knowing that we were running an investigation

5 or there had been a complaint through our team.

6 Q So, when we talk about the complaint rates that RNC would've had access to

7 and would've seen in its Marketing Cloud data, we are not talking about the complaints

8 that were manually sent to your team through the abuse@Salesforce or however other

9 method that it would get to you. We are talking about somebody that somebody

10 would've automatically clicked -- or, somebody would've clicked in an email that you

11 received from the RNC that would've gone directly back to the RNC.

12 A That is correct.

13 Q Okay.

14 And is there an assumption about what email senders are supposed to do with

15 those complaint rates? Like, what's the value of knowing your complaint rate?

16 A So the value of knowing your complaint rate is what your overall reputation

17 is. So, if you have a very high complaint rate, your mail is more likely to go to the spam

18 folder instead of the in box. So that's something you definitely want to keep track of.

19 Now, I will say, that can be harder with Gmail specifically. Because usually when

20 you get a feedback loop complaint, you know what email address specifically complained.

21 Gmail does it so that you don't actually know what address complained. So Gmail's a

22 little bit weird.

23 But, yes, ultimately, that complaint rate is important because it determines your

24 reputation, and reputation is everything in this industry.

25 Q And when you say "your reputation," do you mean the reputation of
 61

1 Marketing Cloud or the RNC?

2 A Could be both. If we don't care about those complaints and we're not

3 actually taking action, that's our infrastructure, that is our reputation.

4 But, specifically, if the RNC gets a bunch of complaints and we're doing everything

5 we can and that's known in the industry, it would be the RNC's email reputation -- the

6 reputation of that IP address. Is this mail something that should go to the in box, or is

7 this mail something that should go to the spam folder?

8 Q Now, a moment ago when you were talking about the complaint rates, I

9 think you said that was from somebody clicking in their email something like "this is

10 spam"?

11 A Yes.

12 Q But could they also -- could the RNC also see unsubscribes in their metrics?

13 A Yes.

14 Q And what is that?

15 A That is when you click the "unsubscribe" button. And that's --

16 Q At the bottom of an email?

17 A Yes. I think Gmail does it so that there's also an "unsub" at the top that you

18 can also click, and that would also come into your metrics.

19 Q And so RNC would be able to see every time somebody unsubscribed and

20 every time somebody clicked "this is spam."

21 A Yes. Again, assuming you're not on Gmail, because Gmail is special. But

22 yes.

23 Q So, while they wouldn't be able to know the complaints that your unit

24 received, they would have a good idea if people clicked "this is spam" or "unsubscribe."

25 A They would.
 62

1 Q Are there other ways -- are there other metrics that the RNC would have in

2 Marketing Cloud that would indicate negative feedback or complaints?

3 A Not complaints. They probably would also have click data. That's

4 basically knowing what links were clicked on. And I guess, in a way, if, like, people aren't

5 clicking the links, you could kind of tell whether your mail's being well-received. We call

6 that "engagement" just sort of as a general umbrella. People are not engaging with your

7 mail.

8 But, otherwise, those are kind of the big things. If you know your hard bounce

9 rate is really bad, your list is bad, those are your -- those are your metrics.

10 Q Okay. So it sounds like you're saying -- and you said the soft bounce rate is

11 kind of unclear because it could be technical issues, but the real one to know that you've

12 got problems is the hard bounce rate.

13 A That's correct. If you have a high hard bounce rate, something's wrong

14 with your list.

15 Q And so they would've been able to see their hard bounce rate in their

16 metrics; they would've been able to see their complaint rates in their metrics; they

17 would've been able to see their unsubscribes in their metrics.

18 A Yes.

19 Q Okay.

20 So now I want to turn to the events of what happened on January 6th.

21 Can you -- and I just want to kind of go back for one second. The last thing that I

22 remember you saying time line-wise was, around the time of the election, there's the

23 Kamala Harris fake-header email, which you do believe went out to people?

24 A I do. Well, it would have to have gone out to people for me to see it. My

25 team was reactive. So I would have to have gotten a complaint from someone who had
 63

1 received that mail.

2 Q Okay. And you believe that was before the email to your supervisors, legal,

3 and ethical and humane about the violent tone, which was on or around sometime of the

4 election?

5 A To my knowledge, yes.

6 Q Does anything happen between that email on or around the time of the

7 election and the events of January 6th?

8 A Nothing -- nothing significant that I can recall, no.

9 Q Okay.

10 So January 6th happens. Just walk us through that day. What do you

11 remember in terms of, where are you, when do you learn of the violence?

12 A Yeah, that was a -- that was a traumatic day.

13 Well, so I work from home, so I was at home. And from what I recall, I think my

14 husband told me that there had been violence at the Capitol. And I think it was

15 sometime that afternoon, like, 2, 3 o'clock-ish, if I had to pinpoint it.

16 Q And, understanding that this is a personal question, but what was your

17 personal reaction at the time that you found out about the violence?

18 A Very much, "Holy shit. What is going on?" There was a lot of texting

19 between, you know, all the family members and stuff of, like, "What is happening? How

20 horrible is this?"

21 My husband's mother said it was a false flag, it was antifa dressed as Trump

22 supporters. There was all -- you know, all of that.

23 Q Every family's got one. Don't worry about it.

24 But were you watching on television?

25 A I was not. I think my husband was watching on one of his computer

 64

1 screens, but I tried not to be involved. It was terrifying.

2 Q And were you working that day?

3 A I was.

4 Q Okay. Did you talk with any of your coworkers about what was happening?

5 A I'm pretty confident I talked t

6 Q And do you remember the conversation that you had? Did you Slack?

7 Did you call? Did you text?

8 A That would've been Slack.

9 Q Okay. And do you remember the conversation that you had with

10 via Slack that day?

11 A No, I don't remember anything from it.

12 I do remember that I -- at some point either that day or some other point in that

13 timeframe, I did block their email sending.

14 Q Who --

15 A Yeah, I'm sorry. The RNC's email sending.

16 Q Yeah, so let's -- let's talk about that. When you say you blocked the -- so

17 did you tell that you were going to take some action against the RNC's

18 account?

19 A I think so.

20 Q And, to the extent that you remember, what did you tell him?

21 A To the extent that I remember, I would've had to have said to him, "I'm

22 going to block their email sending," because, I mean, again, like, everything was in

23 writing, but also, like, needed to know, because there was going to be -- there was

24 going to be some potential blow-back from that. So I was kind of getting ahead of it, if

25 that happened.
 65

1 Q To the best of your recollection, what do you remember saying to him

2 exactly in Slack?

3 A To the best of my recollection, I would've been pretty direct about it.

4 would've just said, "I am blocking their sending."

5 Q No, I was just curious, like, are you like, "I'm shutting it down," or is it more

6 technical, "I'm blocking it"? Did you explain how you would do it, or is it more -- was it

7 an in-depth explanation, or is it, "I'm shutting them down"?

8 A Yeah, it wasn't -- it wasn't in-depth at all. We knew what it meant. So

9 there was no reason to overexplain it. It was just, "I'm going to shut them down."

10 Q So he did know what you meant technically when you said you were shutting

11 it down?

12 A Yes. We knew what blocking email sending meant. It was common

13 across the team.

14 Q Across your team?

15 A Yes.

16 Q Did folks outside of your team know how you shut it down?

17 A From a technical perspective in terms of how it's done, or just what it

18 meant?

19 Q The former. Did they know how you actually mechanically did it?

20 A Maybe one or two people might've known how. Al on the deliverability

21 team would've known. Maybe Mike Wright would've known, in the IT MTA, the

22 technical setup team. Not a lot of people.

23 Q The higher-ups above would they have known how you did

24 that?

25 A I sincerely doubt it.

 66

1 Q And how did you do it?

2 A So the way you suspend email in Marketing Cloud is: You go into their

3 account. You search the record. You click into the account -- the details technically in

4 terms of what's in their account. You get to the IP address. You copy the IP address.

5 You type in "black hole." You click "save changes."

6 There's another screen that comes up and says, "Are you sure you want to make

7 these changes?" And you click "yes" or "okay" or whatever it was. But, yes, it was the

8 "save changes" button and then "okay."

9 And then I -- and I mentioned copying that IP address. I would copy that IP

10 address and send it to myself in Slack to let myself know what the IP address was, what

11 the account was, and that it had been blocked.

12 Q So --

13 A Because, to my knowledge, Marketing Cloud didn't keep records of who

14 blocked what when, so I wanted to keep my own records.

15 Q So, to be clear, when you say you chatted yourself, you Slacked yourself,

16 which is, like, almost like a note to yourself, and created a record that would've had the

17 RNC's IP address in it. And did you note "blocked," or would it just be the IP address?

18 A It -- usually, I just -- like, if I was messaging myself with an account ID and IP

19 address, I knew what I was doing. That was my setup to myself. And it possibly would

20 have said "RNC."

21 Q Okay.

22 A So, yeah, I knew, because that was just how I kept my records.

23 Q So, sometime on January 6th or maybe possibly January 7th, but on or soon

24 after that day, there should be a Slack record of you slacking yourself with "RNC" -- well,

25 possibly "RNC," but with the RNC's IP address, and that's when you would've copied,
 67

1 pasted, saved changes, and shut it down.

2 A That is correct.

3 Q I'm not going to lie. I am disappointed that it wasn't a big red button on

4 the side of the wall.

5 A I'm sorry. We can make a product request.

6 Q How long did the shutdown last?

7 A It was a couple days. I think it was up to -- I think it was the rest of the

8 week, and I want to say it was up to that Monday.

Q That would've been January 11th?

10 A I believe so.

11 Q And did you tell anyone other than that you were shutting it

12 down?

13 A I might've verbally said it to my husband.

14 Q And do you know if it --

15 A But I don't --

16 Q Oh, I'm sorry. I didn't mean to cut you off. Go ahead.

17 A Oh. But I don't think I did it to anybody else that I can recall.

18 Q Anybody else at Salesforce?

19 A Correct. And --

20 Q Right.

21 A No. We were both at Salesforce at the time, so no. Yeah.

22 Q Who was the other individual you told?

23 A my husband. We met at Salesforce.

24 Q Oh, okay. Oh, sorry. I wasn't sure if it was somebody other than your

25 partner.
 68

1 A Oh.

2 Q Okay. So your partner was the only person that you think you told other

3 than

4 A I believe so, yes.

5 Q Okay.

6 And understanding, best of your recollection just sitting here today. So if it's not,

7 it's fine. We're just trying to remember if there's anyone else who would've known in

8 real-time that you were shutting it down.

9 Do you know if told anyone that you shut it down at Salesforce?

10 A I think he prob- -- I mean, reasonably, he probably would have to have,

11 because he later came back to me to tell me to unsuspend them. So I think someone

12 must have --1 mean-would have to have known, because hen said, "Hey,

13 when are they getting unsuspended?" So, yes, I think-must -- yeah. Logically,

14 -would have to have known.

15 Q So I just want to be clear, we're talking about

16 A We are.

17 Q -- who is three layers above you?

18 A H e ' s - ' s boss's boss.

19 Q Yeah. So ?

20 A Yes.

21 Q So three-layers-above-you comes to you and asks, when is it getting turned

22 back on?

23 A Yes. So, from what I recall -- and this is very clear in my mind, but you

24 know how brains can be. But, from my recollection, - c a l l e d me and said, "You

25 need to unsuspend them." And my reaction was, "What?" You know, it was very,
 69

1 "WTF?" Like, "You do realize what happened last week?", kind of, like, incredulous.

2 And said, "It's okay. You know, this goes all the way up to the top. This

3 is so much higher than you and me. The higher-ups are going to be reviewing their

4 content before it goes out. So we need to unsuspend, and you need to tell-when

5 it has been unsuspended."

6 Q Okay.

7 So is it fair to say that when asked you, when is it getting turned back on,

8 that it was your impression that nobody knew how to do it other than you?

9 A Yeah. It was weird, because trained me on how to turn it back on.

10 I have no idea why he didn't just do it.

11 Q Well, is it possible that didn't tell that he also

12 knew how to turn it back on, and hought you were the only person who

13 knew how to turn it back on?

14 A It's entirely possible, yes.

15 Q So, if I understood you says, turn it back on and p i n g -

16 - presumably on Slack?

17 A Yes.

18 Q So ping --

19 A Yeah, anytime we say "ping," it means Slack.

20 Q So says, turn it back on and ping on Slack when

21 it's back on.

22 And a moment ago you said -- I don't want to put words in your mouth, but it

23 sounded like, when old you to turn it back on, it sounded almost like you

24 didn't immediately say yes? You almost said -- it sounded like you almost put conditions

25 on turning it back on, and what is the solution, because the solution can't be letting them
 70

1 continue to send those emails?

2 A Yes. And I very obviously didn't have that power to say no, but I was like,

3 how could this be okay? Like, I want an explanation. Like, what in the world? Why

4 would we ever do that? Why wouldn't we kick them off ASAP because of -- look at what

5 just happened.

6 Q And this -- I'm sorry. Did I cut you off?

7 A No, I was just -- it was just like, I could not believe that we were doing this.

8 Q And this is when says, in response to your concern about how

9 are we turning this back on, don't worry, this is being handled by the higher-ups, and

10 somebody is going to review all the emails before they are sent out.

11 A Yes.

12 Q Okay.

13 And did you happen to see the press articles that were released on

14 January 11th -- I believe the first one may have been Vice, but I think there were other

15 articles that were put out. But on or around January 11th there were articles that stated

16 that Salesforce had, quote, "taken action" against the RNC. Did you have a chance

17 to -- did you see any of those articles when they came out?

18 A I think it was the Vice article that I saw, where they had, quote/unquote,

19 "taken action," yes.

20 Q And did you see in that article where Salesforce had a prepared statement

21 from a spokesperson?

22 A Yeah. Anytime they talked to the public, they would definitely have gone

23 through PR, yes.

24 Q Were you part of crafting that statement that Salesforce put out?

25 A In no way whatsoever.
 71

1 Q Do you know who was responsible for crafting that statement?

2 A Probably -- I mean, probably the PR team. And I would assume the C-level

3 execs, given how high up of a case it was.

4 Q To the best of your recollection, do you remember who was on the PR team

5 that would've handled it?

6 A Oh, no idea.

7 Q Okay.

8 And sitting here today, do you, in fact, know whethe had any

9 conversations with those higher-ups about this?

10 A He probably did. I mean, like, how high up, I guess is my --

11 Q Well, let me rephrase. Did tell you that he had any

12 conversations with anyone higher up about it?

13 A He heavily implied it, yes.

14 Q Okay. So he may not have said he had the conversations, but he may have

15 said conversations are being held by the higher-ups.

16 A Yes.

17 Q Okay.

18 And did anyone other than or talk with you about the

19 action that you took against the RNC?

20 A Not that I recall, no.

21 Q Okay.

22 In the article that referred to the, quote, "action" that Salesforce took, the articles

23 repeatedly say that Salesforce wouldn't discuss what action it, in fact, took.

24 But, sitting here today, do you know what action Salesforce took on January 11th?

25 A The only thing I was told was that they would review the content before it
 72

1 went out.

2 Q So -- but that was because they were turning it back on and they were telling

3 you to turn it back on.

4 A Yes. The action was: Turn it back on. Let them send. We're going to

5 review the content. That's the action we're taking to make sure this doesn't happen

6 again.

7 Q And, sitting here, you don't actually know who the higher-up was that would

8 be reviewing those emails, do you?

9 A I'm not even sure if it was a higher-up reviewing the emails or if it was some

10 poor person who had to deal with it. I don't -- I have no idea.

11 Q Do you know --

12 A But I was not involved, and I should've been.

13 Q Do you have any idea who would've been assigned to review those emails, if

14 they did, in fact, give it to a person?

15 A Yeah, my--

16 Q Whose job -- go ahead.

17 A My best guess, if it wasn't a higher-up -- and it should've been -- would've

18 been someone in deliverability services.

19 And, to clarify, the deliverability services team is a team that you basically buy a

20 block of hours from, and then you have those hours for strategy, execution, whatever it

21 is.

22 My guess would be, if I had to, it would be that team. But it really should've

23 been an exec.

24 Q Okay.

25 And, sitting here today, all of the conversations that happened above you
 73

1 regarding the statement and taking action and, quote, "the higher-ups," to the extent

2 that those happened, is it your understanding that was involved in those

3 discussions with management?

4 A He heavily implied that he was, from my recollection, but he wasn't very

5 direct with me.

6 Q Okay. And he never said who he spoke with about it?

7 A He did not.

8 Q Okay.

9 A I know -- like, I know he was involved w i t h - because, like, logically, he

10 would've been. But I don't know anything really past that.

11 Q But you're assuming that just based on their roles?

12 A Yes.

13 Q Okay.

14 And after you turned back on the RNC's ability to send emails, I believe on or

15 around January 11th, do the emails start getting re-sent? Like, is it a slow trickle back

16 up, or is it throttle back on?

17 A I do not know. I would assume it would have to be slower if they were

18 reviewing the content, just naturally. But I don't really know.

19 I think -- I think it would've -- I mean, it would've had to have been slower that

20 way, but they were also probably slower because, like, it was kind of a shock. But I'm

21 not super-confident of that answer.

22 Q So, after you turn it back on, do you keep getting complaints from recipients

23 of the RNC regarding the emails?

24 A Not nearly as many. It dropped off significantly in terms of complaints that

25 I saw.
 74

1 Q And, after that, what happens to the abuse and compliance department at

2 Salesforce?

3 A Well, we all wound up leaving.

4 Q And this is when 4 months later they don't h i r e - right?

5 A This is correct, yes.

6 Q And they don't provide you resources and they don't provide you bodies?

7 A They provide me with absolutely nothing.

8 Q And there's still no real functional abuse desk for people who email

9 abuse@Salesforce?

10 A Not to my knowledge, no. And the team now is two people; it's one person

11 and a contractor, when it should be a much bigger team.

12 Q Did you have any communications after leaving Salesforce with anyone

13 regarding the events on January 6th?

14 A I did.

15 Q And who was that?

16 A With anyone, would've been like, you know, my mom, my dad, my

17 grandfather. You want Salesforce employees or just, like, people I talked to?

18 Q No, I don't mean, like, anytime you talk about January 6th. I guess I kind of

19 mean more related to --1 don't want to say "your role," that's not what I'm saying, but

20 the actions you took or what happened at Salesforce on or around January 6th.

21 A Oh. who told me she had contacted

22 you guys.

23 Q You -- I believe you produced a document in this case, yes?

24 A Yes.

25 Q So I'm going to show you what's been marked as exhibit 1.

 75

1 A Okay.

2 Q And, hopefully, if this works, it should pop up on your screen. Maybe?

3 No? One moment.

4 A Okay.

5 Q There we go. Can you see that?

6 A I can.

7 Q So you produced this, what looks like a text exchange?

8 A Facebook Messenger.

9 Q I'm sorry?

10 A It's Facebook Messenger.

11 Q Oh, okay, a Facebook Messenger exchange. And who was this with?

12 A This was with my husband.

13 Q Okay. And you sent this -- and I'm sorry, I can't see from here. Are you

14 able to see the date that you sent that to him?

15 A Yes. That was January 9, 2021.

16 Q Okay. And you sent him an article that looks to be -- we can't click on it,

17 but it looks to be that it was an article about the attempted coup, likely discussing the

18 events on January 6th?

19 A That's correct.

20 Q And then I believe there's a second page to this?

21 A There is.

22 Q Just give us one second to access that. One moment real quick.

23 A Sure.

24 Q And this is the second part of the text, and you say, "Oh my God," and then it

25 looks like there's an email?

 76

1 A Yes. That was one of the emails from the RNC.

2 Q And you say-- we might be able to zoom in on the image, actually.

3 Did you highlight those words?

4 A I think those were highlighted from Twitter. I wouldn't really have known

5 how to highlight an image, or I wouldn't have done it.

6 Q So you think you -- did you grab the image of that email from Twitter?

7 A Yes.

8 Q And then you sent it to your partner and said, "This was one of the emails I"

9 dot, dot, dot, dot, dot.

10 A Yes.

11 Q And what did you mean there?

12 A This was one of the emails that I had called out.

13 Q When you say "called out," are you referring to the excerpts that you sent to

14 your supervisors that you had concerns with?

15 A Yes. It was the, "You'd make an excellent addition to the Trump army,"

16 "exclusive Trump army," "let everyone know you're the President's first line of defense

17 when it comes to fighting off the liberal mob." Yes.

18 Q Okay.

19 And then, if we could scroll down, "This was one of the emails I... It's blowing up

20 on Twitter." What was blowing up?

21 A This email was just -- like, people were tweeting about it.

22 Q Because of the language?

23 A Yes.

24 Q And, if you scroll down, your partner says, "Sent by Salesforce TM"?

25 A Yeah.
 77

1 Q What is "TM"?

2 A He's just screwing around. "Trademark."

3 Q Oh, okay.

4 A Yeah.

5 Q Okay.

6 And, then, is there anything else below that? I don't think -- that's it.

7 A No.

8 Q Okay. And so you sent that to -- so that, actually, January 9th, that was

9 before -- it was after you shut it down but before you were told to turn it back on?

10 A Yes.

11 Q So the news and Twitter -- I'll just say "the news" -- but people were

12 essentially blowing up and discussing the violent rhetoric that had been in these emails.

13 A Yes. Yeah. It was all over Twitter. There was a Twitter account that was

14 actually tracking the emails. I don't know if that was -- I think it was before January 6th.

15 They were just tracking all the emails. But, yes, it was all over Twitter.

16 Q Is that the Trump Fundraising Emails Twitter account --

17 A Yes.

18 Q -- that you were referring to?

19 A Yes.

20 Q Okay.

21 And do you remember having any conversations, either with your partner or

22 anyone at Salesforce, when it was all blowing up on Twitter about the fact that you had

23 shut the emails down?

24 A Twitter didn't know that I -- I mean, nobody knew that I had shut

25 the -- nobody publicly knew. So, I mean, I'm certain it came up in discussions, because it
 78

1 was, like, the big topic, so almost definitely, yes.

2 Q Well, I guess what I -- and let me be clear. I don't want to get into, like, the

3 dinnertime conversations with your partner or your family.

4 What I'm more saying is that the timing of this, and it's blowing up on Twitter, and

5 people are talking about the emails that came through the Salesforce platform. Is

6 anybody talking, at Salesforce, about the fact that the content of the emails that

7 Salesforce had sent on behalf of the RNC are blowing up because of their violent nature?

8 A That I'm not sure of.

9 Q Oh. So nobody, to you, talked with you about it at Salesforce?

10 A That's correct.

11 Q And you're all working from home, so there's no real water-cooler talk.

12 A That's correct.

13 Q Okay.

14 A And my whole team worked from home anyway, even before the pandemic.

15 But, yes, I wouldn't have been privy to those conversations.

16 Q And from the time that January 6th happens until the January 11th

17 conversations to turn it back on, while it's blowing up on Twitter that these emails were

18 inflammatory, never reaches out to you and never contacts you to discuss that it

19 was shut down?

20 A To my recollection, I -- I honestly don't know.

21 Q Did you get the impression that after you shut it down on the 6th until the

22 time that he reaches back out to you, that there's just something happening at the higher

23 levels at Salesforce that was beyond you?

24 A Yes. There was that general feeling of flurry. But I don't recall having -- I

25 don't recall any conversations that I can relay.

 79

1 Q Just out of curiosity -- I don't know if you can see; we may not be able to

2 zoom -- but is there a date to that email?

3 A No.

4 Q Okay. But you think you pulled this somewhere off of Twitter possibly on

5 the date that you sent it, on January 9th?

6 A Oh, yes, I would've. That would've been -- like, as part of the content of

7 the conversation, I would've pulled it that day. I don't -- if I take a screenshot, I'm

8 sending it --

9 Q Okay.

10 A -- same day.

11 Q Okay. So there's a good chance that that email was reported on January

12 9th, even though it likely had been sent earlier?

13 A Right. Like, it would've been on Twitter January 9th, but the date it was

14 actually sent would've been unknown.

 80

2 [12:10 p.m.]

3 Q Okay. And I think we can -- we have the text of that. Okay. So that's

4 very helpful.

5 Have you talked with anyone at Salesforce since you left who's currently at

6 Salesforce?

7 A Yes.

8 Q Who?

9 A

10 Q And who is that?

11 A She works in deliverability. Not delivery services; deliverability. We're

12 very close friends.

13 Q And is that just a regular friendship, or have you had any conversations

14 pertinent to anything we've discussed today?

15 A I definitely did ping her, I messaged her on Facebook, talking about

16 Salesforce's -- your request to Salesforce for documents. And I said something along the

17 lines of, like, "Oh my God, am I gonna be subpoenaed? Am I gonna have to go in front

18 of Congress to testify? How safe am I gonna be?" Like, it was very -- I was very scared

19 of, like, if any of this goes public, what's going to happen to me?

20 Q And what do you mean by that?

21 A I mean the internet's a very scary place. I mean people can come after you

22 personally. I mean, I was -- I mean, I even said this -- I said it to my mom, like, "I was the

23 one who did this," and my mom was like, "You could be killed." Which, thanks, Mom,

24 but --

25 Q Did she mean by antifa? Or -- no. Sorry. Oh, no, no, sorry, that was
 81

1 your partner's mom, wasn't it? Apologies.

2 A Mom, actually, also. I have two of them.

3 Q Oh --

4 A Yeah, uh-huh. Yeah.

5 Q -- bless your heart.

6 A My mom also said, like, "Don't tell your grandfather any of this." So, like,

7 I've got a couple of them in the family.

8 Yeah. It was, "You could be killed. They could come after you. They're going

9 to -- you need to not say anything." Mom was very, very afraid for me.

10 Q And is that why you had strong safety concerns about coming forward?

11 A Yes, absolutely. And that's why I'm still a little concerned about this

12 transcript becoming public too.

13 Q And I very much understand that, which is why we're obviously using the

14 security concern of not using your name.

15 And to the extent that I made a joke a moment ago, please understand that, while

16 I take family issues on the lighter side, I was not making a joke about your safety, which

17 we take very seriously and is not a joking matter.

18 So I just want to make sure that my levity regarding your mom's -- parents is not

19 to be conflated with her reasonable concern about your safety.

20 A No, the levity was appreciated.

21 Q Okay. Sometimes it's needed when we're talking about a topic like this,

22 which we very much appreciate is sometimes emotionally difficult.

23 Did you talk with since leaving Salesforce?

24 A Yes.

25 Q And what conversations have you had with him?

 82

1 A So, first, it was still along the lines of, like, oh, man, here's the Salesforce

2 document request, our names are all over it, we're going to be involved, what's up -- you

3 know, kind of all that stuff.

4 We had an informal discussion this week. He contacted me, what, Wednesday,

5 and said that he had been contacted by your team, and we discussed a little bit of it then.

6 Q And did he seem concerned?

7 A He didn't -- well, he said he'd talked to a couple lawyers, that he'd

8 gotten -- he'd had three lawyers involved, and that one of the lawyers -- either one or

9 multiple of the lawyers was going to contact Salesforce and have Salesforce pay for his

10 legal team, that I could expect to probably hear from someone at Salesforce.

11 He said he would do everything to protect me from having to testify. I said,

12 "Yeah, but I was the one who suspended the email, so I'm going to be involved."

13 Q And have you contacted --

14 A 1didn't --

15 Q I'm sorry. Go ahead.

16 A I will also say that I didn't feel safe discussing that I had already been

17 involved. So I did play it off as, like, what kind of lawyer would I need? Am I going

18 to -- you know, I definitely played off like I was not involved, just out of trying to be very,

19 very thoughtful around my own safety and around just, like, nobody knowing what I'm

20 doing.

21 Q And, just to be clear, a moment ago it sounded like you said that -

22 intended to contact Salesforce regarding his contact with the committee but

23 also possibly to see if they would pay his legal fees?

24 A He contacted a lawyer. I think the lawyer was going to contact Salesforce.

25 I don't think-was going to contact Salesforce directly.

 83

1 Q Ah, okay. Okay. But he mentioned something about having his legal fees

2 paid for by Salesforce?

3 A That's correct.

4 Q Was there something that gave him the impression that they would do that?

5 A I think it was -- yes, because he was employed by Salesforce at the time, and

6 he wouldn't have to be involved in this if he wasn't employed by Salesforce. So kind of

7 like an "it's their fault, they should pay" kind of deal.

8 Q This was his -- well, no, I'm not going to make that comment.

9 Was there anyone else that you have spoken with after leaving Salesforce who

10 was employed with you at Salesforce, anyone other than from Salesforce

11 that you've spoken with since leaving?

A Around these events or just in general?

Q Just in general.

14 A Okay. of course. ■a little bit. Who

15 else? , who was a -- he's an SE. - who's in support. I have a couple --

16 Q Okay. These are all friends that you used to --

17 A Yeah.

18 Q -- have at Salesforce?

19 A Yeah.

20 Q Okay. But have you talked with any of them about anything that we've

21 talked about today?

22 A -and - yes. - obviously, I already told you. I think

23 otherwise I've been pretty quiet about it.

24 Q And what conversations did you have w i t h - a n d - ?

25 A That was, again, sending that document link and being like, "Oh my God.
 84

1 WTF. What's gonna happen? This is very scary. I'm very scared." That was pretty

2 much -- that's pretty much been it.

4 and don't have to deal with this." I was like I "Thanks."

I

5 Q And were those reach-outs also Facebook Messenger or texts?

6 A Would've been text.

7 Q And what did say when you reached out?

8 A was mainly like, "LOL. I'm a contractor. Glad I only sent those to

9 you." Basically, like, a "better you than me" kind of thing. But and I are

10 actually, like, also friends outside of work. So, you know, he's been over at our house,

11 and we're friends, we're close. So --

12 Q And there's been --

13 A "Hey, I'm doing this deposition this week," and him being like, "Good luck,"

14 like, "better you than me" kind of stuff. You know. Good friend kind of stuff.

15 Q No, I understand.

16 Was that a group chat that you guys had, or did you individually send the article to

17 all four of them?

18 A Individually. Yeah, it was individual.

19 Q Okay. And is there --

20 A I don't really like group chats.

21 Q I'm sorry?

22 A I don't like group chats, so I don't use group chats.

23 Q No, that's a fair complaint.

24 Is there anyone else from Salesforce that contacted you after you left, other than

25
 85

1 A -did.

2 Q And when did -- ?

3 A Yes.

4 Q And when did he contact you?

5 A Am I allowed to check my phone?

6 Q Sure.

7 A So he messaged me on lnstagram asking to have a conversation,

8 so -- January 7, 2022 -- no, I'm sorry. Where is it? January 3rd. He said, "Hey

9 stranger. Happy New Vear. You available this week to chat for a few moments?

10 want to run something by you." Do you want me to read the whole thing?

11 Q This is, I'm sorry, January 3, 2022?

12 A That's correct.

13 Q So 4-months-ago-ish?

14 A Yes.

15 Q Okay. Yeah, if you could read it, that'd be great.

16 A Okay.

17 I said, "Hey! Happy New Vear. It's so good to hear from you. I'm available.

18 How much time do you need? My best open blocks of time are Thursday and Friday."

19 "Early Friday afternoon, say, 1:30 eastern."

20 I said, "You hit on my one meeting on Friday. I can do any time after 2:30

21 though."

22 [Reporter requests clarification.]

23 [Discussion off the record.]

24 The Witness. Let's do a comfort break, if you don't mind.

25 Ms.. Yep. I'll tell you what. So it's 12:23. How about we come back at
 86

1 12:28, 5 minutes?

2 The Witness. Yeah, that's perfect.

3 Ms. • Okay.

4 What?

5 Okay. 12:30. Very reasonable roundup. So we'll take a comfort break -- it's a

6 little longer for us, because logistically. So we'll take a comfort break until 12:30, and

7 we'll come back on the record and be back from recess then.

8 The Witness. Okay. Thank you.

9 Ms. • Thanks.

10 [Recess.]

11 Ms.. Okay. So we will come back from recess and go back on the record

12 at 12:36 p.m.

13 BYMS. •:

14 Q And just before the recess, we were talking about a call that

15 and you had, I believe in January 2022, after you had left Salesforce.

16 A Yes, that's correct.

17 Q And can you tell me, what did you talk about during that call? Or what was

18 the purpose of him reaching out to you?

19 A So he reached out to offer m e - s job. He basically said, "I've seen

20 your posts on Linkedln. I know how mentally happy and healthy you are at the new job.

21 Would you ever consider coming back and ta kin 's job?" I don't know if he said

22 's job," but it was heavily implied that it would b e - ' s job. "Would you

23 ever consider coming back?" To which I said, "No, thank you. I'm good."

24 Q And did you give him any reason why you didn't want to come back?

25 A I basically said, like, I'm too happy here. I don't want to deal with it
 87

1 anymore. Like, it's -- I'm done with it for now.

2 Q Did you have any conversation about the problems that you had at

3 Salesforce?

4 A No. I mean, at that point, it was so clear that Salesforce didn't care, that

5 saying it wouldn't have mattered. It would've been burning a bridge kind of

6 unnecessarily.

7 Q Uh-huh.

8 A So I just didn't bother. And I was so burnt out at the time, like, nothing

9 mattered in that conversation. Like, I could tell you till I was blue in the face that

10 Salesforce doesn't care and needs to care, and it wouldn't have mattered.

11 Q And just out of curiosity, at the beginning of that, you said something along

12 the lines of, he said something like, I can tell how mentally and emotionally happy you are

13 where you are now?

14 A Yes. I mean, I posted that on Linkedln, that I had previously been

15 super-burned-out, and I was at a new company and that I was so much happier and how

16 great my new role was and how wonderfully I was doing. So I had made it public that I

17 was thrilled with my new role.

18 Q And just out of curiosity, it sounds like -- well, let me rephrase this, because I

19 don't want to make an assumption.

20 A Sure.

21 Q To the extent that you know or got an impression from him, did you get the

22 impression that his knowledge of your past unhappiness was solely from your social

23 media comments to that fact, or do you think he knew while you were at Salesforce how

24 unhappy you were?

25 A That's a good question. He knew towards the end, because I wasn't shy
 88

1 about it.

2 Q Can you explain what you mean, that you weren't shy about it?

3 A I can.

4 So, when I submitted my 2 weeks, he had reached out to me in that timeframe to

5 talk. And I explained that I had issues with everything with Salesforce, that I had issues

6 with how - w a s treating me and had treated me the whole time, with -- being a

7 in tech is hard, but being a in tech where the guy above you has 20 years

8 of experience and is treating you like his kid is even harder. My experiences there

9 just -- I told him everything about why I was so unhappy and why I was leaving. And

10 that was in my last 2 weeks. So he knew I was not happy.

11 So, to him, though, he thought, okay, well, if I l e t - -- if leaves,■

12 might come back, and then we could have, like, a clean slate, everything could be

13 hunky-dory, whatever.

14 Q And what --

15 A But that was not --

16 Q Oh, sorry. I didn't mean to cut you off. What did you say?

17 A But that was not the case.

18 Q During the last 2 weeks at Salesforce, when you had the conversations with

19 and kind of got real with him, did you have any conversations about the lack

20 of culture surrounding abuse and compliance?

21 A Oh, most definitely. I probably would've said, "And it's clear Salesforce

22 doesn't care about my team."

23 Q Do you remember anything that he would've said in response to those

24 concerns?

25 A I don't. He certainly didn't argue that, yes, they do.

 89

1 Q Do you remember, did you have any discussions with him -- during that

2 last-2-week period when you were talking with him about your concerns/feelings, did you

3 talk with him at all about what happened with the RNC or the concerns that you voiced

4 regarding that case?

5 A I don't believe so, no. It was more focused on, like, my feelings, my

6 burnout, my experience. I don't think I brought up anything specific to any client.

7 And I had similar conversations w i t h - also, just in terms of my feelings

8 and emotions, et cetera.

9 Q Was this a standard exit interview, that you would talk to your supervisor's

10 supervisor and supervisor, like, two and three levels up from you?

11 A I don't think it's standard. . , towards the end -- I would say, towards

12 the end -- let's see. Would've been July-ish onward -- or, sorry. Probably would've

13 been April to August, was -- well, he was a mentor. So we had a couple meetings

14 just mentoring corporate -- mentoring, um -- what is it? Like, corporate mentoring

15 meetings, basically, leadership kind of mentor-y stuff.

16 So I think.might've done that as part of the mentor relationship, but I didn't

17 get the impression it was standard.

18 Q This was April to August 2021?

19 A Yes.

20 Q Okay. And that was just part of some standard program that you and he

21 were in?

22 A I was in a leadership program where they were training me to become a

23 leader of leaders, so it would've been a director level.

24 Q Uh-huh.

25 A And I reached out -- I was trying to be mentored and, like, become

 90

1 something more at Salesforce, become a leader. And so I had that mentoring

2 relationship with-to try and get myself up higher in the company. And you can see

3 where --

4 Q Okay.

5 A -- that went.

6 Q And has anybody other than or from Salesforce

7 contacted you since you left?

8 A Other than the friends?

9 Q Outside of your regular -- like, outside of your friendship relationships, has

10 anyone contacted you especially about this or about your role in anything that we've

11 talked about?

12 A No.

13 Q Okay.

14 I'm going to completely change gears and ask you just a couple of kind of, like, just

15 putting a bow on some things.

16 A Okay.

17 Q Have you ever heard of a company called Campaign Monitor?

18 A Yes.

19 Q That was an enthusiastic "yes." How have you heard of them?

20 A I just -- I know of them because of the industry.

21 Q Who are they?

22 A They're an email service provider.

23 Q Is that like Marketing Cloud?

24 A Yes. I think Campaign Monitor is more on the line of Constant Contact, in

25 that they -- I think they have a free level. But, yeah, they're an ESP.
 91

1 Q A free level?

2 A Like, a free tier where you can just sign up for free and send some emails.

3 Q Did you know whether the RNC was using them in addition to Salesforce?

4 A I'm not sure.

5 Q Would that matter in any way to the use of Marketing Cloud?

6 A Potentially. They could've been doing what was known as waterfalling.

7 So waterfalling is when you take a purchased list, you run it through a cheaper or free

8 email service provider -- so you could run it through Mailchimp or somebody -- and that,

9 quote/unquote, "cleans" the list of your hard bounces specifically, and then you take it to

10 your more expensive email service provider and you go run the list through them.

11 And that's very, very hard to know, because I don't have visibility into any other

12 infrastructure they're using.

13 But we call it "waterfalling," or "list washing" is another term.

14 Q Okay.

15 And have you ever heard of something called "warming up IP addresses"?

16 A I have.

17 Q And what is your understanding of what that phrase means?

18 A So, when you are on a new -- when you are changing infrastructures or

19 otherwise somehow adjusting your sending on a new dedicated IP address, you will send

20 a certain quantity of mail to get up to your standard level of sending.

21 So let's say you wanted to send -- ultimately you want to send a million emails.

22 You're not going to start out sending a million emails on that IP. You need to warm it

23 up. So you would start with sending, I don't know, 20,000 the first week. Then you'd

24 do 40,000, then 80,000, and then you'd kind of go up from there.

25 It takes a while to do. But you need to warm up that IP so that receiving servers
 92

1 are seeing, oh, okay, this is a new IP sending on behalf of so-and-so, here's what that mail

2 looks like.

3 And so they -- servers don't like surprises. Because spammers do that, right?

4 Spammers will buy an IP, they'll send whatever they're going to send, trash the IP, and

5 move on. So, for us, we have to warm up the IP address so we are clearly not spammers

6 and you shouldn't treat the mail as spam.

7 Q And a moment ago you said a "dedicated IP." Is that a special type of IP as

8 compared to, say, like, a shared IP? What's the difference in those?

9 A Yes. So a shared IP will be shared with some X number of other customers.

10 A dedicated IP is solely your IP.

11 Q And would warming up IP addresses be necessary for -- would it make sense

12 for a shared IP or only a dedicated?

13 A Not -- on a shared IP, not generally. If you did somehow need to warm on

14 a shared IP, you probably are sending a quantity of mail that makes more sense to be on a

15 dedicated IP. If you're sending more than 200,000 messages a month, you probably

16 should be on a dedicated IP, because you just -- there's more benefits to managing your

17 own reputation, being the master of your own destiny, et cetera, et cetera.

18 Q And if somebody was trying to move, let's say, hundreds of thousands but

19 possibly millions of email addresses off of Marketing Cloud to a different platform in

20 order to warm up IP addresses, would they need to export data and import it to the other

21 platform, or could they do that manually?

22 A You would -- from what I know of Marketing Cloud, I think you would have

23 to export that data to re-import it.

24 Now, that also assumes that their list exclusively lives on Marketing Cloud. So

25 what you could also do is you could pull it from some other source.
 93

1 But, yes, you would have -- at some point you're going to have to export that data

2 to import it elsewhere, yes.

3 Q If the list did live on Marketing Cloud and you wanted to move it to another

4 platform -- and, to your point, functionally, it would not make sense to manually copy and

5 paste emails addresses, so there would be some kind of export -- would there be some

6 kind of log file at Salesforce that would show that?

7 A There -- I know it was in Pardot. I'm not confident of Marketing Cloud, but

8 it should be. And I think that might be a requirement even for Soft2, but don't quote

9 me on that. But there should be, yes.

10 Q Okay.

11 And just going back really quickly, just out of curiosity, were you familiar with or

12 did you hear that around the time of -- soon after, I want to say January 6th, but

13 definitely around the time of the Salesforce action, did you hear news reports that

14 Campaign Monitor also shut down -- oh, excuse me, on January 7th that they also issued

15 a statement noting that they had suspended self-service accounts associated with the

16 Trump campaign?

17 A I had heard that, yes.

18 Q What is a self-service account?

19 A My understanding of that would be accounts that are maybe not high

20 enough to have, like, a dedicated web, is my guess. "Self-service" implies that, like, you

21 don't have dedicated resources from the company. But I -- that wasn't my

22 infrastructure, so I'm not confident.

23 Q No. And I think earlier you said something along the lines of Campaign

24 Monitor might have, like, a free service, like, something -- is it possible that's the

25 self-service account?
 94

1 A It's possible. Given the RNC's money and how much mail they had and how

2 much mail they sent, it would surprise me if they could even stay on a free tier, because

3 free tiers wouldn't let you send that kind of quantity of mail. So that's kind of weird to

4 me. I'm not sure what that's about. They could've been testing on Campaign Monitor

5 maybe.

6 Q So let me -- sorry. I want to make clear, at least the public reporting that I

7 was talking about --

8 A Uh-huh.

9 Q -- the statement that they had shut it down noted that they had suspended

10 the self-service accounts associated with the Trump campaign, not the RNC.

11 A Oh. Okay.

12 Q Yeah. So I didn't want to create confusion and make you think, like, that

13 those were different.

14 Just out of curiosity, do you remember anyone at Salesforce ever having

15 conversations about something called the Make America Great Again Committee?

16 A No.

17 Q Have you ever heard the term "joint fundraising committee"?

18 A Yes.

19 Q Do you know what that is?

20 A I do not.

21 Q Okay.

22 And, sitting here today, did you have any reason to know that the RNC email

23 account at Salesforce was being used to send out emails on behalf of a joint fundraising

24 committee between the RNC and the Trump campaign called the Make America Great

25 Again Committee?
 95

1 A The "Make America Great Again Committee" rings a super-huge bell, but I

2 don't know if it's because I've seen it publicly or if I've seen it on the back end. So --

3 Q And all I'm trying to --

4 A -- I'm not sure.

5 Q I don't want to put thoughts in your head -- I mean, it's difficult not to, just

6 because of the nature of how we ask questions. And I'm really trying to get from you

7 what you knew at the time.

8 So what I'm trying to figure out is: At least for you, everything that you knew

9 from Salesforce suggested that it was the RN C's account. The only way you would've

10 known that it was on behalf of the Trump campaign was when you saw the content of

11 who it looked like it was on behalf of?

12 A That's correct.

13 Q Okay.

14 Ms.. Does anybody on line have any questions?

15 Okay.

16 So we have not been able to receive -- as you mentioned earlier, you became

17 aware of the publicly reported request to Salesforce and the publicly reported litigation.

18 We haven't been able to receive records -- obviously, that's been publicly

19 reported -- about the litigation.

20 So there may be records that come in in the future from Salesforce that would

21 benefit from your examination and testimony. If the committee obtains those records,

22 do you have any objection to returning to answer additional questions?

23 The Witness. No. I would actually welcome that. As I said, everything I do is

24 in writing, so it would be good to have that context. Because, again, everything I'm

25 telling you is from memory, and memory can be fickle, so I would love to have that stuff
 96

1 in writing.

2 Ms.. And we appreciate that and your commitment to attention to detail

3 and trying to be as specific and as clear as possible, which really makes -- it's very

4 appreciated.

5 The Witness. Okay.

6 Ms. - So that will conclude the deposition, and we will stand in recess,

7 subject to recall by the chair.

8 [Whereupon, at 12:51 p.m., the deposition was recessed, subject to the call of the

9 chair.]
 97

1 Certificate of Deponent/Interviewee

4 I have read the foregoing _ _ pages, which contain the correct transcript of the

5 answers made by me to the questions therein recorded.

10 Witness Name

11

12

13

14 Date

15