API tools faq
paste
Advertisement
Guest User

Northwestern Mutual Life Insurance Company vs. Stephen Clayt

a guest
Jun 8th, 2017
305
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 83.69 KB | None | 0 0
raw download clone embed print report
  1. I6CV00323U
  2. STATE OF WISCONSIN CIRCUIT COURT MILWAUKEE COUNTY
  3. Northwestern Mutual Life Insurance Company,
  4. 720 East Wisconsin Ave.
  5. Milwaukee, Wisconsin S3202,
  6. Plaintiff,
  7. HON. DAVID A. HANSHER, BR. 42
  8. CIVIL A
  9. Case No.
  10. Case Code: 30704
  11. vs.
  12. 3875 Doremus St, Hamtramck, Michigan 48212, FILED - AUTHENTIC*] lD
  13. Defendant. n f m / 9 2016 L _ i
  14. J0-N BARRETT
  15. V,IS!I\ HA.UII *
  16. Stephen Clayton,
  17. SUMMONS
  18. THE STATE OF WISCONSIN, TO EACH PERSON NAMED ABOVE AS A DEFENDANT:
  19. You are hereby notified that the Plaintiff named above has filed a lawsuit or other legal action against you. The Complaint, which is attached, states the nature and basis of the legal action.
  20.  
  21. Within 45 days of receiving this summons, you must respond with a written answer, as that term is used in Chapter 802 of the Wisconsin Statutes, to the Complaint. The Court may reject or disregard an answer that does not follow the requirements of the statutes. The answer must be sent or delivered to the Court, whose address is Clerk of Circuit Court, Milwaukee County Courthouse, 901 North Ninth Street, Milwaukee, Wisconsin 53233, and to
  22. Plaintiffs attorneys, David Lucey, Kristina J. Matic, and Thomas R. Dreblow, Foley & Lardner LLP, 777 East Wisconsin Avenue, Milwaukee, WI 53202-5306. You may have an attorney help or represent you.
  23. If you do not provide a proper answer within 45 days, the Court may grant
  24. judgment against you for the award of money or other legal action requested in the Complaint, and you may lose your right to object to anything that is or may be incorrect in the Complaint. A judgment may be enforced as provided by law. A judgment awarding money may become a lien against any real estate you own now or in the future, and may also be enforced by garnishment or seizure of property.
  25. Dated this^* day of April, 2016.
  26. FOLEY & LARDNER LLP
  27. B
  28. D
  29. K
  30. Thomas R. Dreblow WI Bar No. 1101818 FOLEY & LARDNER LLP
  31. Attorneys for Plaintiff Northwestern Mutual Life Insurance Company
  32. 777 East Wisconsin Avenue Milwaukee, WI 53202-5306 414.297.5511 (DL) 414.297.4900 Facsimile Email: dlucey@foley.com
  33. 2
  34. I6CV00323U
  35. STATE OF WISCONSIN CIRCUIT COURT MILWAUKEE COUNTY
  36. The Northwestern Mutual Life Insurance Company,
  37. 720 East Wisconsin Avc.
  38. Milwaukee, Wisconsin 53202,
  39. Plaintiff,
  40. Case No. Case Code: 30704
  41. Stephen Clayton, 3875 Doremus St. FILED AND AUTHENTICATED
  42. Hamtramck, Michigan 48212, 0 i APR 29 2016 j 0
  43. Defendant. JOHN BARRETT Oi».l -t n\~ % r\ .
  44.  
  45. vs.
  46. COMPLAINT
  47. Plaintiff The Northwestern Mutual Life Insurance Company, by its undersigned counsel, as and for its Complaint, alleges and shows as follows:
  48. Parties
  49. 1. The Northwestern Mutual Life Insurance Company (“Northwestern Mutual”) is a mutual insurance company incorporated in the State of Wisconsin with its principal office at 720 East Wisconsin Ave., Milwaukee, Wisconsin 53202.
  50. 2. Stephen Clayton is an adult resident of the State of Michigan, permanently residing, upon information and belief, at 3875 Doremus St., Hamtramck, Michigan. While working as a Platform Consultant for Red Hat, Clayton worked continuously on site at Northwestern Mutual’s home office in Milwaukee and resided approximately four nights per week in a Milwaukee area hotel.
  51. 3. Northwestern Mutual is a mutual insurance company with subsidiaries engaged in insurance and Financial services Fields including brokerage and advisory services and wealth management.
  52. Jurisdiction and Venue
  53. 4. This Court has personal jurisdiction over the defendant in this action because under section 801.05(3) of the Wisconsin Statutes this action involves injury to property of Northwestern Mutual arising out of an act or omission within this state by the defendant, and because under section 801.05(5) because this action arises out of a promise made by the defendant for the plaintiff s beneFit to perform services within this state, and out of the services actually performed for the plaintiff by the defendant within this state.
  54. 5. Venue is proper in Milwaukee County under section 801.50 of the Wisconsin Statutes because the claim arose in Milwaukee County.
  55. Northwestern Mutual’s Website Automation Project
  56. 6. To serve its customers more effectively, Northwestern Mutual has invested heavily in information technology, including development of a state of the art website and supporting infrastructure.
  57. 7. In particular, over approximately the last 12 months, Northwestern Mutual has devoted substantial time and resources to automating the infrastructure of the Northwestern Mutual customer website.
  58. Consulting Relationship with Red hat
  59. 8. For this project, Northwestern Mutual has engaged a consulting service called Red Hat, Inc. (“Red Hat”). Red Hat’s role in the Northwestern Mutual project is to help create a server environment to run a specific operating system on the servers used as infrastructure for the Northwestern Mutual website.
  60. 2
  61. 9. Red Hat initially proposed that Northwestern Mutual employ a Red Hat-owned platform as a service (“PaaS”) product called OpenShift. Northwestern Mutual decided instead to develop and use its own proprietary PaaS solution.
  62. Red Hat Assigns Stephen Clayton to Northwestern Mutual Project
  63. 10. As part of its consulting engagement with Northwestern Mutual, Red Hat assigned an employee named Stephen Clayton to work on-site at Northwestern Mutual. Clayton’s specific assignment involved only a small part of the overall infrastructure automation project.
  64. 11. Specifically, Red Hat assigned Clayton to integrate the Red Hat Satellite product into the Northwestern Mutual platform. Satellite is a Red Hat systems management application that allows a system administrator to deploy, monitor and manage multiple instances of an operating system.
  65. 12. Clayton worked continuously on-site at the Northwestern Mutual home office from approximately August of 2015 through April 14, 2016.
  66. 13. Asa contractor for Northwestern Mutual, Clayton received an Apple MacBook computer owned by Northwestern Mutual to use in performing his work. Along with this Apple MacBook computer, Northwestern Mutual issued to Clayton a user identification and password for the Northwestern Mutual computer network and an electronic token to use in accessing the Northwestern Mutual network remotely.
  67. Northwestern Mutual’s GitLab Repositories
  68. 14. Northwestern Mutual stores the source code used in its automation project in more than 100 secure repositories within the Northwestern Mutual computer network. These repositories are hosted in a software development application called GitLab, which is Northwestern Mutual’s private storage location.
  69. 3
  70. 15. Northwestern Mutual provided Clayton with access to the GitLab repositories so that Clayton would ensure that the source code he was writing would function properly with Northwestern Mutual’s proprietary source code stored in the private GitLab site.
  71. 16. Because of the limited scope of Clayton’s work, he only submitted code updates to seven of Northwestern Mutual’s private GitLab repositories while working on his assigned project.
  72. Clayton’s Termination and Illegal Activities
  73. 17. On or about April 1, 2016, with Clayton’s consulting project nearly completed, Northwestern Mutual and Red Hat notified Clayton that his assignment at Northwestern Mutual would end on April 14, 2016.
  74. 18. Within the days and weeks following the conclusion of Clayton’s assignment at Northwestern Mutual, the company discovered that Clayton had engaged in a pattern of activity indicating a misappropriation of Northwestern Mutual’s proprietary computer code.
  75. Northwestern Mutual’s Investigation of Clayton
  76. 19. First, Northwestern Mutual noticed that when Clayton returned his Northwestern Mutual Apple MacBook computer, Clayton’s user account on that computer had been deleted, and apart from the final work product that Clayton delivered as the completion of his consulting engagement, the computer had been reset to Apple factory default settings. Effectively, these actions hid from any ordinary computer user’s scrutiny all of Clayton’s activity on the Apple MacBook computer during the time that it was assigned to him.
  77. 20. Clayton had not been authorized or directed by either Northwestern Mutual or Red Hat to delete his user account and reset the computer to its original Apple
  78. 4
  79. settings. His actions in doing so were extraordinary and indicative of an effort to hide his activity.
  80. 21. Upon further investigation, Northwestern Mutual learned that in the last 48 hours of Clayton’s possession of the Apple MacBook computer and the token necessary for remote access to the Northwestern Mutual network, Clayton had used those instruments to ‘clone” or download 58 of Northwestern Mutual’s source code repositories from the private GitLab repository accessible only to authorized Northwestern Mutual employees and contractors. All of these repositories contain source code proprietary to Northwestern Mutual and only seven of them contained any source code contributed by Clayton. The total volume of code in these 58 repositories amounted to approximately 1.4 gigabytes.
  81. 22. Next, Northwestern Mutual investigated Clayton’s activity in uploading data from the Northwestern Mutual network to internet sites external to Northwestern Mutual. This investigation revealed that in the last 24 hours before his assignment at Northwestern Mutual ended, during late evening hours of April 13 and the early morning hours of April 14, Clayton uploaded a substantial volume of data to a storage site called “box.com.” The total amount of data Clayton uploaded to box.com over these two days is approximately 2.8 gigabytes. These uploads to box.com occurred contemporaneously with and shortly after Clayton downloaded the 58 repositories from Northwestern Mutual’s GitLab. Clayton uploaded another approximately 1.1 gigabytes of data from the Northwestern Mutual Apple MacBook on April 12,2016.
  82. 23. Neither Northwestern Mutual nor Red Hat authorized Clayton to upload any data from the Northwestern Mutual network to the box.com storage site. There is no known
  83. 5
  84. reason or need related to Clayton’s or Red Hat’s consulting work for Northwestern Mutual for him to store any information taken from the Northwestern Mutual network at the box.com site.
  85. 24. As the investigation continued, Northwestern Mutual learned that in December of 2015, Clayton had uploaded computer code written at Northwestern Mutual to an open source software development site called “GitHub.” Specifically, Clayton created his own repository on GitHub at the site https://github.com/stephenpc under the name “Ansible-Satellite,” the very same name used internally by Northwestern Mutual for the same source code.
  86. 25. Most recently, Northwestern Mutual learned that, on April 26,2016, Clayton posted revisions to the GitHub Ansible-Satellite repository using the code copied from Northwestern Mutual’s proprietary GitLab repository.
  87. 26. On April 28, 2016, Northwestern Mutual learned that, on April 5,2016, shortly after being informed that his assignment at Northwestern Mutual would be terminated, Clayton secretly posted an obscure notice in the Northwestern Mutual GitLab private repository that he was unilaterally declaring the Ansible-Satellite programming to which he contributed to be an open source program. Other than clandestinely posting this notice in the GitLab repository, Clayton did nothing to advise any of his superiors at Red Hat or his contacts at Northwestern Mutual of his open source claim.
  88. 27. Neither Northwestern Mutual nor Red Hat authorized Clayton to post such a notice or to make Northwestern Mutual’s proprietary source code openly available to the public free of charge.
  89. Irreparable Harm to Northwestern Mutual
  90. 28. By his actions and statements over the last four weeks, which have just
  91. recently come to Northwestern Mutual’s attention, Clayton has shown his intent to take
  92. Northwestern Mutual’s proprietary source code for its website automation project and turn it into
  93. 6
  94. open source software freely available to the general public, including competitors of Northwestern Mutual.
  95. 29. Clayton’s actions threaten Northwestern Mutual with loss of its exclusive right to use its proprietary source code in its business and to gain competitive advantages arising from that exclusive use.
  96. 30. Clayton’s conduct threatens Northwestern Mutual with financial loss that is irreparable in nature because of the extreme difficulty in calculating the damages that would flow from that loss.
  97. 31. Northwestern Mutual has no adequate remedy at law for the harm caused by Clayton’s actions.
  98. Count 1 - Misappropriation of Trade Secrets
  99. 32. Northwestern Mutual incorporates by reference and realleges as if fully set forth herein the allegations of paragraphs 1-31 of the Complaint.
  100. 33. Northwestern Mutual’s proprietary code and software derives independent economic value from not being generally known to, and not being readily ascertainable by proper means by, other persons who can obtain economic value from its disclosure or use.
  101. 34. Northwestern Mutual has undertaken reasonable efforts to maintain the secrecy of Northwestern Mutual’s proprietary code and software by, among other things:
  102. • storing the code and software on a password-protected account;
  103. • only providing access to the account to those software developers using the code;
  104. • regularly changing passwords used to access the software and code;
  105. 7
  106. • regularly meeting with developers to discuss the exposure arising from disclosure of Northwestern Mutual’s proprietary information;
  107. • tracking attempts by external agents to log into Northwestern Mutual’s network;
  108. 35. Through his actions described above, Clayton misappropriated Northwestern Mutual’s trade secrets for his own private use.
  109. 36. As a proximate result of Clayton’s conduct, Northwestern Mutual has suffered and continues to suffer damages that are irreparable and for which there is no adequate remedy at law.
  110. 37. As a proximate result of Clayton’s conduct, Northwestern Mutual has incurred damages in an amount that has yet to be determined.
  111. Count 2 - Misappropriation
  112. 38. Northwestern Mutual incorporates by reference and realleges as if fully set forth herein the allegations of paragraphs 1-37 of the Complaint.
  113. 39. The source code posted by Clayton on GitHub in the Ansible-Satellite repository at https://github.com/stephenpc is an invention or idea conceived or developed by Clayton at least in part during the term of his consulting engagement with Northwestern Mutual and at least in part arising from or related to the scope of work for which he was engaged, his work assignments with Northwestern Mutual, or to information obtained from Northwestern Mutual or its employees or contractors in the course of Clayton’s engagement.
  114. 40. In connection with the development of the consulting work product that Clayton produced as an employee of Red Hat assigned to work at Northwestern Mutual, Clayton
  115. 8
  116. received valuable confidential information of Northwestern Mutual that was not available to the public.
  117. 41. Clayton breached his obligations to Northwestern Mutual by, among other things, using ideas and confidential information conceived and developed on behalf of Northwestern Mutual as the basis for the source code posted by Clayton on GitHub in the Ansible-Satellite repository at https://aithub.com/steDhenpc.
  118. 42. As a proximate result of Clayton’ conduct, Northwestern Mutual has suffered and continues to suffer damages that are irreparable and for which there is no adequate remedy at law.
  119. 43. As a direct and proximate result of Clayton’s conduct, Northwestern Mutual has incurred damages in an amount that has yet to be determined.
  120. Count 3 - Wisconsin Computer Crimes Violation
  121. 44. Northwestern Mutual incorporates by reference and realleges as if fully set forth herein the allegations of paragraphs 1-43 of the Complaint.
  122. 45. The source code posted by Clayton on GitHub in the Ansible-Satellite repository at https://github.com/stephenpc is “Computer program,” as defined in section 943.70(l)(c) of Wisconsin’s Computer Crimes Statute, section 943.70 of the Statutes.
  123. 46. The source code contained in the 58 repositories that Clayton cloned, or copied, from Northwestern Mutual’s private GitLab site were also “Computer programs” as defined in section 943.70(l)(c).
  124. 47. The user account assigned to Clayton by Northwestern Mutual and used by Clayton in performing his consulting engagement contained “Data,” as defined in section 943.70(1 )(f) of the Statutes.
  125. 9
  126. 48. Asa consultant engaged by Northwestern Mutual to write computer code for the company’s use, Clayton owed Northwestern Mutual an implied duty not to take the code he had written and treat it as his own, as well as an implied duty not to access or copy computer programs of Northwestern Mutual that were not affected by or otherwise pertinent to the consulting work he was hired to do. These implied duties limited the scope of his authorization to access, copy and take possession of Northwestern Mutual’s computer programs and data.
  127. 49. Because of the limited scope of Clayton’s consulting engagement for Northwestern Mutual, Clayton had authorization to access and make contributions of source code to only seven repositories within Northwestern Mutual’s private Gitlab site. He had no authorization to access let alone copy or take possession of any of the remaining 100 repositories in the internal GitLab site.
  128. 50. In the last 48 hours of his assignment, Clayton exceeded and improperly used his authorized access to the Northwestern Mutual internal GitLab site by copying and downloading to his laptop 58 data repositories in violation of sections 943.70(2)(a)(3), 943.70(2)(a)(4) and 943.70(2)(a)(5) of the Statutes.
  129. 51. Beginning in December of 2015 and continuing through at least April 26, 2016, Clayton has copied, taken possession of and modified computer programs and supporting documentation of Northwestern Mutual from the Ansible-Satellite repository in the company’s internal GitLab site, and posted those programs and documentation with his modifications in the public GitHub repository named Ansible-Satellite that Clayton created at the site https://qithub.com/stephenpc. in violation of sections 943.70(2)(a)(l), 943.70(2)(a)(4) and 943.70(2)(a)(5) of the Statutes.
  130. 10
  131. 52. Clayton deleted his Northwestern Mutual-issued user account without authorization or direction by either Northwestern Mutual or Red Hat in violation of section 943.70(2)(a)(2) of the Statutes.
  132. 53. Pursuant to section 943.70(5) of the Statutes, Northwestern Mutual is an aggrieved party with no adequate remedy at law for the irreparable harm caused by Clayton’s actions, and is therefore entitled to injunctive relief requiring Clayton to comply with his obligations under section 943.70.
  133. Count 4 - Computer Fraud and Abuse Act Violation
  134. 54. Northwestern Mutual incorporates by reference and realleges as if fully set forth herein the allegations of paragraphs 1-53 of the Complaint.
  135. 55. Northwestern Mutual directly and through its subsidiaries is engaged in interstate commerce in the offering of insurance, investment products, and other financial services and uses its computers, website, website infrastructure, and associated computer programs in interstate commerce.
  136. 56. Clayton exceeded and improperly used his authorized access of the Northwestern Mutual computer network by accessing and copying files in repositories unrelated to the limited scope of his assignment in violation of 18 U.S.C. § § 1030(a)(2) and 1030(e)(6),
  137. 57. By virtue of his unauthorized acquisition, usage, copying, downloading, or removal of confidential information from Northwestern Mutual’s computer system for personal use and/or publication as open source programming, Clayton intentionally accessed a computer used in interstate commerce or communication without authorization and in excess of his authorized access, and as a result, caused damage to Northwestern Mutual.
  138. 58. By virtue of his unauthorized acquisition, usage, copying, downloading, or
  139. removal of confidential information from Northwestern Mutual’s computer system, Clayton
  140. 11
  141. knowingly, and with the intent to defraud, accessed a computer used in interstate commerce or communication without authorization and in excess of his authorized access, and as a result, furthered his intended fraud, obtained things of value, and caused damage to Northwestern Mutual.
  142. 59. By virtue of his unauthorized acquisition, usage, copying, downloading, or removal of information, Clayton intentionally accessed a computer used in interstate commerce or communication without authorization and, as a result, caused damage to Northwestern Mutual.
  143. 60. Northwestern Mutual has suffered damage and/or loss by reason of Clayton’s unauthorized acquisition, usage, copying, downloading, or removal of information for personal use and/or publication as open source programming aggregating at least $5,000 in value within a one-year period.
  144. 61. Pursuant to the Computer Fraud and Abuse Act, 18 U.S.C. § 1030, Northwestern Mutual is entitled to a temporary and permanent injunction enjoining Clayton, and anyone to whom he has divulged Northwestern Mutual’s information, from making any use of the information of Northwestern Mutual and ordering Clayton, and anyone to whom he has divulged Northwestern Mutual’s information, to return to Northwestern Mutual all documents and things containing or embodying the information.
  145. 62. Pursuant to the Computer Fraud and Abuse Act, 18 U.S.C. § 1030, Northwestern Mutual is further entitled to a temporary and permanent injunction enjoining Clayton, and anyone to whom he has divulged Northwestern Mutual’s information, from making any further use of the information of Northwestern Mutual, including an order requiring Clayton,
  146. 12
  147. and anyone to whom he has divulged Northwestern Mutual’s information, to discontinue any activities aimed at publication of the information as open source programming.
  148. 63. Pursuant to the Computer Fraud and Abuse Act, 18 U.S.C. § 1030, Northwestern Mutual is further entitled to recover monetary damages against Clayton for the losses Northwestern Mutual has sustained, and the unjust enrichment obtained by Clayton, in an amount to be determined at trial.
  149. WHEREFORE, Plaintiff Northwestern Mutual respectfully demands judgment awarding the following relief:
  150. A. A temporary and permanent injunction against Defendant Stephen Clayton and all those acting in concert or participation with him requiring them to act as follows:
  151. 1. Accessing for any purpose, including but not limited to deleting, copying, cloning, transferring, editing, modifying, sharing data or closing, the contents of any box.com account to which Stephen Clayton uploaded more than 2 gigabytes of data from an Apple MacBook laptop computer belonging to Northwestern Mutual during the period from March 31 through April 14, 2016, or permitting any person not authorized in advance in a writing issued by counsel of record for Northwestern Mutual to access any such box.com account for any purpose;
  152. 2. Accessing for any purpose, including but not limited to deleting, copying, cloning, transferring, editing, modifying, sharing data, closing, or pushing or contributing any commits or other data of any kind to any account at GitHub, Inc,, including but not limited to the account at https://uithub.com/stephenpc.
  153. 13
  154. to which Clayton has uploaded any files or data obtained from Northwestern Mutual;
  155. 3. Accessing for any purpose, including but not limited to deleting, copying, cloning, transferring, editing, modifying, sharing data or closing, the contents of any other file sharing or storage account to which Stephen Clayton uploaded more than 2 gigabytes of data from an Apple MacBook laptop computer belonging to Northwestern Mutual during the period from March 31 through April 14, 2016, or permitting any person not authorized in advance in a writing issued by counsel of record for Northwestern Mutual to access any such file sharing or storage account for any purpose;
  156. 4. During the pendency of this action and until a final determination of the merits, to convey to Northwestern Mutual all right, title and interest in any box.com account to which Stephen Clayton uploaded more than 2 gigabytes of data from an Apple MacBook laptop computer belonging to Northwestern Mutual during the period from March 31 through April 14,2016, and assign all rights to add, delete, and otherwise modify files on the account to Northwestern Mutual; and
  157. 5. Provide a full account of any and all actions taken with respect to all gigabytes of data from an Apple MacBook laptop computer belonging to Northwestern Mutual that Clayton uploaded to any box.com account during the period from March 31 through April 14, 2016, including but not limited to identification of any other accounts or media to which any of that data have been transferred,
  158. 14
  159. 6. During the pendency of this action and until a final determination of the merits, to convey to Northwestern Mutual all right, title and interest in any other file-sharing or file storage account to which Stephen Clayton uploaded data from an Apple MacBook laptop computer belonging to Northwestern Mutual during the period from March 31 through April 14, 2016, provide a full accounting of any and all actions taken with respect to such uploaded data, including but not limited to identification of any other accounts or media to which any of that data have been transferred, and assign all rights to add, delete, and otherwise modify files on any such account to Northwestern Mutual; and
  160. 7. During the pendency of this action and until a final determination of the merits, to convey to Northwestern Mutual all right, title and interest in any repositories at GitHub, Inc., including but not limited to the repositories at https://github.com/stephenpc, to which Clayton has uploaded any files or data obtained from Northwestern Mutual, and assign all rights to add, delete, and otherwise modify files on those repositories to Northwestern Mutual; and
  161. 8. Provide a full accounting of any and all actions taken with respect to the files or data obtained from Northwestern Mutual that Clayton uploaded to any repositories at GitHub, Inc., including but not limited to the repositories at https://github.com/stephenpc,, including but not limited to identification of any other accounts or media to which any of that data have been transferred,
  162. 15
  163. B. An award of compensatory damages in an amount to be determined at trial;
  164. C. An award of punitive damages in an amount sufficient to punish and deter Defendants’ wrongful conduct;
  165. D. An award of the actual attorney fees and costs reasonably incurred by plaintiffs in the preparation for and conduct of this litigation; and
  166. E. Such other and further relief as the Court deems just and equitable.
  167. Dated this^-^Aday of April 2016.
  168. FOLEY & LARDNER LLP
  169.  
  170. 15avid Luccy WI Bar NtSTI t/04129 Attorneys for Plaintiff Npnhwestem Mutual Life InsurancE'Company
  171. David Lucey WI Bar No. 1004129 Kristina J. Matic WI Bar No. 1076037 Thomas R. Dreblow WI Bar No. 1101818 FOLEY & LARDNER LLP 777 East Wisconsin Avenue Milwaukee, WI 53202-5306 414.297.5511 (DML)
  172. 414.297.4900 Facsimile Email: dIucey@foley.com
  173. 16
  174. CIRCUIT COURT
  175. MILWAUKEE COIINTY
  176. Case No. _l_bQA/003^3L| C'ase Code: 30704
  177. The Northwestern Mutual Life Insurance Company,
  178. 720 East Wisconsin Avc.
  179. Milwaukee, Wisconsin 53202,
  180. I
  181. JOHN 9ARRt;n Clerk ot Ciicuit Court
  182. vs.
  183. Stephen Clayton,
  184. 3875 Doremus St.
  185. Hamtramek, Michigan 48212,
  186. Defendant.
  187. 42 j APR 2 9 2015 ; :*2
  188. Plaintiff,
  189. PROPOSED TEMPORARY RESTRAINING ORDER AND ORDER TO SHOW CAUSE
  190. The Motion for Temporary Restraining Order and for an Order to Show Cause of Plaintiff I he Northwestern Mutual Life Insurance Company ("Northwestern Mutual'') came on forex parte hearing before the Conn on April^_. 2016. and good cause having been shown pursuant to Local Rule 3.13(A)(2) for the Court to consider the motion on an ex parte basis, and
  191. upon consideration shown a reasonable
  192. ol the brief, allidnvits and exhibits submitted. Northwestern Mutual liavinu probability ol success on the merits and that a temporary restraining order is
  193. necessary to preserve the status quo and prevent irreparable harm. IT IS HEREBY ORDERED as follows:
  194. I. Defendant Stephen Clayton and all (hose acting in concert or participation with him who shall have received notice of the existence of this order, are hereby immediately restrained, enjoined and prohibited from taking any of the following actions until further order of this Court;
  195. a. Accessing for tiny purpose, including lull not limited to deleting, copying, cloning. transferring, editing, modifying, sharing data or closing, the contents of any hox.com account to which .Stephen Clayton uploaded approximately 3.9 gigabytes of data from a MaeBook laptop computer belonging to Northwestern Mutual during the period from March 31 through April M. 21)16. or permitting any person not authorized in advance in a writing issued by counsel of record Ibr Northwestern Mutual to access any such I3ox.com account for uny purpose:
  196. b. Accessing for any purpose, including but not limited to deleting, copying, cloning, transferring, editing, modifying, sharing data or closing, the contents of any other IT le sharing or storage account to which Stephen Clayton uploaded any of approximately 3.9 gigabytes of data from an Apple MaeBook laptop computer belonging to Northwestern Mutual during the period from March 31 through April 14. 2016. or permitting any person not authorized in advance in a writing issued by eounsel of record for Northwestern Mutual to access any such lile sharing or storage account for any purpose:
  197. 2. Defendant Stephen Clayton shall show cause before this Court.
  198.  
  199. . 2016 at 7 .An o’clock or as soon thereafter as
  200. eounsel may be heard, why an order should not be issued pursuant to section 813.08 of the Wisconsin Statutes further enjoining and restraining Stephen
  201. Clayton and all those tiding in concert or participation with him and who icceivc notice ul this Order as follows:
  202. a. During the pendency of this action and until a llnal determination of the merits, to convey to Northwestern Mutual all right, title and interest in any box.com account io which Stephen Clayton uploaded approximately 3.9 gigabytes of data from an Apple Mac Book laptop computer belonging to Northwestern Mutual during the period from March 31 through April 14. 2016. and assign all rights to add, delete, and otherwise modify iiles on the account to Northwestern Mutual: and
  203. b. Provide a Rill account of any and all actions taken with respect to the approximately 3.9 gigabytes of data from an Apple MacBook laptop computer belonging to Northwestern Mutual that Clayton uploaded to any box.com account during the period from March 31 throuuh April 14. 2016. including but not limited to identification of any other accounts or media to which any ol'that data have been transferred, and assign all corresponding rights to add. delete, ami otherwise modify files on any such other accounts or media to Northwestern Mutual:
  204. c. During the pendency of this action and until a final determination of the merits, to convey to Northwestern Mutual all right, title and interest in any other lile-sharing or file storage account to which Stephen Clayton uploaded any of the approximately 3.9 gigabytes of data from an Apple MucBook laptop computer belonging to
  205. 3
  206. Northwestern Mutual duriny the period Ihmi March 31 through April 14. 2010. provide a lull accounting of am and all actions taken with respect lo such uploaded data, including but not limited to identification ofnnv other accounts or media to which am of that data have been transferred, and assign all rights to add. delete, and
  207. otherwise modify Hies on any such aeemnu lo Northwestern Mutual: anil
  208. 3. Defendant Stephen Clayton shall deliver to plaintiffs counsel and lile with the Court whatever materials lie desires to submit in response to this Order to Show Cause or otherwise in support of a request for the modification.
  209. extension or vacation of this temporun restraining order, on or before Q-22 la ■ •
  210. ————011 ^ ' *~J V .• 2016. Plaintiff may submit responsive materials up to and including A/cw £ f &./ . 20lb.
  211. 4. This temporary restraining order shall be effective immediately, on this das of
  212. Zy . 2010 at o’clock, conditioned upon the filing with
  213. enjoined or restrained, in the amoonl of
  214. the Clerk of this Court of a bond within three days of the entry of this order, lor Ihe payment of such costs and damages as may be incurred or suffered by defendant in the event defendant is ultimately found to have been wroimlulh
  215. Defendant.
  216. Plaintiff,
  217. vs.
  218. Stephen Clayton,
  219. 0
  220. FILED AND
  221. ^authenticated
  222. APR 2 9 2016 / Q
  223. Case No. Mg C.V
  224. Case Code: 30704
  225. The Northwestern Mutual Life Insurance Company,
  226. JOHN BARRETT .Clerk of Circuit Court
  227. AFFIDAVIT OF CHRISTIAN WILHELM
  228. STATE OF WISCONSIN )
  229. ) ss
  230. MILWAUKEE COUNTY )
  231. Christian Wilhelm, being first duly swom on oath, deposes and states as follows:
  232. 1. I am an adult resident of Wisconsin and an employee of the Northwestern Mutual Life Insurance Company (“Northwestern Mutual”). I work for Northwestern Mutual as the manager of cyber threat operations.
  233. 2. I am a Certified Forensic Analyst (“GCFA”) by the Global Information Assurance Certification. The GCFA certification means that I am recognized as having demonstrated knowledge, skills and ability to conduct formal incident investigations in complex digital forensic cases. I earned this certification in March of 2015 after, among other things, passing a proctored examination and submitting an application that showed my acquisition of skills in the computer forensic field through training and industry experience,
  234. 3. I hold a degree in Management Information Systems from the University of Wisconsin-Milwaukee.
  235. 4. On April 18,2016, other personnel at Northwestern Mutual reported to me a concern about the use by a consultant named Stephen Clayton of a Northwestern Mutual laptop computer to engage in improper activities concerning copying of confidential and proprietary information of Northwestern Mutual.
  236. 5. Northwestern Mutual engages consultants from time to time to work on projects concerning the company’s information technology and computer networks, and in such cases, typically provides the consultant with a company-owned laptop computer to use in accessing necessary information on the Northwestern Mutual network. By provided in the consultant with a Northwestern Mutual computer, the company is better positioned to maintain the security of the company’s computer network.
  237. 6. A consultant provided such a company-owned computer is also assigned a Northwestern Mutual user identification and password so that the consultant can maintain the security of the information accessible through the laptop. Northwestern Mutual determines the level of access to the company’s computer network that the consultant’s engagement requires and assigns that level of access to the user identification provided.
  238. 7. The consultant also typically receives the ability to access the Northwestern Mutual network from remote locations using the laptop. That remote access is subject to additional security measures including a password and an electronic token which must be used in order to log in remotely.
  239. 8. In the case of Mr. Clayton, our inventory records indicate that Northwestern Mutual issued an Apple MacBook computer to Mr. Clayton on August 19, 2015, and received the computer back from Mr. Clayton at the end of his consulting engagement on April 14, 2016.
  240. 2
  241. 9. Shortly after receiving the April 18 report concerning Stephen Clayton, 1 received an Apple MacBook computer that Northwestern Mutual records show had been assigned to Clayton for his use in performing consulting services related to the company’s website infrastructure. 1 received the laptop from a Northwestern Mutual employee after Mr. Clayton had returned the computer at the end of his consulting engagement on the morning of April 14, 2016. Although the employee who received the computer from Mr. Clayton had opened the laptop, turned it on and inserted a USB drive to offload some information, he informed me that he took no other actions concerning the computer between receiving it from Clayton and delivering it to me.
  242. 10. A member of my team created a forensic image of the laptop using the computer’s native dmg imaging function. This forensic image is a bit-by-bit exact digital copy of the laptop recorded and was copied to an evidence drive so that the data on the forensic image will not change as it is being examined for evidence.
  243. 11. My team’s examination of the forensic image revealed that someone had deleted the entire user account that Northwestern Mutual had installed on the computer for Clayton’s use, and had reset the computer to Apple factory default settings. The applications ordinarily loaded onto such a computer for use by a Northwestern Mutual consultant, and all of the email messages and other indicia of Mr. Clayton’s use of the computer except his final work product, were missing.
  244. 12. Essentially, Mr. Clayton had deleted the user account that Northwestern Mutual had established for him on the MacBook and that he had been using for months. I am unaware of any other instance of a consultant from Red Hat returning a computer with the user account deleted. This made me suspicious about what Mr. Clayton had done with the computer.
  245. 3
  246. 13. My team also received certain video files that Clayton had produced as part of the deliverables of his consulting engagement. These videos provided instruction on how to use the computer programming that Clayton had performed for Northwestern Mutual. The videos featured images of the computer screen of Clayton’s Northwestern Mutual assigned Apple MacBook computer as Clayton was demonstrating the use of his program.
  247. 14. On a video file called “upgrading satellite.mov”, with a last modified date of April 14,2016 at 008:50,1 observed two things that were noteworthy. In the upper right comer of the screen, I saw an icon from website called box.com which is used to show that material is being uploaded from the computer to box.com. This is significant because Northwestern Mutual does not use box.com for storage of any computer source code or materials used by information technology consultants such as Clayton.
  248. 15. On the same video, I observed icons on the desktop screen of Northwestern Mutual-owned Apple MacBook computer assigned to Clayton of Northwestern Mutual GitLab repositories that had apparently been downloaded to the computer. Significantly, none of these repository icons visible on the screen were repositories that Clayton had been engaged to work on.
  249. 16. To determine whether Clayton had downloaded other repositories to this laptop computer besides those visible on the video he created, I reviewed the logs available on the Northwestern Mutual network of transactions involving Northwestern Mutual’s GitLab source code repository. These logs showed that Clayton had downloaded 58 repositories of custom-written Northwestern Mutual source code during the late evening hours of April 13 and the early morning hours of April 14, his last day as a consultant for Northwestern Mutual. The total size of the 58 repositories that Clayton downloaded was approximately 1.4 gigabytes.
  250. 4
  251. 17. I also reviewed internet proxy logs on Northwestern Mutual’s network which show activity in using a particular computer to upload information from the company’s network to outside sites on the Internet. I viewed these logs for the user identification assigned to Mr. Clayton (which was CLA9780) for the period from January 1,2016 through April 14, 2016. They showed very little uploading activity for this computer until April 13 and 14, the last 24 hours before Mr. Clayton’s consulting engagement ended. Then, on those two days, the logs showed that approximately 2.8 gigabytes of data had been uploaded from this computer to an account at box.com. They showed that another approximately 1.1 gigabytes had been uploaded on April 12, 2016.
  252. 18. lam familiar with box.com as a file sharing site where businesses and individuals can establish accounts to which they can upload information for storage and future use, including sharing the information with others.
  253. 19. Members of my team and I have devoted a total of 121 man hours to the investigation of Mr. Clayton’s actions. Based on the budgeted cost of those man hours, the cost to Northwestern Mutual of this internal investigation stands at approximately $7,400.
  254. 20. Northwestern Mutual has also engaged Dell Secure Works to conduct an investigation of Mr. Clayton’s activities. We brought in DellSecure Works because of their expertise in MacBook forensics and to obtain a third-party independent review of the evidence.
  255. 5
  256. Dell SecureWorks has obtained its own digital image of the Apple MacBook assigned to Clayton by Northwestern Mutual and is analyzing that image. To date, the charges from Dell SecureWorks for its investigation stand at approximately $5,200.
  257. Subscribed and swom to before me this 23 day of April, 2016.
  258. Notciry 'Fublicj-StfitC'of Wisconsin My Commission: 2-/-^ //
  259.  
  260. 6
  261. Christian Wilhelm
  262. The Northwestern Mutual Life Insurance Company,
  263. 720 East Wisconsin Avc.
  264. Case No. I to CJJ (ma yf Case Code: 30704
  265. Milwaukee, Wisconsin S3202,
  266. vs.
  267. Stephen Clayton,
  268. 3875 Doremus St. Hamtramck, Michigan 48212,
  269. Defendant.
  270. filed and
  271. 0 I APR 2 9 2016
  272. JOHN BARRETT Sl^h.of Circuit nn,lft
  273. 0
  274. Plaintiff,
  275. EX PARTE MOTION FOR TEMPORARY RESTRAINING ORDER AND ORDER TO SHOW CAUSE
  276. Plaintiff The Northwestern Mutual Insurance Company (“Northwestern Mutual”), by its undersigned counsel, hereby moves the Court pursuant to sections 813.02 and 813.08 of the Wisconsin Statutes for a Temporary Restraining Order and for an Order to Show Cause as specified below. The grounds for this motion are that Northwestern Mutual is entitled to a judgment restraining certain acts of the defendant, the continuance of which during the litigation will cause Northwestern Mutual irreparable harm for which is had no adequate remedy at law. This motion is further supported by the brief, certificate of counsel and the affidavits filed herewith. The form of the proposed temporary restraining order and order to show cause is attached hereto.
  277.  
  278. lay of April 2016.
  279. FOLEY & LARDNER LLP
  280.  
  281. David Lucey WI Bar No. 1004129 Kristina J. Matic WI Bar No. 1076037 Thomas R. Dreblow WI Bar No. 1101818 FOLEY & LARDNER LLP 777 East Wisconsin Avenue Milwaukee, WI 53202-5306 414.297.5511 (DML)
  282. 414.297.4900 Facsimile Email: dlucey@foley.com
  283. 2
  284. vs.
  285. Stephen Clayton,
  286. Plaintiff,
  287. Case No. 16-CV-003234
  288. Defendant.
  289. Case Code: 30704
  290. BRIEF SUPPORTING MOTION FOR TEMPORARY RESTRAINING ORDER
  291. AND ORDER TO SHOW CAUSE
  292. -^Ht^NTIcate;q David A. Hansher
  293. The Northwestern Mutual Life Insurance Company,
  294. In this case, Plaintiff Northwestern Mutual Life Insurance Company seeks the Court’s immediate intervention to stop what it believes is a cyber crime in process. Plaintiff seeks this relief on an emergency ex part basis because the defendant has already taken steps to destroy evidence and publish computer source code that Northwestern Mutual believes is entitled to be protected as proprietary. The legal grounds for this are Wisconsin’s Computer Crimes law and the factual basis for it is described below.
  295. STATEMENT OF FACTS Parties
  296. The Northwestern Mutual Life Insurance Company (“Northwestern Mutual”) is a mutual insurance company incorporated in the State of Wisconsin with its principal office at 720 East Wisconsin Ave., Milwaukee, Wisconsin 53202.
  297. Stephen Clayton is an adult resident of the State of Michigan, permanently residing, upon information and belief, at 3875 Doremus St., Hamtramck, Michigan. While
  298. working as a Platform Consultant for Red Hat, Clayton worked continuously on site at Northwestern Mutual’s home office in Milwaukee and resided approximately four nights per week in a Milwaukee area hotel.
  299. Northwestern Mutual is a mutual insurance company with subsidiaries engaged in insurance and financial services fields including brokerage and advisory services and wealth management.
  300. Northwestern Mutual’s Website Automation Project
  301. To serve its customers more effectively, Northwestern Mutual has invested heavily in information technology, including development of a state of the art website and supporting infrastructure.
  302. In particular, over approximately the last 12 months, Northwestern Mutual has devoted substantial time and resources to automating the infrastructure of the Northwestern Mutual customer website.
  303. Consulting Relationship with Red hat
  304. For this project, Northwestern Mutual has engaged a consulting service called Red Hat, Inc. (“Red Hat”). Red Hat’s role in the Northwestern Mutual project is to help create a server environment to run a specific operating system on the servers used as infrastructure for the Northwestern Mutual website.
  305. Red Hat initially proposed that Northwestern Mutual employ a Red Hat-owned platform as a service (“PaaS”) product called OpenShift. Northwestern Mutual decided instead to develop and use its own proprietary PaaS solution.
  306. Red Hat Assigns Stephen Clayton to Northwestern Mutual Project
  307. As part of its consulting engagement with Northwestern Mutual, Red Hat assigned an employee named Stephen Clayton to work on-site at Northwestern Mutual.
  308. 2
  309. Clayton’s specific assignment involved only a small part of the overall infrastructure automation project.
  310. Specifically, Red Hat assigned Clayton to integrate the Red Hat Satellite product into the Northwestern Mutual platform. Satellite is a Red Hat systems management application that allows a system administrator to deploy, monitor and manage multiple instances of an operating system.
  311. Clayton worked continuously on-site at the Northwestern Mutual home office from approximately August of 2015 through April 14, 2016.
  312. As a contractor for Northwestern Mutual, Clayton received an Apple MacBook computer owned by Northwestern Mutual to use in performing his work. Along with this Apple MacBook computer, Northwestern Mutual issued to Clayton a user identification and password for the Northwestern Mutual computer network and an electronic token to use in accessing the Northwestern Mutual network remotely.
  313. Northwestern Mutual’s GitLab Repositories
  314. Northwestern Mutual stores the source code used in its automation project in more than 100 secure repositories within the Northwestern Mutual computer network. These repositories are hosted in a software development application called GitLab, which is Northwestern Mutual’s private storage location.
  315. Northwestern Mutual provided Clayton with access to the GitLab repositories so that Clayton would ensure that the source code he was writing would function properly with Northwestern Mutual’s proprietary source code stored in the private GitLab site.
  316. Because of the limited scope of Clayton’s work, he only submitted code updates to seven of Northwestern Mutual’s private GitLab repositories while working on his assigned project.
  317. 3
  318. Clayton’s Termination and Illegal Activities On or about April 1, 2016, with Clayton’s consulting project nearly completed, Northwestern Mutual and Red Hat notified Clayton that his assignment at Northwestern Mutual would end on April 14,2016.
  319. Within the days and weeks following the conclusion of Clayton’s assignment at Northwestern Mutual, the company discovered that Clayton had engaged in a pattern of activity indicating a misappropriation of Northwestern Mutual’s proprietary computer code.
  320. Northwestern Mutual’s Investigation of Clayton First, Northwestern Mutual noticed that when Clayton returned his Northwestern Mutual Apple MacBook computer, Clayton’s user account on that computer had been deleted, and apart from the final work product that Clayton delivered as the completion of his consulting engagement, the computer had been reset to Apple factory default settings. Effectively, these actions hid from any ordinary computer user’s scrutiny all of Clayton’s activity on the Apple MacBook computer during the time that it was assigned to him.
  321. Clayton had not been authorized or directed by either Northwestern Mutual or Red Hat to delete his user account and reset the computer to its original Apple settings. His actions in doing so were extraordinary and indicative of an effort to hide his activity.
  322. Upon further investigation, Northwestern Mutual learned that in the last 48 hours of Clayton’s possession of the Apple MacBook computer and the token necessary for remote access to the Northwestern Mutual network, Clayton had used those instruments to “clone” or download 58 of Northwestern Mutual’s source code repositories from the private GitLab repository accessible only to authorized Northwestern Mutual employees and contractors. All of these repositories contain source code proprietary to Northwestern Mutual and only seven of
  323. 4
  324. them contained any source code contributed by Clayton. The total volume of code in these 58 repositories amounted to approximately 1.4 gigabytes.
  325. Next, Northwestern Mutual investigated Clayton’s activity in uploading data from the Northwestern Mutual network to internet sites external to Northwestern Mutual. This investigation revealed that in the last 24 hours before his assignment at Northwestern Mutual ended, during late evening hours of April 13 and the early morning hours of April 14, Clayton uploaded a substantial volume of data to a storage site called “box.com.” The total amount of data Clayton uploaded to box.com over these two days is approximately 2.8 gigabytes. These uploads to box.com occurred contemporaneously with and shortly after Clayton downloaded the 58 repositories from Northwestern Mutual’s GitLab. Clayton uploaded another approximately
  326. l.l gigabytes of data from the Northwestern Mutual Apple MacBook on April 12, 2016.
  327. Neither Northwestern Mutual nor Red Hat authorized Clayton to upload any data from the Northwestern Mutual network to the box.com storage site. There is no known reason or need related to Clayton’s or Red Hat’s consulting work for Northwestern Mutual for him to store any information taken from the Northwestern Mutual network at the box.com site.
  328. As the investigation continued, Northwestern Mutual learned that in December of 2015, Clayton had uploaded computer code written at Northwestern Mutual to an open source software development site called “GitHub.” Specifically, Clayton created his own repository on GitHub at the site https://github.com/stephenpc under the name “Ansible-Satellite,” the very same name used internally by Northwestern Mutual for the same source code.
  329. Most recently, Northwestern Mutual learned that, on April 26,2016, Clayton posted revisions to the GitHub Ansible-Satellite repository using the code copied from Northwestern Mutual’s proprietary GitLab repository.
  330. 5
  331. On April 28, 2016, Northwestern Mutual learned that, on April 5, 2016, shortly after being informed that his assignment at Northwestern Mutual would be terminated, Clayton secretly posted an obscure notice in the Northwestern Mutual GitLab private repository that he was unilaterally declaring the Ansible-Satellite programming to which he contributed to be an open source program. Other than clandestinely posting this notice in the GitLab repository, Clayton did nothing to advise any of his superiors at Red Hat or his contacts at Northwestern Mutual of his open source claim.
  332. Neither Northwestern Mutual nor Red Hat authorized Clayton to post such a notice or to make Northwestern Mutual’s proprietary source code openly available to the public free of charge.
  333. Irreparable Harm to Northwestern Mutual
  334. By his actions and statements over the last four weeks, which have just recently come to Northwestern Mutual’s attention, Clayton has shown his intent to take Northwestern Mutual’s proprietary source code for its website automation project and turn it into open source software freely available to the general public, including competitors of Northwestern Mutual.
  335. Clayton’s actions threaten Northwestern Mutual with loss of its exclusive right to use its proprietary source code in its business and to gain competitive advantages arising from that exclusive use.
  336. ARGUMENT
  337. 1. A Temporary Restraining Order is Needed to Prevent Further Dissemination of the Programming Stolen from Northwestern Mutual.
  338. Temporary restraining orders and injunctions are available in Wisconsin when one party is doing something during litigation in violation of the other party’s rights and the first party’s actions, if allowed to continue, are likely to cause injury or render the eventual judgment
  339. 6
  340. ineffectual. Sec. 813.02, Stats. (2013-14). Injunctive relief is appropriate when the moving
  341. party shows: (1) a reasonable probability of ultimate success on the merits, (2) that relief is
  342. necessary to preserve the status quo, and that (3) without an injunction, the movant will face a
  343. prospect of irreparable harm without an adequate remedy at law. Werner v. A.L. Grootemat &
  344. Sons, Inc., 80 Wis. 2d 513, 520, 259N.W.2d 310,313-14 (1977).
  345. While such a motion is addressed to the court’s discretion, injunctive relief may
  346. become mandatory once a reasonable probability of success is shown and the threat of
  347. irreparable injury exists. As the court has explained:
  348. [Wjhere the complaint states a cause of action and the motion papers disclose a reasonable probability of plaintiffs ultimate success, it is well-nigh an imperative duty of the court to preserve the status quo by temporary injunction, if its disturbance pendente life will render futile in considerable degree the judgment sought, or cause serious and irreparable injury to one party; especially if injury to the other is slight, or of character easily compensable in money; and that the discretion vested in the court is largely over the question of terms of the restraint and the protection of rights by bonds from one party to the other.
  349. Shearer v. Congdon, 25 Wis. 2d 663, 668, 131 N.W.2d 377, 381 (1964) (emphasis added).
  350. II. An Ex Parte Temporary Restraining Order Is Appropriate Under the Extraoridnary Circumstanced Presented Here.
  351. Wisconsin Courts have discretion on whether to grant a temporary restraining order without notice to the defendant being restrained. See, e.g., Wis. Stat § 813.08 (“The court or judge may, before granting the injunction, make an order requiring cause to be shown why the injunction should not be granted, and the defendant may in the meantime be restrained.”! (emphasis added); Wis. Stat. § 813.02(l)(b) (“Prior to granting a...temporary restraining order, the court may attempt to contact the party sought to be restrained.. .and allow all parties to be heard”) (emphasis added). Cf, Berkoff v. Dept, of Building Inspection & Safety Engineering of
  352. 7
  353. the City of Milwaukee, 47 Wis. 2d 215, 218, 177 N.W.2d 142, 144 (1970) (under then sec. 268.025, “under some circumstances, temporary restraining orders could be issued ex parte and without service upon the adverse party”).
  354. III. Claytons’ Unauthorized Mass Copying of Northwestern Mutual’s Computer Programs Warrants Injunctive Relief Under Section 943.70 of The Statutes.
  355. The Wisconsin Legislature has declared it an “[o]ffense[] against computer data and programs” when someone “willfully, knowingly and without authorization... copies data, computer programs or supporting documentation.” Sec. 943.70(2)(a)(5), Stats. (2011-12). Section 943.70(5) provides that “[a]ny aggrieved party may sue for injunctive relief under ch.
  356. 813 to compel compliance with this section.”
  357. The circumstances here present a compelling case that Clayton acted willfully, knowingly and without authorization when he, at the eleventh hour of his consulting engagement with Northwestern Mutual, “cloned” 58 repositories of computer programs, nearly all of which had not been implicated in the consulting project he had just completed. His consulting work was done; he had already written all of the code he needed to write, and had already made the instructional videos to go along with that programming work. He had no legitimate reason to be downloading 58 repositories at that point.
  358. Any doubt about whether his actions were willfully and knowingly wrong is erased by his next action using the Northwestern Mutual provided Apple MacBook laptop. He proceeded to delete his own user account and reset the computer to the Apple factory default settings. This action, like reformatting a Windows personal computer, has the effect of obscuring the computer forensic evidence available from the laptop about what he had done.
  359. 8
  360. IV. The Balance of Harms Tips Heavily in Northwestern Mutual’s Favor.
  361. The relief Northwestern Mutual seeks with this TRO motion is simply to preserve the status quo by stopping Clayton in this tracks. Clayton is presently working on another consulting engagement for another customer of Red Hat. He has no need or any justification for using the Northwestern Mutual programs that he downloaded or that he has deposited in his own GitHub repository. His further use or dissemination of that programming deprives Northwestern Mutual of its exclusive rights to its possession and use.
  362. CONCLUSION
  363. To preserve the status quo and avoid harm to Northwestern Mutual that would be irreparable, a temporary restraining order is required. Because the temporary relief that Northwestern Mutual seeks is only to freeze Mr. Clayton’s activities with regard to the computer programs at issue, there is no substantial harm to the defendants from granting relief. The balance of harms supports granting the relief Northwestern Mutual seeks.
  364. Dated this^^j^day of April 2016.
  365. By;
  366. David Lucey WI Bar No. 1004129 Kristina J. Matic WI Bar No. 1076037 Thomas R. Dreblow WI Bar No. 1101818 FOLEY & LARDNER LLP 777 East Wisconsin Avenue Milwaukee, WI 53202-5306 414.297.5511 (DML)
  367. 414.297.4900 Facsimile Email: dlucey@foley.com
  368. 4,
  369. David Lucey WI Baf'No. 1004129 Attorneys for Plaintiff Northwestern Mutual Life Insurance Company
  370. 9
  371. FOLEY & LARDNER LLP
  372. vs.
  373. Stephen Clayton,
  374. Plaintiff,
  375. Defendant.
  376. Case No. 1 Q.V
  377. Case Code: 30704
  378. The Northwestern Mutual Life Insurance Company,
  379. AFFIDAVIT OF CHRISTIAN WILHELM
  380. STATE OF WISCONSIN )
  381. ) ss
  382. MILWAUKEE COUNTY )
  383. Christian Wilhelm, being first duly sworn on oath, deposes and states as follows:
  384. 1. I am an adult resident of Wisconsin and an employee of the Northwestern Mutual Life Insurance Company (“Northwestern Mutual”). I work for Northwestern Mutual as the manager of cyber threat operations.
  385. 2. 1 am a Certified Forensic Analyst (“GCFA”) by the Global Information Assurance Certification. The GCFA certification means that I am recognized as having demonstrated knowledge, skills and ability to conduct formal incident investigations in complex digital forensic cases. I earned this certification in March of 2015 after, among other things, passing a proctored examination and submitting an application that showed my acquisition of skills in the computer forensic field through training and industry experience.
  386. 3. I hold a degree in Management Information Systems from the University of Wisconsin-Milwaukee.
  387. 4. On April 18,2016, other personnel at Northwestern Mutual reported to me a concern about the use by a consultant named Stephen Clayton of a Northwestern Mutual laptop computer to engage in improper activities concerning copying of confidential and proprietary information of Northwestern Mutual.
  388. 5. Northwestern Mutual engages consultants from time to time to work on projects concerning the company’s information technology and computer networks, and in such cases, typically provides the consultant with a company-owned laptop computer to use in accessing necessary information on the Northwestern Mutual network. By provided in the consultant with a Northwestern Mutual computer, the company is better positioned to maintain the security of the company’s computer network.
  389. 6. A consultant provided such a company-owned computer is also assigned a Northwestern Mutual user identification and password so that the consultant can maintain the security of the information accessible through the laptop. Northwestern Mutual determines the level of access to the company’s computer network that the consultant’s engagement requires and assigns that level of access to the user identification provided.
  390. 7. The consultant also typically receives the ability to access the Northwestern Mutual network from remote locations using the laptop. That remote access is subject to additional security measures including a password and an electronic token which must be used in order to log in remotely.
  391. 8. In the case of Mr. Clayton, our inventory records indicate that Northwestern Mutual issued an Apple MacBook computer to Mr. Clayton on August 19, 2015, and received the computer back from Mr. Clayton at the end of his consulting engagement on April 14, 2016.
  392. 2
  393. 9. Shortly after receiving the April 18 report concerning Stephen Clayton, I received an Apple MacBook computer that Northwestern Mutual records show had been assigned to Clayton for his use in performing consulting services related to the company’s website infrastructure. I received the laptop from a Northwestern Mutual employee after Mr. Clayton had returned the computer at the end of his consulting engagement on the morning of April 14, 2016. Although the employee who received the computer from Mr. Clayton had opened the laptop, turned it on and inserted a USB drive to offload some information, he informed me that he took no other actions concerning the computer between receiving it from Clayton and delivering it to me.
  394. 10. A member of my team created a forensic image of the laptop using the computer’s native dmg imaging function. This forensic image is a bit-by-bit exact digital copy of the laptop recorded and was copied to an evidence drive so that the data on the forensic image will not change as it is being examined for evidence.
  395. 11. My team’s examination of the forensic image revealed that someone had deleted the entire user account that Northwestern Mutual had installed on the computer for Clayton’s use, and had reset the computer to Apple factory default settings. The applications ordinarily loaded onto such a computer for use by a Northwestern Mutual consultant, and all of the email messages and other indicia of Mr. Clayton’s use of the computer except his final work product, were missing.
  396. 12. Essentially, Mr. Clayton had deleted the user account that Northwestern Mutual had established for him on the MacBook and that he had been using for months. I am unaware of any other instance of a consultant from Red Hat returning a computer with the user account deleted. This made me suspicious about what Mr. Clayton had done with the computer.
  397. 3
  398. 13. My team also received certain video files that Clayton had produced as part of the deliverables of his consulting engagement. These videos provided instruction on how to use the computer programming that Clayton had performed for Northwestern Mutual. The videos featured images of the computer screen of Clayton’s Northwestern Mutual assigned Apple MacBook computer as Clayton was demonstrating the use of his program.
  399. 14. On a video file called “upgrading_satellite.mov”, with a last modified date of April 14,2016 at 008:50,1 observed two things that were noteworthy. In the upper right comer of the screen, I saw an icon from website called box.com which is used to show that material is being uploaded from the computer to box.com. This is significant because Northwestern Mutual does not use box.com for storage of any computer source code or materials used by information technology consultants such as Clayton.
  400. 15. On the same video, I observed icons on the desktop screen of Northwestern Mutual-owned Apple MacBook computer assigned to Clayton of Northwestern Mutual GitLab repositories that had apparently been downloaded to the computer. Significantly, none of these repository icons visible on the screen were repositories that Clayton had been engaged to work on.
  401. 16. To determine whether Clayton had downloaded other repositories to this laptop computer besides those visible on the video he created, I reviewed the logs available on the Northwestern Mutual network of transactions involving Northwestern Mutual’s GitLab source code repository. These logs showed that Clayton had downloaded 58 repositories of custom-written Northwestern Mutual source code during the late evening hours of April 13 and the early morning hours of April 14, his last day as a consultant for Northwestern Mutual. The total size of the 58 repositories that Clayton downloaded was approximately 1.4 gigabytes.
  402. 4
  403. 17. I also reviewed internet proxy logs on Northwestern Mutual’s network which show activity in using a particular computer to upload information from the company’s network to outside sites on the Internet. I viewed these logs for the user identification assigned to Mr. Clayton (which was CLA9780) for the period from January 1,2016 through April 14, 2016. They showed very little uploading activity for this computer until April 13 and 14, the last 24 hours before Mr. Clayton’s consulting engagement ended. Then, on those two days, the logs showed that approximately 2.8 gigabytes of data had been uploaded from this computer to an account at box.com. They showed that another approximately 1.1 gigabytes had been uploaded on April 12, 2016.
  404. 18. Iam familiar with box.com as a file sharing site where businesses and individuals can establish accounts to which they can upload information for storage and future use, including sharing the information with others.
  405. 19. Members of my team and I have devoted a total of 121 man hours to the investigation of Mr. Clayton’s actions. Based on the budgeted cost of those man hours, the cost to Northwestern Mutual of this internal investigation stands at approximately $7,400.
  406. 20. Northwestern Mutual has also engaged Dell SecureWorks to conduct an investigation of Mr. Clayton’s activities. We brought in DellSecure Works because of their expertise in MacBook forensics and to obtain a third-party independent review of the evidence.
  407. S
  408. Dell SecureWorks has obtained its own digital image of the Apple MacBook assigned to Clayton by Northwestern Mutual and is analyzing that image. To date, the charges from Dell SecureWorks for its investigation stand at approximately $5,200.
  409. • (Lid,.
  410. Christian Wilhelm
  411. Subscribed and sworn to before me this day of April, 2016.
  412.  
  413. Not^iyTubliCf^tattrof Wisconsin My Commission: 2-At./ /
  414. 6
  415. The Northwestern Mutual Life Insurance Company,
  416. Case No.UflCAj 00^ Case Code: 30704
  417. FILED AND AUTHENTICATED
  418. JOHN BARRETT I Clerk of Circuit Court
  419. Plaintiff,
  420. vs.
  421. Stephen Clayton,
  422. Defendant.
  423. AFFIDAVIT OF TROY FLUEGGE
  424. STATE OF WISCONSIN )
  425. ) ss
  426. MILWAUKEE COUNTY )
  427. Troy Fluegge, being first duly sworn on oath, deposes and states as follows:
  428. 1. I am an adult resident of Wisconsin and an employee of the Northwestern Mutual Life Insurance Company (“Northwestern Mutual”). I work for Northwestern Mutual in designing the technical architecture for the company’s cloud computing operations.
  429. 2. I have almost 20 years of experience in the information technology field, having worked as a systems engineer, a service delivery manager, and a technical solutions architect and designer. Before joining Northwestern Mutual in 2014, my last three employers were Kohl’s Department Stores, where I worked for more than five years, NCO Financial Systems, where I worked for about two years, and Outsourcing Solutions, where I worked for three years.
  430. 3. At Northwestern Mutual, I have been working on designing and building a continuously available website architecture and infrastructure that will use cloud computing and
  431. automated installations so that the website will be able to expand its capacity to match customer activity and rapidly integrate new services and features.
  432. 4. During the last year, I have worked with consultants from Red Hat, Inc. on various projects concerning the infrastructure for Northwestern Mutual’s website. One of the consultants with whom I have worked is Stephen Clayton.
  433. 5. Mr. Clayton worked on a discrete project involving integration of Red Hat’s Satellite product into the Northwestern Mutual computer network infrastructure. Satellite is a Red Hat systems management application that allows a server administrator to deploy, monitor and manage multiple instances of an operating system on different computer servers.
  434. 6. Mr. Clayton worked on-site at Northwestern Mutual from approximately August 10,2015 through April 14,2016. While working on-site in Milwaukee four days a week, Mr, Clayton stayed at a hotel in the area. On Fridays, he worked remotely from Detroit, Michigan.
  435. 7. Northwestern Mutual stores the source code used in its automation project in approximately 100 secure repositories within the Northwestern Mutual computer network. These repositories are hosted in a software development application called GitLab.
  436. 8. Northwestern Mutual provided Clayton with access to the GitLab repositories so that Clayton would ensure that the source code he was writing would function properly with Northwestern Mutual’s proprietary source code stored in the private GitLab repository.
  437. 9. Because of the limited scope of Clayton’s Satellite integration project, he contributed code revisions to only seven repositories while working on his limited consulting project.
  438. 2
  439. 10. On April 1, 2016, with Mr. Clayton’s project nearly completed, Northwestern Mutual notified Mr. Clayton that his assignment at Northwestern Mutual would end on April 14, 2016.
  440. 11. On the morning of April 14, Mr. Clayton delivered to me the Apple MacBook laptop computer that Northwestern Mutual had assigned to him as a consultant, confirmed that he had delivered the work product expected from him under the consulting project, and then said goodbye. He said nothing to me about retaining any files or repositories from his work at Northwestern Mutual.
  441. 12. When a member of our team opened the Apple MacBook to transfer the end results of Mr. Clayton’s efforts to another team member, I was surprised to leam what he had found. Although the end product of Mr. Clayton’s assignment was available on the computer, the laptop had otherwise been reset to Apple factory default settings.
  442. 13. Part of the final work product on the MacBook that Mr. Clayton delivered were instructional video files intended to provide a guide to the programming Mr. Clayton had completed for Northwestern Mutual. The graphic portion of these videos is simply Mr. Clayton’s computer screen as he is using the program he created and explaining in the audio portion what he is doing on screen. I understand that Northwestern Mutual’s forensics team noted on one of these videos an indication that an upload of files to box.com was in process at the time of making of the video. This is significant because Northwestern Mutual does not use box.com for storage of any computer source code or materials used by information technology consultants such as Clayton.
  443. 14. On a video file entitled “satellitejselfsubscription.mov”, I observed icons on the screen of Mr. Clayton’s Apple MacBook computer depicting GitLab repositories that had
  444. 3
  445. apparently been downloaded to the computer. I recognized these as GitLab repository icons for repositories created in the course of Northwestern Mutual’s website platform automation project. Significantly, none of these repository icons visible on the screen were repositories that Mr. Clayton had been engaged to work on.
  446. 15. On April 18,2016, our team became concerned about the observations we had made concerning the Apple MacBook assigned to Mr. Clayton and we decided to alert Northwestern Mutual’s cyber threat team.
  447. 16. I have since learned that an examination of the logs that track access to the Northwestern Mutual GitLab site show that Mr. Clayton downloaded 58 repositories from the website platform automation project. All of these repositories contain source code proprietary to Northwestern Mutual and Mr. Clayton had contributed code revisions to only seven of them in the course of his consulting project. The total volume of code in these 58 repositories amounted to approximately 1.4 gigabytes.
  448. 17. Given the limits of his consulting engagement, Mr. Clayton had no authorization to copy or “clone” any of these repositories to the Apple MacBook laptop computer that Northwestern Mutual had assigned to him. He certainly had no authorization to engage in this activity in the late evening of April 13 or the early morning of April 14, when he had already finished his consulting project.
  449. 18. Neither Northwestern Mutual nor to my knowledge, anyone at Red Hat, authorized Clayton to upload any data from the Northwestern Mutual network to the box.com storage site. There is no known reason or need related to Clayton’s or Red Hat’s consulting work for Northwestern Mutual for him to store any information taken from the Northwestern Mutual GitLab repository at the box.com site.
  450. 4
  451. 19. As the investigation continued, Northwestern Mutual learned that in December of 2015, Clayton had uploaded computer code written at Northwestern Mutual to an open source software development site called “GitHub.” Specifically, Clayton created his own repository on GitHub at the site https://github.com/stephenpc under the name “Ansible-Satellite” the very same name used by Northwestern Mutual for the same source code.
  452. 20. I learned on April 27, 2016, that Mr. Clayton had posted revisions to his GitHub Ansible-Satellite repository on April 26, 2016, using the code copied from Northwestern Mutual’s proprietary GitLab repository. 1 have compared the code in Mr. Clayton’s April 26 posting to code from Northwestern Mutual’s private GitLab repository, and large portions of it track word-for-word.
  453. 21. On April 28,2016, we discovered that, on April 5, 2016, shortly after being informed that his assignment at Northwestern Mutual would be terminated, Mr. Clayton inserted a file in the Northwestern Mutual GitLab private repository that he was declaring the Ansible-Satellite programming that he worked on to be an open source program. Other than posting this notice in the GitLab repository, Clayton never advised me personally, or anyone else that I know of at Northwestern Mutual or Red Hat, that he considered the programming that he had written at Northwestern Mutual’s expense to be open source code. I certainly would have disagreed with Mr. Clayton if he had told me that, and I am confident that Mr. Clayton knew that would be my response.
  454. 5
  455. 4824-0298-1937.2
  456. 22, Neither Northwestern Mutual nor to my knowledge, anyone at Red Hat, authorized Clayton to post such a notice or to make Northwestern Mutual’s source code openly available to the public free of charge.
  457. Troy Fluegge
  458. Subscribed and sworn to before me this day of April, 2016.
  459.  
  460. 5ublic, State of Wisconsin My Commission:
  461. 6
  462. Case No. llnCV QQ3>3 Case Code: 30704
  463. The Northwestern Mutual Life Insurance
  464. LOCAL RULE 3.13(A) CERTIFICATION
  465. David Lucey, counsel for Plaintiff The Northwestern Mutual Life Insurance Company certifies as follows:
  466. 1. I am an attorney licensed to practice in the State of Wisconsin. I represent the
  467. Plaintiff, Northwestern Mutual Life Insurance Company in this action.
  468. 2. Pursuant to Local Rule 3.13(A)(2), good cause exists for excusing Plaintiff from providing notice to the Defendant, Stephen Clayton, against whom this Temporary Restraining Order (“TRO”) is sought.
  469. 3. The basis for said good cause, as set forth more fully in Plaintiff’s Memorandum in Support of its Motion for Temporary Restraining Order is that, if given notice prior to the issuance of the TRO, Defendant will likely (1) release proprietary computer code that Plaintiff believes Defendant has misappropriated from Defendant publicly on the internet which would cause irreparable loss and damage to Plaintiff; and (2) destroy evidence of Defendant’s wrongdoing. Plaintiff reasonably believes that Defendant will make the proprietary code public
  470. if given notice prior to a TRO because Defendant has already made a small portion of the misappropriated code public. Plaintiff reasonably believes that Defendant will destroy evidence if given prior notice of a TRO because Defendant took steps to destroy evidence upon the end of his engagement with Plaintiff.
  471. Dated thisffiVLdav of April 2016.
  472.  
  473. David Lucey WI Bar No. 1004129 Kristina J. Matic WI Bar No. 1076037 Thomas R. Dreblow WI Bar No. 1101818 FOLEY & LARDNER LLP 777 East Wisconsin Avenue Milwaukee, WI 53202-5306 414.297.5511 (DML)
  474. 414.297.4900 Facsimile Email: dlucey@foley.com
  475. David Lucey \Yfl5ar No. 1004129 Attorneys for iHaiat iff .North western Mutual Life Insurance Company
  476. 2
  477. FOLEY & LARDNER LLP
  478. WAGNERLAW
  479.  
  480. 839 North Jefferson Street Suite 400 Milwaukee, Wl 53202 1414-278-7000 f 414-278-7590 www.wagner-lawgroup.com
  481. GROUP, S.C.
  482. K. Scott Wagner
  483. 3231
  484. ksw@wagner-lawgroup.com
  485. May 4, 2016
  486. Clerk for the Honorable David A. Hansher Milwaukee County Courthouse 901 North 9th Street Milwaukee, WI 53233
  487. Re: The Northwestern Mutual Life Ins. Co. v. Stephen Clayton
  488. Milwaukee County, Case No. 16-CV-003234
  489. Dear Clerk,
  490. Enclosed for filing is an original Notice of Appearance in the above-referenced matter. Please file stamp the enclosed copy of the same and return it to me in the self-addressed and stamped envelope provided.
  491. Thank you for your attention to this matter.
  492. Very truly yours,
  493.  
  494. S'
  495. K. Scott Wagner
  496. AGF:trd
  497. Enclosures
  498. cc: David Lucey (via e-mail only)
  499.  
  500. THE NORTHWESTERN MUTUAL LIFE INSURANCE COMPANY,
  501. vs.
  502. Case No. 16-CV-003234
  503. Plaintiff,
  504. STEPHEN CLAYTON,
  505. Defendant.
  506. NOTICE OF APPEARANCE
  507. PLEASE TAKE NOTICE that we have been retained by and appear for the defendant, Stephen Clayton, in the above-entitled action, and we hereby demand that copies of all pleadings in this action be served upon us at our office, Wagner Law Group, S.C., c/o K. Scott Wagner and
  508. i
  509. Anne M. Plichta, 839 N. Jefferson Street, Suite 400, Milwaukee, WI 53202.
  510. Dated this 4lh day of May, 2016.
  511. WAGNER LAW GROUP, S.C.
  512. Attorneys for Defendant Stephen Clayton
  513. —
  514. K. Scott Wagner (SBN 1004668)
  515. Anne M. Plichta (SBN 1046849)
  516. Post Office Address:
  517. 839 North Jefferson Street, Suite 400 Milwaukee, Wisconsin 53202 Telephone: 414.278.7000
  518. Facsimile: 414.278.7590
  519. Email: ksw@wagner-lawgroup.com
  520. amp@wagner-lawgroup. com
  521. The Northwestern Mutual Life Insurance Company,
  522. Plaintiff,
  523. vs.
  524. Stephen Clayton,
  525. Case No. 16-CV-003234 Case Code: 30704
  526. Honorable David A. Hansher
  527. Defendant.
  528. STIPULATION AND ORDER EXTENDING TRO AND ENLARGING TIME
  529. The parties to this action, by their undersigned counsel of record, hereby stipulate
  530. as follows:
  531. 1. Defendant Clayton, through his undersigned counsel admits to receipt of personal service of the following documents in this case effective as of 9 p.m., Eastern Time, on May 2, 2016: (a) Summons, (b) Complaint, (c) Proposed Temporary Restraining Order and Order to Show Cause (as executed by the Court), (d) Motion for Temporary Restraining Order and Order to Show Cause, (e) Brief Supporting Motion for Temporary Restraining Order and Order to Show Cause, (f) Affidavit of Christian Wilhelm, (g) Affidavit of Troy Fluegge, and (h) Local Rule 3.13(A) Certification; and
  532. 2. The Court may enter the attached order without further notice.
  533. FOLEY & LARDNER LLP
  534. David Lucey
  535. Kristina J. Matic WI Bar No. 1076037 Thomas R. Dreblow WI Bar No. 1101818 FOLEY & LARDNER LLP 777 East Wisconsin Avenue Milwaukee, WI 53202-5306 414.297.5511 (DML)
  536. 414.297.4900 Facsimile Email: dlucey@foley.com
  537. David Lucey WI Bar MoT10j)4129 Attorneys for Plaintiff Northwestern Mutual Life Insurance Company
  538. Dated this day of May, 2016.
  539. WAGNER LAW GROUP, S.C.
  540. K. Scott Wagner WI Bnr/No. 1004668 Attorneys for Defendant Stephen Clayton
  541. K. Scott Wagner WAGNER LAW GROUP, S.C.
  542. 839 N. Jefferson St., #400
  543. Milwaukee, WI 53202
  544. 414.287.7000
  545. 414.278.7590 Facsimile
  546. Email: ksw@wagner-lawgroup.com
  547. ORDER
  548. Based on the foregoing stipulation, IT IS HEREBY ORDERED as follows:
  549. 2
  550. 1. The Temporary Restraining Order and Order to Show Cause entered by the Court on April 29, 2016 ("the TRO Order”) is hereby amended as follows and continued in force:
  551. a. The date in paragraph 2 of the TRO Order for Clayton to show cause why the Court should not enter an order further enjoining Clayton pursuant to section 813.08 of the Statutes is changed from May 5, 2016 at 9:30 a.m. to June 6, 2016 at 2 p.m.;
  552. b. The date in paragraph 3 of the TRO Order for Clayton to submit materials in response to the Order to Show Cause is changed from May 4, 2016 to May 23, 2016;
  553. c. The date in paragraph 3 of the TRO Order for Northwestern Mutual to submit response materials is changed from May 5, 2016 to June 3, 2016;
  554. 2. The TRO Order shall otherwise remain in effect until further order of this Court;
  555. 3. The parties shall participate in a telephone status report to the Court on May 13, 2016 at 9:30 a.m. Counsel for Northwestern Mutual shall initiate the call.
  556. Dated this day of May, 2016.
  557. BY THE COURT
  558. David A. l lansher, Circuit Judge Branch 42 3
  559. ATTORNEYS AT LAW
  560. ■FOLEY
  561. FOLEY & LARDNER LLP
  562. May 20, 2016
  563. 777 EAST WISCONSIN AVENUE MILWAUKEE, Wl 53202-5306 414.271.2400 TEL 414.297.4900 FAX www.foley.com
  564. WRITER'S DIRECT LINE 414.297.5511 dlucey®fol$y.com EMAIL
  565. CLIENT/MATTER NUMBER 059000-0271
  566. The Honorable David A. Hansher Circuit Judge, Branch 42, Room 412 Milwaukee County Courthhouse 901 North 9th Street Milwaukee, WI 53233
  567. Re: The Northwestern Mutual Life Insurance Company
  568. v. Stephen Clayton
  569. Milw. Cty. Circuit Court Case No. 16-CV-3234
  570. Dear Judge Hansher:
  571. Please find enclosed the original and copy of the Stipulation and Order Extending TRO and Enlarging Time.
  572. Very truly yours,
  573. If this stipulation and proposed order meet with your approval, kindly sign and enter the order and return a conformed copy to me in the enclosed, self-addressed, stamped envelope. Thank you for your consideration of this matter.
  574. BOSTON LOS ANGELES SACRAMENTO TALLAHASSEE
  575. BRUSSELS MADISON SAN DIEGO TAMPA
  576. CHICAGO MILWAUKEE SAN DIEGO/DEL MAR TOKYO
  577. DETROIT NEW YORK SAN FRANCISCO WASHINGTON. D.C.
  578. JACKSONVILLE ORLANDO SILICON VALLEY 4825-4048-4657,1
  579. The Northwestern Mutual Life Insurance Company,
  580. Case No. 16-CV-003234 Case Code: 30704
  581. Honorable David A, I-Iansher
  582. Plaintiff,
  583. vs.
  584. Stephen Clayton,
  585. Defendant.
  586. STIPULATION AND ORDER EXTENDING TRO AND ENLARGING TIME
  587. The parties to this action, by their undersigned counsel of record, hereby stipulate
  588. as follows:
  589. 1, As the parties advised the Court during a telephone status report on May 13, 2016, they have been working toward voluntarily resolving their disputes in the hopes of mooting the Plaintiff’s Motion for Temporary Restraining Order and Order to Show Cause, and that they believe that with additional time, the may be able to eliminate the need for a hearing before the Court;
  590. 2. The parties request the Court enter the attached order without further notice,
  591. FOLEY & LARDNER LLP
  592. By:
  593. Kristina J. Matic WI Bar No. 1076037 Thomas R, Dreblow Wl Bar No, 1101818 FOLEY & LARDNER LLP 777 East Wisconsin Avenue Milwaukee, Wl 53202-5306 414.297.5511 (DML)
  594. 414.297.4900 Facsimile Email: dlucey@foley.com
  595. Dated this day of May, 2016.
  596. WAGNER LAW GROUP, S.C.
  597. K. Scott Wagner WI Bar No. 1004668 Anne M, Plichta WI Bar No, 1046849 Attorneys for Defendant Stephen Clayton
  598. WAGNER LAW GROUP, S.C.
  599. 839 N. Jefferson St., #400
  600. Milwaukee, WI 53202
  601. 414.287.7000
  602. 414.278.7590 Facsimile
  603. Email: ksw@wagner-lawgroup.com
  604. ORDER
  605. Based on the foregoing stipulation, IT IS HEREBY ORDERED as follows:
  606. 1. The Temporary Restraining Order and Order to Show Cause entered by the Court on April 29, 2016, and as amended by the Court on May 5,
  607. 2
  608. continued in force:
  609. a. The date in paragraph 2 of the TRO Order for Clayton to show cause why the Court should not enter an order further enjoining Clayton pursuant to section 813,08 of the Statutes is changed from June 6, 2016 at 9:30 a,m. to July 26, 2016 at 2 p.m.;
  610. b. The date in paragraph 3 of the TRO Order for Clayton to submit materials in response to the Order to Show Cause is changed from May 23, 2016 to July 8, 2016;
  611. c. The date in paragraph 3 of the TRO Order for Northwestern Mutual to submit response materials is changed from June 3, 2016 to July 22, 2016;
  612. 2. The TRO Order shall otherwise remain in effect until further order of this Court;
  613. 3, The parties shall participate in a telephone status report to the Court on June 6, 2016 at 2:00 p,m. Counsel for Northwestern Mutual shall initiate
  614. the call,
  615. Dated this day of May, 2016,
  616. BY THE COURT
  617. David A. Hansher, Circuit Judge Branch 42 3
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!