Category: Cybersecurity Expert Witness

  • Healthcare Expert Not Allowed to Opine on Information Blocking

    Healthcare Expert Not Allowed to Opine on Information Blocking

    Intus and RTZ both work with Program of All-Inclusive Care for the Elderly (“PACE”) facilities, which provide care to elderly patients who live in non-institutional settings in the community. RTZ developed the PACECare software system and licenses it to PACE facilities to help manage data, including patients’ electronic health information (“EHI”). Some PACE facilities also contract with Intus, which designed a product to analyze data from patients’ electronic health records to help identify risks and improve care.

    The parties dispute whether RTZ has improperly blocked Intus’ access to data, including EHI, contained in PACECare. Intus asserts three claims for relief: intentional interference with contractual relations; intentional interference with prospective economic advantage; and violation of California’s unfair competition law (“UCL”).

    Its UCL claim is based on its contention that RTZ unlawfully engaged in “information blocking,” in violation of the 21st Century Cures Act and its implementing regulations.

    RTZ has asserted four counterclaims: violation of the California Comprehensive Computer Data Access and Fraud Act; violation of the Computer Fraud and Abuse Act; trespass to chattels; and violation of the UCL.

    RTZ Associates, Inc. sought to exclude the testimony of Intus’ experts, Shawn Fleury and Dr. Kristopher Hult while Intus sought to exclude the testimony of RTZ’s experts, Traci Creegan and Peter Schwechheimer.

    Economics Expert Witnesses

    Dr. Kristopher J. Hult received a Ph.D., M.A., and B.A. in Economics from the University of Chicago, and a B.S. in Mathematics from the University of Chicago.

    Hult’s areas of expertise are in the economics of antitrust, competition, industrial organization, and healthcare.

    Get the full story on challenges to Kristopher Hult’s expert opinions and testimony with an in-depth Challenge Study.

    Peter Schwechheimer is an economic consultant and testifying expert with nearly three decades of professional experience in the economics of intellectual property, antitrust, commercial damages, transfer pricing, and technology licensing including the licensing of standard essential patents (SEPs).

    Gain a comprehensive understanding of Peter Schwechheimer’s qualifications and casework history with his Expert Witness Profile report.

    Cybersecurity Expert Witness

    Shawn R. Fleury is a cybersecurity expert with approximately twenty-nine (29) years of risk management, incident response, and consulting experience.

    Want to know more about the challenges Shawn Fleury has faced? Get the full details with our Challenge Study report.

    Healthcare Expert Witness

    Traci Creegan has over twenty-five years of healthcare and management experience focused on health information technology (IT) and regulatory compliance.

    Get the full story on challenges to Traci Creegan’s expert opinions and testimony with an in-depth Challenge Study.

    Discussion by the Court

    Traci Creegan

    Intus sought to exclude Traci Creegan, one of RTZ’s experts, from offering four opinions relating to liability: “1) that RTZ is not an actor under the Cures Act, 2) that RTZ did not violate the Cures Act [by engaging in information blocking], 3) that the manner exception applies to RTZ’s conduct, and 4) that Intus departed from industry standards.”

    The parties dispute whether the Court has already decided that RTZ is an actor under the Cures Act and that RTZ engaged in information blocking. The Court did not decide the former, but it did decide the latter.

    As a result, Creegan’s testimony on whether RTZ engaged in information blocking is excluded because that issue is “deemed established for purposes of the trial of the case.”

    Analysis

    In addition, her opinion on that question, as well as her opinions that RTZ is not an actor and that the manner exception applies, is improper expert testimony because an expert witness cannot give an opinion as to her legal conclusion, i.e., an opinion on an ultimate issue of law.

    In this case, Creegan opined that “RTZ is not ‘an actor’ subject to the information blocking regulations”; that “RTZ’s conduct did not constitute information blocking as defined by federal regulation”; and that “even if RTZ’s conduct could be construed as information blocking, which it was not, the circumstances satisfy the factual conditions of the Manner Exception.”

    These opinions are improper expert testimony. According to the Court, whether RTZ is liable for violating the information-blocking provisions of the Cures Act—including whether RTZ is a covered “actor” and whether an exception applies—is for the jury to decide.

    Creegan may, however, testify as to industry standards and whether the parties complied with them. Such testimony does not improperly embrace the ultimate issues the jury must decide.

    Intus argued that Creegan’s opinions on industry standards are irrelevant, but that is incorrect. To determine whether the manner exception applies, the jury will need to consider whether RTZ made “at least some reasonable efforts” to reach an agreement with Intus to share information.

    Whether the parties complied with industry standards bears on that question and is therefore relevant.

    As a result, Creegan may not testify that RTZ is not an actor under the Cures Act; that RTZ did not engage in information blocking as defined in the Cures Act; or that, even if RTZ did engage in information blocking, the manner exception applies to RTZ’s conduct. However, Creegan may testify on compliance with industry standards.

    Shawn Fleury

    Although RTZ correctly observed that much of this testimony interprets email correspondence that presumably will be before the jury, it also opined on how the requests expressed in the emails relate to standard industry practice.

    RTZ is incorrect when it argued that Fleury’s opinions “would not assist the jury’s understanding.” Intus is entitled to present Fleury’s testimony to counter Creegan’s testimony regarding industry standards. To the extent RTZ disagreed with Fleury’s reading of the email correspondence, it is free to challenge Fleury’s interpretations on cross-examination.

    Fleury stated, “The email notes that Medications are included under the Patient data that is being requested, which likely corresponds to the ‘redirect.main.meds.new’ module. As such, Creegan’s opinion that this module falls outside of the request is unsupported and factually incorrect.” He continued, “Also significant is the inclusion of the abbreviation ‘etc.’ in the requirements, which indicates that additional data elements may be necessary to complete [Intus’s] responsibilities to its customer.”

    Fleury has no basis for opining on what “etc.” in an email not written by him might refer to. Moreover, he testified at his deposition that he was “not trying to interpret what other data elements [the author of the email] could have meant by having et cetera in there.”

    However, the Court found no basis to exclude the remaining paragraphs in this section of Fleury’s report. RTZ did not argue, for example, that it is improper for Fleury to comment on “the number of times that certain modules were accessed by Intus’ assigned accounts” to conclude that he “would expect a higher volume of audit log entries if there was systematic data mapping occurring by Intus,” or to opine that the audit logs contain no evidence “that Intus exceeded the permissions of the accounts which had been provisioned by RTZ.”

    Kristopher Hult

    Hult bases his analysis on his “understanding that starting in September 2022, RTZ refused to allow Intus access to the electronic medical records (EMR) data stored in RTZ’s PACECare and later prohibited Intus’s clients from providing access to Intus.”

    He stated that his “calculations can be adjusted should the finder of fact determine an alternative appropriate timeframe.”

    RTZ did not challenge Hult’s economic expertise or the economic principles that he applies, but it did challenge the factual bases for some of his opinions.

    RTZ argued that Hult’s testimony incorrectly assumes that any information blocking started in September 2022, when RTZ sent Intus a cease-and-desist letter, even though Intus acknowledged in discovery responses that it continued to log in to PACECare after that date. Hult testified at his deposition that the relevant question is whether Intus had “a loss of access that affected their ability to perform their services,” and not whether Intus had “no access to data.”

    RTZ disputes the factual basis for Hult’s testimony, but that does not render Hult’s opinions unreliable. If the jury agrees with RTZ’s interpretation of the facts and concluded that Intus still had access to data after September 2022 that was sufficient for Intus to perform its services, then it can discount Hult’s testimony accordingly.

    Although RTZ has presented reasons why a jury might discount the weight of Hult’s opinions, whether to credit his testimony is for the jury to decide. The Court is satisfied that Hult’s testimony is admissible under Rule 702 and denied RTZ’s motion to exclude it.

    Peter Schwechheimer

    Intus sought to exclude Schwechheimer’s opinions regarding RTZ’s damages if RTZ were to prevail on its counterclaims. Schwechheimer opined on the “economic damages resulting from Intus’ unauthorized access to and use of RTZ’s PACECare software,” providing one figure for June 2021 through December 2024 and a second figure if the jury were to determine that the unauthorized access continued through at least December 2025.

    He opined that Intus “was unjustly enriched by its ongoing system access to RTZ’s PACECare software,” and that this “would likely manifest in a shorter development cycle, accelerated market entry, and additional venture capital funding.”

    Some of Intus’s criticisms of Schwechheimer’s testimony go to weight and not admissibility. For example, Intus argues that Schwechheimer improperly attributes lost profits to RTZ based on contracts that Intus contends were acquired by Collabrios Health. However, as the Court has previously observed, Intus has cited no “evidence that [Schwechheimer’s] report characterizes the contracts as belonging to or having been assigned to Collabrios.”

    Intus’s remaining challenges do go to admissibility, and the Court accordingly excluded portions of Schwechheimer’s testimony. First, Schwechheimer may not testify about the classification by Laura Emery, Senior Product Manager at Collabrios, of various PACECare modules accessed by Intus as High, Medium, or Low, with High modules being ones “that provided insight into PACECare’s organizational structure and/or included features or functions common to standard EHR software.” Second, Schwechheimer may not testify that accessing PACECare allowed Intus to develop CareHub on an accelerated schedule. Third, Schwechheimer may not testify about Intus’ raising of capital. Finally, Schwechheimer may not testify about what the law requires, including that disgorgement of profits is an available remedy under the California Comprehensive Computer Data Access and Fraud Act.

    Held

    In sum, the Court denied the motion to exclude the testimony by Kristopher Hult. It granted in part and denied in part the motions to exclude testimony by Traci Creegan, Shawn Fleury, and Peter Schwechheimer.

    Key Takeaway

    The Court’s role at this stage of the proceedings is not “to engage in freeform factfinding, to select between competing versions of the evidence, or to determine the veracity of the expert’s conclusions.”

    Instead, the Court “is to determine the scientific validity of an expert’s principles and methodology, not to determine whether their hypothesis is correct, or to evaluate whether it is corroborated by other evidence on the record. That is for the litigants to argue, and for the jury to decide.” 

    Case Details:

    Case Caption: Intuscare, Inc. V. Rtz Associates, Inc.
    Docket Number: 4:24cv1132
    Court Name: United States District Court, California Northern
    Order Date: July 08, 2026
  • Cybersecurity Expert Not Allowed to Opine on ADA Compliance Requirements

    Cybersecurity Expert Not Allowed to Opine on ADA Compliance Requirements

    In May 2025, Plaintiff Richard Paul Merrell filed the operative putative class action complaint against Defendant Ralph Lauren Corporation. Plaintiff is visually impaired and legally blind, and he uses screen-reading software to read website content using his computer.

    Screen-reading software (or a “screen reader”) allows blind and visually impaired users to access websites using a combination of a keyboard and “software that vocalizes the visual information found on a computer screen.”

    Plaintiff alleged that Defendant’s website, including but not limited to https://www.ralphlauren.com/, “is not fully or equally accessible to blind and visually impaired consumers.”

    According to Plaintiff, “Defendant’s failure to properly code its website” to be accessible means that he and other class members “have been and are still being denied equal and full access to Defendant’s retail stores and the numerous goods, services, and benefits offered to the public through Defendant’s website in conjunction with Defendant’s brick-and-mortar retail store locations.”

    Defendant filed motions to exclude the testimony of Plaintiff’s experts, Dr. Jon A. Krosnick and Dr. William C. Easttom, II. Plaintiff filed a motion to exclude the testimony of Defendant’s expert, Aaron Cannon.

    Psychology Expert Witness

    Jon Alexander Krosnick is a Stanford professor and a research psychologist at the U.S. Census Bureau with a degree in psychology from Harvard University and an M.A. and Ph.D. in social psychology from the University of Michigan.

    He has taught classes and trainings on research methods, received awards for research and psychology, authored or co-authored hundreds of articles and presentations, and otherwise conducted extensive research on survey research methods.

    Want to know more about the challenges Jon Krosnick has faced? Get the full details with our Challenge Study report.

    Cybersecurity Expert Witness

    Dr. William Charles Easttom, II has Ph.Ds in technology and computer science, a Doctor of Science in cyber security, and multiple related master’s degrees. He has authored 44 computer science books and dozens of research papers and is an inventor of 27 computer science patents. He is as an adjunct lecturer at Georgetown University and Vanderbilt University. 

    Easttom has published three books specifically on JavaScript (a coding language for web development), holds a Certified Professional in Accessibility Core Competency certification, and has taken two accessibility courses.

    Get the full story on challenges to William Easttom’s expert opinions and testimony with an in-depth Challenge Study.

    Web Accessibility Expert Witness

    Aaron Cannon has “been working in the field of web and mobile app accessibility for over seventeen years and [has] been developing software for twenty-nine years.” He is a “Certified Professional in Web Accessibility” and holds multiple accessibility-related certificates.

    Cannon is totally blind and has been using screen readers since 1988, including JAWS for Windows, NVDA, TalkBack, VoiceOver, and the Orca screen reader. He also co-founded and served as chief accessibility officer for a company that provided accessibility auditing of websites and mobile apps. 

    Discover more cases with Aaron Cannon as an expert witness by ordering his comprehensive Expert Witness Profile report.

    Discussion by the Court

    A. Dr. Jon A. Krosnick

    Based on his review of the complaint, literature and documentation about methodologies employed in past surveys of blind people, past surveys of visually impaired people, studies of accessibility challenges faced by blind people when using computers, and other information, Krosnick conducted a survey and concluded that “the number of legally blind people living in California who used a screen reader and were prevented from doing business with a physical store due to problems related to accessibility with the Ralph Lauren webpage is 3,243.”

    Defendant argued that Krosnick’s testimony should be excluded in full because (1) his opinions are unreliable and not based on sufficient facts or data; (2) his survey results are inadmissible hearsay; and (3) his survey is irrelevant and will not help the trier of fact.

    Analysis

    First, Defendant argued that Krosnick’s survey did not use a random probability sample and instead “recruited non-representative survey respondents from Facebook groups for visually impaired people.” But Krosnick made clear that he combined a primarily randomized probability sample with some respondents from Facebook groups oriented toward visually impaired people, and that this kind of “blended” probability sample “is a widely accepted practice in contemporary survey science.”

    Defendant also contended that Krosnick’s survey had a low response rate, leading questions, self-interest bias, recall bias, and a lack of verification of unreliable answers.

    The Court also is not persuaded that the survey involved leading questions or self-interest bias just because it asked participants if they wanted to “help improve the experiences of blind people using the Internet,” and then listed potential problems the respondents may have experienced.

    Even if the survey’s wording did implicate some level of bias, this would not be so substantial as to render the survey unreliable.

    B. Dr. William C. Easttom, II

    Despite his extensive background, Defendant argued that “Easttom is not qualified to opine on website accessibility,” since general education in computer science is not interchangeable with competence in website accessibility. Even if Easttom has a relatively limited amount of experience with website accessibility, he plainly is an expert on website design and computer science, and the Court is not persuaded that his extensive background is insufficient to qualify him as an expert.

    Defendant also argued that Easttom’s testimony should be excluded in full because (1) his report relied on the wrong website; (2) his methodology is unreliable; and (3) he impermissibly offers legal conclusions.

    Analysis

    First, Defendant argued that Easttom failed to test a screen reader version of its website, “despite being prompted to enable accessibility features.”

    The fact that Easttom didn’t test an alternative, enhanced version of the website may undercut the weight of his methodology or Plaintiff’s claims against Defendant, but it did not render Easttom’s opinions completely irrelevant or unreliable.

    Methodology

    Second, Defendant raised various attacks on Easttom’s methodology, including that Easttom (1) did not use two tools he used in another case and (2) makes a “huge inferential leap” that Defendant denied access to its goods and services from the fact that the store locator wasn’t rendered as a clickable website attribute.

    First, any questions about the tools used go to weight, rather than admissibility. Second, the Court disagreed that Easttom’s conclusions are that large of an inferential leap, or that they are irrelevant to answering the question of whether Defendant’s website violated the ADA. And to the extent another expert said that visually impaired customers could locate Defendant’s brick-and-mortar stores through its website, that is a battle of the experts to be resolved by the trier of fact.

    Legal Conclusions

    Third, Defendant argued that Easttom improperly offered legal conclusions. In particular, Defendant took issue with Easttom’s statements suggesting that Ralph Lauren’s website is not ADA compliant.

    The Court agreed with Defendant: Easttom’s opinion and testimony that Defendant’s website did not meet ADA compliance requirements, is an improper legal conclusion, and the Court granted the motion as to these opinions.

    However, one of the purported “legal” conclusions is actually a conclusion about whether Defendant’s website complies with the Web Content Accessibility Guidelines (“WCAG”), which are “a set of international standards designed to make web content more accessible.” This is not a legal conclusion just because Easttom made reference to tools that are used for scanning ADA compliance.

    Fourth, Defendant argued that Easttom “conflates Ralph Lauren’s alleged non-compliance with WCAG 2.1 AA guidelines, and alleged non-compliance with the ADA,” and “there is no authority at all for the proposition that websites must comply with the WCAG guidelines.”

    Reliability

    Finally, Defendant argued that Easttom improperly used the Internet Wayback Machine to determine if historical versions of Defendant’s website were inaccessible because the Wayback Machine does not necessarily include full JavaScript functionality and may “not allow a user to evaluate [a website’s] full functionality.” These critiques—and critiques about the sample of Wayback Machine pages that were chosen—go to weight and do not fundamentally undermine the reliability of the opinion. This is especially true where, as here, Defendant has offered no reason to believe that these individual webpages had missing JavaScript functionality.

    C. Aaron Cannon

    Plaintiff first argued that portions of Cannon’s declaration should be excluded as untimely. Plaintiff sought exclusion under Federal Rules of Civil Procedure 26 and 37

    Rule 26

    Defendant argued that Cannon disclosed that he had new opinions in his deposition, yet Plaintiff “did not question him about those additional opinions.”

    The Court found that Defendant has not shown harmlessness. Defendant’s argument appears to be that Plaintiff’s counsel should have pushed harder at the deposition, ignoring the fact that Cannon evasively and vaguely mentioned he had some unspecified other opinions, but would not explain what they were. This is especially true where Defendant had already asserted that it would not disclose its rebuttal opinions to Easttom’s report, which it did not perceive to be related to class certification. As a result, the Court rejected Defendant’s suggestion that Plaintiff had the same “free rein” to get additional discovery on these untimely opinions as in Defendant’s cited cases.

    Defendant’s other arguments regarding a lack of prejudice or surprise are unpersuasive. Defendant summarily stated that Plaintiff only cites a “single distinguishable case” supporting his claims of prejudice, and “Plaintiff has also not identified any additional expenses caused by Defendant’s alleged failure to disclose, because there is none.” This flips the burdens: it is Defendant’s burden to demonstrate harmlessness or substantial justification, and it has not done so. Accordingly, the Court will strike the identified portions of Cannon’s declaration, though those portions would have been irrelevant to the remainder of the Court’s order here.

    Rule 702

    Plaintiff next argued that Cannon’s testimony should be excluded in full because (1) his opinions are not based on sufficient facts or data; (2) he did not apply a reliable, testable method to the case; (3) his class certification opinions are unhelpful; (4) his opinions offer impermissible legal conclusions; and (5) he is not qualified to offer “socioeconomic and population-level opinions or reliability engineering opinions.”

    In particular, Plaintiff first argued that Cannon’s opinion should be excluded because he did not “gather any site-specific facts about Ralph Lauren’s website” and instead “offered generalized assumptions based on experience, which Rule 702(b) does not permit.”

    The Court found that Cannon’s opinions about what individualized technical problems may impede a user with a screen reader from accessing a website are adequately based upon his extensive personal knowledge and experience. To the extent Plaintiff believes Cannon’s testing was flawed or didn’t consider enough data or site-specific information, those critiques go to weight, not admissibility.

    The same is true for Plaintiff’s arguments that Cannon did not deploy a reliable methodology.

    Cannon is applying his extensive experience with accessibility-related software and screen readers to make high-level observations about, for example, the differences in hardware, operating systems, and screen reader software, in order to explain why this Court would have to engage in individualized inquiries about each class members’ experience.

    The Court also disagreed that Cannon’s opinions “substitute legal judgment for technical analysis.” The fact that Cannon is identifying individualized issues in a user’s experience with accessibility features—a central part of the predominance inquiry—did not mean that he is impermissibly making legal conclusions.

    Held

    • The Court denied the motion to exclude the testimony of expert Dr. Jon A. Krosnick.
    • The Court granted in part and denied in part the motion to exclude the testimony of William C. Easttom.
    • The Court granted in part and denied in part the motion to exclude the testimony of Aaron Cannon.

    Key Takeaway

    When evaluating specialized or technical expert opinion testimony, the relevant reliability concerns may focus upon personal knowledge or experience.

    Case Details:

    Case Caption: Merrell V. Ralph Lauren Corporation
    Docket Number: 4:23cv6669
    Court Name: United States District Court, California Northern
    Order Date: July 09, 2026
  • Cybersecurity Expert Allowed to Opine on the Functionality of the Software Tools

    Cybersecurity Expert Allowed to Opine on the Functionality of the Software Tools

    This case arises from Plaintiff Cox Automotives, Inc’s (“Cox”) allegations that Defendant Super Dispatch Inc. (“Super Dispatch”) has committed false advertising, unfair competition, and other business torts against Cox.  Super Dispatch denied the allegations.

    Cox retained an expert in computer security, Dr. Micheal Bailey (1) to evaluate the cybersecurity measures Cox employed to protect its Central Dispatch platform; and (2) to analyze the functionality of the software tools that Super Dispatch uses to interact with Central Dispatch. Super Dispatch filed a motion to strike the first category of testimony on the basis that it will not be helpful to the jury, is based on insufficient facts, and his evaluation is conclusory. With respect to the second category, Super Dispatch argued that the functionality of the software tools is “a factual inquiry” that did not require expert testimony.

    Defendant Super Dispatch Inc. filed a motion to exclude the testimony of Bailey.

    Cybersecurity Expert Witness

    Micheal Donald Bailey currently serves as a Professor and School Chair in the School of Cybersecurity and Privacy at the Georgia Institute of Technology.

    He received a Ph.D. in Computer Science from the University of Michigan, a Master of Science degree in Computer Science from DePaul University, and a Bachelor of Science in Computer Science from the University of Illinois.

    Get the full story on challenges to Micheal Bailey’s expert opinions and testimony with an in-depth Challenge Study.

    Discussion by the Court

    With respect to Bailey’s testimony about Cox’s cybersecurity measures, one of the issues in this case is whether Super Dispatch violated Missouri
    Uniform Trade Secrets Act (“MUTSA”).

    As an expert in computer security, Bailey’s testimony will help the jury understand industry practices for protecting electronic data and the
    types of controls put in place by Cox. Moreover, Bailey’s evaluation was guided by three widely recognized cybersecurity frameworks and included interviews with a knowledgeable Cox witness, direct interaction with the Central Dispatch platform, and review of relevant documentation. Based on those assessments, Bailey evaluated whether the cybersecurity measures in place for Central Dispatch are consistent with recognized guidelines and industry expectations.

    Analysis

    The Court held that his testimony is not conclusory in any sense of the word. It is based on substantive analysis as demonstrated by his report. However, Bailey may not testify that Cox’s efforts to maintain the secrecy of information in the Central Dispatch were reasonable under MUTSA—an issue reserved for the jury—but he may testify that they were consistent with respect to industry expectations, standards, and guidelines.

    Moreover, the functionality of the tools Super Dispatch used to interact with Central Dispatch, e.g., the digital “scraper” that Super Dispatch allegedly used to mine information behind Central Dispatch’s paywall without authorization, underlies all of Cox’s claims. The Court held that Bailey’s testimony will help the jury understand how these tools operate. Thus, his testimony is relevant.

    His analysis includes source code where available (i.e., scraper and Chrome extension), direct interaction where available (i.e., Chrome extension), and review of relevant documentation and testimony.

    Finally, the Court rejected Super Dispatch’s suggestion that its access of the Central Dispatch platform is a “factual inquiry” that should only be presented to the jury through “fact witnesses with personal knowledge.” This argument misconstrues one of the roles of expert testimony: to help the trier of fact understand the evidence.

    Held

    The Court granted in part and denied in part the Defendant Super Dispatch Inc.’s motion to exclude the testimony of Dr. Michael Bailey. 

    Key Takeaway:

    Evidence regarding the software tools that Super Dispatch used to access Central Dispatch will involve highly technical subject matter, including source code, the operation of browser extensions, the use of an App to extract data from a third-party website, and two techniques for using automated means to post information to a third-party website. Expert testimony on these complex technical issues will be helpful to the jury.

    Case Details:

    Case Caption: Cox Automotive Inc. V. Super Dispatch Inc.
    Docket Number: 4:24cv292
    Court Name: United States District Court, Missouri Western
    Order Date: November 11, 2025