Brian Shaw

Brian Shaw testified for the prosecution on Day 9 and Day 10 about his analysis of seized-server copies and reconstruction of Silk Road. An information-security engineer and FBI contractor, he described matching MD5 and SHA1 hashes and rebuilding the website on an isolated computer using recovered databases, images, and code. He created the FBINY account to obtain screenshots. The court admitted screenshots over defense objections, but the advertised offerings did not establish completed sales or that sellers' claims were accurate. In his testing, the Dread Pirate Roberts account could access the Mastermind page, while several other tested accounts could not.

Shaw explained how database records connected messages with usernames. He compared jurisdictions requested in identification-document messages with nine photographed IDs and matched identifying information in other messages with a log Howard identified as recovered from Ulbricht's computer. Howard read correspondence attributed to DPR and other accounts, including threats and proposed killings. Shaw matched payment details to blockchain transfers of 1,670 bitcoins on March 31, 2013, and 3,000 bitcoins on April 8, 2013. These were account records, not Shaw's firsthand observations of the underlying events. The court admitted a stipulation that Canadian authorities had no records of the specified homicides or other evidence of physical harm resulting from the discussed plans.

His transaction summaries reported 1,530,252 transactions, $213,888,103 in recorded sales, and $13,174,896 in recorded commissions. He explained that the dollar figures summed transaction-time values stored in the database, rather than applying a later bitcoin price. His proposed drug-weight calculations faced separate foundation challenges. After considering possible admission with additional explanation, data production, and cross-examination, the government declined to proceed, and the court confirmed that both estimates remained excluded.

On cross-examination, Shaw acknowledged limits on connecting technical access to personal identity. He agreed that the frosty@frosty key label could be generated on any computer, did not know the key file's earlier contents, and had not verified whether DPR's credentials were encrypted. He could not determine whether four named accounts represented different people or the same people. He also approximately agreed that uncategorized transactions constituted 11 or 12 percent of transactions and were omitted from the pie chart.

On redirect, Shaw clarified that Exhibit 936 combined one public forum post with private messages from two database sources. He distinguished uses of hashing and defended MD5 for checking whether files changed in transit. On recross, he described SHA1 as newer and without the same weakness as MD5, and confirmed that the exhibit's blue and white sections represented separate conversations.