Thomas Kiernan

Thomas Kiernan testified for the prosecution as the FBI computer scientist who seized and examined Ulbricht's running laptop. On Day 5, he described agents staging a distraction at the San Francisco library, preserving live access, photographing the screen and transferring the computer to Christopher Jon Beeson. He identified the Frosty account, an open conversation with the undercover account Cirrus and browser pages displaying Dread Pirate Roberts. He explained how he verified a working copy of the forensic image with matching hashes.

His file comparisons addressed the prosecution's effort to connect the laptop to Silk Road and DPR. Kiernan identified website files, messaging instructions and a public key corresponding to the DPR key. On Day 6, he described using a password found on the laptop to decrypt two active files on a thumb drive recovered from Ulbricht's residence. He distinguished older versions from later laptop files, including a log whose laptop version contained additional entries. Howard read recovered journals, chats and financial records during the examinations; those writings were not Kiernan's firsthand account of operating Silk Road. Dratel disputed attributing everything on the laptop to Ulbricht, and the court left alleged defendant statements subject to connection.

On cross-examination, Dratel tested the foundations of Kiernan's analysis and the distinction between stored material and its authorship. Kiernan acknowledged that he had not participated in Beeson's imaging, that timestamps and chat text were editable, and that he did not know whether his Tor chat test matched Ulbricht's software version or installation method. He maintained that the hashing methods were very reliable and explained that ordinary BitTorrent sharing did not provide unrestricted computer access. The questioning did not establish actual remote intrusion or alteration of the recovered files. The court also barred him from interpreting what chat writers intended.

On redirect, Kiernan said none of the files admitted during his direct examination were in BitTorrent's configured download folder and confirmed that the introduced chats came from Ulbricht's computer. He testified that closing the encryption-enabled laptop would have blocked access to the chat files, but on recross acknowledged that he had not closed it and lacked personal knowledge of what would have happened. He also acknowledged that downloads could contain malware. During further redirect, he confirmed that he had reviewed the computer for malware, but Howard withdrew the question about what he found after the court noted its earlier restriction on defense questioning.