5.Brian Shaw — Cross/Redirect/Recross (Part 4)
392 linesCROSS EXAMINATION BY MR. DRATEL:
MR. DRATEL: Good afternoon, Mr. Shaw.
BRIAN SHAW: Good afternoon.
MR. DRATEL: I want to go back to Government Exhibit 901 which you testified about on Thursday with respect to an SSH key.
BRIAN SHAW: Yes. Okay.
MR. DRATEL: And that's in evidence and there were two SSH keys on the Silk Road server, correct?
BRIAN SHAW: Correct.
MR. DRATEL: And there was one ending in frosty@frosty and one ending in root@bcw, right?
BRIAN SHAW: Correct.
MR. DRATEL: And an SSH key essentially allows someone to have remote administrative access to a computer server?
BRIAN SHAW: Correct.
MR. DRATEL: And by administrative access that means total control over the site, right? Through those keys?
BRIAN SHAW: Correct.
MR. DRATEL: Not just general administrative access but through these SSH keys, correct?
BRIAN SHAW: Correct. In this case, correct.
MR. DRATEL: So, an individual gaining access through those SSH keys would be able to review and change any information in the server, correct?
BRIAN SHAW: The database had its own authentication which would be separate, but otherwise, correct.
MR. DRATEL: And anyone getting in through that SSH key would be able to obtain information that's logged within the database or on the server, correct?
BRIAN SHAW: Again, the database had its own authentication, but yes, correct.
MR. DRATEL: And that would include they could get login and password information for the Dread Pirate Roberts account, right?
BRIAN SHAW: Depends on which -- what you mean by password information. Passwords are typically stored encrypted.
MR. DRATEL: Well, but typically, but do you know?
BRIAN SHAW: I'm sorry?
MR. DRATEL: Do you know though, with respect to that? With respect to the server?
BRIAN SHAW: It is the default for the ubuntu which the server was.
MR. DRATEL: Do you know?
BRIAN SHAW: And then for the --
MR. DRATEL: The question is do you know.
BRIAN SHAW: Can you rephrase your question, please?
MR. DRATEL: Sure.
You said that typically such information would be encrypted. Do you know for a fact whether that information, DPR's password and login information on the server, was encrypted?
BRIAN SHAW: I have not verified that.
MR. DRATEL: Now, so, by the way, with respect to, you had, on Government Exhibit -- the mastermind page for the server, right?
BRIAN SHAW: Yes.
MR. DRATEL: And if you log in as Dread Pirate Roberts that automatically comes up, correct?
BRIAN SHAW: No, it does not. It depends which page you come from. There are two login pages.
MR. DRATEL: So which login page does it come up on automatically?
BRIAN SHAW: There was a special support admin login page.
MR. DRATEL: For the support admin page, right?
BRIAN SHAW: Correct.
MR. DRATEL: And you testified Thursday that you used both an MD5 hash value and an SHA 1 -- you call it a SHA 1 or SHA?
BRIAN SHAW: Shah 1.
MR. DRATEL: So, MD5 hash and Shah 1 hash value to confirm the copies of the server that you viewed, right?
BRIAN SHAW: Correct.
MR. DRATEL: And you did that to ensure that you were looking at the same data that was on the original that you had imaged on a copy?
BRIAN SHAW: Correct.
MR. DRATEL: There was a reason -- withdrawn.
You used both the MD5 hash and the Shaw 1 hash because you wanted to be thorough and you wanted to be as -- you want to be as reliable as possible, right?
BRIAN SHAW: It was the default setting for the tool that I used so it automatically calculated both for verification.
MR. DRATEL: But it calculates both but you matched both, right?
BRIAN SHAW: That's correct.
MR. DRATEL: That's not always -- you don't have to match both, you decided to match both, right?
BRIAN SHAW: Yes, I did match both.
MR. DRATEL: Not because you wanted to be forensically sound in your analysis, right?
BRIAN SHAW: Sure.
MR. DRATEL: That's because MD5 hashes have some vulnerability, correct?
BRIAN SHAW: Depends on the use case.
MR. DRATEL: But you use a SHA 1 because that has more reliability, right?
BRIAN SHAW: Again, depends on the use case.
MR. DRATEL: But you did it in this case, correct?
BRIAN SHAW: Because it was available to me, yes.
MR. DRATEL: Now, going back to Government Exhibit 901 and looking at the key that ends the SSH key which we were just talking about -- let me know when you get there.
BRIAN SHAW: Thanks.
MR. DRATEL: Looking at the key that ends in frosty@frosty and you testified Thursday, I think, that the user name frosty and the computer name "frosty" that are found in the SSH key are taken from the system that you are coming from?
BRIAN SHAW: That's correct.
MR. DRATEL: Well, the part of the key that contains frosty@frosty is what is called a comment, right?
BRIAN SHAW: I don't know that for sure.
MR. DRATEL: Well, you can generate a key ending in frosty@frosty from my computer, right? You can do it at any computer, can't you?
BRIAN SHAW: That is correct.
MR. DRATEL: Are you familiar with the program called SSH- -- withdrawn.
And you also talked a little bit about on direct on how SSH keys work, right?
BRIAN SHAW: Correct.
MR. DRATEL: And you are familiar with how they're generated?
BRIAN SHAW: Yes.
MR. DRATEL: And you have a lot of background and training in UNIX and Linux programs, the two computer systems, right?
BRIAN SHAW: I have experience at both, yes.
MR. DRATEL: And you are familiar with the manual pages associated with computer programs contained in UNIX-based operating systems like Macrolex or Linux?
BRIAN SHAW: Yes.
MR. DRATEL: And these manuals contain documentation for how the software works, right?
BRIAN SHAW: Correct.
MR. DRATEL: And they're widely accepted in the community as being reliable authority on how computer programs contained in a UNIX-based operating system work, right?
BRIAN SHAW: As long as updated, yes.
MR. DRATEL: And if you look at 901, that's a file called authorized keys, right?
BRIAN SHAW: Correct.
MR. DRATEL: And that file is associated with a computer program called SSHD or open SSH Daemon, right?
BRIAN SHAW: I believe that is correct.
MR. DRATEL: And are you familiar with the system manager's manual for that computer program SSHD?
BRIAN SHAW: I have not reviewed that manual, no.
MR. DRATEL: Isn't the comment field not used for anything other than the convenience of the user to identify the key?
BRIAN SHAW: Again, I don't know if that is referred to as a comment field or not. I have not reviewed the page on that.
MR. DRATEL: With respect to the Silk Road market server image that you worked on, right?
BRIAN SHAW: Yes.
MR. DRATEL: There was an image of the server captured October 8, 2013; correct?
BRIAN SHAW: Correct.
MR. DRATEL: And you received the Silk Road marketplace server by recreating a local copy of the server on your computer, right?
BRIAN SHAW: Correct.
MR. DRATEL: And just for purposes of shorthand, that was the server ending in the IP address, last two digits .49, right?
BRIAN SHAW: I don't remember the IP address off the top of my head.
MR. DRATEL: Let's look at 603A -- Government Exhibit 603A.
This is the image that you used to create a local copy of the Silk Road marketplace on your computer, right? In other words this is the log entry?
BRIAN SHAW: That looks familiar. Correct.
MR. DRATEL: And if you look at the created date on the top -- I'm sorry, on the left as you go down it says: Task, status and created date is Tuesday, October 8, 2013, right?
BRIAN SHAW: That's what it says. Yes.
MR. DRATEL: And the image that you get is essentially -- not essentially, the image that you get is a snapshot of what exists on the computer at that moment in time, right?
BRIAN SHAW: Correct.
MR. DRATEL: Now, I want to direct your attention back to Government Exhibit 936, please. If we look at the third entry in the second paragraph, the one that begins on March 14, 2013 at 11:26, right?
BRIAN SHAW: Okay.
MR. DRATEL: If you look at the second paragraph of that and at first it says -- it says it is from friendlychemist:
"u dont know me but i am lucydrops supplier. the only reason i lent lucydrop so much product is bcuz he showed me the chat logs of u and him talking and how u made him the #1 seller on silkroad."
Now, do you know whether that is accurate or not, that statement?
MR. HOWARD: Objection.
THE COURT: Overruled.
BRIAN SHAW: I do not know.
THE COURT: I take it by that you mean did he see it, a reference to that elsewhere?
MR. DRATEL: Right.
THE COURT: Was that the question?
MR. DRATEL: Yes, your Honor.
THE COURT: Is that how you understood the question?
BRIAN SHAW: Yes.
THE COURT: Yes?
BRIAN SHAW: Yes.
THE COURT: All right.
BY MR. DRATEL:
MR. DRATEL: Further down that entry do you see the paragraph that begins:
"i put a keylogger on lucydrops computer when he left the room one day"...
Right? Do you see that?
BRIAN SHAW: Yes.
MR. DRATEL: So, when you were looking at hacking software, right, which you showed us on Thursday as well, can you explain what a key logger is?
MR. HOWARD: Objection. Beyond the scope.
THE COURT: Sustained.
MR. DRATEL: Your Honor, the government read this document.
THE COURT: No, they can read the document, but whether or not he knows about how to interpret the content is different. So, you can ask him about the matters that he went over in his direct.
MR. DRATEL: Your Honor, he also testified about hacking software such as that, key loggers, in his direct.
THE COURT: If he talked about it then certainly you can go into that. Don't tie it to the document but go ahead and question him about things he otherwise testified to.
BY MR. DRATEL:
MR. DRATEL: In terms of hacking software, what does a key logger do?
BRIAN SHAW: Key logger? It is my understanding that it logs your key strokes.
MR. DRATEL: When you say logs your key strokes, you mean for someone -- it could be done by someone who is not at the computer, correct?
MR. HOWARD: Your Honor, objection. Beyond the scope.
THE COURT: You know, Joe, my LiveNote has gone out.
I will allow this to the extent -- I can't look and see what he testified to on direct as to this topic because my LiveNote is not currently working.
MR. HOWARD: Your Honor, if we can have a side bar we can make a proffer as to that or maybe he could move on to a different issue and come back once you can verify that.
THE COURT: We can do it even more easily. Why don't you say do you recall testifying on direct that? And then that will remind me and it will have the benefit of reminding everybody and then we can take it from there.
BY MR. DRATEL:
MR. DRATEL: Do you recall testifying on direct about hacking tools and reading from the screen pages about what hacking tools were available on Silk Road?
MR. HOWARD: Objection.
THE COURT: Well, that question he can answer.
BRIAN SHAW: I didn't read out loud any of the hacking tools. I described that there were listings for items referred to as hacking tools.
MR. DRATEL: Known as key loggers, right?
BRIAN SHAW: That is correct.
MR. DRATEL: So, when you say a key logger logs strokes, it is not by the person who is actually logging them, right? It is someone who wants to know what the person, as a hacking tool -- it is for someone who wants to know what the person is doing on the computer while the person who wants to know is not there, right?
MR. HOWARD: Objection to scope and foundation and form.
THE COURT: Now it is sustained.
BY MR. DRATEL:
MR. DRATEL: Now, let's go to page 8, please, of 936.
That blue portion, that's not from the chats, right?
BRIAN SHAW: On this page, that is correct, it is not from the chats.
MR. DRATEL: And all blue portions for the entire document are not from the chats, right?
BRIAN SHAW: They are not from the marketplace chats, that's correct.
MR. DRATEL: They are from the forum, correct?
BRIAN SHAW: From a file -- backup file from the forum, correct.
MR. DRATEL: And that forum is available to the entire Silk Road community, correct?
BRIAN SHAW: That is my understanding. Correct.
MR. DRATEL: And it is imported into this document, correct?
BRIAN SHAW: Correct.
MR. DRATEL: So, when we are looking at the -- so, when this was taken off the server, that blue part wasn't there in that chat, right?
BRIAN SHAW: It was not blue. That is correct.
MR. DRATEL: No, but it wasn't there.
BRIAN SHAW: Wasn't where? I'm sorry.
MR. DRATEL: In other words, the next entry on the chat is the next white entry, not the next blue entry; correct?
In other words let's parse this out. Let's go to the entry right above it, 3/15/2013 at 20:42, right?
BRIAN SHAW: Yes.
MR. DRATEL: And that's 8:42 p.m., correct?
BRIAN SHAW: Correct.
MR. DRATEL: We are talking military time here, right? 24-hour clock.
Okay, so then we have a blue section and then we have another blue section on page 9, right? All blue, right?
BRIAN SHAW: Correct.
MR. DRATEL: And then we have 10 which is all blue again, right?
BRIAN SHAW: Correct.
MR. DRATEL: And then we have 11 which is all blue, right?
BRIAN SHAW: Correct.
MR. DRATEL: And then we have 12 which is all blue?
BRIAN SHAW: Correct.
MR. DRATEL: And we have a part of 13 that is all blue?
BRIAN SHAW: Correct.
MR. DRATEL: Then we have 3/21/2013 at 1:33, that's the next white entry, correct?
BRIAN SHAW: Correct.
MR. DRATEL: And, in fact, that white entry is the next entry on the private message chat, correct?
BRIAN SHAW: On the -- yeah, the Silk Road marketplace, correct.
MR. DRATEL: So, all that blue stuff was imported into this document, correct?
BRIAN SHAW: Correct.
MR. DRATEL: So, if I were to print out just the part that is white I would not see any blue. This was created for purposes of the trial, right?
BRIAN SHAW: It was the weaving of two different.
MR. DRATEL: It was created for the trial, right?
BRIAN SHAW: Correct.
MR. DRATEL: Did you do it?
BRIAN SHAW: I participated in the creation of this, yes.
MR. DRATEL: It is actually occurring on a public forum -- when I say public I mean for any Silk Road user, anyone with a user account, anyone with a user name, anyone with access to the Silk Road site, right?
BRIAN SHAW: There is the one individual forum post on page 8 and then the rest were one-on-one messages.
MR. DRATEL: But on the forum page?
BRIAN SHAW: On the forum site, correct, the separate site.
MR. DRATEL: If you go to page 16, 3/26/2013, that second, the third entry, the second white entry at 20:08, right? And it says:
"That is interesting."
This is from redandwhite, right?
BRIAN SHAW: Correct.
MR. DRATEL: And it says:
"That is interesting. How much is it possible to sell on here if we listed every product far cheaper than everyone else? We have a majority hold over most of the movement of products in western Canada (one of the main drug ports to North America)."
It says that, right?
BRIAN SHAW: Yes, it does.
MR. DRATEL: Now, if we go to page 17 at March 27, 2013 at 23:38.
Do you see that entry?
BRIAN SHAW: Yes, I do.
MR. DRATEL: By the way, that blue one in the middle there again, that belongs on the Silk Road forum, right?
BRIAN SHAW: Right. That is a message on the Silk Road forum, correct.
MR. DRATEL: Okay, that paragraph:
"In those categories, I think you could be doing over $1M in sales a week within a few months. It is hard to estimate because it depends on how much market share you get and also the site as a whole is constantly growing. You will need to become very proficient at stealth shipping and packaging if you aren't already. Think vacuum sealers and leaving no forensic evidence on your packages. You will also want to ship from multiple drop points so you can't be traced back via your (fake) return address.
If you go through with this, I would contact some of the top vendors and hire them to consult you. Ask the weed vendors because you won't be competing with them and their product is smelly and looked for by USPS" --
That would be the United States Postal Service?
MR. HOWARD: Objection.
THE COURT: Sustained.
MR. DRATEL: -- "so they have to be on top of their game."
MR. HOWARD: Objection to form.
MR. DRATEL: It says that, right?
THE COURT: Yeah. What is the objection?
MR. HOWARD: I thought that was the question. I didn't realize.
THE COURT: Do those words appear on the page?
BRIAN SHAW: Yes, they do.
THE COURT: All right.
BY MR. DRATEL:
MR. DRATEL: That is talking about security, correct?
MR. HOWARD: Objection.
THE COURT: Sustained.
He can't talk about what the content means. He can talk about what the content is on the page but he can't interpret the content. So, move on.
MR. DRATEL: Your Honor, this is a witness who put the document in evidence.
THE COURT: He did. He did put it in evidence. He can't interpret what the people meant.
BY MR. DRATEL:
MR. DRATEL: Let's go to April 2nd, 2013 at 20:55, page 24.
BRIAN SHAW: Okay.
MR. DRATEL: And that entry which is in the middle of the page, if we can blow that up a little bit it says:
"Regarding image metadata, you can strip all of that out and it is a good practice. The upload page is secure, but I would still have access to that metadata."
By the way, this is from Dread Pirate Roberts to redandwhite?
BRIAN SHAW: Correct.
MR. DRATEL: So:
"Regarding image metadata, you can strip all of that out and it is a good practice. The upload page is secure, but I would still have access to that metadata. Of course you can trust me, but what if I was compromised? Do a search of 'remove image metadata.' A decent one for windows can be found here:"
And there is a URL, correct?
BRIAN SHAW: Correct.
MR. DRATEL: "Regarding bitcoin withdrawal, I would avoid mt gox if at all possible, especially if you are withdrawing to a USA account. There are many other exchanges that don't have so much attention on them."
It says that, right?
BRIAN SHAW: Yes, it does.
MR. DRATEL: And if you look at the bottom, April 4, 2013, that one it says:
"I can't find a surname anywhere of Lawsry."
L-A-W-S-R-Y?
BRIAN SHAW: Yes, it says that.
MR. DRATEL: In fact, you heard the stipulation, right, that there was no person by that name?
MR. HOWARD: Objection.
THE COURT: Sustained.
BY MR. DRATEL:
MR. DRATEL: Now, let's go to 4/6/2013 on page 26 at 57 minutes, so that would be 12:57, right, after midnight?
BRIAN SHAW: Correct.
MR. DRATEL: 12:57 a.m., right?
BRIAN SHAW: Correct.
MR. DRATEL: And just look at that, we will go to the third sentence:
"He is likely sitting on many thousands of stolen bitcoins perhaps tens of thousands, so I would think we'd want to "work him over" to get those funds back. They could be on an encrypted drive only he can unlock."
Right? It says that?
BRIAN SHAW: Yes, it does.
MR. DRATEL: Now, from your knowledge of the server, having reviewed the server and the private messages, is there any way for you to tell whether or not lucydrop, redandwhite, reallucydrop, friendlychemist, whether they're different people or the same people?
BRIAN SHAW: There is -- no. Not that I can think of.
MR. DRATEL: Now, this set of messages occurs from March -- from page 1 is March 13, 2013, right?
BRIAN SHAW: Correct.
MR. DRATEL: And goes up to April 18th, 2013 -- actually, April 21st, and then there is one also on June 1st, but the particular string is pretty much through April 21st, right?
BRIAN SHAW: Correct.
MR. DRATEL: Going back to the SSH key for a second, that was changed March 26, 2013? Is that right?
THE COURT: I'm sorry, could you have the court reporter read back the question? I missed it.
MR. DRATEL: I can rephrase it.
THE COURT: Either way. My LiveNote is still not up, we are trying to fix it.
BY MR. DRATEL:
MR. DRATEL: Going back to the SSH keys, you testified, I believe on Thursday, that it was modified -- the frosty@frosty was modified March 26, 2013, right?
BRIAN SHAW: Can you tell me which exhibit that was, please?
MR. DRATEL: I think it is 603.
BRIAN SHAW: 900s, hopefully.
MR. DRATEL: 901?
BRIAN SHAW: Thanks. That is correct; recorded date modified was March 26, 2013.
THE COURT: I am back in business here with LiveNote.
Mr. Dratel, I think you got an answer.
MR. DRATEL: Thank you, your Honor.
BY MR. DRATEL:
MR. DRATEL: If we can go to Government Exhibit 1201?
MR. HOWARD: Objection, your Honor. This has not been admitted into evidence.
THE COURT: Take it down and let's find out if it was.
MR. DRATEL: It may not be, your Honor. It was not the one I was looking for.
THE COURT: So you are looking for a different exhibit?
BY MR. DRATEL:
MR. DRATEL: Government Exhibit 1200, that is in evidence; just look at the date on that, does it say March 16th?
BRIAN SHAW: Yes, it does.
MR. DRATEL: 2013?
BRIAN SHAW: Yes.
MR. HOWARD: Objection, your Honor. This is argumentative.
THE COURT: Well, I don't know where it is going yet, so overruled. Let me see where it is going.
MR. DRATEL: It is precisely what the government does in all of its examinations.
THE COURT: Let's see where it goes. I am overruling the objection. Go ahead.
BY MR. DRATEL:
MR. DRATEL: I am saying that this is March 16, 2013, right; and there is a post by frosty to stackoverflow, right, about code, correct?
BRIAN SHAW: I'm not familiar with this exhibit but it is what it looks like, yes.
MR. DRATEL: Then if we go to the next entry in this exhibit, if we go up further, okay, if we go to -- that's March 16, 2013 and the last modification of the authorized user key for the 16789SH was March 26, 2013, correct?
BRIAN SHAW: Correct.
MR. DRATEL: And you don't know what it was before then because you just have what it was changed -- what became of it as of March 26, 2013, right?
BRIAN SHAW: That is correct.
MR. DRATEL: With respect to 940A that is in evidence, you said that the null category was not included in your analysis?
BRIAN SHAW: It is included in Exhibit 940 -- or 940A.
MR. DRATEL: 940As it included, but when you did the pie chart you didn't include it, correct?
BRIAN SHAW: That is correct.
MR. DRATEL: And so, the null transactions account for about 11 or 12 percent of the entirety, right, of the transactions?
BRIAN SHAW: Doing a quick double-check here. That's approximately correct.
MR. DRATEL: And the reason they're null, just again, is because you could not categorize them, correct?
BRIAN SHAW: That is correct.
MR. DRATEL: Let's talk about 940D and the total number of commissions over the life the Silk Road is 642,455 bitcoin, right?
BRIAN SHAW: That's what it says. Correct.
MR. DRATEL: And the dollar value of $13 million is based on the value of bitcoin at the time of the transaction, correct?
BRIAN SHAW: As it was recorded in the database.
MR. DRATEL: So, in other words, if the database recorded bitcoin value, let's say, in 2012, bitcoin value might be different in 2013, correct?
BRIAN SHAW: Correct.
MR. DRATEL: And that would influence not the value -- not the number of bitcoin but in fact the value of the money, correct, in terms of exchange into dollars, right?
Let me pose it a simpler way for everybody's benefit, including mine.
If a transaction in October of 2012 is 1 bitcoin is worth $4.50, right, that would look there at 1 bitcoin and at the bottom, U.S. equivalent would be $4.50, right?
BRIAN SHAW: Correct.
MR. DRATEL: If that same transaction occurred with bitcoin at a value of $12 a bitcoin, it would still be 1 bitcoin on the commissions but the dollar value -- U.S. dollar equivalent would be $12, right?
BRIAN SHAW: That's what the database would -- should reflect, yes.
MR. DRATEL: And so that the database only reflects the value of bitcoin in the transaction, correct? Right?
BRIAN SHAW: Correct.
MR. DRATEL: Did you look at the value of bitcoin over time?
BRIAN SHAW: No. I was pulling it from the database. The value recorded in the database.
MR. DRATEL: Let me show you what is in evidence as Defendant's Exhibit B. It is in evidence. This is a graph of the value of bitcoin over time and so in the context of your chart which is 940D, it doesn't tell you what the value is of those commission bitcoins at any point in time other than what is in the database at the time of the transaction, correct?
BRIAN SHAW: It tells you what the value was recorded in the database.
MR. DRATEL: Right; but it doesn't tell you what happens a month or a year later if those bitcoins are still held and whether the price has appreciated. It is not reflected in that chart?
BRIAN SHAW: Yes. To my understanding that that field does not change, correct, once entered in.
MR. DRATEL: So that if you had 100 bitcoins at a dollar, right, and in 2012 and you held on to them until November 2013 as on that graph when it peaks at, and we will say $1,000, just for round numbers, that 100 bitcoins at a dollar each would be worth a thousand times more, correct?
MR. HOWARD: Objection. Beyond the scope.
THE COURT: Well, no. It is, I think, related to what he was saying before but I think it has been asked and answered. But, I will allow this last question.
MR. DRATEL: Thank you, your Honor.
BRIAN SHAW: Yeah, the value of the bitcoin varies wildly.
BY MR. DRATEL:
MR. DRATEL: And it would be a thousand times more but it wouldn't be reflected on 940B?
BRIAN SHAW: It is my understanding, yeah, that the value in the database did not change.
MR. DRATEL: I want to draw your attention to Government Exhibit 935. If you look at that first entry, this is from shefoundme to KingofClubs, June 10th, 2013. Right?
BRIAN SHAW: Correct.
(Continued on next page)
MR. DRATEL: And you testified about this Thursday?
BRIAN SHAW: Correct.
MR. DRATEL: And this is about shefoundme ordering fake IDs, right?
MR. HOWARD: Objection.
THE COURT: Hold on. Well, I think the document says what it says. I don't want the witness to be interpreting it, but if you want to read something into the record, you can do that.
MR. DRATEL: Okay.
MR. DRATEL: Let's read from the top "Hi I need a few of your highest quality IDs. I notice several attributes you list: Hologram, UV, scannable, raised lettering. Can you give me a rundown of the importance of these attributes and what they are needed for? For example, which are needed to pass airport security for a domestic flight?"
Right?
BRIAN SHAW: Yes, it says that.
MR. DRATEL: "Which are needed to get through being pulled over by a cop." Right?
BRIAN SHAW: Yes.
MR. DRATEL: And if you go to page two, again, from shefoundme to -- June 10, 2013, shefoundme to KingOfClubs, right?
BRIAN SHAW: Correct.
MR. DRATEL: And then if you look at the third-to-the-last paragraph down at the bottom, it's a one-line paragraph, "Can you comment on the suitability of using any of these IDs to board a domestic USA flight." Right?
BRIAN SHAW: Yes, it says that.
MR. DRATEL: Then it says "Can you please comment on what the various attributes mean. For example, does UV mean if it is held under a UV light then some pattern appears that makes it look legit. If it doesn't have UV, does that mean if it is held under UV light, it will be exposed as a fake? In general, how much scrutiny can these cards hold up against?"
Right?
BRIAN SHAW: Yes.
MR. DRATEL: Now, if we go to page 11, July 18, 2013, the one right in the middle of page 132606, right?
BRIAN SHAW: Okay.
MR. DRATEL: From shefoundme to KingOfClubs: "Looks like it got stuck in customs. The last step is 'inbound out of customs' on the tenth. Have you ever had something seized or any of your customers get in trouble?"
Right it says that?
BRIAN SHAW: Yes, it does.
MR. DRATEL: May I have a moment, your Honor.
THE COURT: Yes.
MR. DRATEL: With respect to SSH keys and what we talked about before with respect to a manual, right, the system manager's manual, are you familiar with them?
BRIAN SHAW: I'm familiar with man pages in general.
MR. DRATEL: So are you familiar with the SSH-D system manager's manual?
BRIAN SHAW: I have not reviewed that one; no.
MR. DRATEL: But you testified here about SSH keys, right?
BRIAN SHAW: That is correct.
MR. DRATEL: Nothing further. Thank you.
THE COURT: All right. Thank you.
Mr. Howard.
MR. HOWARD: I'll be very brief.
THE COURT: All right.
MR. HOWARD: Mr. Evert, can you please publish Government Exhibit 936 again, please.
REDIRECT EXAMINATION BY MR. HOWARD:
MR. HOWARD: Mr. Shaw, this is a compilation of messages involving the Dread Pirate Roberts, correct, other than the forum posts?
BRIAN SHAW: That's correct.
MR. HOWARD: Can we go to page seven, please. And the one that's shaded here on blue on page eight, that's the forum post, right?
BRIAN SHAW: That is correct.
MR. HOWARD: A forum post can be seen by many users on Silk Road, right?
BRIAN SHAW: That's correct.
MR. HOWARD: Can we go to the next page. Isn't it true that you testified that all of the other messages shaded in blue were private messages taken from the forum database, correct?
BRIAN SHAW: That's correct.
MR. HOWARD: Those are one-to-one private messages involving Dread Pirate Roberts, correct?
BRIAN SHAW: Correct.
MR. HOWARD: So 936, apart from that forum post, contains private messages taken from the private message database on the Marketplace, correct?
BRIAN SHAW: Correct.
MR. HOWARD: And also private messages between Dread Pirate Roberts and other individuals taken from the forum database?
BRIAN SHAW: Correct.
MR. HOWARD: And all of these were contained on the servers you reviewed?
BRIAN SHAW: Yes, they were.
MR. HOWARD: You testified about MD5s and SHA1s on cross, right?
BRIAN SHAW: Yes, I did.
MR. HOWARD: And you testified that whether or not you used one or both comes down to the use case, correct?
BRIAN SHAW: Correct.
MR. HOWARD: What do you mean by "use case"?
BRIAN SHAW: For the purposes -- there are multiple use cases for hashing a file. Typically in the forensic world, users will create what's called a white list, you know, known files. And so it's common to create hash values of those files so that way, you know, every Windows computer ever has notepad.exe, so if you create a hash value of that file, whenever you import your new image, you can quickly exclude that image. So it's a process for quickly excluding files. So it's fairly common to use hash values to eliminate files that need review and there was, you know, a few years ago some academic papers and studies on weaknesses in MD5 for that purpose.
MR. HOWARD: So for the purpose of creating forensic images, however, are you aware of weaknesses in MD5?
BRIAN SHAW: For comparing whether a file has changed, you know, whether it's been under control and whether it's changed from point A and point B, MD5 is still used; yes.
MR. HOWARD: So relying on MD5 alone would be sufficient?
MR. DRATEL: Objection.
THE COURT: Sustained.
You can ask a different way.
MR. HOWARD: Is MD5 alone accepted in the community as a way of verifying forensic copies?
MR. DRATEL: Objection; form.
THE COURT: I'll allow it.
BRIAN SHAW: MD5 is a -- still considered a technique for verifying if a file changed in transit. With hash values, if they're -- that weakness that I discussed, something else will also change in the process. So the size of the file will likely change almost always will get larger. Additionally, if it's, like, a jpeg type image, that the image would get corrupted. So when it comes to verifying whether a file changed in transit, it's still considered a valid process.
MR. HOWARD: No further questions, your Honor.
THE COURT: Mr. Dratel.
RECROSS EXAMINATION BY MR. DRATEL:
MR. DRATEL: It's not most valid process, though, is it, right? SHA1 is more reliable than MD5?
BRIAN SHAW: SHA1 is the newer standard that --
MR. DRATEL: I'm sorry --
BRIAN SHAW: The newer process that doesn't have the same weakness as MD5.
MR. DRATEL: And with respect to the 936 of those posts, those were -- the blue sections were imported from a different -- that's a separate conversation going on from the white ones, right --
BRIAN SHAW: That is correct.
MR. DRATEL: -- in terms of where it's occurring?
BRIAN SHAW: Correct.
MR. DRATEL: Thank you. Nothing further.
THE COURT: All right. Thank you. You may step down, sir.
BRIAN SHAW: Thanks.