2.Jared Der-Yeghiayan — Cross (Part 8)
299 linesCROSS-EXAMINATION (Resumed) BY MR. DRATEL:
MR. DRATEL: Good afternoon, Agent Der-Yeghiayan.
JARED DER-YEGHIAYAN: Good afternoon.
MR. DRATEL: Have you ever heard of someone with a username "inlightof"?
JARED DER-YEGHIAYAN: I have.
MR. DRATEL: And have you ever identified that person?
JARED DER-YEGHIAYAN: No, I did not.
MR. DRATEL: And that was a person you were looking at at some point as DPR, right?
MR. TURNER: Objection. Form.
THE COURT: Sustained.
MR. DRATEL: And we talked the other day about "peaceloveharmony," someone with that username, right?
MR. DRATEL: That was someone who was, as you described it, sitting on DPR's profile for a few hours a couple of days before Mr. Ulbricht was arrested, right?
MR. DRATEL: And you had asked your law enforcement colleagues whether it was them, and the people on the arrest team, it wasn't any of them, correct?
JARED DER-YEGHIAYAN: That is the reply I got, yes.
MR. DRATEL: And did you ever learn who peaceloveharmony was?
JARED DER-YEGHIAYAN: Not that I can recall.
MR. DRATEL: Now, was there a user or someone named Mr. Wonderful?
MR. TURNER: Objection.
MR. DRATEL: Do you recall that?
MR. TURNER: Objection. 401.
MR. DRATEL: I didn't hear the objection.
MR. TURNER: 401.
THE COURT: Hold on one second.
I don't know why it would apply. I will allow a few -- let me allow a few questions to develop that.
BY MR. DRATEL:
MR. DRATEL: Mr. Wonderful was involved with Scout, correct?
JARED DER-YEGHIAYAN: Yes, he was.
MR. DRATEL: And who was Mr. Wonderful?
MR. TURNER: Objection. Foundation.
MR. DRATEL: If you know.
THE COURT: If you know. Just testify if you know.
MR. TURNER: Objection to form.
THE COURT: I will allow it.
You may proceed.
JARED DER-YEGHIAYAN: Mr. Wonderful was operated by another HSI agent.
MR. DRATEL: And was there a question -- was there a discussion between Scout and DPR about Mr. Wonderful?
MR. TURNER: Objection. Form.
MR. DRATEL: In the forums or in the private messaging system that you were able to monitor?
THE COURT: I will allow it. Overruled.
JARED DER-YEGHIAYAN: I believe there was.
On the forums you are asking?
MR. DRATEL: No. Between DPR and Scout on the Silk Road system in one form or another.
JARED DER-YEGHIAYAN: Later on I learned of that there was discussion between them.
MR. DRATEL: And that was one of the reasons for a falling out between DPR and Scout?
MR. TURNER: Objection. Foundation.
THE COURT: Yes. So that is sustained.
JARED DER-YEGHIAYAN: That --
THE COURT: No. That was sustained. So he will ask another question.
JARED DER-YEGHIAYAN: Sorry.
BY MR. DRATEL:
MR. DRATEL: But there was talk between Scout and DPR about whether Mr. Wonderful was law enforcement, correct?
MR. TURNER: Objection. Foundation.
THE COURT: Well, I think that the issue is did you actually review the communications between Scout and Mr. Wonderful?
MR. DRATEL: No, between Scout and DPR, your Honor.
THE COURT: Did you review the communications between Scout and DPR?
JARED DER-YEGHIAYAN: I can't recall if I did. I know there were some that were shared at a later date, but I don't know if there actually was, if I actually saw the screenshots or this was something that was told to me.
THE COURT: I want you to put aside something that may have been told to you but in terms of what you recall seeing, go ahead, and, Mr. Dratel, you can ask the question in that context.
MR. DRATEL: There was discussion between DPR and Scout as to whether or not Mr. Wonderful was law enforcement, right?
MR. TURNER: The same objection.
THE COURT: Well, if he knows.
JARED DER-YEGHIAYAN: I don't recall seeing screenshots. There may have been some that were shared at a later date but I can't recall seeing them.
MR. DRATEL: And do you recall that Mr. Wonderful and whether or not he was law enforcement, or she, was the reason that DPR took over Scout's account for awhile?
MR. TURNER: Objection to form. Foundation.
THE COURT: Sustained. You may re-ask it.
MR. DRATEL: Well, DPR took over Scout's account for awhile, correct?
MR. DRATEL: And wasn't that in order to investigate the Mr. Wonderful situation?
MR. TURNER: Objection. 401.
THE COURT: I think the issue is do you have any information regarding why DPR took over that account?
JARED DER-YEGHIAYAN: That was relayed through a source later on, yes.
THE COURT: Let's put aside what you may have heard from a third, a person, a source. That's a person?
THE COURT: OK. Did you see any information in connection with your review of the screenshots of Silk Road that indicated to you, at least words on a page, as to why DPR --
JARED DER-YEGHIAYAN: Took over that account?
THE COURT: Took over that account.
JARED DER-YEGHIAYAN: Not that I could recall.
THE COURT: All right. You may proceed.
MR. DRATEL: Thank you, your Honor.
(Pause)
MR. DRATEL: Could you look up Government's Exhibit 126A.
It is in evidence.
MR. DRATEL: Take a look at where it says, "Hey, gang," do you see that post?
MR. DRATEL: This is July 12, 2013, right?
MR. DRATEL: So you reviewed a lot of communications involving -- withdrawn.
Here it says "Cirrus," right?
MR. DRATEL: And Cirrus is the same as Scout, right?
JARED DER-YEGHIAYAN: The person that originally operated the Scout account created the Cirrus account, correct.
MR. DRATEL: And this is kind of when they created the Cirrus account, right?
MR. TURNER: Objection to form.
MR. DRATEL: It says "post," as far as we know?
THE COURT: I will allow it.
JARED DER-YEGHIAYAN: This is about the timeframe, yes.
MR. DRATEL: And you reviewed these; this is not when you were operating the account, right?
JARED DER-YEGHIAYAN: This is not when I was operating the account.
MR. DRATEL: So you reviewed a whole host of Cirrus and, before that, Scout's messages, right?
JARED DER-YEGHIAYAN: There were other messages that I reviewed that were in the account, yes.
MR. DRATEL: And one of the reasons you did that is because if you are going to be playing that part, you really have to know what's going on, right?
JARED DER-YEGHIAYAN: That is correct.
MR. DRATEL: So let's read it: "Hey, gang, we have a new moderator going by the name Cirrus. We used to know him as Scout. Cirrus has always been dedicated to our common goals and the community at large and we've put what happened surrounding Mr. Wonderful behind us so he can come back to the team."
Right?
MR. DRATEL: So reading that, you had to find out what was going on with Mr. Wonderful, right?
JARED DER-YEGHIAYAN: I was talking to that agent at the time so they had the idea --
MR. TURNER: Objection. Hearsay.
THE COURT: Don't go into what your conversation was with that agent, but you could talk about what steps you took.
MR. DRATEL: Did you go back and read posts having to do with Mr. Wonderful?
JARED DER-YEGHIAYAN: I didn't have access to the Scout account to go back to read that. I only had access to the Cirrus account.
MR. DRATEL: Now, the URL, the onion address for Silk Road, changed in December of 2011, correct?
JARED DER-YEGHIAYAN: That sounds about right, yes.
MR. DRATEL: And also around that time Silk Road instituted a new bitcoin system, right?
MR. TURNER: Objection. Foundation.
THE COURT: Hold on for one second.
MR. TURNER: 804.
THE COURT: Well, if you know. As to everything, only testify if you know a fact. Don't speculate or guess.
And so the question is do you know whether or not around that time Silk Road instituted a new bitcoin system?
JARED DER-YEGHIAYAN: I don't recall about a new bitcoin system.
(Continued on next page)
BY MR. DRATEL:
MR. DRATEL: I'll show you what's marked as 3505-3602 and ask you just to review the last paragraph and when you've done that, let me know.
JARED DER-YEGHIAYAN: Okay.
MR. DRATEL: Does that refresh your recollection that as of December 30, 2011, Silk Road instituted a new bitcoin system?
JARED DER-YEGHIAYAN: I believe what it did is it -- it allowed multiple accounts to deposit bitcoins, so it was something that was different about the bitcoin system, yes.
MR. DRATEL: They instituted a change?
JARED DER-YEGHIAYAN: As far as I recall, yes.
MR. DRATEL: Now, in June of 2011, the site Silk Road went down for a little bit, right?
MR. TURNER: Objection; time frame, form.
THE COURT: Hold on.
June of 2011?
MR. DRATEL: Yes.
THE COURT: All right. If that's your recollection, you may testify. Go ahead.
JARED DER-YEGHIAYAN: I wasn't aware of Silk Road at that time.
MR. DRATEL: That's not my question. You know that in 2011 the site went down, right?
MR. TURNER: Objection; foundation.
THE COURT: Well, the foundation is only about what he -- I don't want you to say anything you don't know. At any point in time over the course of your investigation, did you learn that in June of 2011 -- did you learn whether or not in June of 2011 a new bitcoin system was implemented?
MR. DRATEL: No. It's about the site going down now.
THE COURT: Do you know whether or not the site went down in June of 2011, not what you knew in June 2011, but later on did you ever learn that there had been an outage?
JARED DER-YEGHIAYAN: There were posts that reflect that I believe on the forums, and there's I think articles that said that, yes.
MR. DRATEL: So that in June 5, 2011, the website posted a message saying "Silk Road is currently closed to visitors; this will be reviewed on July first and the site will probably be reopened sorry for the inconvenience." Right?
MR. TURNER: Objection; foundation. This document is not in evidence.
THE COURT: I think that he's talked about his recollection.
Did you ever determine whether or not the site had in fact gone down?
JARED DER-YEGHIAYAN: I couldn't confirm it, no.
THE COURT: One way -- did you try one way or the other?
JARED DER-YEGHIAYAN: There was no way for me to.
THE COURT: It might have gone down, it might not have gone down. You don't know for sure?
JARED DER-YEGHIAYAN: I don't know for sure.
THE COURT: You can continue.
MR. DRATEL: But that post was made, right?
MR. TURNER: Objection; hearsay.
THE COURT: I'm going to allow it.
JARED DER-YEGHIAYAN: The post was made; yes.
MR. DRATEL: And there were posts --
THE COURT: Let me be clear, with that particular objection, that means that the witness is testifying about what he saw or read. He doesn't know if it's true or not, but he saw a post with those words on it that had that information on it. Whether it's true or not is another question.
MR. DRATEL: It could have been some other reason why the post was made, right?
JARED DER-YEGHIAYAN: I'm sorry?
MR. DRATEL: It might not have been a technical problem with the site. It could have been another reason why that post was made, right?
MR. TURNER: Objection; calls for speculation.
THE COURT: Don't speculate. Sustained.
MR. DRATEL: And the silkroadmarket.org, the page that was available on the ordinary Internet that you testified about, that stopped operating in April of 2012, correct?
JARED DER-YEGHIAYAN: That's correct.
MR. DRATEL: Now, with respect to forum posts, with respect to PGP keys that we were talking about, right, last week, there's no customized version of a PGP key? Withdrawn.
A PGP key is generated by a computer at random, right?
JARED DER-YEGHIAYAN: It's created when you create a new key; yes, it's created by the computer.
MR. DRATEL: So it doesn't have any specific identifying information about the person who is creating the key, in other words, their initials or anything or numbers or any kind of -- it's not like a password where you would choose to put in the identifying information so that you'd remember it, right?
JARED DER-YEGHIAYAN: Just on the profile itself can you -- it's customizable to enter in certain information, like a name or an email address.
MR. DRATEL: No, I'm talking about the PGP key.
JARED DER-YEGHIAYAN: Okay.
MR. DRATEL: The PGP key is not like a password in the sense that you put in identifying information. It's generated by the computer?
JARED DER-YEGHIAYAN: You're saying, like, the output?
MR. DRATEL: Yeah, the actual key, the text block?
JARED DER-YEGHIAYAN: Yeah. It's random digits and numbers; yes.
MR. DRATEL: And with respect to -- talked about computers and UTC time. In fact, you yourself acknowledged in one of the chats that UTC time -- you assumed that all the computers were on UTC time? Essentially the computers ran on UTC time, right?
MR. TURNER: Objection; form, hearsay and relevance.
THE COURT: Hold on one second. Let me read it.
Why don't you restate the question. I'll allow a form of that question.
MR. DRATEL: You recall a chat with DPR in which you said that essentially all our computers are on UTC time?
MR. TURNER: Objection; form and foundation.
THE COURT: I will allow it.
You may answer.
JARED DER-YEGHIAYAN: I believe there was a chat, yeah, that we were talking about the servers for Silk Road.
MR. DRATEL: I'll show you what's marked as Defendant's F for identification and ask you just to review it.
JARED DER-YEGHIAYAN: Okay.
MR. DRATEL: Do you recognize it?
JARED DER-YEGHIAYAN: It's a screen shot that I would have taken of a chat that was on the computer --
MR. DRATEL: Between you and DPR?
JARED DER-YEGHIAYAN: No, the person that operated before.
MR. DRATEL: And so, I --
MR. DRATEL: I move it in evidence, your Honor.
MR. TURNER: I have several objections, first "the person who operated before" needs to be clarified. And if it's being offered for truth, then we object on hearsay grounds.
THE COURT: Somebody needs to hand me a copy of this document.
MR. DRATEL: I'm sorry.
THE COURT: That's all right. That's okay. I didn't know if I needed to look at it. I have the witness'. Let me take a quick look.
All right. As of August 2, 2013, were you cirrus?
JARED DER-YEGHIAYAN: August 2, I was; yes.
THE COURT: All right. And how about July 23?
JARED DER-YEGHIAYAN: I was not.
THE COURT: You were not cirrus on July 23rd?
THE COURT: All right. Did you take this screen shot that's been marked as Defense Exhibit F as in frank?
JARED DER-YEGHIAYAN: Yes, I believe.
THE COURT: And you took it on or about August 2 at the top left?
JARED DER-YEGHIAYAN: That would be correct; yes.
THE COURT: Was it a true and accurate reflection of what appeared on that page at the time you took it?
JARED DER-YEGHIAYAN: It is.
THE COURT: All right. I will allow this in, but the content of the messages themselves are not in for the truth, but you can proceed, Mr. Dratel.
MR. DRATEL: Thank you, your Honor.
(Defendant's Exhibit F received in evidence)
MR. DRATEL: See where it says "cirrus." It says "I always just assume we all live in UTC (or our computers anyway.)" Right?
JARED DER-YEGHIAYAN: I do, yes.
MR. DRATEL: And that's because essentially computers can be configured to run on any timezone, right?
MR. TURNER: Objection; foundation.
THE COURT: Sustained.
MR. DRATEL: A computer can be configured so that the timezone on the computer can be anything that the operator inputs, right, the person who is operating the computer?
JARED DER-YEGHIAYAN: That's correct.
MR. DRATEL: Now, we talked -- you said that you had seen some messages in which the DPR PGP key had not been validated, correct?
JARED DER-YEGHIAYAN: I believe there were times that he -- other people weren't able to validate a signed message by him, but then that would follow up with him I think reissuing another signature.
MR. TURNER: Objection; hearsay.
MR. DRATEL: You saw this on the site?
THE COURT: The objection is sustained and that answer is struck.
MR. DRATEL: But you saw that on the site?
THE COURT: Why don't you reask the question and then we'll get a clean --
MR. DRATEL: There were some times when the signature was not valid, correct?
MR. TURNER: Objection; foundation.
THE COURT: Let's start the question over again and then we'll take it one by one, because if he saw with his own eyes these kinds of things, then he can testify to it.
Mr. Dratel, you may proceed.
MR. DRATEL: Thank you, your Honor.
MR. DRATEL: So you saw instances in which the PGP key was not validated from a message from DPR, correct? You saw that on the forum?
MR. TURNER: Same objection; form and foundation.
THE COURT: First of all, did you ever see -- were any of your messages that you tried to validate not validated?
JARED DER-YEGHIAYAN: Not that I did; no.
THE COURT: During the course of the time that you were using the Silk Road website, did you become aware of others who at least indicated that they had messages that had not been validated?
JARED DER-YEGHIAYAN: There were times that there were posts made that the -- that another user might say that they can't validate a signature.
THE COURT: Did you follow up to determine whether or not you could validate that particular message on your own?
JARED DER-YEGHIAYAN: I did not.
THE COURT: So you don't know whether it's, in fact, the case that they couldn't validate it or if they were just saying that?
JARED DER-YEGHIAYAN: I don't know why it wasn't validating for them at the time.
THE COURT: But you saw it there? You saw the posts?
JARED DER-YEGHIAYAN: I did see the posts.
THE COURT: All right.
MR. DRATEL: Government Exhibit 127B, please, if we could focus on the top part.
Do you see the part right above 6:12:15 p.m. where it says "encrypted OTR chat initiated." And then it says "dread@" and there's an onion address, and it says "identity not verified." Right?
JARED DER-YEGHIAYAN: I do.
MR. DRATEL: And that essentially comes before every one of these Pidgin chats, right?
JARED DER-YEGHIAYAN: I believe that, yeah, it was on every time that we initiated a chat.
MR. DRATEL: And you said you used a program called Adium, right?
JARED DER-YEGHIAYAN: That's correct.
MR. DRATEL: And Adium gives you the ability to authenticate the other side of the chat, correct --
JARED DER-YEGHIAYAN: I'm not aware --
MR. DRATEL: -- in a way that can verify what's not verified on that?
JARED DER-YEGHIAYAN: I honestly don't know if it can or cannot.
MR. DRATEL: But you never did that -- you didn't use any kind of verification process in your chats with DPR, correct, like that?
JARED DER-YEGHIAYAN: No, I did not.
MR. DRATEL: And on your side, you said that there were certain accounts that could have more than even one agent working, right?
JARED DER-YEGHIAYAN: What type of accounts?
MR. DRATEL: In other words, Silk Road accounts; there are certain Silk Road accounts that were operated by more than one agent?
JARED DER-YEGHIAYAN: There were ones from time to time, yes, they were operated by multiple agents.
MR. DRATEL: So there's nothing to tell you whether on the other side of that, an unverified chat, whether there's more than one person or who it is on the other side, correct, other than someone coming on as dread, right?
JARED DER-YEGHIAYAN: There's no way of knowing how many people are operating that, no.
MR. DRATEL: Now, I want to go to Government Exhibit 130, please, Government Exhibit 130, and this is the piece of paper recovered from the trash from Mr. Ulbricht's apartment in San Francisco when you searched it after his arrest, right?
JARED DER-YEGHIAYAN: Yes, it is.
MR. DRATEL: And it's got notes about ratings, right?
JARED DER-YEGHIAYAN: That's correct.
MR. DRATEL: Let's go to Government Exhibit 131, please. So if we go down to the bottom, the bottom of -- I guess also 130A, no. I'm sorry. One second. If we can enlarge that a little bit.
So this a process, going to the first post, and the posts go from bottom to top essentially, not chronologically. The oldest post would be at the bottom and the newest post would be at the top?
MR. TURNER: I don't recognize this exhibit.
THE COURT: What exhibit is this?
MR. DRATEL: 131.
THE COURT: GX 131.
MR. TURNER: I see. Okay. Third page.
JARED DER-YEGHIAYAN: Yes, I believe so.
MR. DRATEL: So, the first date that this starts is in August, right, 2013?
JARED DER-YEGHIAYAN: For this --
MR. DRATEL: August 11, 2013?
JARED DER-YEGHIAYAN: Yes, I believe so.
MR. DRATEL: And it talks about undergoing an overhaul of the ratings system, right?
JARED DER-YEGHIAYAN: It does.
MR. DRATEL: And this is DPR initiating it, right?
JARED DER-YEGHIAYAN: It is.
MR. DRATEL: And then there's another post on the 31st of August, right?
JARED DER-YEGHIAYAN: Correct.
MR. DRATEL: And then there's another post on the 12th of September, right?
MR. DRATEL: And these posts contain detailed discussion mostly from DPR about ideas for the ratings overhaul, right?
JARED DER-YEGHIAYAN: They do.
MR. DRATEL: So that's been going on as of the date of Mr. Ulbricht's arrest, it's been going on for seven weeks or so, right?
MR. DRATEL: And these handwritten notes found in the trash are related to a project that DPR has been posting about for two months?
JARED DER-YEGHIAYAN: It appears so, yes.
MR. DRATEL: And he needed to take notes from this?
MR. TURNER: Objection; calls for speculation, foundation.
THE COURT: Sustained.
MR. DRATEL: Now, an important part of your investigation was trying to find money, right, bitcoin, correct?
JARED DER-YEGHIAYAN: Yes, it was.
MR. DRATEL: And we went back on Thursday, bitcoin is anonymous but there's a block chain that has every transaction, right?
JARED DER-YEGHIAYAN: Yes, it does.
MR. DRATEL: And it's public?
JARED DER-YEGHIAYAN: Yes, it is.
MR. DRATEL: At some point, in October of 2012, Silk Road split some of its accounts up?
MR. TURNER: Objection; form and foundation.
THE COURT: Hold on one second. Sustained.
You can come back at it.
MR. DRATEL: Did your investigation establish that Silk Road had split, based on your analysis of the block chain of Silk Road looking for accounts that could be linked to Silk Road, that Silk Road had split a main account into other accounts?
MR. TURNER: Objection; same objection, form.
THE COURT: Sustained.
MR. DRATEL: At some point you identified some of the Silk Road accounts, correct?
JARED DER-YEGHIAYAN: Yes, there were accounts we believed belonged to Silk Road.
MR. DRATEL: That was in April 2012, right?
JARED DER-YEGHIAYAN: I believe the date is -- sounds right, yes.
MR. DRATEL: And part of what you're looking for is movement of bitcoins, people cashing out accounts in unusual amounts, correct, in large amounts?
JARED DER-YEGHIAYAN: We were trying to see if we could trace the funds going in to see if it would hit something that would look like it belongs to the website and we were also trying to trace funds out of the website, too.