5.Thomas Kiernan — Direct (Part 2)
620 linesMR. HOWARD: Mr. Kiernan, in your review of the defendant's laptop, did you have files with reference to computer servers?
THOMAS KIERNAN: I did, yes.
MR. HOWARD: What is a computer server?
THOMAS KIERNAN: It's a machine that will actually host or run a website or a database, something to that effect. It's the place that you connect to when you actually go to the site, like Google has servers behind it. When you go to Google's website, there's a machine behind it that's actually producing the answers for you. That's what a server basically does.
MR. HOWARD: How are computer servers identified on the Internet?
THOMAS KIERNAN: Through an IP address.
MR. HOWARD: What is an IP address?
THOMAS KIERNAN: An IP address is a numeric number used to actually get to a computer, kind of like a phone number, how you call somebody on your phone. It's a unique number associated with the server or any computer any time you're on a computer, and it allows you to actually get to that destination point.
MR. HOWARD: Mr. Kiernan, can you please flip to what has been marked for identification purposes as Government Exhibit 264, please.
THOMAS KIERNAN: Sure. Okay.
MR. HOWARD: Do you recognize what this is?
THOMAS KIERNAN: I do.
MR. HOWARD: And what is it?
THOMAS KIERNAN: It's a file extracted from the defendant's computer.
MR. HOWARD: And what was the name of the file?
THOMAS KIERNAN: Servers.ODS.
MR. HOWARD: And what is an ODS file?
THOMAS KIERNAN: It's a -- this is a spreadsheet.
MR. HOWARD: And according to the meta data, what was the date this file was first saved on the defendant's computer?
THOMAS KIERNAN: 3/24/2013.
MR. HOWARD: The government offers Government Exhibit 264 into evidence.
THE COURT: Mr. Dratel.
MR. DRATEL: Just the hearsay and Vayner.
THE COURT: Those objections are overruled and GX 264 is received.
(Government's Exhibit 264 received in evidence)
MR. HOWARD: Ms. Rosen, can you please publish the zoomed-in highlighted version of this chart, please. Why don't we look at the column titles, please. Let's try part of it at the top.
MR. HOWARD: So here we have the columns are alias, type, host, email/user, host, pass, username, pass, IP address, correct?
THOMAS KIERNAN: That is correct, yes.
MR. HOWARD: And the IP address what you just testified about being a unique way that servers are identified on the Internet?
THOMAS KIERNAN: How they communicate on the Internet, yes.
MR. HOWARD: I've been advised the team is working on getting a clearer version up.
THE COURT: Thank you. That or you may want to hand around a piece of paper to the jury so they can actually see it because I don't think that it's legible on the screen.
MR. HOWARD: For the record, the highlighting, that's been added by the government.
The file and the computer, Mr. Kiernan, did not contain any highlights, correct?
THOMAS KIERNAN: No highlights, no.
MR. HOWARD: I'm going to get a copy to pass around to the jury, if that's okay.
THE COURT: Yes. Do you want to maybe go on and come back to this or does this fit right where you are now?
MR. TURNER: I think it takes a second to autofocus. We should have it.
MR. HOWARD: Mr. Kiernan, are you able to read the titles of the columns in the version that's in front of you?
THOMAS KIERNAN: Yes, I can see them in this version right here.
THE COURT: Could you pull down this for a second so I can just see. He was referring to some columns before in the dark. I see. Okay.
THOMAS KIERNAN: That's nice.
MR. HOWARD: The columns are alias, type, host, email/user, host pass, username, pass, IP address, correct, Mr. Kiernan?
THOMAS KIERNAN: That's correct.
MR. HOWARD: And the IP address, as what you testified, is the unique way that servers are identified on the Internet, correct?
THOMAS KIERNAN: That's correct, yes.
MR. HOWARD: And the other is the remaining columns are location, expires, use, notes and there are some additional columns further down the page, correct?
THOMAS KIERNAN: Correct.
MR. HOWARD: Now, to draw your attention to a couple that the government has highlighted. There's one here that you can see, what is the alias of this server I'm pointing to?
THOMAS KIERNAN: Bora.
MR. HOWARD: And what is the IP address that's listed for that server?
THOMAS KIERNAN: It's 193.107.86.49-53.
MR. HOWARD: And what -- does the chart describe the location of the server?
THOMAS KIERNAN: Iceland.
MR. HOWARD: And what does it describe about the use of the server?
THOMAS KIERNAN: Market back end.
MR. HOWARD: I'd like to direct your attention to the other rows highlighted here labeled "gala" under the alias.
THOMAS KIERNAN: Yes.
MR. HOWARD: What does it reflect about the IP address for this server?
THOMAS KIERNAN: 207.106.6.25.
MR. HOWARD: And what does it say about the host for the server?
THOMAS KIERNAN: Jtan.com.
MR. HOWARD: And what does it list as the email/user of this server?
THOMAS KIERNAN: Ggb.
MR. HOWARD: What does it list about the location of the server?
THOMAS KIERNAN: USA.
MR. HOWARD: And what does it describe about the use of the server?
THOMAS KIERNAN: Backup.
MR. HOWARD: I just want to draw your attention to one more row that's not highlighted, this one right here, there's Bora and then there's one that says BTC, correct?
THOMAS KIERNAN: Yes.
MR. HOWARD: And there's an IP address?
THOMAS KIERNAN: Sure.
MR. HOWARD: What is the IP address?
THOMAS KIERNAN: 193.107.86.34.
MR. HOWARD: Where is that located?
THOMAS KIERNAN: Iceland.
MR. HOWARD: What is the described use for that server?
THOMAS KIERNAN: Live wallets, and then in parenthesis, archive wallets.
MR. HOWARD: Now, Mr. Kiernan, what is listed on the very next line as the use of the following server? We haven't talked about this server, but what is listed in the "use" column?
THOMAS KIERNAN: I'm sorry. For which?
MR. HOWARD: It's this one -- you just said live wallets?
THOMAS KIERNAN: Yes.
MR. HOWARD: What is the use of the following server?
THOMAS KIERNAN: Oh, the one after it?
MR. HOWARD: Yes.
THOMAS KIERNAN: The 178 -- that's smed has.
MR. HOWARD: In your review of Tor chats recovered from the defendant's computer, did you find any references to smed?
THOMAS KIERNAN: I did; yes.
MR. HOWARD: Ms. Rosen, can you please publish Government Exhibit 231A, which has already been admitted into evidence.
MR. HOWARD: And this chat is dated May 4, 2012, correct?
THOMAS KIERNAN: Yes.
MR. HOWARD: "Myself: can I get your thoughts on something?
Smed: always
Smed: i am your slave :)
Myself: vm isolation vs. seperate physical machines vs. jails, permissions, etc.
Smed: yeah
Smed: interesting stuff
Smed: the more moving parts you have, the more doors you have to protect
Myself: "attack surface" yea?
Smed: yeah
Smed: i have been staring at the ceiling a lot over this project and how to go about it
Myself: lots of ins and outs, lots of what have yous, lots of strands in the 'ol duder
Myself: shead
Smed: i think a medium footprint is best.. it's impossible to be small.. you just cant do it. all paths lead down to the same road.. you will have 1 or 2 servers under constant attack by people you dont want getting in
Smed: so my job, as I see it, is to make sure that when they do get in that you can get back up and running with minimal damage
Smed: for example.. moving btc to cold storage offline as soon as daily funding estimates are reached
Myself: prevent, detect, redeploy
Smed: yes!
Myself: patch
Myself: and on and on
Smed: yeah, exactly"
Just leave us on this page for a second.
MR. HOWARD: Mr. Kiernan, in the first line it says by smed, "For example, moving BTC to cold storage offline as soon as daily funding estimates are reached."
Do you see that?
THOMAS KIERNAN: I do. Yes.
MR. HOWARD: Do you have familiarity with bitcoin transactions?
THOMAS KIERNAN: I do.
MR. HOWARD: Do you have familiarity with what cold storage refers to in the context of bitcoins?
MR. DRATEL: Object; foundation.
THE COURT: Why don't you build more foundation for that before he answers, before he answers that last question, all right?
MR. HOWARD: Sure.
THE COURT: In connection with his work how has he encountered cold storage, etc.
MR. HOWARD: Yes.
MR. HOWARD: In connection with your work as a computer scientist at the FBI, have you had experience with bitcoin wallet files?
THOMAS KIERNAN: Yes, I have.
MR. HOWARD: Have you had experience in dealing with bitcoin wallet files on computers you've examined?
THOMAS KIERNAN: Yes.
MR. HOWARD: Are you familiar with how bitcoins are stored?
THOMAS KIERNAN: I am.
MR. HOWARD: Are you familiar with terminology used to refer to various bitcoin wallets and where they are stored?
THOMAS KIERNAN: Yes.
THE COURT: Go ahead.
MR. HOWARD: So do you -- are you familiar with what the phrase cold storage means in reference to bitcoins?
THOMAS KIERNAN: Yes.
MR. HOWARD: And what does it refer to?
THOMAS KIERNAN: Sure. So when you're running a bitcoin wallet, you have a -- it's a live, working device, not device but software. It's -- what you do is, when you take your wallet from the live working machine, basically you move it offline; you take it and copy it someplace else so the computer doesn't have access to it, others don't have access to it and the wallet is basically in a cold storage state. You can't make changes to it at that point.
THE COURT: You move the wallet off the computer?
THOMAS KIERNAN: You can. You just move it to a place that it's not working in that program anymore. So it's not accessible to the actual coins, to the actual program running.
THE COURT: I see.
You may continue.
MR. HOWARD: Ms. Rosen, would you please publish Government Exhibit 231B, which has already been admitted into evidence.
MR. HOWARD: And this chat is dated May 4, 2012. Is that correct?
THOMAS KIERNAN: Yes. Sorry.
MR. HOWARD: "Smed: i should be pushing you some code tonight or tomrrow
Smed: i'm up against multiple deadlines due to travel schedule
Myself: stress!
Smed: :)
Smed: i'm going to finish mods to your login function hopefully tonight
Myself: hey smed, run into some trouble with the code you mentioned yesterday?
Smed: what code did you have problems with?
Myself: none, just wondering if you had trouble since you said you'd push me some by now, but it sounds like you are just busy getting out of town
Smed: actually.. i should have something in a bit"
(Pause)
MR. HOWARD: I'm sorry. I didn't realize it was done.
Ms. Rosen, can you please publish Government Exhibit 231C, which has already been admitted into evidence.
MR. HOWARD: This chat begins on May 15, 2012, is that correct, Mr. Kiernan?
THOMAS KIERNAN: Yes.
MR. HOWARD: "Myself: hey, got a minute?
Smed: always
Myself: thanks, just wanted to check in with you. can you give me a quick rundown of where we've been, where we are, where we are going in the development process? I'm getting a bit disoriented as new things have come up since we began and I don't have anything tangible to orient around.
Smed: Sorry about that. My bad completely
Myself: no worries, we don't exactly have the most freedom communication wise
Smed: exactly!! I'm glad you see it.. Normally, my development process is quite open. The nature of the firewall between you and the rest of the world has left a large gap in my normal way of doing things and my habits have not been suffificently corrected to make that extra step
Smed: Where we are..
Smed: We have a fully functional "escrow management system" in it's most raw form
Smed: it moves BTC between users, in both roles as shoppers and merchants
Smed: admin/overlord role has the power to do anything it wants as far as approving or rejecting transactions
Smed: this 'system' in it's current form is going through some fine tooth comb work right now to ensure that nothing has been missed when it comes to decimal places, confirmations etc
Smed: existing test results have shown a high degree of accuracy in reguards to all transactions
Smed: i have not yet been able to cheat the system, however those final tests (trying to cheat) have not been marked as complete yet because we have not let cimon loose on it ;)
Smed: That side of the project is Team 1
Smed: Team 2 is working on the more public side of the shopping system
Smed: the vendor management piece
Smed: I have had several set backs and delays in the vendor part and that side was behind for about 3 weeks due to the moron factor
Smed: however, team 2 came through last week with part 2 of 3
Smed: really where i'm at is this..
Smed: I have replaced your entire foundation.. i probably have a little bit more efficient approach only because hindsight is 20/20
Myself: always good to get a fresh set of eyes on a problem
Smed: exactly
Smed: from what I have seen.. if you did it right now i dont think you would change much from what i'm doing
Smed: i've focused a lot on abstraction of the concepts
Smed: making each one of them a bit more accessable individually
Smed: but the concepts are yours either way
Myself: well, I'm not one to hold your feet to the fire on estimates, I know you are working hard, but are we behind our intial estimate at this point?
Smed: I'm going to be testing the latest submission tonight and tomorrow.. the order management stuff.. will know more about that side afterwards
Smed: I am a little behind on part, but some of the additional code work (ykey etc) will allow me to catch up
Myself: how does additional work equal catching up?
Smed: because i'm bringing in more people to help me
Myself: ahh
Smed: Just so it's said.. I have lots of motivation to get this done to where I stay in your good graces"
MR. HOWARD: Would you flip to what has been marked as Government Exhibit 254 in your binder for identification purposes.
THOMAS KIERNAN: Okay.
MR. HOWARD: Do you recognize this exhibit?
THOMAS KIERNAN: I do.
MR. HOWARD: What is it?
THOMAS KIERNAN: It's a file pulled from the defendant's laptop.
MR. HOWARD: What was the name of the file?
THOMAS KIERNAN: Interview_questions.txt.
MR. HOWARD: And what was the location of the file?
THOMAS KIERNAN: This was found in the home/frosty/backup/reference/directory.
MR. HOWARD: And on what date was this file last saved on the defendant's computer?
THOMAS KIERNAN: 6/5/2013.
MR. HOWARD: And when was it first created on the defendant's computer?
THOMAS KIERNAN: Also 6/5/2013.
MR. HOWARD: The government offers Government Exhibit 254 into evidence.
MR. DRATEL: Prior objections, your Honor.
THE COURT: Those objections are overruled. GX 254 is received.
(Government's Exhibit 254 received in evidence)
MR. HOWARD: Zoom in on the top, Ms. Rosen.
MR. HOWARD: And I'm sorry, the name of the file was interview_questions.txt, right?
THOMAS KIERNAN: Correct, yes.
MR. HOWARD: "What kind of computer did you use laptop/desktop? What model and how old is it? What OS do you use? Do you use whole disk encryption? Do you use a Tor bridge? Do you use a VPN or proxy? Who in your life knows of your involvement with Silk Road? Does anyone IRL know you are a mod on the forums? Does anyone (IRL or here) know I've offered you a promotion? How long will it take you to wrap up your other responsibilities and begin training? Are there any major situations in your life that might pull you away from your responsibilities here on short notice (health, family, etc.)? Do you have an income stream outside of SR? How do you intend to launder your earnings?"
MR. HOWARD: Mr. Kiernan, could you please flip to what's been marked as Government Exhibit 270 in your binder for identification purposes.
THOMAS KIERNAN: Yes.
MR. HOWARD: And do you recognize this exhibit?
THOMAS KIERNAN: I do.
MR. HOWARD: And what is it?
THOMAS KIERNAN: Again, a file extracted from the defendant's laptop.
MR. DRATEL: Objection, your Honor. Withdrawn.
THE COURT: All right. Proceed, Mr. Howard.
MR. HOWARD: And what was the name of this file?
THOMAS KIERNAN: 1.text.
MR. HOWARD: Where was it located in the defendant's computer?
THOMAS KIERNAN: Sure. This was under the home/frosty/documents/archive/documents/op/prof/sec/security/ Arto directory.
MR. HOWARD: The government offers Government Exhibit 270.
MR. DRATEL: Same objections as prior.
THE COURT: All right. Those objection are overruled. GX 270 is received.
(Government's Exhibit 270 received in evidence)
MR. HOWARD: Ms. Rosen, can you just zoom in on the top section maybe down to about there. It starts "On Sep. 15, 2009, at 17:01, Ross Ulbricht wrote," and now there's a section with the little caret signs:
"Dear Arto. Thank you for being open to my questions. I don't want to bother you too much, but I find this topic fascinating and very applicable. The impression I get is that the technology is getting close but not quite there yet."
MR. HOWARD: What does the sections that is marked with the caret signs in this document appear to be?
THOMAS KIERNAN: An email.
MR. HOWARD: And what does the section that is marked with these little caret signs appear to be?
MR. DRATEL: Objection as to drawing conclusions.
THE COURT: Why don't you describe whether in your experience in your job you've seen documents which have a format similar to this.
THOMAS KIERNAN: Okay. Yes, I've seen emails or documents with this type of format where it has the -- this conversation split between basically a "from" and a "to," like a thread of emails or a thread that keeps getting included on your emails before.
This is based in a text file as opposed to a real email would look like from your email clients, but it's the appearance from that same type of format. So to me, it looks like an email conversation and it's divided by the greater-than signs.
MR. HOWARD: What does the greater sign portion refer to?
THOMAS KIERNAN: That would be the person -- that would be, in this case, it would be what Ross Ulbricht wrote in his email.
MR. HOWARD: Now, Ms. Rosen, I just want to read only the parts that have the carets by it.
"Dear Arto. Thank you for being open to my questions. I don't want to bother you too much but I find this topic fascinating and very applicable. The impression I get is that the technology is getting close but not quite there yet. What do you think of Tor browsing and Tor hiding services? Is it as anonymous as they say it is? The hidden services part sounds interesting, but I have been unsuccessful in actually accessing any of the existing ones yet including eCache."
Ms. Rosen, can you zoom in on the bottom part and highlight the section with the carets, please.
"With Pecunix, I understand it is a goldbacked digital currency. Can I anonymously and securely deposit funds? Can I anonymously and securely withdraw funds in the form of fiat currency or gold? I can see how it would work as a closed system, but is there a way to integrate it with the rest of the economy securely?
"I would love to be able to set up an online storefront that couldn't be traced back to me (Tor hidden services?) where my customers could buy my products (revealing their identity only to me) and transferring funds to me anonymously and securely (Pecunix?). I suppose this is the ideal. What are the key pieces that are currently missing that would make this a reality. Once again, I appreciate your willingness to discuss these matters with me."
MR. HOWARD: Mr. Kiernan, would you please turn to what's been marked for identification purposes as Government Exhibit 280 in your binder.
THOMAS KIERNAN: Okay.
MR. HOWARD: Do you recognize this exhibit?
THOMAS KIERNAN: I do.
MR. HOWARD: And what is that?
THOMAS KIERNAN: A file extracted from the defendant's computer.
MR. HOWARD: And where was it located on the defendant's computer?
THOMAS KIERNAN: This was found in the home/frosty/backup/reference/directory.
MR. HOWARD: What was the name of the file?
THOMAS KIERNAN: XMPP.txt.
MR. HOWARD: The government offers Government Exhibit 280.
THE COURT: Mr. Dratel.
MR. DRATEL: Hearsay and Vayner.
THE COURT: All right. Those objections are overruled and GX 280 is received.
(Government's Exhibit 280 received in evidence)
MR. HOWARD: "1. download and install pidgin."
And then there's a weblink to add Pidgin.
"2.10.7.exe"
2. close pidgin
3. download and install off-the-record (OTR)
4. start pidgin
5. enable OTR from the plugins menu
6. make sure Tor is running
7. create a new account
8. basic settings
8.a. protocol: XMPP
8.b. username: ***
8.c. domain: pi5mmj2ronhutyxv.onion
8.d. password: ***
9. advanced"
Some more instructions 9a through 10c.
"11. add the account. if it doesn't connect, double check the socks port
Tor is listening on and change step 10.c. accordingly
13. add buddy "dread@pi5mmj2ronhutyxv.onion". if I'm online we'll connect. There are a few more steps to finalize OTR, but those can be done once we're chatting."
Ms. Rosen, can you please move this to the left-hand side of the screen and publish Government Exhibit 127 on the right side of the screen, which is already in evidence, which is a forum post from the Dread Pirate Roberts -- sorry -- a private message from the Dread Pirate Roberts. Can you focus on actually on the instructions part, the text.
MR. HOWARD: Mr. Kiernan, how does the instructions that appear in the private message from Dread Pirate Roberts on the right side compare with the document you recovered from the defendant's computer?
THOMAS KIERNAN: They're identical except for the username and the password fields on the right-hand side of the screen have been filled in.
MR. HOWARD: Mr. Kiernan, can you please flip to what's been marked as Government Exhibit 271 in your binder.
THOMAS KIERNAN: Okay.
MR. HOWARD: Do you recognize this exhibit?
THOMAS KIERNAN: I do.
MR. HOWARD: And what is it?
THOMAS KIERNAN: It's a file extracted from the defendant's computer.
MR. HOWARD: And what was the date that the file was last modified?
THOMAS KIERNAN: 8/21/2009.
MR. HOWARD: And what was the date that this file was saved to the defendant's computer?
THOMAS KIERNAN: 5/8/2012.
MR. HOWARD: Is this the date that you described previously that there were a lot of files that were saved on the computer on that date?
THOMAS KIERNAN: Yes.
MR. HOWARD: The government offers Government Exhibit 271.
MR. DRATEL: Same objections as previously.
THE COURT: All right. Those objections are overruled. GX 271 is received.
(Government's Exhibit 271 received in evidence)
THE COURT: "The construction and operation of clandestine drug laboratories, second edition. Revised and expanded, Jack B. Nimble." It says Jelly PDR version.
The second page, can we zoom in on the table of contents. And I'm just going to read the section contents: "Preface to second edition, the risks, security, scanners and monitoring equipment, safety, location and facilities, when to stop and how, glassware, heating, stirring and mixing, fume hoods, miscellaneous equipment, scaling up, procurement of suspicious items, tablets, capsules, and other packaging materials, computers."
"Appendix one is more equipment; appendix two, watched chemicals; appendix three, watched laboratory equipment; appendix four, legitimate businesses that use laboratory equipment; appendix five, common products and the valuable chemicals they contain; and appendix six, recommended reading."
Ms. Rosen, can you flip through some of the pages. Don't spend too much time with it.
(Continued on next page)
MR. HOWARD: OK. Ms. Rosen, you can take it off.
BY MR. HOWARD:
MR. HOWARD: Mr. Kiernan, could you please flip to what has been marked as Government Exhibit 272 in your binder.
MR. HOWARD: Do you recognize this exhibit?
THOMAS KIERNAN: Yes, I do.
MR. HOWARD: And what is it?
THOMAS KIERNAN: A file extracted from the defendant's computer.
MR. HOWARD: And what is the date this file was last changed?
THOMAS KIERNAN: 9/21/2013.
MR. HOWARD: What does the metadata reflect about the date that the file was first saved in the defendant's computer?
THOMAS KIERNAN: 9/24/2013.
MR. HOWARD: The government offers Government Exhibit 272.
MR. DRATEL: The same objections, your Honor.
THE COURT: All right. GX272 is received. The objections are overruled.
(Government's Exhibit 272 received in evidence)
MR. HOWARD: Ms. Rosen, publish Government Exhibit 272. Let's zoom in on the text on the back.
"Silk Road proof September 20 DPR," and then a heart symbol.
Ms. Rosen, you can take that down.
MR. HOWARD: Mr. Kiernan, could you please flip to what has been marked as Government Exhibit 275 in your binder?
MR. HOWARD: Do you recognize what this exhibit is?
THOMAS KIERNAN: I do.
MR. HOWARD: What is it?
THOMAS KIERNAN: A file extracted from the defendant's computer.
MR. HOWARD: What is the title of the file?
THOMAS KIERNAN: "Ops.txt."
MR. HOWARD: Where was the file located in the defendant's computer?
THOMAS KIERNAN: This was in the "home/frosty/backup/reference by me" directory.
MR. HOWARD: The government offers Government Exhibit 275.
MR. DRATEL: The same as before, your Honor.
THE COURT: All right. Those objections are overruled. Government Exhibit 275 is received.
(Government's Exhibit 275 received in evidence)
MR. HOWARD: We'll publish this at a later time, your Honor.
THE COURT: All right.
BY MR. HOWARD:
MR. HOWARD: Mr. Kiernan, could you please flip to what has been premarked as Government Exhibits 290 and 291 in your binder.
THOMAS KIERNAN: 290 and 291, OK.
MR. HOWARD: Do you recognize these exhibits?
THOMAS KIERNAN: I do.
MR. HOWARD: And what are they?
THOMAS KIERNAN: Files extracted from the defendant's computer.
MR. HOWARD: And what is the name of Government Exhibit 290, the name of the file?
THOMAS KIERNAN: 290, yes. "Dominica-economic-citizenship2011.pdf.
MR. HOWARD: And where was it located on the defendant's computer?
THOMAS KIERNAN: This was in the "home/frosty/backup/reference/ politics/Dominica" folder.
MR. HOWARD: And what is the title of Government Exhibit 291, the title of the file?
THOMAS KIERNAN: Oh, "Disclosure form."
MR. HOWARD: And where was that located on the defendant's computer?
THOMAS KIERNAN: The location, file location was in "home/frosty/backup/ reference/politics/dominica" folder.
MR. HOWARD: Is that the same folder that Government Exhibit 291 was found in?
THOMAS KIERNAN: Yes.
MR. HOWARD: What are the dates -- what is the date that Government Exhibit 291 was first saved to defendant's computer?
THOMAS KIERNAN: 5/1/2012.
MR. HOWARD: And how about Government Exhibit 291?
THOMAS KIERNAN: I'm sorry, that was 291.
MR. HOWARD: So to be clear, let's go to 291 --
THOMAS KIERNAN: I'm sorry, 291, yes.
MR. HOWARD: What date was that?
THOMAS KIERNAN: 5/8/2012.
MR. HOWARD: How about the other one, 290?
THOMAS KIERNAN: Sorry about that. 290, 5/8/2012.
MR. HOWARD: The government offers Government Exhibits 290 and 291.
MR. DRATEL: Objection on 403, hearsay, Vayner, and that is it.
THE COURT: All right. DXs -- sorry, Government Exhibits 290 and 291 are received. The objections are overruled.
(Government's Exhibits 290 and 291 received in evidence)
MR. HOWARD: Thank, your Honor.
Ms. Rosen, could you please publish Government Exhibit 290.
MR. HOWARD: Mr. Kiernan, this is the first page of the document that is depicted on the screen, correct?
THOMAS KIERNAN: Yes.
MR. HOWARD: Here it says "Commonwealth of Dominica Economic Citizenship Program, Guide of Reference 2011."
MR. HOWARD: Ms. Rosen, could you add the highlights to the document. Let's zoom in on the bottom here.
"Benefits of passport of the Commonwealth of Dominica. Dominica recognizes dual citizenship, and you are not required to renounce your other citizenships. Besides that, Dominica does not notify authorities of your country of residence or citizenship on your Dominican citizenship."
"Dominican citizenship is the most affordable option and the one quicker to obtain. It requires a $75,000 U.S. donation for a single option and $100,000 U.S. for a family option, and normally takes 2 to 5 months."
Could we now publish 291, please? Zoom in on the top.
It's titled, "Disclosure Form - Individual."
MR. HOWARD: And, Mr. Kiernan, this was found in the same folder you said as the guide that we just saw, correct?
THOMAS KIERNAN: Yes, the same folder.
MR. HOWARD: Ms. Rosen, could you zoom back out. Can you zoom in on the name, this box here.
Last name Ulbricht, first name Ross, middle names William. And then we have the beginning of a Social Security number on the last line.
Could you go to the next page, please.
Zoom in on this additional personal information. OK.
MR. HOWARD: I'm not going to read all of this in, but we have fields including date of birth, place of birth, names of family members, and other identifiers; correct, Mr. Kiernan?
THOMAS KIERNAN: Correct.
MR. HOWARD: Ms. Rosen, could you slide down just a little bit on that page.
MR. HOWARD: And here you see a cell phone number that's been redacted, an email address, "rossulbricht@gmail.com," correct?
THOMAS KIERNAN: Correct.
MR. HOWARD: Zoom out, Ms. Rosen.
Down -- can we just zoom in on this bottom section, please.
MR. HOWARD: "Residences: (List all residences) (other than your current) you have had for the last 10 years."
One from 9/2009 to 5/16/2012. There is an Austin, Texas reference. And then lower than that there is a July 2006 to September 2009 State College, Pennsylvania, reference. Correct?
THOMAS KIERNAN: Correct.
MR. HOWARD: Can you go to the next page, Ms. Rosen. Just keep on going. Can you zoom in on the "Education" section here?
MR. HOWARD: "Education: "List all academic and trade schools attended." I'm not going to read all of it, but College/University, University of Texas at Dallas from August 2002 through May 2006, and then Pennsylvania State University from July 2006 through September 2009.
At the bottom we have "List All Academic Degrees Conferred." "BS Physics, UT Dallas, May 2006; M.S. Materials Science, Penn State University May 2009."
On the next page, the columns are "Name of Employer, Address of Employer, Position Held, Dates, Month and Year, and reason for leaving."
And the first row is "Self (IT consulting)," and the reason for leaving, it says "Current" there, right?
THOMAS KIERNAN: Yes, it does.
MR. HOWARD: And what is the time period that he has been self-employed, according to this column -- row, I'm sorry?
THOMAS KIERNAN: Sure. March 2011 to the present.
MR. HOWARD: And what is his previous employment listed as?
THOMAS KIERNAN: Good Wagon Books.
MR. HOWARD: What are the dates that are listed for his employment at Good Wagon Books?
THOMAS KIERNAN: November of 2009 to May of 2011.
MR. HOWARD: And what is listed as the reason for living -- for leaving?
THOMAS KIERNAN: "Business was liquidated."
MR. HOWARD: Ms. Rosen, could you please move to the last page of this exhibit. And then right here above the signature line. Above it, please. Thank you.
MR. HOWARD: The last paragraph: "I authorize investigation of all statements contained herein and the references and employers listed above to give you any and all information concerning my previous employment and any pertinent information they may have, personal or otherwise, and release the company conducting the investigation and the government of Dominica from all liability for any damage that may result from utilization of such information."
Mr. Kiernan, can you please flip in your binder to what has been marked for identification purposes as Government Exhibit 295.
MR. HOWARD: Do you recognize this exhibit?
THOMAS KIERNAN: I do.
MR. HOWARD: And what is it?
THOMAS KIERNAN: A file extracted from the defendant's computer.
MR. HOWARD: And what date was this file first saved on the defendant's computer, according to the metadata?
THOMAS KIERNAN: 5/8/2012.
MR. HOWARD: The government offers Government Exhibit 295.
THE COURT: Any objection?
MR. DRATEL: Yes, your Honor. Hearsay and Vayner.
THE COURT: All right. Those objections are overruled, and Government Exhibit 295 is received.
(Government's Exhibit 295 received in evidence)
BY MR. HOWARD:
MR. HOWARD: So, Mr. Kiernan, how many pages is this exhibit?
THOMAS KIERNAN: Two.
MR. HOWARD: And so what is depicted right here on the -- is this another screenshot from FTK Imager?
THOMAS KIERNAN: Yes.
MR. HOWARD: And where was this file located?
THOMAS KIERNAN: This was in the "home/frosty/documents/archive/documents/op prof sek/security/aliases/Richard Page" folder.
MR. HOWARD: Can you zoom out please, Ms. Rosen, and can you zoom in on the top left-hand corner here.
MR. HOWARD: Is this an image showing -- another image showing the directory structure of the defendant's computer?
THOMAS KIERNAN: Yes.
MR. HOWARD: And can you zoom in on this part, Ms. Rosen.
MR. HOWARD: And so is the directory that you just referenced as to where the file was located reflected in this?
THOMAS KIERNAN: Yes.
MR. HOWARD: Can you just point it out?
THOMAS KIERNAN: Sure. The name of the folder is "Richard Page."
MR. HOWARD: That was in a folder called "Aliases," correct?
THOMAS KIERNAN: Correct.
MR. HOWARD: Which is, in turn, in a folder called "security," correct?
THOMAS KIERNAN: That's correct.
MR. HOWARD: What does the metadata of the document reflect about the date that this file was first saved to the defendant's computer?
THOMAS KIERNAN: 5/8/2012.
MR. HOWARD: Is that this reference right by the "Date Created" field?
THOMAS KIERNAN: Yes.
MR. HOWARD: And earlier you testified that there were a lot of files with that date on them?
THOMAS KIERNAN: Yes.
MR. HOWARD: Can you zoom out, please.
MR. HOWARD: What is contained on the bottom right-hand corner of this exhibit? What does this part of the screenshot represent?
THOMAS KIERNAN: Oh, the contents of the file, what was in the file. It is a viewer for that.
MR. HOWARD: So we have: "Name: Richard Page. DOB: 5/13/1977. Married. Address, or "Addr:" 11640 Gary Street, Garden Grove, California 92840, United States. Phone is 714-620-7320. PGP pass phrase, and then a redacted area there.
Is there text in that section that is redacted?
THOMAS KIERNAN: Yes.
MR. HOWARD: And down here we see the word KalyHost, AutoVPS, Silk Road, staff@SilkRoad.org, correct?
THOMAS KIERNAN: Correct.
MR. HOWARD: Ms. Rosen, can you please move this to the left-hand part of the screen.
Could you publish Government Exhibit 150 on the right-hand side, which has already been admitted into evidence, which is the who.is information for silkroadmarket.org. Can you just zoom in here.
Actually, a little higher, please. Right there. Actually, you were in the right place. That is my fault.
And a little higher. Just a little bit.
MR. HOWARD: So here it says, "Domain history info for silkroadmarket.org," right?
THOMAS KIERNAN: Correct.
MR. HOWARD: Could you scroll down, Ms. Rosen. Here it says -- I'm sorry. Pause it for a second.
MR. HOWARD: "Old registrar information, March 12, 2011," correct?
THOMAS KIERNAN: Yes.
MR. HOWARD: Could you go down Ms. Rosen.
And this says -- can you focus on this little block right here? Right here.
Here it says: "Registrant contact information. Name: Richard Page. Address: 111640 Gary Street. City: Garden Grove. State: California. Zip: 92840. Country: U.S. Phone: +1.7146207320. And email: Richardpage@gawab.com.
Mr. Kiernan, how does the information on the who.is lookup compare to the information on the file that was recovered from the defendant's computer?
THOMAS KIERNAN: It's the same.
MR. HOWARD: Ms. Rosen, could you please publish Government Exhibit 212, which has already been admitted into evidence.
MR. HOWARD: Mr. Kiernan, what does Government Exhibit 212 depict?
THOMAS KIERNAN: 212 is the file structure of the defendant's laptop, of the "var/www/market" directory.
MR. HOWARD: Let me zoom in over here. Is this upper left-hand window again the file structure of the defendant's computer?
THOMAS KIERNAN: Yes.
MR. HOWARD: And so you are talking about the var/www directory, correct?
THOMAS KIERNAN: I am, yes.
MR. HOWARD: Is this one of the folders you are referring to?
THOMAS KIERNAN: Correct, that is one of the folders.
MR. HOWARD: So what is -- you have experience with Linux-based computers, correct?
THOMAS KIERNAN: I do, yes.
MR. HOWARD: Approximately how many have you analyzed in the course of your career?
THOMAS KIERNAN: Hundreds.
MR. HOWARD: So what kind of files are stored in var/www directory on a computer running Linux?
THOMAS KIERNAN: Typically website files, Web server files.
MR. HOWARD: And what can such website files found on a laptop in this kind of directory be used for?
THOMAS KIERNAN: For maybe backup there or to test out, to try --
MR. DRATEL: Objection. Objection.
THE COURT: Well, apart from this document, your general experience, why don't you discuss that.
THOMAS KIERNAN: Sure. Usually that directory structure on a Linux machine will house or hold Web files for the actual Web server working. So for this you can run it to practice, to test, to backup a website, or things like that would generally appear in this file structure.
MR. HOWARD: Did you review the files in this directory?
THOMAS KIERNAN: I did.
MR. HOWARD: And did this directory contain files associated with any website?
THOMAS KIERNAN: Yes, they did.
MR. HOWARD: And what website was that?
THOMAS KIERNAN: The Silk Road website.
MR. HOWARD: Mr. Kiernan, could you please flip in your binder to what's been marked for identification purposes as Government Exhibits 268 and 269.
(Pause)
MR. HOWARD: And what are these exhibits?
THOMAS KIERNAN: These are files extracted from the defendant's laptop.
MR. HOWARD: And from what part of the laptop?
THOMAS KIERNAN: This was from the "var/www/market/public" directory.
MR. HOWARD: And you testified that this is a part of a Linux system in which Web page files could be stored, correct?
THOMAS KIERNAN: Sure. Yeah.
MR. HOWARD: Did you take these screenshots?
THOMAS KIERNAN: I did, yes.
MR. HOWARD: The government offers Government Exhibits 268 and 269.
THE COURT: Mr. Dratel.
MR. DRATEL: I am just going back to the page, your Honor.
(Pause)
MR. DRATEL: On Vayner, your Honor.
THE COURT: All right. That objection is overruled. Government Exhibits 268, 269 are received.
(Government's Exhibits 268, 269 received in evidence)
THE COURT: There wasn't an objection noted pretrial, but we will go over that at the break.
MR. HOWARD: Ms. Rosen, would you please publish Government Exhibit 268.
MR. HOWARD: So is this another screenshot from FTK Imager?
THOMAS KIERNAN: It is.
MR. HOWARD: And as with the other ones we've seen, is the contents of the file contained in the bottom right-hand corner?
THOMAS KIERNAN: Yes.
MR. HOWARD: What is the title of this file? What is it called?
THOMAS KIERNAN: This is called "closed.PHP."
MR. HOWARD: What does "php" mean?
THOMAS KIERNAN: It's a scripting file or files that can sit on a server running php software. Basically, they are Web pages. That is how they look on the machine hosting that website.
MR. HOWARD: And, Ms. Rosen, can you zoom in on the bottom right-hand corner.
MR. HOWARD: This is the one that contains the contents of the file, correct?
THOMAS KIERNAN: Yes.
MR. HOWARD: And here it says, "Silk Road anonymous market."
Do you recognize what this is, what I am pointing to on the screen?
THOMAS KIERNAN: Yes. That is the Silk Road logo.
MR. HOWARD: It says here: "Silk Road is down for maintenance. More information can be found on the forum here," then a link, correct?
THOMAS KIERNAN: Correct.
MR. HOWARD: And the link includes a dot-onion address, isn't that correct?
THOMAS KIERNAN: That is correct.
MR. HOWARD: Ms. Rosen, would you please publish Government Exhibit 269, please.
MR. HOWARD: Is this another file that was recovered from the part of the computer used to store website files?
THOMAS KIERNAN: Yep. Ah, yes.
MR. HOWARD: And what was the names of this file?
THOMAS KIERNAN: This was "dpr_key.php."
MR. HOWARD: And this is also a website code -- it is a php file?
THOMAS KIERNAN: Right, it is a php file.
MR. HOWARD: Could you zoom in on the bottom right-hand corner of the screenshot, please.
MR. HOWARD: And this, again, this part of the FTK Imager shows the contents of the file, correct?
THOMAS KIERNAN: Yes, it does.
MR. HOWARD: It says: "The following PGP key can be used to verify messages signed by the Silk Road administrator Dread Pirate Roberts. Begin PGP public key block," a bunch of text here and then "End PGP public key block."
What is a PGP key, Mr. Kiernan?
THOMAS KIERNAN: It's a key to enable -- to verify or to enable people to share documents back and forth. The keys basically lock the message that's being shared. To actually read it, you share your public key with other people so they can open or verify things that you get from them.
MR. HOWARD: Ms. Rosen, can you just move this to the left-hand side of the screen and just focus on the actual contents.
And on the right side, can we please publish Government Exhibit 133, which is a screenshot taken by Special Agent Der-Yeghiayan of the Silk Road website.
And can we zoom in on the text here. Above that, please.
"The following PGP key can be used to verify messages signed by the Silk Road administrator Dread Pirate Roberts. Begin PGP public key block." A bunch of text. And "End PGP public key block."
MR. HOWARD: Mr. Kiernan, how did this file on the defendant's laptop compare to this page from the Silk Road website?
THOMAS KIERNAN: They were the same.
MR. HOWARD: Now, what kind of -- is this a public key or private key, Mr. Kiernan?
THOMAS KIERNAN: These are public keys.
MR. HOWARD: Did you find in your analysis of the defendant's computer, did you find a corresponding PGP private key?
THOMAS KIERNAN: I did, yes.
MR. HOWARD: Mr. Kiernan, would you please flip in your binder to what has been marked for identification purposes to Government Exhibit 296.
(Pause)
MR. HOWARD: Do you recognize what this is?
THOMAS KIERNAN: Yes.
MR. HOWARD: And what is it?
THOMAS KIERNAN: This is the file extracted from the defendant's computer. It's the Silk Road private key.
MR. HOWARD: How many pages is this exhibit?
THOMAS KIERNAN: Two.
MR. HOWARD: What is the second page of this exhibit?
THOMAS KIERNAN: The second page is when I imported that key into a different program, a PGP -- a GPG program to get the statistics of that file.
MR. HOWARD: Mr. Kiernan, is that a screenshot that you took?
THOMAS KIERNAN: Oh, I'm sorry. Yes, it is. Yes.
MR. HOWARD: The government offers Government Exhibit 296.
MR. DRATEL: Objection. Vayner and hearsay.
THE COURT: All right. Those objections are overruled. GX296 is received.
(Government's Exhibit 296 received in evidence)
BY MR. HOWARD:
MR. HOWARD: So, Mr. Kiernan, is this another screenshot taken from FTK Imager?
THOMAS KIERNAN: It is, yes.
MR. HOWARD: What is the name of the directory that's depicted here on the upper -- the files, what directory are they from?
THOMAS KIERNAN: The "Home/frosty/backup/keys" directory.
MR. HOWARD: And could you focus in on the top right-hand window, Ms. Rosen.
MR. HOWARD: These are the files that are located in that directory?
THOMAS KIERNAN: Yes.
MR. HOWARD: And where did you find the corresponding private key for the Dread Pirate Roberts?
THOMAS KIERNAN: In this directory.
MR. HOWARD: And which file was it?
THOMAS KIERNAN: SilkRoad.asc."
MR. HOWARD: Can we please flip to page second -- page 2 of the exhibit.
Can you explain what is depicted in this screenshot?
THOMAS KIERNAN: Yes. So this was the gpg software where I imported the keys from that other public -- from that file, from the defendant's laptop.
MR. HOWARD: What is gpg software?
THOMAS KIERNAN: It's software to trade -- not trade, but it's software used to create keys, pass out keys. So when I sign my stuff, my mails or my documents, I can give you the other key to actually verify it is my stuff.
MR. HOWARD: And so can we zoom in on this window here, Ms. Rosen, the whole window. If you could do the whole window.
MR. HOWARD: And so what does this depict, Mr. Kiernan?
THOMAS KIERNAN: That depicts the opening of that ASC file that you saw before, and it shows the name of the key, the Silk Road, the email associated with the key, the staff@silkroadmarket.org. And then if you go down, the date that the key was created. And if you continue down, it says "key." And right next to it it has "secret and public key" contained within that file.
MR. HOWARD: So what does "secret and public key" mean?
THOMAS KIERNAN: So I could build -- well, it contains both keys. I could sign stuff and open stuff using this and verify stuff using these keys.
MR. HOWARD: If this wasn't a private key, if this was a public key, what would it say there?
THOMAS KIERNAN: Just have the public -- "secret" would be off there. Public key would be the only thing you could see there.
MR. HOWARD: What was the date this private key was created?
THOMAS KIERNAN: April 1st, 2011.
MR. HOWARD: And were you able to verify that this matched with the public key?
THOMAS KIERNAN: I was able to extract the public key from it, yes.
MR. HOWARD: And did it correspond to the public key for the Dread Pirate Roberts that you found on the Silk Road website and the on the defendant's computer?
THOMAS KIERNAN: Yes.
THE COURT: Mr. Howard, you've got about eight minutes left. All right? Just to give you a sense of timing.
MR. HOWARD: For the day, your Honor?
THE COURT: For the day.
MR. HOWARD: I think there would be a few more questions, and then it would be an appropriate time for a natural breaking point, if that works.
THE COURT: Absolutely, I want you to use the time or for sure. I just wanted to give you a sense of what you've got left.
MR. HOWARD: Thank you, your Honor.
BY MR. HOWARD:
MR. HOWARD: Mr. Kiernan, can you please flip in your binder at what has been marked for identification purposes as Government Exhibit 212A.
(Pause)
MR. HOWARD: How many pages is Government Exhibit 212A?
THOMAS KIERNAN: Three pages.
MR. HOWARD: Do you recognize what this exhibit is?
THOMAS KIERNAN: I do. Files extracted from the defendant's computer.
MR. HOWARD: And where on the computer were these files located?
THOMAS KIERNAN: These were in the var/www/market/application/views directory.
MR. HOWARD: Is this part of the same var.www directory that you described that was used to have Web page files?
THOMAS KIERNAN: Yes.
MR. HOWARD: Did you take these screenshots?
THOMAS KIERNAN: I did, yes.
MR. HOWARD: The government offers Government Exhibit 212A.
THE COURT: Mr. Dratel.
MR. DRATEL: Objection on Vayner and hearsay grounds, your Honor.
THE COURT: All right. Those objections are overruled. Government Exhibit 212A is received.
(Government's Exhibit 212A received in evidence)
MR. HOWARD: Ms. Rosen, could you please publish page 1.
MR. HOWARD: Are all the pages in this exhibit various screenshots of files found within that directory used for website files?
THOMAS KIERNAN: Yes.
MR. HOWARD: What is the name of the file that's depicted on the first page?
THOMAS KIERNAN: About.php.
MR. HOWARD: Could you focus on the bottom right-hand corner.
THOMAS KIERNAN: I can, yes.
MR. HOWARD: Ms. Rosen, why don't we just focus on maybe the top of this. We will see it a little bigger.
MR. HOWARD: So, Mr. Kiernan, there is also -- there is this text here that's inside little brackets.
THOMAS KIERNAN: Yes.
MR. HOWARD: What does that represent? What is that?
THOMAS KIERNAN: That's actually code within the file. It doesn't get rendered correctly in this viewer.
MR. HOWARD: Are you familiar with that kind of code?
THOMAS KIERNAN: Yes.
MR. HOWARD: Can you describe -- can you read or point to on the screen if this file was loaded in a browser, what is the text that would appear?
THOMAS KIERNAN: Sure.
MR. HOWARD: Read it, please.
THOMAS KIERNAN: "Greetings and welcome to Silk Road." That would be one of them. "I know you can't wait to get to the good stuff, but please take a moment to read this message. It's been written to help keep you safe," and things like that.
MR. HOWARD: That's enough.
Can we go to the second page of this exhibit. What was this file called?
THOMAS KIERNAN: This was called "logo_hi-res.jpg."
MR. HOWARD: What kind of file is a JPG file?
THOMAS KIERNAN: An image file, a picture file.
MR. HOWARD: Was this also found in that same section of the defendant's computer?
THOMAS KIERNAN: The same section, yes.
MR. HOWARD: Do you recognize the photograph that that file contains?
THOMAS KIERNAN: I do, yes. It's the Silk Road logo.
MR. HOWARD: Ms. Rosen, can we flip to the last page of this exhibit.
MR. HOWARD: What is the name of this Web page?
THOMAS KIERNAN: "Sellers_guide.php."
MR. HOWARD: Ms. Rosen, can you zoom into the bottom right-hand window.
MR. HOWARD: Again, this contains certain Web page code, correct?
THOMAS KIERNAN: Correct, it does.
MR. HOWARD: Could you please read the first two lines of what the text would appear like and point to it on the screen if this was loaded into a Web browser?
THOMAS KIERNAN: Sure. "Sellers Guide. You and you alone will have your client's shipping address" -- I'm sorry. Above that, it is "Client Anonymity." Yes. Right there. "This information must be destroyed as soon as it is used to label their package," and so on.
MR. HOWARD: Now, if you read the next couple of lines.
THOMAS KIERNAN: Oh, sure.
"Never ask your clients for personal information. Under no circumstance should you save a copy of your client's address. Publish a public encryption key in your user description on your settings page."
Sorry. All the way over here.
MR. HOWARD: Ms. Rosen, can you zoom out, please.
Can you zoom in on the upper right-hand window.
MR. HOWARD: And, Mr. Kiernan, what are all of these files that include ".php" at the end?
THOMAS KIERNAN: They are all Web page files.
MR. HOWARD: Here we have "Buyers_guide.php," "Category." We discussed some already, like "DPR_key.php," correct?
THOMAS KIERNAN: Correct.
MR. HOWARD: Reviews.php?
THOMAS KIERNAN: Yes.
MR. HOWARD: Support.php, user.php?
THOMAS KIERNAN: Yes.
MR. HOWARD: Write_review.php?
THOMAS KIERNAN: Yes.
MR. HOWARD: These are all Web pages?
THOMAS KIERNAN: Yes.
MR. HOWARD: Mr. Kiernan, would you please flip in your binder to what's been marked for identification purposes as Government Exhibit 212B.
THOMAS KIERNAN: 212B?
MR. HOWARD: Do you recognize what this is?
THOMAS KIERNAN: Yes.
MR. HOWARD: And what is this?
THOMAS KIERNAN: A file extracted from the defendant's computer.
MR. HOWARD: And did you take this screenshot of this file?
THOMAS KIERNAN: I did, yes.
MR. HOWARD: The government offers Government Exhibit 212B.
THE COURT: Mr. Dratel.
MR. DRATEL: The same objections, hearsay and Vayner, your Honor.
THE COURT: Those objections are overruled. Government Exhibits 212A and B are received.
(Government's Exhibits 212A and 212B received in evidence)
MR. HOWARD: Can you zoom in on the upper right-hand corner.
MR. HOWARD: What was the name of this file, Mr. Kiernan?
THOMAS KIERNAN: This file was mastermind.php.
MR. HOWARD: Are you familiar with the "mastermind" page from the Silk Road website, Mr. Kiernan?
THOMAS KIERNAN: I am.
MR. HOWARD: And when have you seen it before?
THOMAS KIERNAN: I've seen it when I was doing this laptop, looking at the laptop, and when I was on the defendant's -- when I took the pictures of the defendant's laptop.
MR. HOWARD: And who chooses the titles for Web page files?
THOMAS KIERNAN: The designers of the website.
MR. HOWARD: Your Honor, this would be a natural breaking point if you want to stop here.
THE COURT: Yes. Ladies and gentlemen of the jury, we will end for the day. We'll pick up tomorrow morning at 9:30.
I want to remind you not to talk to each other or anybody else about this case. I want to remind you, also, to avoid any news articles or media that may discuss this case in any way. If you run across anything, avert your eyes. I instruct you that you must do so.
And, also, I want to remind you not to try to go on the Web and do any research on your own. It is very important that the only evidence that is used to decide this case is the evidence you receive in this room. So don't try to go off onto Google and become an expert in Linux or anything else.
All right. Thank you. We are adjourned for the evening. We'll pick up tomorrow morning.
COURT CLERK: All rise as the jury leaves.
(Continued on next page)
(Jury not present)
THE COURT: Mr. Kiernan, we'll pick up at 9:30 tomorrow morning. So you can also step down. Thank you.
THOMAS KIERNAN: Thank you, your Honor.
(Witness not present)
THE COURT: All right, ladies and gentlemen. Let's all be seated for just one moment.
I just wanted to very quickly go through the exhibits that had had objections as to which the prior rulings, I wanted to be sure that we understood that they apply.
GX264 was received and the Court overruled the Vayner objection for all of the reasons that we've already discussed, and, indeed, that is the same for each of the electronic documents, that this witness has authenticated them appropriately.
And in terms of hearsay, these are not for the truth, nor is 254 for the truth or 270, 275, 295, 280, 268, but I want the government to make sure with 268 that that is right, that you are not offering it for the truth. 269 not for the truth. 296 not for the truth. 212A and B not for the truth. There is one of them, the Dominica Guide, 290 and 291, not for the truth, 291 being the application.
272 was the photograph with the bags of what could be whatever they are. That was objected to in the Pretrial Order under 403. So the Court additionally had undertaken a 403 analysis, and finds that given the charges in this case, that evidence is both relevant but it is not unduly prejudicial. Its probative value is not substantially outweighed by any prejudicial effect. Certainly, at most, the inferences that could be drawn are consistent with the charges in this case, and it is no more serious than that. It also was properly authenticated.
Mr. Howard, were any of the documents which I had mentioned things which the government had intended to offer for the truth?
MR. HOWARD: Your Honor, to the extent that some of them included statements of the defendant, we would seek to admit them as party admissions.
THE COURT: All right. To the extent that there are portions where it is not only by the -- allegedly by the defendant subject to connection, but that it's for the truth associated with the defendant, as opposed to associated and not for the truth, then they would be party admissions in the same manner that we previously discussed subject to connection.
MR. HOWARD: Yes, your Honor.
MR. DRATEL: Your Honor, just because it is on his laptop doesn't mean it is a party admission. Everything on his laptop is not by the defendant.
THE COURT: Subject to connection. As we all know, the subject to connection will be a finding by a preponderance of the evidence. That is what the evidentiary objections require. And so when the government's case is in, we'll determine whether or not ultimately all the "subject to connection" statements have been met or not met, and we'll take that up at that time.
All right. Anything else that you folks wanted to raise?
MR. DRATEL: Just one thing. I will wait for the government first, just in case.
MR. HOWARD: Yes, your Honor. There is an additional witness that we plan on calling tomorrow. It is a very short witness. It is Special Agent Gregory Fine from the Federal Bureau of Investigation.
THE COURT: All right. And tell me why Mr. Fine is coming in now and was not on your original list.
MR. HOWARD: Yes. Special Agent Fine is only going to be testifying about the seizure of thumb drive devices from the defendant's residence. The relevance of the files to the government became more clear following what the defense previewed in their opening statement. So he will be authenticating the seizure of thumb drives.
Mr. Kiernan tomorrow will testify about an analysis of files that were recovered from that thumb drive.
THE COURT: All right. So he is simply to authenticate the thumb drives?
MR. HOWARD: Yes.
THE COURT: That is really his entire purpose is to say I was there, I got the thumb drives, do a chain of custody?
MR. HOWARD: Yes, your Honor.
THE COURT: All right. Mr. Dratel.
MR. DRATEL: Do we have all of the exhibits that they are going to put in? I want to make sure.
THE COURT: Do you have everything that you are going to use with this fellow?
MR. HOWARD: Yes. They are in the 200 series.
THE COURT: And they have already been turned over to the defense?
MR. HOWARD: They have, your Honor.
THE COURT: All right.
MR. DRATEL: OK.
THE COURT: Any 3500 material, I take it there probably isn't any, but if there is, you have given it to the defendant?
MR. HOWARD: Yes. We just need to verify that he didn't send any emails that we can assert 3500. Based on his role in the search, we doubt there is anything. We'll get that immediately and promptly provide it to the defendant.
THE COURT: Thank you.
Mr. Dratel.
MR. DRATEL: Not 5,000 pages.
The only thing I wanted to add, your Honor, not about that, but about some of the exhibits that came in -- I think most of the exhibits that came in today through Mr. Kiernan were different than the original ones that we had. I don't mean different altogether, but in terms of how they were sent to us. So, for example, many of them, in terms of the time that we interposed objections, did not have metadata or a different kind of presentation of metadata.
So I think that may be one of the reasons why there may not be objections to some of them previously and there are now. I'm not saying that is all of them, but I just wanted -- there are differences. We are getting the series of exhibits as the government has posted them.
THE COURT: I have not found that you have waived objections. I have been allowing you to put them on the record, and we have been dealing with them.
If there are any other issues which you want to raise, you can either raise them on cross-examination with this witness if there are differences, or if there is anything that you should bring to my attention, go ahead and bring it to my attention either now or tomorrow morning about that.
MR. DRATEL: It is just more about timing for that particular issue.
THE COURT: All right. Anything further, folks, that we should go over tonight? Otherwise we will meet tomorrow morning at 9.
MR. HOWARD: Nothing from the government, your Honor.
MR. DRATEL: Nothing, your Honor. Thank you.
THE COURT: One thing I do want to encourage you folks, because things have a way of coming up, as we know, if we could be here close to 9, that would be helpful. Otherwise we end up starting with ourselves at 9:20. We don't get the jury out here until 9:40 or 9:45, today at 9:50. So let's just give it a go.
All right. Thank you. We are adjourned.
COURT CLERK: All rise.
(Adjourned to 9 a.m., Thursday, January 22, 2015)