1.Thomas Kiernan — Direct (Part 3)
325 linesUNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK ------------------------------x UNITED STATES OF AMERICA,
v. 14 Cr. 68 (KBF) ROSS WILLIAM ULBRICHT, Defendant. ------------------------------x New York, N.Y. January 22, 2015 9:10 a.m. Before: HON. KATHERINE B. FORREST, District Judge APPEARANCES PREET BHARARA, United States Attorney for the Southern District of New York BY: SERRIN A. TURNER TIMOTHY HOWARD
Assistant United States Attorneys JOSHUA LEWIS DRATEL LINDSAY LEWIS JOSHUA HOROWITZ Attorneys for Defendant - also present - Special Agent Vincent D'Agostino Molly Rosen, Government Paralegal Nicholas Evert, Government Paralegal Sharon Kim, Legal Intern
(In open court; jury not present)
THE COURT: This is the Continuation of the matter now on trial, the United States of America v. Ross William Ulbricht, 14 Cr. 68.
Counsel, state your names for the record.
MR. TURNER: Good morning. Timothy Howard and Serin Turner for the government, joined by Nicholas Evert and Molly Rosen and Sharon Kim who is a student intern.
THE COURT: Good morning all of you.
MR. DRATEL: Good morning. Joshua Dratel with Ross William Ulbricht and Lindsay Lewis and Joshua Horowitz.
THE COURT: Good morning to all of you.
I have one matter to raise just relating to the letter that I got from the government this morning and to give you folks a sense as to how I think we should proceed on that.
We have a juror who had called 45 minutes ago saying that he thought he would be ten to 15 minutes late due to a plumbing issue that he had to address but he only thought it would be ten to 15 minutes, so I think we're look at 9:40 anyway, unless he gets here earlier.
Do you folks have things that you would like to raise?
MR. HOWARD: Just one issue we'd like to address at side bar.
THE COURT: Okay. So there's one issue for the government.
For you, Mr. Dratel, anything?
MR. DRATEL: No, your Honor.
THE COURT: Before we go to side bar, let me just deal with the complaint of bitcoin amount, and this relates to the defense application to read the paragraph 22C, if my memory serves, from the complaint relating to the bitcoin amount. I think we are in agreement at least that the GAF case, among others, does provide a basis to read documents of that type. It seems that there's a dispute between the government and the defense as to whether or not there's a material fact which needs to be addressed by virtue of this.
My suggestion is sufficient unto the day. Let's see how the government's case comes in and whether or not the defense believes that there's still a basis for asserting a material dispute of fact. I reviewed yesterday the way in which I perceived, based upon the defense opening, that the issue came into the case. Whether or not the factual dispute is resolved by virtue of whatever the proof is, that I think remains to be determined. So let's wait and see whether or not, Mr. Dratel, your application remains and you want to do that at the conclusion of the government's case. It's perfectly appropriate for you to do so if there still is a remaining dispute of fact on that issue.
MR. DRATEL: I just want to say, I think this case is completely distinguishable from GAF, in fact, the Court says it's distinguishable from GAF. So it's a theory of issue, not a question of a representation made by the government in a binding way, which was a sworn complaint under oath. It's extraordinarily different.
THE COURT: Let me just make sure that I have put my view clearly, which is, as a matter of law, the statement in the complaint is the kind of statement, if there's a material dispute of fact, which can be taken as an admission.
MR. DRATEL: Right. Thank you.
THE COURT: Now, the question is whether or not there's a material dispute of fact, and that is something which the government is taking issue with. My view is sufficient unto the day. If, at the end of the government's case, there's no remaining material dispute of fact on that issue, so be it. You may choose that you don't want to pursue this. If you believe that it remains, we'll talk about it, but I think the legal principle we're now resolved on.
Yes, Mr. Turner.
MR. TURNER: I just want to note on our part, we actually don't agree that GAF applies to an agent affidavit. It's not like a bill of particulars. But in any event, we don't think the Court needs to address that issue because even if it does apply, we don't think there's a genuine conflict in the representations being made.
THE COURT: All right. I think the rationale of bill of particulars versus complaint may give -- is not as much of a distinction as -- the difference between those two types of documents is not so much of a distinction. The rationale of the GAF court really was a document put forward by a government agent in furtherance of a governmental position sworn in under oath, which this was. Let's put it aside. I think we understand how we're going to be dealing with it, which is at the end of the government case.
That was my issue. Let's hear the issue that you folks wanted to raise at side bar.
MR. DRATEL: With respect to side bars, because we have had some long ones, if Mr. Ulbricht can be present at side bar.
THE COURT: Well, come on up.
(At the side bar)
MR. TURNER: This is brief. I want to note the government's continuing concern about the defendant turning to communicate with his family in the presence of the jury during side bars. Members of my team noticed it yesterday. The marshals noticed it. There was an entire news article that talked about all the communications between the defendant and his family in part in the presence of the jury. So I just ask that the defendant be reminded again to save those communications until times when the jury has gone back to the jury room.
THE COURT: Mr. Dratel, will you remind your client of that?
MR. DRATEL: Okay. Thank you.
THE COURT: It's obviously difficult for -- I didn't see the news article. I don't read the press while the case is ongoing, unless somebody feels like they need to bring something to my attention. I'll have my deputy pay attention to the issue. What I need to understand is what would be the measures that the government would be suggesting should be taken and if there was and issue.
One possibility is to move the parents and the family to a different part of the courtroom. There may be other increasingly necessary measures, but let me have Mr. Dratel talk to his client about that.
MR. DRATEL: Not saying anything. I'm not acknowledging that there has been an issue.
THE COURT: I haven't seen anything myself, but I haven't been looking. And it is an issue because there shouldn't be communicative conduct that can convey things to the jury, but if Mr. Ulbricht is going to come up during side bars, this issue will be eliminated as we proceed because he'll be here and not there.
MR. DRATEL: Right. Thank you.
THE COURT: Remind him since he's standing here. He can hear.
THE DEFENDANT: I'm aware, and I'm listening.
THE COURT: Thank you.
(In open court)
THE COURT: We're checking on the jury. We might have lucked out, including the person who thought he might be late.
If the defendant wants to come up to side bar, which is perfectly fine with the Court, the marshals will come up. That's protocol. I want you to be aware of that because the jury may or may not draw an inference from that. You know, you folks can weigh the competing issues. I don't have a problem with that occurring.
We're waiting for Joe to see how the jury is doing.
MR. DRATEL: Thank you.
THE COURT: Anything else we should deal with right now?
MR. HOWARD: Not from the government's perspective.
THE COURT: Okay.
Mr. Dratel, anything else from your perspective?
MR. DRATEL: No.
THE COURT: Joe is checking on them. Let's take a brief break. Hopefully, we'll be able to start very shortly as soon as we have a full array of jurors.
(Continued on next page)
(In open court; jury present)
THE COURT: Mr. Kiernan, I want to remind you, you are still under oath from yesterday.
THOMAS KIERNAN: Okay.
THE COURT: Mr. Howard.
MR. HOWARD: Thank you, your Honor.
DIRECT EXAMINATION (Continued) BY MR. HOWARD:
MR. HOWARD: Good morning, Mr. Kiernan.
THOMAS KIERNAN: Good morning.
MR. HOWARD: Your Honor, may I approach the witness.
THE COURT: You may.
MR. HOWARD: Mr. Kiernan, I just handed you what's been marked for identification purposes as Government Exhibit 502A. Do you recognize this exhibit?
THOMAS KIERNAN: I do, yes.
MR. HOWARD: What is this?
THOMAS KIERNAN: These are two thumb drives that were recovered from the defendant's residence.
MR. HOWARD: And how do you recognize them?
THOMAS KIERNAN: From the markings on them and from the paperwork provided with them.
MR. HOWARD: The government offers 502A.
MR. DRATEL: I don't think -- one second, your Honor, with respect to this specific -- no objection.
THE COURT: All right. Received.
(Government's Exhibit 502A received in evidence)
MR. HOWARD: Mr. Kiernan, what is a thumb drive?
THOMAS KIERNAN: It's a media device that you can hold files on. It's a little smaller than a hard drive, but it has the same purposes as a hard drive. You can store files from -- on the devices.
MR. HOWARD: And how many thumb drives are contained in Government Exhibit 502A?
THOMAS KIERNAN: Two.
MR. HOWARD: What is the storage capacity of each of those thumb drives?
THOMAS KIERNAN: One was a four gig thumb drive, and the other one was a 16 gig thumb drive.
MR. HOWARD: Did there come a time when you reviewed the contents of the 16 gigabyte thumb drive?
THOMAS KIERNAN: Yes.
MR. HOWARD: How did you get access to the contents of that thumb drive?
THOMAS KIERNAN: Through a -- again, with the images that we had created, I had made a staging copying of that -- of the drive, and we were able to look at the drive using the FTK Imager.
MR. HOWARD: Again, is a staging copy, what you testified yesterday, a working copy for you not to affect the original?
THOMAS KIERNAN: Correct, correct. Yes.
MR. HOWARD: Did you do anything to confirm whether the staging copy was identical to the evidence on the original thumb drive?
THOMAS KIERNAN: Yes. We used the MD5 Hash, the digital fingerprint, to make sure that what I was looking at was the actual true copy of these two drives.
MR. HOWARD: Could you please take a moment and flip to what has been marked as Government Exhibit 502 in your binder, please.
THOMAS KIERNAN: I'm sorry. Which one?
MR. HOWARD: 502.
THOMAS KIERNAN: 200s, right?
MR. HOWARD: 502, in the very back.
THOMAS KIERNAN: 502. Oh, yes, there it is. Okay.
MR. HOWARD: Do you recognize what this is?
THOMAS KIERNAN: I do.
MR. HOWARD: And what is it?
THOMAS KIERNAN: This is a standard report from FTK Imager.
MR. HOWARD: What does it depict?
THOMAS KIERNAN: It depicts the checksum value of the -- of the drives here, the digital fingerprinting.
MR. HOWARD: Does it indicate anything about the MD5 Hash value?
THOMAS KIERNAN: Yes, it does. It has it here.
MR. HOWARD: The government offers Government Exhibit 502.
MR. DRATEL: No objection.
THE COURT: Received.
(Government's Exhibit 502 received in evidence)
MR. HOWARD: Ms. Rosen, can you please publish Government Exhibit 502.
MR. HOWARD: Mr. Kiernan, see here at the bottom it says MD5 checksum and then a long string of characters starting with "fc12"?
THOMAS KIERNAN: Correct, yes.
MR. HOWARD: What is that long string of characters that we just pointed out?
THOMAS KIERNAN: That's the number that's produced when you run that program, that MD5 program on the devices.
MR. HOWARD: That's what you refer to as essentially the fingerprint?
THOMAS KIERNAN: That's the fingerprint. That's the number that that represents, yes.
MR. HOWARD: Now, could you now flip in your binder to what's been marked for identification purposes as Government Exhibit 205A.
THOMAS KIERNAN: Okay.
MR. HOWARD: Do you recognize what this is?
THOMAS KIERNAN: Yes.
MR. HOWARD: And what is it?
THOMAS KIERNAN: This is the checksum that I took of the imaged files of the thumb drives to make sure that I'm working on the same -- a good copy of those drives.
MR. HOWARD: And you took this screen shot?
THOMAS KIERNAN: I took this screen shot, yes.
MR. HOWARD: The government offers Government Exhibit 502 -- sorry -- 205A.
MR. DRATEL: No objection.
THE COURT: Received.
(Government's Exhibit 205A received in evidence)
MR. HOWARD: Ms. Rosen, can you please publish Government Exhibits 502 and 205A side by side. Actually, let's focus on 205A. Let's do that full screen.
MR. HOWARD: Mr. Kiernan, you see here it says computer hash?
THOMAS KIERNAN: Yes.
MR. HOWARD: I'm sorry, up here on the MD5?
THOMAS KIERNAN: MD5, yes.
MR. HOWARD: And then here it says "fc12," a long string of characters. Can you highlight that, Ms. Rosen.
What does this represent here?
THOMAS KIERNAN: Again, that's the value created when looking at the thumb drives that I had, that's the checksum, that's the fingerprint that's created.
MR. HOWARD: And did it match with the original copy?
THOMAS KIERNAN: It did, yes.
MR. HOWARD: Did you analyze the contents of this thumb drive?
THOMAS KIERNAN: I did.
MR. HOWARD: And what did you find on the copy of the thumb drive after you started to analyze it?
THOMAS KIERNAN: I found two files.
MR. HOWARD: Could you please flip in your binder to what's been marked for identification purposes as Government Exhibit 297.
THOMAS KIERNAN: Okay. Got it.
MR. HOWARD: How many pages is this exhibit?
THOMAS KIERNAN: This is two.
MR. HOWARD: And what is it -- do you recognize this exhibit?
THOMAS KIERNAN: I do.
MR. HOWARD: And what is it?
THOMAS KIERNAN: This is a screen shot of the files stored on the thumb drive, the 16 gig thumb drive; yes.
MR. HOWARD: What is the second page?
THOMAS KIERNAN: The second page is a process used to look at one of those files.
MR. HOWARD: Did you take the screen shots of the images depicted in Government Exhibit 297?
THOMAS KIERNAN: Yes.
MR. HOWARD: The government offers Government Exhibit 297.
MR. DRATEL: No objection.
THE COURT: Received.
(Government's Exhibit 297 received in evidence)
MR. HOWARD: Could you please publish 297, please.
MR. HOWARD: This is another screen shot taken from FTK Imager?
THOMAS KIERNAN: That it is, yes.
MR. HOWARD: What device?
THOMAS KIERNAN: The 16 gig thumb drive.
MR. HOWARD: So, Ms. Rosen, could you please zoom in on the upper right-hand window.
MR. HOWARD: And what is listed in this window, Mr. Kiernan?
THOMAS KIERNAN: The files that were contained on that thumb drive.
MR. HOWARD: A second ago, you mentioned two files in particular. Which ones are those?
THOMAS KIERNAN: Correct. Those two files are the backup.tar.gz.gpg above that, not the fileslack one.
MR. HOWARD: The one I'm pointing to right now?
THOMAS KIERNAN: Yes, the one in green there. And the other file is www.tar.gz.gpg. Those are the only active real files on that drive. The Xs represent files that were deleted that I did not recover. That's how it comes up.
MR. HOWARD: Based on your review of the thumb drive, do you know what date those files were saved?
THOMAS KIERNAN: Yes. 9/23/2013.
MR. HOWARD: And what, if you look at those two files that you just discussed, they end in ".gpg"?
THOMAS KIERNAN: Correct.
MR. HOWARD: What is a gpg file?
THOMAS KIERNAN: Again, that was encrypted software that had those two files encrypted, encryption software.
MR. HOWARD: Were you able to open these files despite the encryption?
THOMAS KIERNAN: I was, yes.
MR. HOWARD: And how were you able to do that?
THOMAS KIERNAN: Again, by finding a password on the defendant's laptop that -- was I able to open them.
MR. HOWARD: Would you please publish the second page of this exhibit, Ms. Rosen.
MR. HOWARD: Mr. Kiernan, what does this screen shot depict?
THOMAS KIERNAN: Just to verify that the file was actually decrypted after I put the password in. This is just the software tool that I used to do it. That's all.
MR. HOWARD: I would like to first focus on the file www.tar.gz.gpg. You were able to successfully decrypt that file, correct.
THOMAS KIERNAN: Yes.
MR. HOWARD: Did you analyze the contents of that file once you decrypted it?
THOMAS KIERNAN: Yes.
MR. HOWARD: What did you discover?
THOMAS KIERNAN: Those -- the files in that tar file, that file, were similar to the ones I found on the laptop under that web directory if remember from yesterday, that var www directory, so it seemed to be a backup of that.
MR. DRATEL: Objection.
THE COURT: I'll allow it. Overruled.
MR. HOWARD: Mr. Kiernan, you said that these files were saved on September 23, 2013 to the thumb drive, correct?
THOMAS KIERNAN: Correct.
MR. HOWARD: And is that the reason you believe it's a backup of the files on the computer?
THOMAS KIERNAN: Yes.
MR. DRATEL: Objection.
THE COURT: Overruled.
MR. HOWARD: And that www/var directory that you testified about yesterday, isn't it correct that you testified that that contained web pages from the Silk Road website?
THOMAS KIERNAN: Yes. It was a var www, but, yes.
MR. HOWARD: And yesterday we walked through a number of exhibits that were from the directory that contained files from the Silk Road website?
THOMAS KIERNAN: Correct.
MR. HOWARD: Did you find each of those exhibits those same files in this backed-up version?
THOMAS KIERNAN: Yes. Exhibits --
MR. DRATEL: Objection.
THE COURT: Overruled.
Why don't you strike the word "backed-up" and just say "version." Rephrase.
MR. HOWARD: Did you find the same files that were introduced as exhibits yesterday in the folder on the laptop containing Silk Road website files as were found in this file that was saved on September 23 to the thumb drive?
THOMAS KIERNAN: I did; yes.
MR. HOWARD: Now, let's focus on the other file we discussed, the backup.tar.gz.gpg file.
THOMAS KIERNAN: Okay.
MR. HOWARD: You were also able to successfully decrypt that, right?
THOMAS KIERNAN: Yes.
MR. HOWARD: Did you analyze the contents of that file?
THOMAS KIERNAN: I did, yes.
MR. HOWARD: And what did that appear to contain?
THOMAS KIERNAN: That appeared to contain a different version of the files that I found on the defendant's laptop under the home/frosty/backup directory, that directory.
MR. HOWARD: And you testified that those files were saved to a thumb drive on September 23rd, 2013, correct?
THOMAS KIERNAN: Yes.
MR. HOWARD: Now, yesterday we discussed a number of exhibits that were taken -- that you extracted from the back -- from the backup directory on the computer, correct?
THOMAS KIERNAN: Correct.
MR. HOWARD: Did you also find copies of those same files in that file from the thumb drive?
THOMAS KIERNAN: Yes, in this version, yes.
MR. HOWARD: Were there any differences?
THOMAS KIERNAN: Yes. They were -- seemed to be -- well, it didn't seem to be. They were older versions of what we had found on the laptop.
MR. HOWARD: Now, Mr. Kiernan, could you please flip to what's been marked for identification purposes as Government Exhibit 298 in your binder.
THOMAS KIERNAN: Okay.
MR. HOWARD: Do you recognize what this is?
THOMAS KIERNAN: Yes.
MR. HOWARD: And what is this?
THOMAS KIERNAN: That was the log.txt file.
MR. HOWARD: Where did you recover this log.txt file?
THOMAS KIERNAN: This was 298 -- it's from the thumb drive of the uncompressed -- the unencrypted file. This file was part of that.
MR. HOWARD: Which of the two files that you -- which of the two files is that from?
THOMAS KIERNAN: From the USB drive.
MR. HOWARD: Earlier you testified there were two files you decrypted from the thumb drive, correct?
THOMAS KIERNAN: Correct.
MR. HOWARD: There was the one that contained the Silk Road website files, correct?
THOMAS KIERNAN: Yes.
MR. HOWARD: And there was one that contained the backup files, correct?
THOMAS KIERNAN: Yes. Right. So this was from the backup -- the backup file, that backup file that we had found on the USB thumb drive, so it's from that uncompressed file, the backup file.
MR. HOWARD: Can you please take a look at the last page of this exhibit.
THOMAS KIERNAN: Yes.
MR. HOWARD: What is the last page of this exhibit?
THOMAS KIERNAN: This is a screen shot of the contents of the USB drive -- of the -- I'm sorry -- of the uncompressed -- the un -- the decrypted backup file that was found on the USB drive that I decrypted.
MR. HOWARD: The government offers Government Exhibit 298.
MR. DRATEL: No objection.
THE COURT: Received.
(Government's Exhibit 298 received in evidence)
MR. HOWARD: Ms. Rosen, can you please publish the last page of Government Exhibit 298, page six, please.
MR. HOWARD: Mr. Kiernan, this is another screen shot you took from FTK Imager depicting the file from the thumb drive?
THOMAS KIERNAN: Yes.
MR. HOWARD: And what is depicted in the upper left-hand window of the screen?
THOMAS KIERNAN: So that's the directory structure starting with the USB of the unencrypted file called backup.tar.gz right there.
MR. HOWARD: And there included within a folder called frosty, correct?
THOMAS KIERNAN: Yes.
MR. HOWARD: Could you zoom out, please, Ms. Rosen.
MR. HOWARD: Now, where was the log.txt file found specifically on the thumb drive?
Ms. Rosen, can you zoom in on the bottom left-hand corner here.
THOMAS KIERNAN: On the thumb drive, after it was de-encrypted, the file name is backup.tar.gz, which contained files in it, so it's backup.tar.gz, it's home/frosty/backup is where it is on the uncompressed version of that file.
MR. HOWARD: What does the metadata reflect about the date that that file was saved to the thumb drive?
THOMAS KIERNAN: 9/20/2013.
MR. HOWARD: Ms. Rosen, can you please publish page five of this exhibit, and could you please move this to the left side.
MR. HOWARD: Earlier you testified -- did you find a similar file on the defendant's laptop?
THOMAS KIERNAN: Yes.
MR. HOWARD: Could you please publish Government Exhibit 241 on the right side of the screen, which has already been admitted into evidence, and please go to page five.
Now, Mr. Kiernan, the one on the left side is the one from the thumb drive, right?
THOMAS KIERNAN: That's correct.
MR. HOWARD: And the one on the right is the one from the defendant's laptop, right?
THOMAS KIERNAN: Yes.
MR. HOWARD: Ms. Rosen, can we zoom in on the last couple of entries on each of these pages. Why don't we try top and bottom. It might be more clear.
MR. HOWARD: Now, to be clear, Mr. Kiernan, is the top one from the USB drive?
THOMAS KIERNAN: Yes.
MR. HOWARD: And the bottom one is from the defendant's computer?
THOMAS KIERNAN: Computer, correct.
MR. HOWARD: And what is the last entry on the one taken from the USB drive?
THOMAS KIERNAN: 9/19/2013.
MR. HOWARD: "r&w pinged me and asked for meeting tomorrow," correct?
THOMAS KIERNAN: That's correct.
MR. HOWARD: And you testified that this file was saved on September 20, 2013 --
THOMAS KIERNAN: Yes.
MR. HOWARD: -- according to the metadata?
THOMAS KIERNAN: Right.
MR. HOWARD: Could we zoom in on the bottom here starting at 9/19/2013, to the bottom.
"9/19/2013 red pinged me asked for meeting tomorrow."
That's similar to the last entry of the version you found on the thumb drive, correct?
THOMAS KIERNAN: That's correct.
MR. HOWARD: And there are additional entries for 9/19 to 9/25/2013 as well as 9/30/2013 on the version that was recovered from the defendant's computer, correct?
THOMAS KIERNAN: That's correct, yes.
MR. HOWARD: So I'm going to read this now: "9/19 to 9/25/2013 red got in a jam and needed 500,000 to get out. Ultimately he convinced me to give it to him but I got his ID first and had Cimon send Harry, his new soldier of fortune to Vancouver to get $800,000 in cash to cover it. Red has been mainly out of communication, but I haven't lost hope. Atlantis shut down. I was messaged by one of their team who said they shut down because of an FBI doc leaked to them" dealing "vulnerabilities in Tor."
THE COURT: I think you misspoke in terms of the word "dealings." It's "detailing."
MR. HOWARD: Pardon me. "...detailing vulnerabilities in Tor. 9/13/2013 spoke with inigo for a while about the book club and swapping roles with libertas. Had revelation about the need to eat well, get good sleep and meditate so I can stay positive and productive."
MR. HOWARD: Ms. Rosen, can you please publish Government Exhibit 214 to the jury, which has already been admitted into evidence.
MR. HOWARD: Mr. Kiernan, what does Government Exhibit 214 depict?
THOMAS KIERNAN: Screen shot of a -- from the defendant's computer of a wallet.dat file.
MR. HOWARD: Let's zoom in on the bottom left-hand corner here. And where was this wallet.dat file located?
THOMAS KIERNAN: This was in the home/frosty.bitcoin directory.
MR. HOWARD: Are you familiar with what a wallet.dat file is?
THOMAS KIERNAN: Yes. I am.
MR. HOWARD: What is it?
THOMAS KIERNAN: It's the file that contains your bitcoin wallets, your addresses where you store your bitcoins.
MR. HOWARD: And what, if anything, did you do with this file after you discovered it on the defendant's laptop?
THOMAS KIERNAN: Extracted it and gave it to Special Agent Ilhwan Yum.
MR. HOWARD: Ms. Rosen, can you please publish Government Exhibit 213 -- pardon me -- the last exhibit that we looked at, the wallet.dat file.
THE COURT: Ilhwan Yum?
THOMAS KIERNAN: Yum, yes.
THE COURT: Y-U-M?
THOMAS KIERNAN: Yes.
THE COURT: Thank you.
THOMAS KIERNAN: You're welcome.
MR. HOWARD: What device was the wallet.dat file on?
THOMAS KIERNAN: Oh, this was back on the laptop.
MR. HOWARD: Ms. Rosen, can you please publish Government Exhibit 213, please.
MR. HOWARD: Mr. Kiernan, what does Government Exhibit 213 depict?
THOMAS KIERNAN: This is a directory structure of the MySQL database under the -- called "market."
MR. HOWARD: And on which device was this from?
THOMAS KIERNAN: Again, this is back on the laptop.
MR. HOWARD: Ms. Rosen, can we just zoom into this area right here.
MR. HOWARD: And where was the file located, Mr. Kiernan?
THOMAS KIERNAN: Yes. All these files are located under var/lib/mysql/market.
MR. HOWARD: And what kind of files were contained in that folder?
THOMAS KIERNAN: Database files.
MR. HOWARD: What is a database?
THOMAS KIERNAN: A database is a collection of records or information that you want to organize and keep in a nice forum. So a digital way to do it is a database. You store it in the database like a phone book, per se, or your contact list on your phones. Those are all databases. It just makes it easier so you can search for people, search for things, phone numbers, where you live -- where someone else lives, and you could do combos. You can query the database to get all the people that you know that live in New York City but also work at a company here; and the object of it is just to make it a lot easier to find data on your hard drives.
MR. HOWARD: Did you look at the contents of the database?
THOMAS KIERNAN: I did.
MR. HOWARD: And what did the database appear to contain?
THOMAS KIERNAN: It contained some entries of drugs and items like that.
MR. HOWARD: Ms. Rosen, can you please zoom into the upper right-hand corner of this screen, give me part of the page.
MR. HOWARD: What is depicted in this window, Mr. Kiernan?
THOMAS KIERNAN: The layout, the tables contained within the database.
MR. HOWARD: I'm going to read a couple of the files here. There's balance log, withdrawals, transaction log, archive, categories, messages, users archive, transaction log -- can we scroll down, Ms. Rosen. We have featured items, shipping, deposits, vendor details.
You can take it off the screen, Ms. Rosen.
Now, Mr. Kiernan, you testified earlier that the purpose of trying to arrest the defendant at his laptop was to prevent his computer from becoming encrypted, correct?
THOMAS KIERNAN: That's correct; yes.
MR. HOWARD: And you also testified that not every laptop is encrypted, correct?
THOMAS KIERNAN: No, not every laptop.
MR. HOWARD: And what does a user have to do to encrypt the data on his laptop?
THOMAS KIERNAN: Usually enable some type of software that enables encryption.
MR. HOWARD: And if a user has encryption available on the laptop, how can the encryption be activated?
THOMAS KIERNAN: Like we had talked about, same thing: You can close your laptop, you can log out of your laptop, power failure would cause a laptop to go back into an encryption state, things to that nature.
MR. HOWARD: And what, if anything, did you do during the triage process to prevent these things from happening?
THOMAS KIERNAN: During the triage state, we continued to make sure the computer was active, looked for any type of screen-savers or programs running that would try to disable the laptop or turn the laptop off and put it into a sleep state that would enable encryption once again. That was mostly what the triage was for.
MR. HOWARD: When you were performing your triage, were you able to determine whether there was any encryption running on the computer?
THOMAS KIERNAN: Yes. Yes. So using a -- I opened up a terminal window to -- it's just a program to get a little bit behind the scenes of what you -- the nice, gooey, pretty picture interface that you're used to seeing on the screen, just to run some commands to see if -- what was running on it. So I did a listing of what types of programs were running in the background to look for an encryption-type software, and I was able to find a file that showed that encryption was enabled on the machine.
MR. HOWARD: What would have happened if the defendant had closed his laptop before the FBI seized it?
THOMAS KIERNAN: It would have went into an encrypted state.
MR. HOWARD: And what would have happened if you had not been able to keep the laptop alive while you were performing your triage?
THOMAS KIERNAN: It would have turned into a brick basically. It would have been tough to -- it makes it a lot harder to get into -- into the machine to actually get any data off of the device.
MR. HOWARD: The government has no further questions.
THE COURT: Thank you.
Mr. Dratel.
MR. DRATEL: Thank you, your Honor.