2.Thomas Kiernan — Cross/Redirect/Recross (Part 4)
703 linesCROSS-EXAMINATION BY MR. DRATEL:
MR. DRATEL: Good morning, Mr. Kiernan.
THOMAS KIERNAN: Good morning.
MR. DRATEL: I want to go back to actually where you ended with the day of the arrest, the day that Mr. Ulbricht was arrested. By the way, the encryption, when you talked about closing the laptop where it basically made it inaccessible, right?
THOMAS KIERNAN: Yes.
MR. DRATEL: So him being in a public place was an important factor, right?
THOMAS KIERNAN: Yes.
MR. DRATEL: Because if you had to go through the door of his apartment, he would have had an opportunity to close his laptop, right?
THOMAS KIERNAN: That's right.
MR. DRATEL: I want to go back to Government's Exhibit 128H, please. And that's a photograph of the Glen Park library, correct?
THOMAS KIERNAN: That's correct, yes.
MR. DRATEL: And that's where Mr. Ulbricht was arrested, right?
THOMAS KIERNAN: Yes.
MR. DRATEL: He was arrested -- if we can enlarge the right part, I guess, yes. That's fine. He was arrested at the table where the person is sitting against the window, is that right?
THOMAS KIERNAN: Yes.
MR. DRATEL: And in fact, Mr. Ulbricht was sitting not where that person is, but he was actually sitting with his back to where we are and he was looking out the window, right?
THOMAS KIERNAN: He was -- what I remember, he was just like that.
MR. DRATEL: You've been interviewed in preparation for your testimony, correct?
THOMAS KIERNAN: Yes.
MR. DRATEL: You sat down with the government, right?
THOMAS KIERNAN: Yes.
MR. DRATEL: More than once, right?
THOMAS KIERNAN: Several times.
MR. DRATEL: Yes. And didn't you tell the government that Mr. Ulbricht had his wack to you looking out a window? Didn't you say that twice to the government?
THOMAS KIERNAN: I don't -- do you have anything to show me?
MR. DRATEL: Sure. I'll show you what's marked as 3508-2 and 3508-7. If you could look at 3508-2 and 3508-7 and the first highlighted portion on that page and the highlighted portion on that page.
THOMAS KIERNAN: Sure.
MR. DRATEL: Does that refresh your recollection, that you told the government twice in preparation for this case that Mr. Ulbricht's back was to you and he was looking out the window?
THOMAS KIERNAN: I don't know what these are, but that's what it says there, yes.
MR. DRATEL: And could we go to Government's Exhibit 225B, please. If we can scroll down a little bit. This is a conversation that you -- you didn't read it. Mr. Howard read it yesterday, right? This is something you got off the laptop, right --
THOMAS KIERNAN: Correct, yes.
MR. DRATEL: -- you got off the drive that was given to you? The highlight version reads -- and this is -- just to put this back in context, this is Dread Pirate Roberts and this is on a Tor chat, right?
THOMAS KIERNAN: These are from the Tor chats, yes.
MR. DRATEL: And Dread Pirate Roberts is responding to someone working for him that the person is concerned about being arrested, right, about law enforcement?
And Dread Pirate Roberts responds "There is nothing on your laptop for them to use, if you obscure your bitcoins properly, there's there is no way for them to trace them back to me. Realistically, the only way for them to prove anything would be for them to watch you log in and do your work," right?
That's Dread Pirate Roberts, right?
THOMAS KIERNAN: That's what it says.
MR. DRATEL: And that's January of 2013, right?
THOMAS KIERNAN: Yes.
MR. DRATEL: So if we could go further. Again Dread Pirate Roberts: "Sure, someone could stand behind you without you realizing it," right? Yes?
THOMAS KIERNAN: Yes.
MR. DRATEL: So Dread Pirate Roberts understood full well the dangers of having his back to anyone who could sneak up behind him, right?
MR. HOWARD: Objection; speculation.
THE COURT: Sustained.
MR. DRATEL: You testified yesterday, right, that the argument dispute that was contrived to distract Mr. Ulbricht was, in fact, behind him, right, and he turned around?
THOMAS KIERNAN: Yes.
MR. DRATEL: So if we go back to 228 -- I'm sorry -- 128H, Mr. Ulbricht really couldn't be sitting in that spot where that person was against the window because the other two people would have to be behind him, right?
THOMAS KIERNAN: That's where I remember him.
MR. DRATEL: But you told the government twice in preparation for this case that he had his back to you looking out the window?
THOMAS KIERNAN: It's here. It's in this document here.
MR. DRATEL: You deny that you said that?
THOMAS KIERNAN: Yeah, I mean. I don't deny I said it, but it's here in the document. If that's what that is, then, yes, I said that.
(Continued on next page)
MR. DRATEL: OK. Now, just going back to 228 -- I'm sorry, 225B, which we were just looking at.
So if we go back up a little further to the first part, so it says: "There is nothing on your laptop for them to use. If you obscure your bitcoins properly there is no way for them to trace them back to me."
But all of the material that you put in yesterday, and some of what you put in today, came from an image that Mr. Beeson provided to you from Mr. Ulbricht's laptop?
THOMAS KIERNAN: That is correct.
MR. DRATEL: The journals, right?
THOMAS KIERNAN: Yes.
MR. DRATEL: The Tor chat logs; thousands of pages of Tor chat logs, right?
THOMAS KIERNAN: Yes.
MR. DRATEL: PGP keys, right?
THOMAS KIERNAN: Yes.
MR. DRATEL: Now, you have a background in security, correct, in Internet security, right?
THOMAS KIERNAN: Yes.
MR. DRATEL: You have taken courses; you have trained that way, right?
THOMAS KIERNAN: Yes.
MR. DRATEL: And aren't you -- isn't it part of the security for a PGP key is not to make it available on your computer, your private key?
MR. HOWARD: Objection to form.
THE COURT: Sustained. You can rephrase.
BY MR. DRATEL:
MR. DRATEL: Isn't it a fundamental part of security not to keep your PG -- your private PGP key available on your computer in a manner that can be viewed by anyone on that computer?
THOMAS KIERNAN: No. You have to -- the key has to be somewhere. If you set it up on your computer, that's where you would keep your key. The idea behind it is to store it in a safe location, like an encrypted, again.
MR. DRATEL: And you put it in a file that says "Key," is that a good way to disguise it?
MR. HOWARD: Objection.
THE COURT: Sustained.
MR. DRATEL: But you wouldn't put it in a file -- would you as a person trying to be secure put it in a file with the name "Key" on it?
MR. HOWARD: Objection.
THE COURT: Sustained.
MR. DRATEL: Do you instruct people on how to disguise PGP keys on their computer?
THOMAS KIERNAN: I don't --
MR. DRATEL: Have you been instructed? Is there training on that?
THOMAS KIERNAN: Is there training on that? No, there is no training on where to keep your PGP key. It is your secret key. So if I was doing it, I would have an encrypted laptop and keep my key there, and when I turned off my laptop the key would be safe.
MR. DRATEL: And you would put it in a file called "key"?
MR. HOWARD: Objection.
THE COURT: Sustained.
MR. DRATEL: And when you say -- throughout your testimony, you said "pulled off the defendant's laptop," "pulled off the defendant's laptop." In fact, what you're working with is not the defendant's laptop, correct?
THOMAS KIERNAN: Not the -- it's a copy of what was on the defendant's laptop.
MR. DRATEL: Right. It was a copy that you didn't make?
THOMAS KIERNAN: A copy I didn't make, no.
MR. DRATEL: Right.
THOMAS KIERNAN: That is correct.
MR. DRATEL: It is what you received from Mr. Beeson?
THOMAS KIERNAN: Yes.
MR. DRATEL: So when you say "off the laptop," "off the laptop," it is really off of a copy of a copy, right? In other words, Mr. Beeson gave you a hard drive that was not the hard drive from the laptop but an image of the laptop?
THOMAS KIERNAN: That is correct.
MR. DRATEL: And then you made a copy of that and worked off of that?
THOMAS KIERNAN: Yes.
MR. DRATEL: So -- and you didn't participate in the imaging that Mr. Beeson did, correct?
THOMAS KIERNAN: That's correct.
MR. DRATEL: Also, when you said -- sometimes you said it's up to the designers of the site, right, in terms of certain issues with respect to Web pages and things like that?
MR. HOWARD: Objection to form.
THE COURT: Overruled.
THOMAS KIERNAN: I did, yes.
MR. DRATEL: And when you -- and when you say "designers," that doesn't mean that it can't be modified at some point, right, by other people?
THOMAS KIERNAN: The names of it?
MR. DRATEL: The way the site appears, the names of fields and the way of the Web pages.
THOMAS KIERNAN: Sure, it could be changed, again, by the designer or --
MR. DRATEL: When you say "designer," it doesn't have to be the same designer as the initial designer, it could be other people later on, right?
THOMAS KIERNAN: Yes.
MR. DRATEL: Now, if we could go to Government's Exhibit 201A, please.
Go further up. Go to the metadata.
(Pause)
MR. DRATEL: So this is the one where your phone -- you are taking this with your BlackBerry, correct?
THOMAS KIERNAN: That is correct, yes.
MR. DRATEL: And your BlackBerry registers East Coast time, right?
THOMAS KIERNAN: It does, yes.
MR. DRATEL: Even though you're standing in the Glen Park library in California, your electronic device in your hand has East Coast time, right?
THOMAS KIERNAN: It does, yes.
MR. DRATEL: So it doesn't reflect where you are?
THOMAS KIERNAN: Time zone, no.
MR. DRATEL: Right?
THOMAS KIERNAN: Time zone, no. Physically I'm still in San Francisco.
MR. DRATEL: Right. So the time zone reflected in your electronic device in the metadata is not accurate as to where you actually are?
THOMAS KIERNAN: That's correct.
MR. DRATEL: So metadata is just digital data, right?
THOMAS KIERNAN: It is.
MR. DRATEL: Now, we talked just for a second -- you have training in network security, correct?
THOMAS KIERNAN: I do.
MR. DRATEL: And you were an informational technology -- information technology specialist, is that one of the positions you have held?
THOMAS KIERNAN: Yes.
MR. DRATEL: So could you explain what that involves in terms of training?
THOMAS KIERNAN: Information technology specialist?
MR. DRATEL: Yes.
THOMAS KIERNAN: Yes. That is more on the side of maintenance and things to that nature of computer systems.
MR. DRATEL: Keeping networks secure?
THOMAS KIERNAN: Keeping networks secure.
MR. DRATEL: Teaching best practices to people who work on networks?
THOMAS KIERNAN: Just, again, managing computer systems for users and things like that.
MR. DRATEL: Now, by the way, the photos that we've seen that you've put in evidence were not the only photos that you took of the laptop, correct?
THOMAS KIERNAN: No. No.
MR. DRATEL: I want to show you what's marked as Defendant's G, for identification.
I will give you the original.
MR. DRATEL: And I ask you if you recognize that?
THOMAS KIERNAN: I do.
MR. DRATEL: Is that a photo that you took?
THOMAS KIERNAN: It is, yes.
MR. DRATEL: Is it a photo of the defendant's laptop that you took October 1, 2013, at the time -- at or near the time of his arrest, or shortly after his arrest?
THOMAS KIERNAN: Yes, it is.
MR. DRATEL: I move it into evidence, your Honor.
THE COURT: Mr. Howard.
MR. HOWARD: No objection.
THE COURT: Received, defendant's Exhibit G.
(Defendant's Exhibit G received in evidence)
MR. DRATEL: Thank you, your Honor.
So if we could publish it, please.
MR. DRATEL: Now, this window shows one of the programs that was operating at the time of Mr. Ulbricht's arrest, correct?
THOMAS KIERNAN: It does, yes.
MR. DRATEL: And it is a program called BitTorrent?
THOMAS KIERNAN: It's called TransMissions but it is a BitTorrent client, yes.
MR. DRATEL: Right, it is a BitTorrent client. Could you explain what that means?
THOMAS KIERNAN: It is a file sharing program that allows you to -- it allows you to upload and download files that you want to look at. It's based on seeds that are up on the network that you pull. You pull down the seed and you can populate your data with -- populate your folders with the data.
MR. DRATEL: And it is very popular for music and movies and things like that, correct?
THOMAS KIERNAN: It is, yes.
MR. DRATEL: It is called a peer-to-peer network, is that one of the ways this is described?
THOMAS KIERNAN: It runs on something like that, yes.
MR. DRATEL: And it involves your computer connected to the Internet, right?
THOMAS KIERNAN: Yes.
MR. DRATEL: I'm trying to break this down rather than have a compound question.
THOMAS KIERNAN: That's fine.
MR. DRATEL: Your computer connected to the Internet with all other people who are on that same network, that BitTorrent network, who are connected to the Internet, right?
THOMAS KIERNAN: Yes.
MR. DRATEL: In other words -- and they can -- if they identify files on your computer that they want to share, they can take them from your computer, right?
THOMAS KIERNAN: Not that easy but you have to give the Torrent to them to actually get files from your computer that you designate. It is not willy-nilly where you can go anywhere on your computer, but you designate spots that you can download from -- not put on but download from.
MR. DRATEL: But, in other words, you share the files, essentially?
THOMAS KIERNAN: Essentially you are sharing some of your files.
MR. DRATEL: And so this says, it says: "Sending to 7 of 9 connected peers," right?
THOMAS KIERNAN: Yes.
MR. DRATEL: So that means that there are seven computers out there in the world that are actually connected to Mr. Ulbricht's computer right there?
THOMAS KIERNAN: To --
MR. DRATEL: Through this network?
THOMAS KIERNAN: To his specified location that he gave.
MR. DRATEL: Right. But to his computer?
THOMAS KIERNAN: Yeah, to his computer.
MR. DRATEL: Do you see what's downloading there is the Colbert Report, right?
THOMAS KIERNAN: Yes.
MR. DRATEL: It is not complete at that point, right?
THOMAS KIERNAN: It doesn't look to be.
MR. DRATEL: It only looks like about 8-and-a-quarter megabytes of 197 megabytes, right?
THOMAS KIERNAN: Yes.
MR. DRATEL: So that takes some time, correct?
THOMAS KIERNAN: Yeah. Depending on connection speeds and things like that, but yeah.
MR. DRATEL: So you have to have an open port to the Internet on your computer to operate BitTorrent, correct?
THOMAS KIERNAN: You do. The protocol is required that a port or a connection spot is open.
MR. DRATEL: And the fact that he's downloading at that time, that that process is going on, means that the port was open at that time, right?
THOMAS KIERNAN: It was connected.
MR. DRATEL: And that you know from your training makes one vulnerable, correct, to have an open port like that -- it makes your computer vulnerable?
THOMAS KIERNAN: That's how the Internet works. There is open ports on a lot of different surfaces. It is the nature of the Internet. Something has to get transferred back and forth. So, yes, a port was open on the machine to allow BitTorrent, that client, to work.
MR. DRATEL: But that also means that those with sophisticated computer skills could exploit an open port as well, correct?
THOMAS KIERNAN: Is it possible for that to happen? Yes.
MR. DRATEL: In fact, you could be exploited by hackers, by viruses, right; all sorts of things can get into your computer through BitTorrent? Even BitTorrent downloading, you can have viruses and malware that come with those files, right?
THOMAS KIERNAN: With the files you download?
MR. DRATEL: Yes.
THOMAS KIERNAN: Yes, they can contain programs that do things like that.
MR. DRATEL: I'm sorry. Programs?
THOMAS KIERNAN: There are programs that can be used maliciously, yes.
MR. DRATEL: Maliciously, including to operate a computer remotely, right, that kind of malware can be --
THOMAS KIERNAN: They make that stuff but it's again ...
MR. DRATEL: And knowing a port is open on a computer, for someone trying to exploit that computer makes it easier to get in, right, if you know that there is a port there that's available?
THOMAS KIERNAN: That's incorrect. It is not easier. It gives you opportunities but it does not make it easier. It is the software guarding that port that is --
MR. DRATEL: But, I mean, it is easier than no port at all open, correct?
THOMAS KIERNAN: Yes. Again, that's how the Internet works. You have these ports that are open.
MR. DRATEL: And does the FBI allow you to run BitTorrent on your machine at work?
THE COURT: Let's have a sidebar.
(Continued on next page)
(At the sidebar)
THE COURT: I'm concerned that you're trying to make this witness into a general expert on BitTorrent. I have no problem -- obviously you are fully entitled to explore what acts this witness took with respect to the testimony he has given and explore his background in terms of whether he was qualified to do that. But you can't make him into a generalized expert on BitTorrent. This has gone far afield.
MR. DRATEL: That is my last question on this subject.
THE COURT: We are not going to this question. It is irrelevant with this witness. It's beyond the scope of his direct. All right? I mean --
MR. DRATEL: I don't think it is beyond the scope of his direct.
THE COURT: Absolutely. Are you aware that the FBI allows BitTorrent?
MR. DRATEL: It is for purposes of the security, in other words, the lack of security of BitTorrent.
THE COURT: That is not relevant. Whether the FBI allows BitTorrent on their computers is not relevant to whether or not the particular computer here -- you've got to establish that it was running BitTorrent. If you want to explore whether or not, if you've got a good faith basis to believe -- a good faith basis to believe that the files were placed on this computer, Mr. Ulbricht's computer, through the use of the BitTorrent program, then go after that. But I am not going to let you go into the practices of the FBI.
MR. DRATEL: It is the practice -- it is a fundamental question of security. This is a completely insecure system for someone who --
THE COURT: That is not this case. Thank you.
Let's go back.
(Continued on next page)
(In open court)
BY MR. DRATEL:
MR. DRATEL: You have been trained and certified in the Linux operating system, correct?
THOMAS KIERNAN: Correct.
MR. DRATEL: A number of courses and certifications --
THOMAS KIERNAN: Yes.
MR. DRATEL: -- that you have taken with respect to Linux in particular?
THOMAS KIERNAN: Oh, yes.
MR. DRATEL: And you talked about the Tor chats that you created as a test, as an experiment, right?
THOMAS KIERNAN: Yes.
MR. DRATEL: And you saved them, right?
THOMAS KIERNAN: Yes.
MR. DRATEL: So could you describe the process by which you saved them?
THOMAS KIERNAN: Sure. Turn on the -- inside Tor chat in Tor chat client there is an enabling button that allows you to log your chats and save my chats.
MR. DRATEL: So, in other words, you had to affirmatively hit the enable button to save them?
THOMAS KIERNAN: Yes.
MR. DRATEL: So that was a decision -- conscious decision to save them on your part?
THOMAS KIERNAN: Yes.
MR. DRATEL: And Tor chats can easily be deleted from a computer, right?
THOMAS KIERNAN: Sure.
MR. DRATEL: You wouldn't even have to save them at all. Unless you hit the button, they wouldn't be saved?
THOMAS KIERNAN: Yes.
MR. DRATEL: And there are programs that can wipe away even any trace of what's happened on a computer previously, right?
THOMAS KIERNAN: Yes.
MR. DRATEL: And with respect to the chats that we saw, some of the ones -- and, again, Mr. Howard read them, you didn't read them, but some of them were snippets from chats, obviously, from a long series of chats, right?
THOMAS KIERNAN: That's right.
MR. DRATEL: And the snippets sometimes were different days and they were separated by a black line, right, some of them?
THOMAS KIERNAN: Yes.
MR. DRATEL: So those weren't all continuous; some of them were separated by time?
THOMAS KIERNAN: Yes.
MR. DRATEL: Now, that line that's on the top of each chat as it appears initially -- not in the way that it was done for purposes of reading them into evidence, but initially the line that says the log file is not signed and has no cogency of proof; do you recall that?
THOMAS KIERNAN: I do, yes.
MR. DRATEL: And that's automatically generated at the beginning of each chat, right?
THOMAS KIERNAN: Yes.
MR. DRATEL: And that means that there is no way to validate that these particular log files were generated on that computer, correct?
MR. HOWARD: Objection.
THE COURT: I will allow it.
THOMAS KIERNAN: I'm sorry. Can you repeat that?
MR. DRATEL: Sure. What that means is that there is no way to validate that those log files were in fact generated on that computer?
THOMAS KIERNAN: Not generated but that's where they were saved.
MR. DRATEL: Right. OK. So it doesn't -- OK, not generated.
And those log files don't take up a lot of space, correct, about 15 kilobytes?
THOMAS KIERNAN: No, they're small. They are text files. They are not big. I don't know the size of them.
MR. DRATEL: And a kilobyte is about a thousandth of a megabyte, right, roughly?
THOMAS KIERNAN: Somewhere about there.
MR. DRATEL: 1024 bites to a megabyte?
THE COURT: Hold on. I think that because your question and his answer were interspersed, I'm not actually sure if it is 1024, which you want it to be, or a thousand, or if you care.
MR. DRATEL: I don't necessarily care. I was just trying to be precise.
THOMAS KIERNAN: 1024 is what it is, but we will go with a thousand.
MR. DRATEL: So those are files, because of the size of the files, the physical text files, they could be quickly transferred, correct?
THOMAS KIERNAN: Yes.
MR. DRATEL: Even over the Internet, correct?
THOMAS KIERNAN: Yes.
MR. DRATEL: And that is basically true for all the text files we saw, right, that they are small?
THOMAS KIERNAN: They are small --
MR. DRATEL: Ones -- even some of those spreadsheets are relatively compact, right, in terms of size?
THOMAS KIERNAN: Yes. It is not a huge file.
MR. DRATEL: And you talked about the mastermind screen.
THOMAS KIERNAN: Yes.
MR. DRATEL: And the mastermind.php file?
THOMAS KIERNAN: Yes.
MR. DRATEL: And the mastermind screen is the one that you found by hitting the back button, right, from the screen that was on the laptop when you first received it?
THOMAS KIERNAN: That's right.
MR. DRATEL: And did you have an opportunity to examine any of the other php files that were in that var/www directory?
THOMAS KIERNAN: Where? On the laptop?
MR. DRATEL: What you had, the copy that you had.
THOMAS KIERNAN: Yes.
MR. DRATEL: And do you know whether a user logging into the Silk Road site, using the password and username for the Dread Pirate Roberts' account, would automatically be directed to that mastermind page? Would that be -- do you know whether that would be the first thing that would come up?
MR. HOWARD: Objection. Beyond the scope.
THE COURT: Hold on. Let me just read his question.
(Pause)
THE COURT: I will allow it.
THOMAS KIERNAN: Can you repeat that?
MR. DRATEL: Sure. Do you know whether a user logging on to the Silk Road site, using the Dread Pirate Roberts' username and password to get on to the Silk Road site, would automatically be directed to the mastermind page?
THOMAS KIERNAN: I don't know.
MR. DRATEL: I am going to show you what's marked as Defendant's J and ask you to look at just first what it is. Do you recognize that?
THOMAS KIERNAN: Yes. The code looks familiar.
MR. DRATEL: Is that from the php files?
THOMAS KIERNAN: Yes.
MR. DRATEL: From the image that you were given of the laptop, right?
THOMAS KIERNAN: I don't know if from the laptop or the server.
MR. HOWARD: Objection to foundation.
THE COURT: Well, why don't you try to build a more concrete foundation.
MR. DRATEL: Sure.
MR. DRATEL: You've reviewed this document in the course of your investigation, correct?
THOMAS KIERNAN: Yes.
MR. DRATEL: That looks familiar to you?
THOMAS KIERNAN: This looks familiar, yes.
MR. DRATEL: And you don't know whether it is from the server or from the laptop, or could it be from both?
THOMAS KIERNAN: It could be from both.
MR. DRATEL: And it would be either from the Silk Road server or from the laptop image that you -- of Mr. Ulbricht's laptop that you reviewed, right?
THOMAS KIERNAN: Yes.
MR. HOWARD: Objection. Beyond the scope.
THE COURT: Well, I don't know whether it is or not. I have to see where this is going. I will allow a few more questions.
MR. DRATEL: OK. Thank you, your Honor.
I would move it in evidence, your Honor.
MR. HOWARD: Objection.
THE COURT: Well, I think that I'm going to receive it subject to connection. Obviously, whether it is in the server or the laptop, if that becomes important, then you will need to determine which it came from. If that is an irrelevancy, then since it came from one or the other, there would be a sufficient foundation. So I would receive it.
So it will be received subject to any later testimony which may require a different ruling.
You may proceed.
MR. DRATEL: Thank you, your Honor.
THE COURT: Defense Exhibit J received.
(Defendant's Exhibit J received in evidence)
BY MR. DRATEL:
MR. DRATEL: So if you look at the lines that are marked on page 2, do you see that?
THOMAS KIERNAN: Yes.
MR. DRATEL: So from looking at those, is it possible now to answer the question as to whether a person logging on to the Silk Road site with the username and password of Dread Pirate Roberts would automatically be directed to the mastermind page?
THOMAS KIERNAN: I don't know.
MR. DRATEL: And, by the way, php -- I'm sorry, go ahead.
THOMAS KIERNAN: Like you said, I could read the php script and I could tell. I don't know.
MR. DRATEL: I'm sorry. You said you could read the php script?
THOMAS KIERNAN: I don't know the context of the script, that is all.
MR. DRATEL: Php is a script, essentially. We talked yesterday about operating systems, right, and so an operating system would be Ubuntu as part of a Linux-based operating system, right, kind of like Windows --
THOMAS KIERNAN: Yes.
MR. DRATEL: -- or Mac; Yosemite I think is the current version. But php is what's called a scripting program, right?
THOMAS KIERNAN: It is, yes.
MR. DRATEL: And by that we mean sort of how you build a site, essentially, a website?
THOMAS KIERNAN: Yes.
MR. DRATEL: And is it somewhat similar to, in a Windows-based environment, say html?
THOMAS KIERNAN: Html, similar but not the same.
MR. DRATEL: Not exactly, but it is the same -- in other words, it is the way that website appears, its fields, that's the php part, right?
THOMAS KIERNAN: Yes.
THE COURT: All right. Let's take our mid-morning break now, ladies and gentlemen. And I want to remind you not to talk to anybody else about -- anybody about this case, including each other or anybody else. And we'll come back in just a few minutes. Thank you.
COURT CLERK: All rise as the jury leaves.
THE COURT: And, Mr. Kiernan, you can step down and take a break.
THOMAS KIERNAN: Thank you.
(Continued on next page)
(Jury and witness not present)
THE COURT: All right. Ladies and gentlemen, let's all be seated.
I want to find out where you're going, Mr. Dratel, because what you can't do with this witness is -- I've allowed, in response to the government's objection about going beyond the scope, I have allowed you some room, but what you can't do is make him into a generalized computer expert for the defense. You are welcome, of course, if you have complied with the appropriate disclosure requirements, to call your own expert or to call a percipient witness. But the mastermind page came in through the back button series. It was a percipient witness set of testimony, as opposed to generalized how you would enter the username. The username was there, but the coding behind it was not the subject of this witness' testimony.
MR. DRATEL: He testified about php. He testified about the website pages.
This is from the laptop. We are going to establish that with him. And it is from the laptop, and he said he looked at php files. He should just --
THE COURT: You have to stay within the scope of the direct. So the direct is not just because he mentioned php, every php question you can think of that might be helpful to the defense, it is to go after what this witness testified about. The scope of his direct, as you know, determines the parameters of the cross. And so you are welcome to go anywhere with the cross. But his direct was actually quite narrow. It was here's what I got. Here are the files I extracted.
MR. DRATEL: He put in the entire laptop. That is fair game now.
THE COURT: It is not fair game now.
MR. DRATEL: He can't just ignore it by not asking the witness. He examined the entire laptop.
THE COURT: You can get him, through cross-examination, on any one of the files he testified about. Go after that. But you've got to tie it specifically to the file in the extraction process. The two things he did was extraction, and then this file came out of this directory, which had this folder in it. That's it.
MR. DRATEL: No, but there is more. He puts in a whole document, essentially. If someone puts in a 30-page document and he only testifies about page 2, that doesn't put the other 29 off limits, I mean, on cross if they are part of the same document.
THE COURT: Sometimes it does. It depends. And so just because he's got a laptop that he's authenticated doesn't mean he can be your laptop expert.
Now, to be clear -- to be clear, if you want to call somebody to talk about php, the laptop more generally, BitTorrent more generally, that's the defense case, but this witness is not your generalized computer witness.
MR. DRATEL: He is not an expert. I'm not making him an expert. He testified, number one, about the mastermind page yesterday. And he testified about the mastermind file on the laptop in the php directories. That makes him fair game for --
THE COURT: That does not make him --
MR. DRATEL: I can't be limited to just -- then I have no cross if all I can do is just talk about what they've talked about. Cross is much further than that.
THE COURT: No. What you can do is talk about whether or not in fact the file that he looked at on the computer was not a php file, it was really something else, whether or not his definition of php was inaccurate. You go dig into anything that he testified about. Whether when he pushed the back button it somehow corrupted the file, changed the file, whether or not he's reading the directory and the file paths correctly.
Let me hear from the government, but I am concerned that this is going to go on far longer than it needs to go because you are trying to make him into a different witness.
MR. DRATEL: He answered the question, no, he can. I just want to now establish that it's in the laptop --
THE COURT: I know, but we are going to be coming back to the same problem again and again.
MR. DRATEL: I don't think so.
THE COURT: Let me hear from the government about your view.
MR. HOWARD: Your Honor, I think the Court has it absolutely right. That is why we are objecting as to the scope of the cross-examination.
Mr. Kiernan simply testified to the extraction of files from certain locations on the laptop. He did not testify about how the scripts worked, how they operated, or anything of that sort. And it is apparent that Mr. Dratel is trying to go further than the scope of Mr. Kiernan's direct, which was just simply about locating and extracting files from the digital evidence.
MR. DRATEL: He didn't. He went further. He talked yesterday about the purpose of php and --
THE COURT: You can go after -- if his definition of php was wrong and you want to undermine his credibility in terms of his expertise by asking him whether the definition is correct, that is fair game. Absolutely. No doubt about it. That is absolutely impeachment material.
If, however, by merely mentioning the word "php" you are now going to find other kinds of php material which would be helpful to the defense, he's not your witness. You need a different witness, either that the government may later call where you can use it or where you yourself call. But we are going to stay within the scope of the direct or this is going to become a detour and frolic. You need to call a witness to make the points you want to make if it is beyond the scope. I am not going to allow it to be very far afield.
You know what's within the scope of the direct.
MR. DRATEL: I disagree, your Honor. OK. So --
THE COURT: Well, stay within the scope of the direct. And if you are able to stay within the scope of the direct, then it will be clear to us both that you understand what I'm saying. If you continue to go outside the scope of the direct, I will sustain the government's objections.
The government should continue to object if it believes it is outside the scope of the direct. I wanted to see where this was going. It's going outside the scope. I want to say, for the fifth time I think now, I am by no means suggesting that the defense can't put on evidence it believes is appropriate as to these very topics, as to these very documents, as to these very files, but it's for the defense to do if it's not for the purposes of directly going into the scope of the direct of this witness.
Let's take our own break and then we'll come back.
COURT CLERK: All rise.
(Recess)
THE COURT: All right. Let's bring out the jury.
(Continued on next page)
COURT CLERK: All rise as the jury enters.
(Jury present)
THE COURT: All right, ladies and gentlemen. When you get to your seats, please be seated.
Mr. Dratel, you may continue.
MR. DRATEL: Thank you, your Honor.
BY MR. DRATEL:
MR. DRATEL: So let's go back to your creating those Tor chats, where you create the Tor chat that showed that myself was you, right, on the Tor chat? Do you know what I'm talking about? You testified about that on direct.
THOMAS KIERNAN: Yes.
MR. DRATEL: So you set up your computer with Ubuntu, right?
THOMAS KIERNAN: Yes.
MR. DRATEL: And Linux, right, which Ubuntu runs on?
THOMAS KIERNAN: They run the same, yes.
MR. DRATEL: Do you know how Mr. Ulbricht's laptop was set up, in other words, the methodology of how the Tor chat program was installed?
MR. DRATEL: And, in fact, Linux is highly customizable, right, meaning -- withdrawn.
A user who installs Linux has a lot of options, correct?
THOMAS KIERNAN: Yes.
MR. DRATEL: And can make a custom version for themselves based on a lot of variables?
MR. HOWARD: Objection to form.
THE COURT: Sustained.
MR. DRATEL: A user of Linux has a lot of options of features to put on their system and how they get on the system, correct?
MR. HOWARD: The same objection, your Honor.
THE COURT: I will allow this one question.
THOMAS KIERNAN: Yes. You can customize your install.
MR. DRATEL: And there is something called a kernel, correct, k-e-r-n-e-l?
THOMAS KIERNAN: That's correct.
MR. DRATEL: That is an essential part of the Linux operating system?
THOMAS KIERNAN: Yes.
MR. DRATEL: And the composition of the kernel is also a critical factor in terms of its customizing, correct?
MR. HOWARD: Objection. Beyond the scope.
THE COURT: Sustained.
MR. DRATEL: Your Honor, he did an experiment --
THE COURT: Sustained.
MR. DRATEL: He --
THE COURT: Sustained.
MR. DRATEL: In your experiment, do you know -- you used a bundle of Linux -- or Tor chat, right? Withdrawn.
Linux is an open-source program, correct?
THOMAS KIERNAN: Yes.
MR. DRATEL: It is available for free on the Internet, right?
THOMAS KIERNAN: Yes.
MR. DRATEL: And both Linux and Ubuntu are perhaps not as popular as Windows but they're popular, right?
MR. HOWARD: Objection.
THE COURT: Sustained.
MR. DRATEL: The Linux kernel is essentially the glue that holds the software and the hardware together, right, for Linux?
MR. HOWARD: The same objection.
THE COURT: Sustained. Stay within the scope of the direct.
MR. DRATEL: Your Honor, this is within the scope.
THE COURT: Sustained.
MR. DRATEL: Can I have another sidebar, please?
THE COURT: No. Move on to your next line of questioning.
BY MR. DRATEL:
MR. DRATEL: So you don't know if the kernel that Mr. Ulbricht had --
THE COURT: Leave "the kernel."
MR. DRATEL: You used a Tor chat -- withdrawn.
You downloaded Tor chat through something called the Debian package, correct, D-e-b-i-a-n?
THOMAS KIERNAN: And AppGet, yes.
MR. DRATEL: I missed that last one.
THOMAS KIERNAN: The install command is AppGet.
MR. DRATEL: Oh, OK. But that's a preconfigured package that has all of the Tor chat elements in it and you just put it right in on the machine, right?
THOMAS KIERNAN: Yes.
MR. DRATEL: OK. But it can also be done in sort of a DIY, do it yourself, where a user can take code and put it in separately. They don't even have to buy the package as a bundle. They can do it on their own with the various components, correct?
MR. HOWARD: Objection. Beyond the scope and foundation.
THE COURT: Sustained.
MR. DRATEL: Your Honor, it's not beyond the scope.
THE COURT: Sustained.
MR. DRATEL: May I be heard?
THE COURT: No. You can be heard on this at the next break. Go on to your next line of questioning.
BY MR. DRATEL:
MR. DRATEL: So in the experiment that you described yesterday, you don't know that the way that you installed Tor chat on your computer and the version of Tor chat was the same as that on Mr. Ulbricht's computer, right?
THOMAS KIERNAN: That's right.
(Continued on next page)
BY MR. DRATEL:
MR. DRATEL: So, the experiment that you ran -- withdrawn.
The purpose of a scientific experiment is to try to replicate as much as possible - and frankly completely - all of the elements of one set of events so that you can match them to a second set, right?
MR. HOWARD: Objection.
THE COURT: Sustained.
MR. DRATEL: If an experiment doesn't have the same elements in it to get to a result, it's not a valid experiment, is it?
THE COURT: Why don't you ask it in terms of the experiment he did.
MR. DRATEL: Yes. That's what I'm trying to do.
THE COURT: No. You're saying "if an experiment." Not any generalized experiment. Talk to him about the experiment he did.
MR. DRATEL: That's what I was doing before. That's exactly what I was doing before.
THE COURT: Try again.
MR. DRATEL: In your experiment, Tor chat is an essential element of your experiment, correct?
THOMAS KIERNAN: Not essential, but it's -- the download was important to get, yes.
MR. DRATEL: Could you have done it without Tor chat?
THOMAS KIERNAN: I needed Tor chat to run -- it wasn't an experiment. I wanted to make sure that the log files, what directory they would start in and if logging was enabled by default. Nothing more complicated than that.
MR. DRATEL: You were trying to create a Tor chat so you could see if "myself" was you on the Tor chat, correct?
THOMAS KIERNAN: That was part of it; yes.
MR. DRATEL: So you needed Tor chat for that, right?
THOMAS KIERNAN: Yes.
MR. DRATEL: There are different versions of Tor chat, correct?
THOMAS KIERNAN: I don't know how many versions there are of Tor chat.
MR. DRATEL: And you have no idea what version Mr. Ulbricht downloaded?
THOMAS KIERNAN: I don't know, no.
MR. DRATEL: And you don't know whether he downloaded it through a Debian package or whether he did it himself by taking components off the Internet and making the Tor chat program accessible on his computer, right?
THOMAS KIERNAN: That's right.
MR. DRATEL: So, when you do an experiment like that, the experiment that you did, if you don't know what went into it, how can you verify what came out of it?
THOMAS KIERNAN: "Myself" is the user of the computer.
MR. DRATEL: On the one that you did, correct?
THOMAS KIERNAN: On the one that I did.
MR. DRATEL: And you didn't do it on the one that Mr. Ulbricht's laptop had, right?
THOMAS KIERNAN: I didn't do it with the version that he had, or I don't know what version he had on his.
MR. DRATEL: Right.
THOMAS KIERNAN: Right; that correct.
MR. DRATEL: Now, Linux -- you talked about creation dates, modification dates, right?
THOMAS KIERNAN: Yes.
MR. DRATEL: Linux has timestamps for three times of files, right, three types of timestamps, correct?
THOMAS KIERNAN: Yes.
MR. DRATEL: One is an "M" time, right?
THOMAS KIERNAN: Correct.
MR. DRATEL: C time, right?
THOMAS KIERNAN: Yes.
MR. DRATEL: And "A" time, right. "M" time is for the modification time of a file, right?
THOMAS KIERNAN: Yes.
MR. DRATEL: When the content of the file was last modified, right?
THOMAS KIERNAN: That's right.
MR. DRATEL: "A" time is for access, right?
THOMAS KIERNAN: Yes.
MR. DRATEL: When the last time it was opened or reviewed, right?
THOMAS KIERNAN: Accessed.
MR. DRATEL: And "C" time is not creation time, correct, Linux doesn't recognize creation time the same way Windows operating systems do?
THOMAS KIERNAN: It does in the ExT4 version of the file system.
MR. DRATEL: And when did that come out?
THOMAS KIERNAN: 2010 I believe.
MR. DRATEL: So do you know what was running on Mr. Ulbricht's?
THOMAS KIERNAN: ExT4; yes.
MR. DRATEL: So you're saying that recognized "C" time?
THOMAS KIERNAN: Oh, yes.
MR. DRATEL: That was the creation time?
THOMAS KIERNAN: Yes.
MR. DRATEL: It's not the last time that metadata associated with the file was changed, that's not what "C" time is in a Linux system?
MR. DRATEL: Now, you're familiar with Linux, right, you again have certifications in programs, right?
THOMAS KIERNAN: Yes.
MR. DRATEL: And there's an option on Linux called Touch by which you can change -- you can manipulate these metadata times, right?
THOMAS KIERNAN: There is. Touch files.
MR. DRATEL: So it doesn't have to -- so when something says "May 8, 2012," that could have been changed somehow by the Touch system, right?
THOMAS KIERNAN: You can always change file systems, I mean, times, I mean.
MR. DRATEL: So metadata just tells you a number, right? A date, a time. It doesn't verify that that's the date something actually happened, correct? Right?
THOMAS KIERNAN: It verifies the time that the files were there and created and modified, but those are -- again, they're editable. Sure.
MR. DRATEL: Metadata is editable just like content, right?
THOMAS KIERNAN: Correct.
MR. DRATEL: In the Tor chat files are ordinary text files that can be edited even after they're created, right?
THOMAS KIERNAN: Yes.
MR. DRATEL: So you talked about MD5 Hash values, right?
THOMAS KIERNAN: Yes.
MR. DRATEL: And the files that you took off the computer, you said you had copied a couple of files initially, correct?
THOMAS KIERNAN: Yes.
MR. DRATEL: Before you gave it to Mr. Beeson, right?
THOMAS KIERNAN: Yes.
MR. DRATEL: And you didn't do any hash values for those, right?
THOMAS KIERNAN: No. I don't have any fields.
MR. DRATEL: So just to make clear about the hash values, the hash values you're comparing is not to the laptop itself, correct, it's from the image that Mr. Beeson created, right?
THOMAS KIERNAN: It's the hash value from his image.
MR. DRATEL: Right. So it's not from the laptop. It's from the image?
THOMAS KIERNAN: The image is from the laptop, right, it's from the image that he created.
MR. DRATEL: The hash value is from his image, right?
THOMAS KIERNAN: Correct.
MR. DRATEL: In other words, you're comparing what you copied on your computer to the image you got from him and they matched, right?
THOMAS KIERNAN: Yes, yes.
MR. DRATEL: Not from the laptop itself?
THOMAS KIERNAN: That's where the image was created from.
MR. DRATEL: But it's not a hash value from the laptop itself?
THOMAS KIERNAN: No, not from the laptop itself. That's in a different -- that was on the hard drive that came back that was a brick that we couldn't actually look at.
MR. DRATEL: Now, by the way, as far as encryption goes, on Ubuntu, this -- the encryption that was running is an option on Ubuntu, right?
THOMAS KIERNAN: Yes.
MR. DRATEL: So anyone who downloads Ubunto can use that encryption option?
THOMAS KIERNAN: I'm sorry. Say that again.
MR. DRATEL: Anyone who downloads Ubuntu operating system could avail themselves of that encryption option that was on this machine?
THOMAS KIERNAN: Sure.
MR. DRATEL: And you don't know whether closing the laptop would have turned it on, right, made the files unavailable, right? You don't know because you didn't close it, right?
THOMAS KIERNAN: We closed it later on, and we weren't able to get to any of the file systems.
MR. DRATEL: And was that -- Mr. Beeson was involved in that?
THOMAS KIERNAN: Yes.
MR. DRATEL: So that was really his work, not yours?
THOMAS KIERNAN: Well, correct.
MR. DRATEL: Right, so that's what you heard?
MR. DRATEL: I move to strike that, your Honor, as hearsay.
THE COURT: That answer is struck.
MR. DRATEL: Now, with respect to hash values, there can be problems with MD5 Hash values, correct?
THOMAS KIERNAN: Yes. There is a one -- there is an older problem with MD5s that it was able to recreate -- it's one of those long shot-type deals that happened -- that was you're able to create a file and make another MD5 with the same number, but with two different files. It's a known problem.
MR. DRATEL: And in fact, there's a better system called SHA1, right?
THOMAS KIERNAN: Yes.
MR. DRATEL: And, in fact, if we look at Government Exhibit 205A -- or 201, whichever. Look at 205A or 201. I saw 205A this morning, so that would be easiest.
In fact, there's a section for SHA, right?
THOMAS KIERNAN: Yes.
MR. DRATEL: But you didn't do that one. You just did the MD5?
THOMAS KIERNAN: Yes. We used the MD5. Standard.
MR. DRATEL: Even though SHA1 is more reliable?
THOMAS KIERNAN: They're both very reliable.
MR. DRATEL: SHA1 is more reliable, correct?
THOMAS KIERNAN: Yes.
MR. DRATEL: Now, let me talk about some of the exhibits that were admitted through you yesterday. If we can go to 240A, please, if we can scroll up a little bit.
This is a journal entry that you put in, right?
THOMAS KIERNAN: Yes.
MR. DRATEL: And it's labeled "2010," correct?
THOMAS KIERNAN: Yes.
MR. DRATEL: So if we can go up to the part that the government did not read yesterday. And I'll read it: "Up to this point, I had been working on selling my rental house in Pennsylvania. It had helped me stay afloat with around $600/mo in Cashflow, but finally the sale came to a close. I made about $30k off the whole thing, and could finally start trading again. I had been practice trading for a while and saw an opportunity to take my $30k And make it as a day trader. $30k isn’t alot to start with, and I didn’t Get off to a very good start with my trading. Around that time, another opportunity came into my life. Donny Had gotten a job offer from his brother in Dallas to be the VP of sales at Their milling company. He didn’t know what to do about Good Wagon which he had grown somewhat to the point that he was making around $6k per month in sales. He made me an offer. 50% of the company and a $3k per month salary to take over and run the business going forward. I took the deal and we went to work on it. By the end of the year, we had our best month on record with about $10k in sales in December."
This is 2010, correct -- go back to the top just for a second -- right?
THOMAS KIERNAN: Yes.
MR. DRATEL: So let's go further down, the next highlighted portion, again not read by the government: "I went through a lot over the year in my personal relationships as Well. I had mostly shut myself off from people because I felt ashamed of where my life was. I had left my promising career as a scientist to be an investment adviser and entrepreneur and came up empty handed. More and more my emotions and thoughts were ruling my life and my word was losing power. At some point I finally broke down and realized my love for people again, and started reaching out. Throughout the year I slowly re-cultivated my relationship with my word and started honoring it again."
Let's go to 240B. This is "2011" it says, right?
THOMAS KIERNAN: It does.
MR. DRATEL: So let's go to the highlighted portion, again not read by the government yesterday: "At some point, a hacker found some major flaws in my code. I sent it to him for review and he came back with basically “this is amateur shit”. I knew it too. I tried to work with him but I think he lost interest and since I wasn't charging commission, I only had my shroom money to pay him with. Thankfully that quadrupled from bitcoin increasing in price, little did I know I could've cashed out at 8x higher for a total of 32x! That would have gotten me off to a hell of a start. As it was, I cashed out all the way up and all the way down. I called the peak, my timing was just off."
If we go down further -- no, I think that's it for that. No. Okay. I'm sorry. I just want to ask you a couple of questions while we're talking.
The bitcoin came up. You talked yesterday about cold storage bitcoin, cold storage?
THOMAS KIERNAN: I did.
MR. DRATEL: And the bitcoins don't become physical at that point, right?
THOMAS KIERNAN: Never physical.
MR. DRATEL: They're always digital, right?
THOMAS KIERNAN: That's right.
MR. DRATEL: They're always electronic, they're always in a file, right?
THOMAS KIERNAN: Yes.
MR. DRATEL: Or a wallet, let's say, right?
THOMAS KIERNAN: Yes.
MR. DRATEL: And transactions cashing out of them are going to be registered on the public block chain, right?
THOMAS KIERNAN: That's right.
MR. DRATEL: Let's go up. This is another paragraph or another section not read by the government: "It looked like I didn't have to process the transactions manually anymore, but then the rot started. Some where the site accounting wasn't balancing and I was losing hundreds of dollars every few hours. I started to panic. I tried everything I could think of, but couldn't stop the bleeding. It was getting to the thousands of dollars and I was losing sleep and getting slow. I didn't give up though. I rewrote the entire transaction processor from scratch and some how it worked. To this day I don't know what the problem was."
Now, I want to look at 232A which is a Tor chat. This is March 14, 2012?
THOMAS KIERNAN: Yes.
MR. DRATEL: And it's between "da" and it says "myself," right?
THOMAS KIERNAN: Yes.
MR. DRATEL: And it says "We might want to construct a new identity for you though," right.
THOMAS KIERNAN: That's what it says; yes.
MR. DRATEL: And if you go down further and the person asks "IRL or online."
IRL means in real life?
THOMAS KIERNAN: Oh. You're asking?
MR. DRATEL: IRL?
THOMAS KIERNAN: Yes. I'm sorry.
MR. DRATEL: "Or online," right? DA is asking "myself," I guess that's Dread Pirate Roberts, right?
MR. HOWARD: Objection; foundation.
THE COURT: Overruled. Why don't you just reask the question attached to this.
MR. DRATEL: Sure.
MR. DRATEL: IRL to your knowledge is in real life?
THOMAS KIERNAN: In real life; yes.
MR. DRATEL: And in this chat, DA asks Dread Pirate Roberts "IRL or online," right?
THOMAS KIERNAN: Yes.
MR. DRATEL: Distinguishing the two things, right?
THOMAS KIERNAN: Yes.
MR. DRATEL: Real life from online?
THE COURT: Hold on. He can't testify as to what was meant by these people, but he can say what the word "IRL" means to him.
MR. DRATEL: And Dread Pirate Roberts answers no, just online. My concern is that LE, and that's law enforcement, right?
THE COURT: Hold on. He's not going to interpret what the writers meant. He didn't do it yesterday. He's not going to do it today. You can put somebody else on the stand to do that.
MR. DRATEL: "My concern is that LE will see that DA is a player at Silk Road by your forum presence and then track down who you bought from, and sold to under that name and then find you irl."
Now, that application for the Island of Dominica that you looked at yesterday, right --
THOMAS KIERNAN: Yes.
MR. DRATEL: -- all of the personal identifying information with respect to Mr. Ulbricht that was in there - name, address, social security - all the things in there was all accurate, wasn't it?
MR. HOWARD: Objection.
THE COURT: Sustained.
MR. DRATEL: Do you know of any of it that was inaccurate?
MR. HOWARD: Objection.
THE COURT: Sustained.
MR. DRATEL: Did you check as to the accuracy of any of that information?
THE COURT: I'll allow that.
THOMAS KIERNAN: Personally, no.
MR. DRATEL: And in that document, he provides references, right, persons, correct?
THOMAS KIERNAN: Correct.
MR. DRATEL: Nothing further.
THE COURT: Thank you.
Any redirect?
MR. HOWARD: Thirty seconds if you don't mind. It will be very brief, your Honor.
THE COURT: All right. Redirect examination.
REDIRECT EXAMINATION BY MR. HOWARD:
MR. HOWARD: On cross-examination, you testified about BitTorrent, correct, BitTorrent?
THOMAS KIERNAN: I did.
MR. HOWARD: And BitTorrent was on the defendant's computer, correct?
THOMAS KIERNAN: It was, yes.
MR. HOWARD: And it's basically a file-sharing program?
THOMAS KIERNAN: Yes.
MR. HOWARD: You can --
MR. DRATEL: Objection.
THE COURT: Sustained.
Let's put it this way: You had better state very carefully with only the limited amount that was opened by the defendant. Don't go beyond that.
MR. HOWARD: Did you look at the settings of the BitTorrent program on the defendant's computer?
THOMAS KIERNAN: Yes.
MR. HOWARD: Did you see where -- what the settings indicated about where files downloaded to the defendant's computer would go?
THOMAS KIERNAN: Yes.
MR. HOWARD: And what folder did that indicate the files would go?
THOMAS KIERNAN: The home/frosty/downloads folder.
MR. HOWARD: Did you look at the contents of that folder?
THOMAS KIERNAN: Yes.
MR. HOWARD: And what was contained within that folder?
THOMAS KIERNAN: Movies, books, things to that nature.
MR. HOWARD: Were any of the files that were admitted as exhibits during your direct examination found in that folder?
MR. HOWARD: You testified about the Tor chats on cross-examination, correct?
THOMAS KIERNAN: I did.
MR. HOWARD: And you've logged your own Tor chats, is that right?
THOMAS KIERNAN: I have.
MR. HOWARD: And have the logs of those Tor chats been true and accurate transcriptions of the Tor chats that you have had?
THOMAS KIERNAN: Yes.
MR. HOWARD: And you found the Tor chats we put in on direct examination, you found them on the defendant's computer, correct?
THOMAS KIERNAN: I did.
MR. DRATEL: Objection.
THE COURT: Overruled.
You may proceed.
THOMAS KIERNAN: Yes.
MR. HOWARD: You testified on direct that you found encryption -- an encryption process was active on the computer, correct?
THOMAS KIERNAN: Correct, yes.
MR. HOWARD: If the defendant had been able to close his computer before he was arrested, would you have been able to access the Tor chat files?
MR. DRATEL: Objection; objection.
THE COURT: I will allow it.
MR. HOWARD: Let me check with cocounsel and see if there's anything else, but I think we're done.
No further questions.
THE COURT: Mr. Dratel.
RECROSS EXAMINATION BY MR. DRATEL:
MR. DRATEL: To be clear about the last point, you didn't close the laptop, correct?
THOMAS KIERNAN: Correct.
MR. DRATEL: So you don't have any personal knowledge as to what would have happened had that laptop been closed, right?
THOMAS KIERNAN: I know when I got it back --
MR. DRATEL: No.
THOMAS KIERNAN: Personal, no.
MR. HOWARD: No further questions.
THE COURT: He may still be going.
MR. HOWARD: Pardon me.
MR. DRATEL: Now, you testified about BitTorrent on redirect about files, about download destination, right?
THOMAS KIERNAN: Yes.
MR. DRATEL: But you can't sit here now and testify that you know all of the activity that went on through that open port on that computer, either that day or some other day when he was downloading something else?
THOMAS KIERNAN: Not from the whole time period.
MR. DRATEL: Right.
THOMAS KIERNAN: But that's a BitTorrent --
MR. DRATEL: But that's a BitTorrent, but the port is open and it gives access to the computer, correct?
THOMAS KIERNAN: It gives access to the BitTorrent client.
MR. DRATEL: Right. But people who -- and that means those seven users out there who have it, right, who are connected?
THOMAS KIERNAN: That's right.
MR. DRATEL: And as we said before, it could contain all sorts -- that anything you download, can contain all sorts of malware, right, malicious --
THOMAS KIERNAN: Possible.
MR. DRATEL: -- malicious software that can be used against the person who is operating the computer, right?
MR. HOWARD: Objection.
THE COURT: Sustained.
MR. DRATEL: I have nothing further.
THE COURT: Thank you.
Anything further, Mr. Howard, like one question?
MR. HOWARD: Yes. It is one question -- two questions, but start with one.
REDIRECT EXAMINATION BY MR. HOWARD:
MR. HOWARD: Mr. Kiernan, did you review the contents of the defendant's computer for malware?
THOMAS KIERNAN: Yes.
MR. HOWARD: Did you find any --
THE COURT: I stopped Mr. Dratel on the malware.
MR. HOWARD: I'm sorry. Withdrawn. No further questions.
THE COURT: Thank you.
You may step down.
THOMAS KIERNAN: Thank you.
(Witness excused)
THE COURT: Would the government like to call its next witness, please.
MR. HOWARD: The government is calling Special Agent Greg Fine. We're getting him right now.
(Witness sworn)
THE COURT: Mr. Fine, please be seated. And it will be important for you to pull up your chair and adjust the microphone so that you can speak clearly and directly into the mic.
THOMAS KIERNAN: Thank you.
THE COURT: Mr. Turner, you may proceed.
MR. TURNER: Thank you.
GREGORY FINE, called as a witness by the Government, having been duly sworn, testified as follows: