2.Alex Miller — Direct/Cross/Redirect/Recross
270 linesDIRECT EXAMINATION BY MR. TURNER:
MR. TURNER: Good morning, Mr. Miller.
ALEX MILLER: Good morning.
MR. TURNER: Where do you work?
ALEX MILLER: Stack Exchange.
MR. TURNER: And what is Stack Exchange?
ALEX MILLER: We're a network of Q and A websites broken up into different groups.
MR. TURNER: What are Q and A websites?
ALEX MILLER: It is question and answer. So anyone on one of the topics can go online and ask a question, get answers.
MR. TURNER: Is one of the Q and A websites your company operates called Stack Overflow?
ALEX MILLER: Yes.
(Continued on next page)
BY MR. TURNER:
MR. TURNER: And what is Stack Overflow about?
ALEX MILLER: It's focused on computer programming.
MR. TURNER: So what can people do there?
ALEX MILLER: They can ask questions about anything directly related to software development or computer programming and get answers from the rest of the community or seek questions that have already been asked.
MR. TURNER: And can any Internet user post on Stack Overflow?
ALEX MILLER: Yes.
MR. TURNER: And anybody can answer those posts?
ALEX MILLER: Yes.
MR. TURNER: Can a user register an account on Stack Overflow?
ALEX MILLER: Yes, they can.
MR. TURNER: And in registering, what information are they required to provide?
ALEX MILLER: They provide an account name and email address and then a password.
MR. TURNER: And when you say account name, what do you mean?
ALEX MILLER: A display name that is shown to identify them to the rest of the community and whenever they ask or answer a question or for their profile, to show what they have done on the site.
MR. TURNER: Is that their screen name?
ALEX MILLER: Yes.
MR. TURNER: Does Stack Overflow maintain records of a user's registration information?
ALEX MILLER: Yes.
MR. TURNER: Are those records entered by hand or are they automatically generated?
ALEX MILLER: It's all automatically handled by the computer.
MR. TURNER: At or near the time the registration information is provided?
ALEX MILLER: Yes, as it happens.
MR. TURNER: And can a user change his registration information after initially registering?
ALEX MILLER: Yes. They can change any account information.
MR. TURNER: And Stack Overflow keeps records of those changes?
ALEX MILLER: Yes.
MR. TURNER: Does Stack Overflow keep records of all the posts by that user?
ALEX MILLER: Yes.
MR. TURNER: And responses to those posts?
ALEX MILLER: Yes.
MR. TURNER: Do you have access to those records?
ALEX MILLER: Yes.
MR. TURNER: Are you familiar with the records maintained by your company?
ALEX MILLER: Yes.
MR. TURNER: Do you have a binder in front of you?
ALEX MILLER: I do.
MR. TURNER: Can you take a look at what's been marked as GX or Government Exhibit 1200.
ALEX MILLER: Yes.
MR. TURNER: Tell me if you recognize it.
ALEX MILLER: I do.
MR. TURNER: How do you recognize it?
ALEX MILLER: It's a question from Stack Overflow.
MR. TURNER: A question posted on Stack --
ALEX MILLER: Sorry. A question that was posted on Stack Overflow.
MR. TURNER: And what was the date of the post?
ALEX MILLER: March 16, 2013.
MR. TURNER: And the username?
ALEX MILLER: Frosty.
MR. TURNER: Your Honor, the government offers Exhibit 1200 into evidence.
MR. DRATEL: Just hearsay, your Honor, and Vayner.
THE COURT: All right. That objection is overruled and Government Exhibit 1200 is received.
(Government's Exhibit 1200 received in evidence)
MR. TURNER: Mr. Evert, can you zoom in this area first.
MR. TURNER: You said the date was?
ALEX MILLER: Yes, the date is March 16, 2013.
MR. TURNER: And this is the username?
ALEX MILLER: Yes.
MR. TURNER: Can you back up, Mr. Evert.
MR. TURNER: And the title of the post, where is that shown?
ALEX MILLER: Directly right -- right there.
MR. TURNER: Mr. Evert, maybe you can zoom in here. So the title, before you do that, include the title.
The title is "How can I connect to a Tor hidden service using curl in php." It says "I'm trying to connect to a Tor hidden service using the following php," and there's a bunch of computer code under that. Then it says "When I run it I get the following error, couldn't resolve host name. However when I run the following command from my command line in the ubuntu," and there's more computer language, "I get a response as expected, the php curl documentations says this," and there's some more computer language, and then it says "I believe the reason it works from the command line is because Tor (the proxy) is resolving the dot onion host name, which it recognizes. When running the php above, my guess is that curl or php is trying to resolve the dot onion host name and doesn't recognize it. I've searched for a way to tell curl/php to let the proxy resolve the host name, but can't find a way."
MR. TURNER: Based on Stack Exchange records, are you familiar with the account information for the Stack Exchange user that made this post?
ALEX MILLER: Yes.
MR. TURNER: You reviewed those account records?
ALEX MILLER: Yes.
MR. TURNER: And when was the account originally registered?
ALEX MILLER: I believe that was in March of 2012.
MR. TURNER: About a year before this post?
ALEX MILLER: Yes.
MR. TURNER: Up to this point, how many posts had the user made?
ALEX MILLER: One other post.
MR. TURNER: After this post was put up on Stack Overflow, were any changes made to the account information for the user?
ALEX MILLER: Yes. The publicly displayed username was changed.
MR. TURNER: And what was the account -- what was the account name or display name originally associated to the account?
ALEX MILLER: Ross Ulbricht.
MR. TURNER: And what was it changed to after this post?
ALEX MILLER: Frosty.
MR. TURNER: And how soon after this post was made was that change made?
ALEX MILLER: Less than a minute.
MR. TURNER: Now, based on Stack Exchange records, do you know whether any responses to this post were made by other users?
ALEX MILLER: Yes.
MR. TURNER: Were there?
ALEX MILLER: Yes. He received -- the post received several answers.
MR. TURNER: Could you take a look at Government Exhibit 1205.
ALEX MILLER: Yes.
MR. TURNER: Do you recognize this exhibit?
ALEX MILLER: I do.
MR. TURNER: What is it?
ALEX MILLER: It's one of the answers that the post received.
MR. TURNER: The government offers Exhibit 1205 into evidence.
MR. DRATEL: The same objection, your Honor.
THE COURT: Government Exhibit 1205 is received. The objection is overruled.
(Government's Exhibit 1205 received in evidence)
MR. TURNER: So, somebody posted this. This is the username of the user who posted it?
ALEX MILLER: Yes.
MR. TURNER: It says "Wanted to help until I checked the URL and found out it is the hidden wiki. Sorry, I'm not helping that kind of people."
And down below it says "Please don't jump to conclusions. I only used that as an example. I've changed the address to TorMail's hidden service."
Who posted that response there?
ALEX MILLER: The response came from the original poster of the question.
MR. TURNER: Frosty?
ALEX MILLER: Yes.
MR. TURNER: And after this -- it says here "I've changed the address to TorMail's hidden service."
Was any change to the original post made around this time?
ALEX MILLER: Yes.
MR. TURNER: Take a look at Government Exhibit 1204.
ALEX MILLER: Yes.
MR. TURNER: Do you recognize this exhibit?
ALEX MILLER: I do.
MR. TURNER: What is it?
ALEX MILLER: It's a revision history of the question showing the original question and then a change that was made to it.
MR. TURNER: The government offers 1204 into evidence, your Honor.
MR. DRATEL: Same objection.
THE COURT: Government Exhibit 1204 is received. The objection is overruled.
(Government's Exhibit 1204 received in evidence)
MR. TURNER: Can you zoom in on this part, Mr. Evert.
MR. TURNER: So the URL and the code provided by the user in the original post was changed.
ALEX MILLER: Yes.
MR. TURNER: Can you back out, Mr. Evert.
MR. TURNER: And can you see from the exhibit when that change was made, directing your attention to the top?
ALEX MILLER: Yes. That was made on April 4th, 2013.
MR. TURNER: And was any change to the account user information made around this time?
ALEX MILLER: Yes.
MR. TURNER: What change was that?
ALEX MILLER: The email address on the account was changed.
MR. TURNER: From what to what?
ALEX MILLER: From, I believe, rossulbricht@gmail.com to frosty@frosty.com.
MR. TURNER: And how soon after this amendment to the post was made was that change made to the registration?
ALEX MILLER: Within a minute or two.
MR. TURNER: No further questions.
THE COURT: Mr. Dratel.
MR. DRATEL: Thank you.
CROSS-EXAMINATION BY MR. DRATEL:
MR. DRATEL: Good morning, Mr. Miller.
ALEX MILLER: Good morning.
MR. DRATEL: You just testified on direct about that March 16th post at 3:39, I think it's Exhibit 1200.
ALEX MILLER: Yes.
MR. DRATEL: Right?
ALEX MILLER: Yes.
MR. DRATEL: I want to go back about 20 minutes earlier in the timeline and ask you a few questions about the process of logging on in which you -- this user account logged onto the Stack Overflow.
ALEX MILLER: Okay.
MR. DRATEL: So, Stack Overflow accepted a method of logging on called OpenID, is that correct?
ALEX MILLER: That's correct.
MR. DRATEL: And OpenID is a system that essentially allows people to log in to multiple websites without having to enter the username and the password for each website, right?
ALEX MILLER: Correct.
MR. DRATEL: And it works by establishing -- and establishing the person operating a web browser is who they claim to be, right?
ALEX MILLER: Yes.
MR. DRATEL: And we're talking about any web browser, whether it be Internet Explorer, Mozilla, Firefox, Google, right?
ALEX MILLER: Yes.
MR. DRATEL: Now, as vice-president of operations, right --
ALEX MILLER: Correct.
MR. DRATEL: -- at Stack Exchange --
ALEX MILLER: Yes.
MR. DRATEL: -- you're aware that there are security flaws with the OpenID system, correct?
ALEX MILLER: I'm not familiar with the technical details of them.
MR. DRATEL: Are you familiar with literature with respect to security researches from Microsoft and computer scientists from the University of Indiana at Bloomington about OpenID?
MR. TURNER: Objection; foundation, hearsay.
THE COURT: If the answer is "no," then it's straightforward. We'll take it one question at a time. I'll allow this.
ALEX MILLER: I am not, at least not having actually read it.
MR. DRATEL: Are you familiar with a term called covert redirect?
ALEX MILLER: Yes.
MR. DRATEL: And that's when someone steals personal data from a user, right?
ALEX MILLER: Yes.
MR. DRATEL: And OpenID is something that can be vulnerable to covert redirect, right?
ALEX MILLER: My understanding is that it could.
MR. DRATEL: Also you said that all you really need to register is an email address and a username, right?
ALEX MILLER: Correct.
MR. DRATEL: So if I had your email, I could register as you and just put a different username, right, with your email?
ALEX MILLER: Yes.
MR. DRATEL: So all I have to do is know an email address for someone else to sign onto Stack Overflow, use that email address with whatever username I chose, right?
ALEX MILLER: Yes.
MR. DRATEL: And there's no way from the records that we've seen or the records that you have to determine who the actual person is who is using that email account to register, correct?
ALEX MILLER: No. We -- if I'm understanding your question correctly, all we do is basically look at the email account. We don't try and look into who the actual person is.
MR. DRATEL: Right. So you wouldn't know from your records who is using that email account to register on Stack Exchange or Stack Overflow?
ALEX MILLER: Correct.
MR. DRATEL: And there's nothing in your records that would help us determine whether or not the use of the OpenID system to get into that account was the subject of some covert redirect attack, right?
ALEX MILLER: Correct.
MR. DRATEL: Now, just looking at the sequence of events that you testified to earlier, so the first thing that the person who registered did was use the email rossulbricht@gmail.com, right?
ALEX MILLER: The account was originally created using Facebook Connect, so the email address would have been passed automatically by Facebook as part of that authentication.
MR. DRATEL: But that's the email that was on the account?
ALEX MILLER: That's the email that Facebook tells us who is on the account and, therefore, the email that we added to the account.
THE COURT: What is Facebook Connect?
ALEX MILLER: It's a service that allows a website such as ours to allow someone to use a Facebook account to establish their account on our website.
THE COURT: All right.
ALEX MILLER: It's their version of the OpenID.
MR. DRATEL: So it's a version of OpenID essentially?
ALEX MILLER: Yes.
MR. DRATEL: And subject to the same vulnerabilities that we just talked about with respect to OpenID?
ALEX MILLER: I'm not familiar with the technical implementation details on it, but in theory, yeah, I would suppose.
MR. DRATEL: And then 30 seconds later, the username changes to frosty, correct?
ALEX MILLER: No. The username frosty wasn't changed until the following year.
MR. DRATEL: Following year?
ALEX MILLER: Sorry. Can you repeat the question?
MR. DRATEL: Yes. On March 16, 2013, at 3:39:25 a.m. the user posted a question "How can I connect to a Tor hidden service using curl and php," correct?
ALEX MILLER: Yes.
MR. DRATEL: And put specific lines of code in the message, correct?
ALEX MILLER: Yes.
MR. DRATEL: And available essentially for the world to see, correct?
ALEX MILLER: Correct.
MR. DRATEL: And you keep all of those records, right?
ALEX MILLER: Yes. We make them --
MR. DRATEL: And even if someone changes their screen name or their username, you would still have all the original records, right?
ALEX MILLER: Yes.
MR. DRATEL: And they would be available by subpoena, right?
ALEX MILLER: Yes.
MR. DRATEL: But we have that first entry, March 16, and that's Exhibit 1200, right, 3:39:25 a.m.?
ALEX MILLER: Yes.
MR. DRATEL: And that's UTC time, by the way?
ALEX MILLER: That's correct.
MR. DRATEL: So, at approximately 30 seconds later March 16, 2013, the user changes the screen name to frosty, right?
ALEX MILLER: Yes.
MR. DRATEL: So thereby establishing without any question for anyone subpoenaing those records that frosty and Ross Ulbricht are connected, right?
MR. TURNER: Objection, form.
THE COURT: Sustained.
MR. DRATEL: So it doesn't change the fact that you still have all the original records available by subpoena, right?
ALEX MILLER: Correct.
MR. DRATEL: Kind of a blinking neon arrow, isn't it?
MR. TURNER: Objection.
THE COURT: Sustained.
MR. DRATEL: Nothing further, your Honor. Thank you.
THE COURT: Redirect?
MR. TURNER: Very briefly.
THE COURT: All right.
REDIRECT EXAMINATION BY MR. TURNER:
MR. TURNER: You said when the account was originally registered, it was registered using a Facebook account?
ALEX MILLER: Yes.
MR. TURNER: Would the user of that Facebook account had to have been logged into his Facebook account in order to register with Stack Overflow in that manner?
ALEX MILLER: Yes.
MR. DRATEL: Objection; foundation.
THE COURT: Overruled.
MR. TURNER: And just to make sure the timeline is clear, the account was registered in March 2012, right?
ALEX MILLER: Correct.
MR. TURNER: And from 2012 until March 2013, the display name for this user was Ross Ulbricht, correct?
ALEX MILLER: Correct.
MR. TURNER: And the registered email address was rossulbricht@gmail.com, right?
ALEX MILLER: Correct.
MR. TURNER: Not until the post we saw in 2013 did that information change, right?
ALEX MILLER: Correct.
MR. TURNER: No further questions.
MR. DRATEL: Just a couple, your Honor.
RECROSS EXAMINATION BY MR. DRATEL:
MR. DRATEL: Now, you don't know how the person logged in, though, to make that post, correct?
ALEX MILLER: In -- sorry. In which case?
MR. DRATEL: In 2013? In other words, to log into Stack Overflow in 2013, they used the OpenID system?
ALEX MILLER: Correct. They used the OpenID through Google.
MR. DRATEL: Right. So it didn't necessarily have to come through a Facebook account?
ALEX MILLER: No. In this case, if I'm understanding your question correctly, we key -- we do what's called keying on the email address. So any OpenID-type system that you use if it returns the same email address because that trusted third party trusts -- says that that is the email address of this person, we trust that it is the email address of the user at the time.
MR. DRATEL: Right. So in March of 2013 when that post was made, I could have typed in "rossulbricht@gmail.com" and had the right -- and that would be it, right? I would be in there?
ALEX MILLER: Google would have to tell us that the person on the computer -- if you were to do that, we would be trusting Google to tell us that you had control over that Gmail address at that time.
MR. DRATEL: But that's what essentially the OpenID system does, right?
ALEX MILLER: Yes.
MR. DRATEL: With respect to the register of an account that you say is on Facebook, but obviously you don't know who is on the Facebook account when they're registering, right?
ALEX MILLER: Correct, correct.
MR. DRATEL: Can I have one moment, your Honor.
THE COURT: Yes.
MR. DRATEL: Nothing further. Thank you.
THE COURT: Thank you, Mr. Miller. You may step down, sir.
(Witness excused)
THE COURT: Let's get Mr. Alford back on the stand.
Mr. Alford, you're reminded that you remain under oath from our prior session.
ALEX MILLER: Thank you.
GARY ALFORD, resumed.