5.Gary Luis Alford — Cross/Redirect (Part 3)
262 linesTHE COURT: I want to apologize to having you folks ready to go at ten of, and I know you were. All I can say is the best laid plans.
We are on the cross-examination of Mr. Alford.
Mr. Dratel, you may proceed, sir.
MR. DRATEL: Thank you, your Honor. GARY ALFORD,
CROSS-EXAMINATION CONTINUED BY MR. DRATEL:
MR. DRATEL: Now, good afternoon, Agent Alford.
GARY LUIS ALFORD: Good afternoon.
MR. DRATEL: You were focused in your investigation on trying to identify Dread Pirate Roberts, correct?
GARY LUIS ALFORD: At one point, yes.
MR. DRATEL: And did you come across evidence suggesting that there was more than one Dread Pirate Roberts during the course of the Silk Road?
GARY LUIS ALFORD: I did not.
MR. DRATEL: Didn't you refer to Mr. Ulbricht at one point as the original DPR?
GARY LUIS ALFORD: I don't recall that. May I see the document?
MR. DRATEL: Sure. I show you what's marked as 3501-0002 and ask you to just read that on top.
GARY LUIS ALFORD: "I received Google" -- The entire thing?
MR. DRATEL: Don't read it. Read it to yourself. I apologize.
GARY LUIS ALFORD: Okay. Okay.
MR. DRATEL: Does that refresh your recollection that you, in December of 2013, December 30th, 2013, referred to Mr. Ulbricht as the original DPR?
MR. TURNER: Objection; agent belief.
THE COURT: He's asking whether or not he made that statement. You may answer.
GARY LUIS ALFORD: Yes. I was referring to --
MR. DRATEL: Just "yes" is fine. Thank you.
GARY LUIS ALFORD: Yes.
MR. DRATEL: And when you did all the -- when you looked for comparisons of things that were happening online versus returns on subpoenas and other things that you could find online such as Google and other -- withdrawn.
When looking at Mr. Ulbricht, you were trying to compare time frames with various things that were going on, either on Google or Facebook -- Gmail, rather, or Facebook and versus other things like chats and things like that, right?
GARY LUIS ALFORD: Information that was found on the laptop versus information we found from outside.
MR. DRATEL: And you did that a little bit with respect to Richard Bates as well, correct?
MR. TURNER: Objection; beyond the scope.
THE COURT: Sustained.
MR. DRATEL: Did you at one point find evidence that someone who worked at eBay or PayPal was Dread Pirate Roberts?
MR. TURNER: Objection; agent belief.
THE COURT: Sustained.
MR. DRATEL: One of the other purposes of your investigation was about looking at bitcoins, correct?
GARY LUIS ALFORD: At bitcoins?
MR. DRATEL: Trying to find bitcoin wallets and Silk Road bitcoin?
MR. TURNER: Objection; form and beyond the scope.
THE COURT: Well, I don't understand how it's within the scope. Sustained.
MR. DRATEL: You had access to the Silk Road servers at some point, too, correct?
MR. TURNER: Objection; beyond the scope.
THE COURT: I don't know where this is going. I don't find it within the scope. I can't conceive how it's within the scope. Sustained.
MR. DRATEL: Well, you talked about Government Exhibit 241, correct, on your direct?
GARY LUIS ALFORD: Can you refresh.
MR. DRATEL: The log?
GARY LUIS ALFORD: The log.
MR. DRATEL: Yes. In fact, there were other documents -- withdrawn. You had access to the private messages, right, you reviewed private messages on the Silk Road server?
MR. TURNER: Objection; beyond the scope.
THE COURT: I'll allow it. Let him develop a few questions on this.
GARY LUIS ALFORD: Can you repeat the question?
MR. DRATEL: Sure. By the way, all the things that you looked at and that you went through today, you developed after the fact; meaning that they weren't at the time that those posts were made or those emails were sent or anything like that? You did all of that in the course of preparation for this trial, correct?
GARY LUIS ALFORD: Everything had to be done after the fact. It was -- it happened before.
MR. DRATEL: So you had access to private message system, right, that was on -- from Silk Road on the servers, right?
MR. TURNER: Same objection, and objection to form.
THE COURT: What's the objection?
MR. TURNER: Beyond the scope and the form.
THE COURT: Sustained as to the scope.
If you're going to tie it -- are you going to tie it into 241?
MR. DRATEL: Yes.
THE COURT: Tie it directly to 241 and then we'll understand it.
MR. DRATEL: I'm building a foundation.
THE COURT: The parameters.
MR. DRATEL: Let me show you what's marked as Defendant's E. Let's go back to 241 for a second. Let's do that first.
Government's 241, if we can look at the first page at the bottom?
GARY LUIS ALFORD: 241 at the bottom.
MR. DRATEL: Yes. It's in evidence.
(Continued on next page)
MR. DRATEL: Do you see the entry for April 2nd, 2013?
MR. TURNER: Your Honor, objection.
May we have a sidebar, please?
THE COURT: All right. Hold on.
This is Exhibit 241 in evidence, right?
MR. DRATEL: Yes.
THE COURT: All right.
All right. Let's have a short sidebar but we won't have a long one.
(Continued on next page)
(Pages 1440 through 1442 sealed by order of the Court)
(In open court)
THE COURT: All right. You may proceed.
BY MR. DRATEL:
MR. DRATEL: Let's look at the entry 3/21/2013, the top of that page of Government Exhibit 241, which is in evidence.
It says, "Main server was ddosed and taken offline by host." Do you see that?
GARY LUIS ALFORD: Yes.
MR. DRATEL: You know that that refers to a denial of service attack on the Silk Road website, correct?
MR. TURNER: Objection. Foundation.
THE COURT: Hold on.
MR. TURNER: Beyond the scope.
THE COURT: Why don't you build up the foundation through his knowledge in that regard, Mr. Dratel.
BY MR. DRATEL:
MR. DRATEL: You are aware that that refers to an attempted denial of service attack on the Silk Road site at or around that time, right?
GARY LUIS ALFORD: That's what the statement says, yes.
MR. DRATEL: And if we go down to 3/25/2013, which is just a few entries later, it says that "Server was ddosed, meaning that someone knew the real IP," right?
GARY LUIS ALFORD: That's what it says.
MR. DRATEL: And "real IP" meaning the real Internet protocol address of the server, right?
GARY LUIS ALFORD: That is what IP, Internet protocol, means.
MR. DRATEL: Right. So this is March of 2013, right?
GARY LUIS ALFORD: Yes.
MR. DRATEL: The same time as the Stack Overflow posts that you -- that we saw this morning, right? You know about the Stack Overflow posts, right?
MR. TURNER: Objection, foundation.
THE COURT: Sustained.
MR. DRATEL: You know about the Stack Overflow posts, correct, by Mr. Ulbricht or Frosty, correct, in March of 2013?
GARY LUIS ALFORD: I am aware of it.
MR. DRATEL: You have seen them, right?
GARY LUIS ALFORD: Which exact posts are you talking about? The posts, all of them?
MR. DRATEL: I am talking about the posts on March 26, 2013 about code and php and curl?
GARY LUIS ALFORD: I recall it being in March. I'm not exactly certain if that is the date, but I remember there was posts around that time.
MR. DRATEL: It is also the same time -- withdrawn.
Now, you've seen other posts with respect to the denial of service attack on the defendant's computer?
MR. TURNER: Objection. Form. Beyond the scope.
THE COURT: I will allow this question and we'll see where it goes.
GARY LUIS ALFORD: Can you repeat question?
MR. DRATEL: Sure. You've seen other posts on the defendant's laptop referencing this denial of service, other files, other -- right, referencing this denial of service?
GARY LUIS ALFORD: I recall seeing other files referencing ddosed.
(Pause)
MR. DRATEL: I show you what's marked as Defendant's N, as in Nancy. I just ask you it look at it. Tell me if you recognize it.
GARY LUIS ALFORD: I do recognize it.
MR. DRATEL: It is from the defendant's laptop, correct?
(Pause)
GARY LUIS ALFORD: I don't know if I've seen this statement on the laptop. I've seen it in another.
MR. DRATEL: And it's about the denial of service, right, attack?
GARY LUIS ALFORD: Yes.
MR. DRATEL: I move it in, your Honor, as Defendant's N.
MR. TURNER: We'll stipulate that it was from the computer, your Honor.
THE COURT: Any objection?
MR. TURNER: We don't think there was a proper foundation laid but we will stipulate to that.
THE COURT: Any objection?
MR. TURNER: Beyond the scope. Yes.
THE COURT: Can I see the document?
GARY LUIS ALFORD: (Handing to the Court)
THE COURT: Thank you, sir.
(Pause)
THE COURT: I will allow it. Defendant's Exhibit N is received.
(Defendant's Exhibit N received in evidence)
MR. DRATEL: Thank you, your Honor.
BY MR. DRATEL:
MR. DRATEL: Now, you testified this morning about Government Exhibit 130, the handwritten notes, correct?
GARY LUIS ALFORD: I provided testimony about it, yes.
MR. DRATEL: I show you, this is --
(Handing to the government)
MR. DRATEL: I show you what's marked as Defendant's M, for Mary, and ask you if you recognize that?
(Pause)
GARY LUIS ALFORD: I don't -- I don't recall this.
MR. DRATEL: You reviewed the files on the defendant's laptop, correct?
GARY LUIS ALFORD: Not all the files.
MR. DRATEL: How many?
GARY LUIS ALFORD: What was provided to me.
MR. DRATEL: Did you prepare exhibits for purposes of this trial? Did you assist in the preparation of exhibits for this trial with the prosecutors?
GARY LUIS ALFORD: Yes.
MR. DRATEL: But that one you don't recognize, right?
MR. DRATEL: You don't recognize that document?
GARY LUIS ALFORD: I don't recognizes it, no. I don't have any -- no.
MR. DRATEL: I want to go back to 241. And look at the last page, please.
And you talked about the poison oak, right, entry?
GARY LUIS ALFORD: Yes.
MR. DRATEL: OK. And it also talked about Amelia from OKC, right?
GARY LUIS ALFORD: Yes.
MR. DRATEL: OK. I want you to look through 241 in its entirety and point out to me one entry that has anything personal before that entry. Withdrawn.
That entry is in September of 2013, right? That's what it says, right?
GARY LUIS ALFORD: The one with Amelia and the poison oak?
MR. DRATEL: Yes.
GARY LUIS ALFORD: Yes.
MR. DRATEL: Right? It says September 11th to September 18th, right?
GARY LUIS ALFORD: Yes.
MR. DRATEL: So I want you to look at the rest of 241 before then. Tell me if you could find a single entry that had anything personal. I am talking about as opposed to Silk Road business.
GARY LUIS ALFORD: May 3rd, 2013?
MR. DRATEL: No. I mean the whole thing, starting with March 20, 2013, when this exhibit starts, to the end.
MR. TURNER: Objection. The witness is about to answer.
THE COURT: He was answering.
MR. DRATEL: Oh, I'm sorry.
GARY LUIS ALFORD: Yes. On May 3rd, 2013 it says, "I'm sick."
MR. DRATEL: OK. Any others? You don't think that has to do with business -- withdrawn.
Let's look at May 3, 2013. It says, "Helping smed fight off attacker. Site is mostly down. I'm sick."
Right?
GARY LUIS ALFORD: Yes. Correct.
MR. DRATEL: So is it something that you might tell a coworker, that you are sick?
THE COURT: Don't speculate as to the state of mind of the author. The objection is sustained.
MR. DRATEL: Any others?
GARY LUIS ALFORD: Let me look through.
(Pause)
GARY LUIS ALFORD: Are you saying strictly personal?
MR. DRATEL: Yeah.
GARY LUIS ALFORD: What you said before, I guess that's it.
MR. DRATEL: Right. That's it, right?
GARY LUIS ALFORD: Yes.
MR. DRATEL: Now, you began your investigation -- withdrawn.
The Task Force began its investigation as a result of an open letter from two United States senators, Chuck Schumer, and another senator asking that Silk Road be shut down, correct?
MR. TURNER: Objection.
THE COURT: Sustained.
MR. DRATEL: Your Honor, this goes to --
THE COURT: It is beyond the scope of this witness' testimony.
MR. DRATEL: It goes to a fundamental part --
THE COURT: It is beyond the scope of this witness' testimony.
BY MR. DRATEL:
MR. DRATEL: You pulled out all the stops on this investigation, correct?
MR. TURNER: Objection. Form and relevance.
THE COURT: Overruled.
MR. DRATEL: This is a high-priority investigation, correct?
GARY LUIS ALFORD: It was a high-priority investigation, yes.
MR. DRATEL: And one of the things you did was to time it so that when the arrest of Mr. Ulbricht occurred you would be able to also, within a very short frame of time, speak to people who you'd identified as people who knew him, correct?
MR. TURNER: Objection. Beyond the scope.
THE COURT: Sustained.
MR. DRATEL: Now, almost every agency of federal law enforcement was involved in this investigation, correct?
GARY LUIS ALFORD: That is correct.
MR. DRATEL: And that caused some friction between agencies, right?
MR. TURNER: Objection. Relevancy.
THE COURT: Sustained.
MR. DRATEL: Everybody wanted -- every agency wanted to get credit for this arrest, correct?
MR. TURNER: Objection.
THE COURT: Sustained.
MR. DRATEL: I want to go back to -- so 333A is -- you can put it up for everybody -- that's something that was provided by Google about logins, correct?
GARY LUIS ALFORD: That is correct.
MR. DRATEL: Now, that was part of a larger subpoena production by Google, correct?
GARY LUIS ALFORD: This?
MR. DRATEL: Yes.
GARY LUIS ALFORD: Yes.
MR. DRATEL: And that showed all the login times during a longer period, correct?
GARY LUIS ALFORD: Yes.
MR. DRATEL: And so you reviewed that, correct?
GARY LUIS ALFORD: Yes, I did.
MR. DRATEL: And, in fact, there are gaps between login times in certain place, right, sometimes as long as four days, right?
GARY LUIS ALFORD: I would have to see it.
(Pause)
(Mr. Dratel conferred with Mr. Turner off the record)
MR. DRATEL: I show you what we'll mark as Defendant's O for purposes of identification and just ask you to look here and see if that refreshes your recollection that there were gaps of as many as four days in logins by Mr. Ulbricht to his account?
THE COURT: And we'll get a paper copy of this at some point?
MR. DRATEL: (Indicating affirmatively).
THE COURT: Thank you.
GARY LUIS ALFORD: I believe this is a separate subpoena production than the one I'm looking at on this, my exhibit.
MR. DRATEL: But does that have Mr. Ulbricht's logins for Google, you know, for his Gmail?
GARY LUIS ALFORD: If that's the logins, yes.
MR. DRATEL: Can Mr. Horowitz help him, come up to identify the document, if that helps him?
THE COURT: Yes.
MR. DRATEL: It is just a MacBook and I don't have a MacBook.
(Mr. Horowitz assisted the witness)
MR. DRATEL: Does that refresh your recollection that it's login times for Mr. Ulbricht's Gmail or Google account?
GARY LUIS ALFORD: Yes, that looks like the --
MR. DRATEL: OK. And there is a four-day -- and does that refresh your recollection that there was a four-day gap, between June 24th and June 28th, just as an example, of logins, according to those records?
GARY LUIS ALFORD: I've never used a Mac. I'm going to have to have someone scroll it down to that particular timeframe.
MR. DRATEL: Mr. Horowitz, could you scroll it back to where it was. I'm sorry. The last time I touched the touchscreen the entire document disappeared.
(Mr. Horowitz assisted the witness)
GARY LUIS ALFORD: OK. Yes. What is represented there are four-day gaps.
MR. DRATEL: Did you check the Gmail account to see whether there were any emails sent by Mr. Ulbricht during that four-day period --
GARY LUIS ALFORD: I can't recall --
MR. DRATEL: -- in Gmail?
GARY LUIS ALFORD: I would have to look through it to see those specific dates.
MR. DRATEL: You don't recall just offhand, no?
GARY LUIS ALFORD: Those specific dates off the top of my head?
MR. DRATEL: Yes.
MR. DRATEL: Do you recall looking to see whether there were emails from Mr. Ulbricht's account on periods where there is no login from the Google records?
MR. TURNER: Objection. Beyond the scope and foundation for this witness.
THE COURT: Sustained.
MR. DRATEL: I have nothing further, then.
THE COURT: All right. Thank you.
MR. TURNER: Could I have 241 back on the screen.
May I approach, your Honor?
THE COURT: You may.
REDIRECT EXAMINATION BY MR. TURNER:
MR. TURNER: You were asked during cross whether there were any references to personal matters in this log prior to September 2013, right?
GARY LUIS ALFORD: Yes, I was.
MR. TURNER: And you said there was one in May 3rd, 2013.
MR. TURNER: Mr. Evert, could you go there.
MR. TURNER: Could you point to where it is? I forget.
GARY LUIS ALFORD: It's towards the bottom.
MR. TURNER: There it is. Pop that up on the screen, Mr. Evert.
"May 13, 2013: Helping smed fight off attacker. Site is mostly down. I'm sick."
Did you find anything in the defendant's Gmail account indicating the defendant was sick on that date?
GARY LUIS ALFORD: I did.
MR. TURNER: Could you take a look at Government Exhibit 323.
Do you recognize this exhibit?
GARY LUIS ALFORD: Yes.
MR. TURNER: How do you recognize it?
GARY LUIS ALFORD: It's an email that I found in the defendant's Gmail account.
MR. TURNER: The government offers Exhibit 323 into evidence.
MR. DRATEL: Vayner and hearsay, your Honor.
THE COURT: Those two objections are overruled.
GX323 is received.
(Government's Exhibit 323 received in evidence)
MR. TURNER: The email says: "Chat with Casa Bambu" is the subject.
"From: Casa Bambu.
"Date: May 3, 2013.
"To: Ross Ulbricht.
"Casa: how are you feeling today?
"Me: alot better. I took Nyquil last night and got a good night's sleep
"Casa: oh good."
No further questions, your Honor.
THE COURT: Thank you.
Mr. Dratel, anything further for this witness?
MR. DRATEL: No, your Honor.
THE COURT: All right. Thank you. You may step down, sir.
GARY LUIS ALFORD: Thank you.