8.Brian Shaw — Direct (Part 1)
420 linesMR. HOWARD: The government calls Brian Shaw.
THE COURT: Mr. Shaw to the stand, please.
COURT CLERK: Raise your right hand.
(Witness sworn)
THE COURT: Mr. Howard, you may proceed, sir.
BRIAN SHAW, called as a witness by the Government, having been duly sworn, testified as follows:
DIRECT EXAMINATION BY MR. HOWARD:
MR. HOWARD: Good afternoon, Mr. Shaw.
BRIAN SHAW: Good afternoon.
MR. HOWARD: What do you do for a living?
BRIAN SHAW: I am an info sec engineer.
MR. HOWARD: In your work, do you have any relationship with the FBI?
BRIAN SHAW: Yes, I do.
MR. HOWARD: What is that relationship?
BRIAN SHAW: I am a government contractor to the FBI.
MR. HOWARD: How long have you been a government contractor to the FBI?
BRIAN SHAW: Since 2001.
MR. HOWARD: And what are your roles and responsibilities as a contractor?
BRIAN SHAW: My roles and responsibilities include collecting, processing and analyzing computer data.
MR. HOWARD: What is your educational background?
BRIAN SHAW: I have a Bachelor's degree in Electrical Engineering from Northwestern and a Master's degree in Computer Engineering from Virginia Tech.
MR. HOWARD: Are you familiar with computer databases?
BRIAN SHAW: Yes, I am.
MR. HOWARD: We'll talk more about databases in detail later, but can you provide a short description of what that is.
BRIAN SHAW: Sure. Computer database is a way to store structured data in a format that is easy to retrieve it later.
MR. HOWARD: Do you have any specialized training in reviewing and analyzing computer databases?
BRIAN SHAW: Yes, I do.
MR. HOWARD: And what is that?
BRIAN SHAW: Request I have completed a training class in SQL, which is structured query language, which is the language used to interact with databases.
MR. HOWARD: Now, in your role as a contractor with the FBI, do you have any role in FBI investigations?
BRIAN SHAW: Yes, I do.
MR. HOWARD: What is that role?
BRIAN SHAW: I assist in analyzing and collecting and processing data in support of investigations.
MR. HOWARD: And in the course of your career as a consultant to the FBI, approximately how many computers have you examined?
BRIAN SHAW: I have supported over 100 investigations with digital evidence.
MR. HOWARD: Have you been involved in the review of computer evidence collected during the Silk Road investigation?
BRIAN SHAW: Yes, I have.
MR. HOWARD: And, what your -- what is your involvement been specifically?
BRIAN SHAW: I've had two different roles: One was fairly early on where I was given copies of the databases collected from the investigation. And taking those copies of the databases, I assisted in creating intelligence packages to help support field investigations. Those intelligence packages, for example, with the DEA came to us and asked could we have information on user Joe X, Y, Z. We would create an intelligence product to then send back to the field investigator so that they could work on their investigation.
More recently, I was asked to take a look at two of the servers that were seized as a part of the investigation.
MR. HOWARD: Your Honor, may I approach.
THE COURT: You may.
MR. HOWARD: I have just handed you Government Exhibit 603 and 604, which have already been admitted into evidence.
BRIAN SHAW: Yes.
MR. HOWARD: Do you recognize those exhibits?
BRIAN SHAW: Yes, I do.
MR. HOWARD: What are they?
BRIAN SHAW: These are the copies of the servers that I received copies of to analyze.
MR. HOWARD: And how do you recognize them?
BRIAN SHAW: They have my initials on them.
MR. HOWARD: Did you review the files on the servers themselves or did you review copies of those servers?
BRIAN SHAW: I reviewed from a copy of these images here.
MR. HOWARD: Now, what, if anything, did you do to confirm that the copies you reviewed were true and accurate copies of the original servers?
BRIAN SHAW: I verified the hash values of -- from the original servers to the copies that I was analyzing.
MR. HOWARD: And what kind of hash values did you run?
BRIAN SHAW: The MD5 and the SHA1 hash values.
MR. HOWARD: And real briefly, what a hash value?
BRIAN SHAW: A hash value is, in essence, a fingerprint of a file so it helps you to uniquely identify a file and also to detect if any changes have occurred.
MR. HOWARD: Mr. Shaw, can you please flip in your binder to what has been premarked as Government Exhibits 900A and 900B.
BRIAN SHAW: Yes.
MR. HOWARD: Do you recognize these exhibits?
BRIAN SHAW: Yes, I do.
MR. HOWARD: What are they?
BRIAN SHAW: These are screenshots of the MD5 and the SHA1 values of the images that I analyzed.
MR. HOWARD: Did you take these screenshots?
BRIAN SHAW: Yes, I did.
MR. HOWARD: The government offers Government Exhibits 900A and 900B.
MR. DRATEL: No objection.
THE COURT: Received.
(Government's Exhibits 900A, 900B received in evidence)
MR. HOWARD: Mr. Evert, could you publish 900A.
MR. HOWARD: Mr. Shaw, is this the screenshot of the hash values for one ever those two servers?
BRIAN SHAW: Yes, it is.
MR. HOWARD: Do you know which server it was?
BRIAN SHAW: I believe this was the server that hosted the web server and the Marketplace.
MR. HOWARD: Mr. Evert, could you please publish Government Exhibit 900B.
MR. HOWARD: And what is this?
BRIAN SHAW: This is the hash values from the second server that hosted backup copies of data from the Marketplace.
MR. HOWARD: And do you -- you compared these values with the copies in the original log files for these servers?
BRIAN SHAW: That is correct.
MR. HOWARD: Did they match?
BRIAN SHAW: Yes, they did.
MR. HOWARD: And what does that indicate?
BRIAN SHAW: That indicates that there was no change between the original and the copy that I was given.
MR. HOWARD: Can you please flip in your binder to what has been premarked for identification purposes as Government Exhibit 901.
BRIAN SHAW: Okay.
MR. HOWARD: Do you recognize this exhibit?
BRIAN SHAW: Yes, I do.
MR. HOWARD: And what is it?
BRIAN SHAW: This is a screenshot from a tool called FTK Imager and it's -- it shows information about a file called authorized_keys.
MR. HOWARD: Did you take the screenshot?
BRIAN SHAW: Yes, I did.
MR. HOWARD: And where was this file extracted from?
BRIAN SHAW: This was extracted from the primary server that hosted the Marketplace.
MR. HOWARD: The government offers Government Exhibit 901.
MR. DRATEL: No objection, your Honor.
THE COURT: Received.
(Government's Exhibit 901 received in evidence)
MR. HOWARD: Mr. Shaw, what is depicted in the top right-hand corner of this exhibit?
BRIAN SHAW: That is the file name of the file being reviewed.
MR. HOWARD: It's called authorized_keys?
BRIAN SHAW: Correct.
MR. HOWARD: Could we zoom out.
MR. HOWARD: What's depicted on the bottom right-hand corner of the screen?
BRIAN SHAW: That is the content of the file or at least part of the content.
MR. HOWARD: Now, are you familiar with this kind of file?
BRIAN SHAW: Yes, I am.
MR. HOWARD: And what is it?
BRIAN SHAW: It's part of an SSH key.
MR. HOWARD: And, what an SSH key?
BRIAN SHAW: An SSH keys are used for automatic mated authentications. Normally, when you connect to a server you have to type in your username and password. System administrators don't like to have to remember all of their usernames and passwords for all of the systems that they work on, so they like to set up an automated process for handling this authentication.
So what you do is you put a copy of your SSH key on the remote server that you're administering. And when you go to connect to the remote server, it does a comparison, three-part comparison to see if you're authorized to access the system.
MR. HOWARD: And so what is this first part -- let's look at the first line. There's a long series of characters here, letters and numbers.
BRIAN SHAW: Yes.
MR. HOWARD: What is that?
BRIAN SHAW: That's the tail end of the key that is used as part of the authentication.
MR. HOWARD: And what is frosty@frosty to the right of that?
BRIAN SHAW: That is -- the first "frosty" denotes the username and the second "frosty" denotes the computer name, and those are taken from the system you are coming from.
MR. HOWARD: So what is required for this key to work?
BRIAN SHAW: In order for this work, you must be coming from a computer -- let's see if I can use this -- you must be coming from a computer with a computer name frosty, that's the second part there. And the username that you are, again, coming from must be the first frosty here.
And then the comparison -- once those two match, a comparison is done to see if the keys are also a pair, and if so, then you're automatically authenticated and allowed into the server.
MR. HOWARD: If any of those parts are not correct, then what happens?
BRIAN SHAW: You get a login error.
MR. HOWARD: And here there is a second line here. What does it indicate?
BRIAN SHAW: That indicates that there was a second key that was authorized access to this server. Again, the username in this case would be "root" and the computer name would be "BCW."
MR. HOWARD: Now, Mr. Evert, could you please publish Government Exhibit 241, a file that was recovered from the defendant's computer and zoom in on the entries from March 25 through March 27, 2013. "03/25/2013. Server was ddosed, meaning someone knew the real IP. I assumed they obtained it by becoming a guard node. So, I migrated to a new server and set up private guard nodes. There was significant downtime and someone has mentioned that they discovered the IP via a leak from lighttpd.
03/26/2013: Private guard nodes are working ok. still buying more servers so I can set up a more modular and redundant server cluster. redid login page.
03/27/2013: Set up servers"
MR. HOWARD: Mr. Shaw, from that FTK Imager, does it indicate the last date that that file was changed?
BRIAN SHAW: Yes. It has a "date modified" date of March 26, 2013.
MR. HOWARD: Now, focusing on what you reviewed the Marketplace server did you review the contents of that computer server?
BRIAN SHAW: Yes, I did.
MR. HOWARD: Did you discover if any website was running from that server?
BRIAN SHAW: Yes, I did.
MR. HOWARD: What website did the server appear to be running?
BRIAN SHAW: The Silk Road Marketplace.
MR. HOWARD: Now, based on your review of the files on that server, were you able to observe what the website looked like at around the time that it was seized?
BRIAN SHAW: Yes, I was. I was able to recreate the web server. I took database files, the files that contained images and along with some of the code that was used to run the web server and I copied those, that data, moved it to a clean computer image that I created and I was able to re-instantiate, recreate what the web server would have looked like on my own local computer completely isolated from any networks.
MR. HOWARD: So no one else could access --
BRIAN SHAW: Correct.
MR. HOWARD: -- the simulation of the Silk Road website?
BRIAN SHAW: Correct.
MR. HOWARD: Now, if you can please flip in your binder to what has been marked for identification purposes as Government Exhibit 910.
BRIAN SHAW: Yes.
MR. HOWARD: Do you recognize what this is?
BRIAN SHAW: Yes, I do.
MR. HOWARD: What is this?
BRIAN SHAW: It's a screenshot from my recreated web server.
MR. HOWARD: Did you take this screenshot?
BRIAN SHAW: Yes, I did.
MR. HOWARD: Government offers Government Exhibit 910.
MR. DRATEL: No objection.
THE COURT: Received.
(Government's Exhibit 910 received in evidence)
MR. HOWARD: Mr. Shaw, what page of the Silk Road website does this depict as you recreated it?
BRIAN SHAW: This is the page that loads after you log in.
MR. HOWARD: So here in the upper left-hand corner we see Silk Road Anonymous Market. If we can zoom out, Mr. Evert and maybe zoom into the top two rows here. We have various photographs and words underneath, for example, front seller cocaine 0.5 grams, 500 milligrams, .7216 bitcoins. Another example, we have a picture and a tilde, 100 percent pure MDMA capsules X4 and a bitcoin price underneath, correct?
BRIAN SHAW: Correct.
MR. HOWARD: Can we zoom out, please. Can we zoom in on the top right-hand corner of the screen. Here we have the words "A few words from the Dread Pirate Roberts," and an avatar to the right?
BRIAN SHAW: Correct.
MR. HOWARD: And here it says "Hi, FBINY." What is FBINY?
BRIAN SHAW: In order to get into the recreated server, I had to create a login account. I chose the name FBINY.
MR. HOWARD: That was a new user you created for the purpose of making these screenshots?
BRIAN SHAW: That is correct. That user did not exist prior to me recreating the website.
MR. HOWARD: Could you zoom out, please. Could you zoom in on the bottom right-hand corner here.
MR. HOWARD: You see the word "support" here?
BRIAN SHAW: Yes, I do.
MR. HOWARD: What is that?
BRIAN SHAW: That is a hyperlink to a new page.
MR. HOWARD: Did you try clicking on the link?
BRIAN SHAW: Yes, I did.
MR. HOWARD: What happened?
BRIAN SHAW: A new page loaded with support information.
MR. HOWARD: Would you please flip in your binder to what's been marked for identification purposes as Government Exhibit 918.
BRIAN SHAW: Okay.
MR. HOWARD: Do you recognize this exhibit?
BRIAN SHAW: Yes, I do.
MR. HOWARD: And what is it?
BRIAN SHAW: This is a screenshot that I took of the support page.
MR. HOWARD: This is the page that happened after you clicked on the support link?
BRIAN SHAW: Correct.
MR. HOWARD: The government offers Government Exhibit 918.
MR. DRATEL: Your Honor, hearsay in terms of for the truth.
THE COURT: Is it offered for the truth?
MR. HOWARD: No, your Honor.
THE COURT: Then that objection is overruled. Government Exhibit 918 is received.
(Government's Exhibit 918 received in evidence)
THE COURT: You may proceed.
MR. HOWARD: Here it says "Follow the steps below to get the help you need."
Reading the titles: Step one, look for your question in the FAQ. Step two, search the forum. Step three, post your question in the customer support section of the forum. Step four, open a support ticket. Underneath that it says "If all else fails, you can message support as a last resort and an administrator will take care of you personally. Support tickets should only be used when absolutely necessary." And then there's a link -- the words there "Contact customer support."
Mr. Evert, can you please publish 910 again. Can you zoom in on the top of the list right here.
MR. HOWARD: You see here where it says "drugs"?
BRIAN SHAW: Yes.
MR. HOWARD: Is that also a link?
BRIAN SHAW: Yes, it is.
MR. HOWARD: Did you click on the link?
BRIAN SHAW: Yes, I did.
MR. HOWARD: And what happened when you clicked on the link?
BRIAN SHAW: It took me to a page with products being offered for sale labeled drugs.
MR. HOWARD: Now, Mr. Shaw, could you please flip in your binder to what's been marked for identification purposes as Government Exhibit 911.
BRIAN SHAW: Okay.
MR. HOWARD: Do you recognize this exhibit?
BRIAN SHAW: Yes, I do.
MR. HOWARD: What is that?
BRIAN SHAW: This is a screenshot of the page that loaded when you clicked on the link "drugs."
MR. HOWARD: Did you take this screenshot?
BRIAN SHAW: Yes, I did.
MR. HOWARD: The government offers Government Exhibit 911.
MR. DRATEL: Same objection.
THE COURT: Overruled. Received.
(Government's Exhibit 911 received in evidence)
MR. HOWARD: Can we zoom in real fast on this little area here, right here. It says "sort by bestselling."
MR. HOWARD: Can you explain that?
BRIAN SHAW: Yes. You had at least two options for sorting the information. In this case, it was sorted by bestselling.
MR. HOWARD: What is the other option?
BRIAN SHAW: I believe it was "recent."
MR. HOWARD: Can you zoom out, Mr. Evert. And zoom in on the first few listings.
MR. HOWARD: Heroin China White, 1 gram, U.S. only, 10X, 140mg pure 84 percent MDMA capsules, high quality number four heroin all rock directly from Key. 100 grams, 72 percent pure speed. East Coast Style Heroin Stamps x10, and then in parentheses three free. And the seller is listed as deezletime, correct?
BRIAN SHAW: Correct.
MR. HOWARD: Now, can we zoom out and look on the upper left-hand corner of the page.
MR. HOWARD: There's various -- are these all links on the left-hand side of the page by the way?
BRIAN SHAW: Yes. They're all hyperlinks.
MR. HOWARD: There are various links: Cannabis, Ecstasy, opioids and others. Did you try to click on all of these links?
BRIAN SHAW: Yes, I did.
MR. HOWARD: Did they take you to other pages on the Silk Road website?
BRIAN SHAW: Yes, they did.
MR. HOWARD: Please take a moment and look in your binder to what's been marked for identification purposes as Government Exhibits 911A through 911B, and let me know when you're done.
BRIAN SHAW: Okay.
MR. HOWARD: Do you recognize what these are?
BRIAN SHAW: Yes, I do.
MR. HOWARD: And what are they?
BRIAN SHAW: These are screenshots taken from pages that loaded after clicking on some of these links on the left side.
MR. HOWARD: Did you take these screenshots?
BRIAN SHAW: Yes, I did.
MR. HOWARD: The government offers Government Exhibits 911A through 911D.
MR. DRATEL: The same objection.
THE COURT: Okay. The objections are overruled. Those are received.
(Government's Exhibits 911A-911D received in evidence)
MR. HOWARD: Mr. Evert, can you please publish Government Exhibit 911A.
MR. HOWARD: Mr. Shaw, do you recognize what this is?
BRIAN SHAW: Yes, I do.
MR. HOWARD: What is this?
BRIAN SHAW: This is the page that loads when you click on the link "cocaine."
MR. HOWARD: There are a bunch of cocaine listed on this page, correct?
BRIAN SHAW: That's correct.
MR. HOWARD: And is this a subcategory of drugs?
BRIAN SHAW: It's a subcategory of "drugs" and further a subcategory of "stimulants," yes.
MR. HOWARD: Please publish Government Exhibit 911B, please. And what does Government Exhibit 911B depict?
BRIAN SHAW: This is the page that loads when you click on the link "heroin."
MR. HOWARD: Is this another subcategory of drugs?
BRIAN SHAW: Yes, it is.
MR. HOWARD: Can you please publish Government Exhibit 911C, please.
THE COURT: We haven't got to C yet.
COURT CLERK: A through D.
MR. HOWARD: A through D. Then A through D are received.
MR. HOWARD: What is this page, Mr. Shaw?
BRIAN SHAW: This is the page that loaded when you clicked on the link "LSD."
MR. HOWARD: Will you please publish Government Exhibit 911D as in dog, please. And, what this page, Mr. Shaw?
BRIAN SHAW: This is the page that loaded when you clicked on the link "meth."
MR. HOWARD: Mr. Evert, can we zoom in on the top listing here.
MR. HOWARD: It says 3.5 grams ball in parentheses, pure crystal methamphetamine; is that correct?
BRIAN SHAW: Correct.
MR. HOWARD: Mr. Evert, could you please publish Government Exhibit 910 again. Could we zoom in on this part of the page down to here.
MR. HOWARD: Mr. Shaw, do you see the link called "forgeries" here?
BRIAN SHAW: Yes, I do.
MR. HOWARD: Did you try clicking on that link?
BRIAN SHAW: Yes, I did.
MR. HOWARD: And what happened when you clicked on that link?
BRIAN SHAW: It took me to a page of listings of various forgery items to include passports and fake IDs.
MR. HOWARD: Mr. Shaw, can you please flip to Government Exhibits 913 and 914 in your binder.
BRIAN SHAW: Okay.
MR. HOWARD: Do you recognize what these exhibits are?
BRIAN SHAW: Yes, I do.
MR. HOWARD: And what are they?
BRIAN SHAW: These are the pages that loaded when I went to the category "fake IDs" and "passports," both under the category "forgeries."
MR. HOWARD: Did you take these screenshots?
BRIAN SHAW: Yes, I did.
MR. HOWARD: The government offers 913 and 914.
MR. DRATEL: The same objection; for the truth.
THE COURT: What was the other word?
MR. DRATEL: That if it's coming in for the truth, it's hearsay.
THE COURT: The objection is overruled. GX 913 is received and 914.
(Government's Exhibits 913, 914 received in evidence)
MR. HOWARD: Mr. Shaw, what is this?
BRIAN SHAW: This is the page that loaded when you clicked on the link "Fake IDs."
MR. HOWARD: Could we zoom in on the first few rows, please, Mr. Evert.
MR. HOWARD: Here we see IDs from Ohio, Illinois and I guess two from Illinois, correct?
BRIAN SHAW: Correct.
MR. HOWARD: Mr. Evert, could you please publish Government Exhibit 914.
MR. HOWARD: And what does this page depict?
BRIAN SHAW: This is the page that loaded when you clicked on the link "passports."
MR. HOWARD: Let's zoom in on the two -- the top two listings, please.
MR. HOWARD: Here we have an E.U. passport listing, a USA passport listing and a UK passport listing, correct?
BRIAN SHAW: Correct.
MR. HOWARD: And Mr. Shaw, did you review some of the individual listings within the forgeries category?
BRIAN SHAW: Yes, I did.
MR. HOWARD: Could you please flip through what's been premarked as 915A through 915G as in George.
BRIAN SHAW: Okay.
MR. HOWARD: Do you recognize what these are?
BRIAN SHAW: Yes, I do.
MR. HOWARD: What are they?
BRIAN SHAW: These are screenshots of items that were offered for sale under the category of "fake IDs" and "fake passports."
MR. HOWARD: Did you take these screenshots?
BRIAN SHAW: Yes, I did.
MR. HOWARD: The government offers 915A through 915G as in George.
MR. DRATEL: Same objection, your Honor, with respect to the truth of the matter.
THE COURT: All right. Those objections are overruled. GX 915A through G received.
(Government's Exhibits 915A-G received in evidence)
MR. HOWARD: Mr. Evert, can you please publish 915A.
MR. HOWARD: Here the title is listed "Real passport and new identity in 30 days, rush service." Zoom in on the second paragraph there. Actually, go down a little further to the next paragraph right here. It says here "The real ID we provide is a Dominican Republic passport and citizenship. It will have your picture and the details of another real person which is your real new identity. We need to know (1) your approximate age, (2) natural hair color, (4) natural eye color, (5) height and (6) weight, (7) country you are from. This is used to access the info of a real person for your new identity, with info as close to you as possible."
Mr. Evert, can you please publish Government Exhibit 915B, please. The title here is "Europe, fake documents passports ID, DL, Diplomas! Passports Denmark Latvia, Poland, Sweden, Holland, Lithuania."
Down here it says "USA, DL (PA, FL IL, NJ) all security UV, helograms, barcode, magnetic line," correct?
BRIAN SHAW: Correct.
MR. HOWARD: Mr. Evert, can you please publish 915C, please. Zoom in on the top.
MR. HOWARD: This says here "New York driver's license hologram plus scannable," and the seller is KingOfClubs, correct?
BRIAN SHAW: Correct.
MR. HOWARD: Look at the instructions.
MR. HOWARD: Mr. Evert, would you please publish Government's Exhibit 915D as in dog, please.
MR. HOWARD: This is a similar listing for a Pennsylvania driver's license, Mr. Shaw?
BRIAN SHAW: Correct.
MR. HOWARD: Can you please publish Government Exhibit 915E.
MR. HOWARD: And what is this a listing for, Mr. Shaw?
BRIAN SHAW: This is a listing for a Tennessee driver's license.
MR. HOWARD: Mr. Evert, can you please publish Government Exhibit 915F.
MR. HOWARD: Mr. Shaw, what is this a listing for?
BRIAN SHAW: It's a listing for a New south wales driving license.
MR. HOWARD: Would you publish 915G, please. And what is this a listing for?
BRIAN SHAW: A forged Social Security card.
MR. HOWARD: Zoom out, please. Zoom this. This is a listing for a forged social security card. At the end the last sentence it says "In addition if you assume another identity and all you have in your wallet is a fake ID and some cash it looks a little empty and suspicious. Having more forms of ID and having more cards to pull it up makes it look real so buy this and more of my forged items will build a solid cover identity. Below is the order form."
MR. HOWARD: Mr. Shaw, during your review of the contents of the Silk Road website as it existed when it was seized, did you find any listings for computer hacking tools and service?
BRIAN SHAW: Yes, I did.
MR. HOWARD: Mr. Shaw, could you please take a moment and flip through the binder to what's been marked as Government Exhibits 916A through Z for identification purposes.
BRIAN SHAW: Okay.
MR. HOWARD: What are these?
BRIAN SHAW: These are listings for various hacking tools and services that were offered for sale on the Silk Road Marketplace.
MR. HOWARD: Were you involved in taking these screenshots?
BRIAN SHAW: Yes, I was.
MR. HOWARD: The government offers 916A through 916Z.
MR. DRATEL: Same objection.
THE COURT: All right. Those objections are overruled. GX 916A through Z are received.
(Government's Exhibits 916A-Z received in evidence)
MR. HOWARD: We won't go through all of them. Let's look through a selection of them, Mr. Shaw.
BRIAN SHAW: Okay.
MR. HOWARD: Can we look at 916E, please. Here the title is "Android RAT plus tutorial"?
BRIAN SHAW: Correct.
MR. HOWARD: Zoom down to description, that far. "The description of this listing will be for an Android RAT and setup tutorial. Please only purchase if you have previous experience with RATS. Here are some of the media it's capable of stealing: Contacts, personal information, phone call logs, pictures, SMS messages (sent & received) WhatsApp messages."
BRIAN SHAW: Correct.
(Continued on next page)
MR. HOWARD: Mr. Evert, could you please publish Government Exhibit 916F, please.
BY MR. HOWARD:
MR. HOWARD: This is for a remote administration tool, correct?
BRIAN SHAW: Correct.
MR. HOWARD: Let's look at the first line.
The description is: "This is a remote administration tool. Used for hacking computers. You send a file to a computer and then you control it." Correct?
BRIAN SHAW: Correct.
MR. HOWARD: Look at 916I, please. It is called an "Email account cracker - best price on SR."
BRIAN SHAW: Correct.
MR. HOWARD: Let's look at the description.
"This tool will allow you to crack nearly any email account. All you need to know is the smtp server and port (a quick Google search can solve that). It's extremely easy to use and I'll even throw in a little .gif image showing you how to use it. This can crack gmail, hotmail, yahoo email and any others you need."
BRIAN SHAW: Correct.
MR. HOWARD: Let's at one last one, 916K.
It says: "I will crack any username+password."
BRIAN SHAW: Correct.
MR. HOWARD: And the description: "This listing will be for a list of contacts that can crack random accounts on any website that has a login page. Please note that I will not crack any finance-related website accounts. If you are interested in having a specific account cracked, get in touch with me and we can make a deal. If you have any questions, feel free to send me a message. Sniffsniff."
BRIAN SHAW: Correct.
MR. HOWARD: Mr. Evert, could we just go back to Government Exhibit 910, please, and let's zoom in to the bottom of the list.
MR. HOWARD: Do you see the money link, Mr. Shaw?
BRIAN SHAW: Yes.
MR. HOWARD: Did you try clicking on that one?
BRIAN SHAW: Yes, I did.
MR. HOWARD: What happened after you clicked on that one?
BRIAN SHAW: It took me to a page with various money listings.
MR. HOWARD: Would you flip in your binder at what has been marked for identification purposes as Government Exhibit 917.
BRIAN SHAW: OK.
MR. HOWARD: Do you recognize what this is?
BRIAN SHAW: Yes, I do.
MR. HOWARD: And what is this?
BRIAN SHAW: This is the page that loaded after clicking on the link "money."
MR. HOWARD: Did you take this screenshot?
BRIAN SHAW: Yes, I did.
MR. HOWARD: The government offers 917.
MR. DRATEL: The same objection, your Honor.
THE COURT: All right. The objection is overruled. Government Exhibit 917 is received.
(Government's Exhibit 917 received in evidence)
MR. HOWARD: Mr. Shaw, if you could please flip in your exhibit binder to what has been marked for identification purposes as 917A through 917F.
BRIAN SHAW: OK.
MR. HOWARD: Do you recognize these exhibits?
BRIAN SHAW: Yes, I do.
MR. HOWARD: And what are they?
BRIAN SHAW: These are screenshots of items that were offered for sale related to money, separate transactions.
MR. HOWARD: Did you participate in the creation of these screenshots?
BRIAN SHAW: Yes, I did.
MR. HOWARD: The government offers 917A through 917F.
MR. DRATEL: The same objection. Hearsay.
THE COURT: All right. Those objections are overruled. 917A through F are received.
(Government's Exhibits 917A through F received in evidence)
MR. HOWARD: Mr. Evert, could you please publish 917A, please.
MR. HOWARD: Here it says "$10,000 delivered," correct?
BRIAN SHAW: Correct.
MR. HOWARD: And photos of cash?
BRIAN SHAW: Correct.
MR. HOWARD: The description says: "$10,000 delivered to your doorstep in the form of 100 $100 bills (or U.S. bills of your choosing). You will be mailed genuine U.S. currency that has not been altered or linked to criminal activity."
BRIAN SHAW: Correct.
MR. HOWARD: Can we look at 917B, please.
The title is "Vendors cash in UR coins 4 packs (3% fee)," correct?
BRIAN SHAW: Correct.
MR. HOWARD: Let's look at the description.
"Hello my good friends! This is a listing for anyone to cash in their coins for moneypaks, REloadits, Vanilla Reloads, and netspends."
Now, here we have: "The rates are the same all the way up no matter what, 3%.
"$500 pack costs $515 coins. $100 pack costs $103 in coins. You get the picture."
BRIAN SHAW: Correct.
MR. HOWARD: Look at 917C, please.
The listing is called "Anonymous Visa ATM Card EUR USD PLN + Bank ACC."
BRIAN SHAW: Correct.
MR. HOWARD: Let look at the first line here:
"Get your own anonymous reloadable ATM physical plastic VISA debit card, with sealed PIN code, shipped by me from EU, bank will never know your name."
Skip to 917E, please. The title is "$100 Green Dot Moneypak," correct?
BRIAN SHAW: Correct.
MR. HOWARD: The description: "Optimal: Contact me on TorChat to receive your code," and there are some letters and numbers. "I need up to 24 hours to buy these at the store, then I'll just PM you the card code and you can load it onto PayPal, credit cards, online bank, or whatever as if you had bought it yourself."
And, finally, let's look at 916F -- sorry, 917F. The listing is "[BTC] Bicion Laundry (Highly Anonymous, Impossibl," correct?
BRIAN SHAW: Correct.
MR. HOWARD: Let's look at the first paragraph here.
"Ever worried & paranoid about your unaccounted dirty money to be painful for you at some point? Then right now you are in the right listing, buy this listing and PM me... I will provide you fresh, washed, clean bitcoins in your BTC wallet in just 24 hours, making it completely anonymous and never be able to trace by using my own methods of mixing algorithm."
Mr. Shaw, can you please flip in your binder to what's been marked for identification purposes as Government Exhibit 919.
BRIAN SHAW: OK.
MR. HOWARD: And what is this?
BRIAN SHAW: This is a screenshot that I created of a page called "Mastermind."
MR. HOWARD: Did you take this screenshot?
BRIAN SHAW: Yes, I did.
MR. HOWARD: The government offers Government Exhibit 919.
MR. DRATEL: The same objection.
THE COURT: Overruled. Received.
(Government's Exhibit 919 received in evidence)
BY MR. HOWARD:
MR. HOWARD: Mr. Shaw, you testified that the name of this page was "Mastermind"?
BRIAN SHAW: Correct.
MR. HOWARD: Now, earlier you said that you had created the FBI NY account to access the Web pages, correct?
BRIAN SHAW: That is correct.
MR. HOWARD: Were you able to access this page using the FBI NY account?
BRIAN SHAW: No, I was not.
MR. HOWARD: Would you please explain?
BRIAN SHAW: Sure. We were testing only one account that was able to get to this page and that account was the Dread Pirate Roberts' account. So I was unable to get to this page using my FBI NY account, and I also tried a few of the other user accounts in addition. I tried to use -- can you zoom in on the top, please? Also, I tried to use the account Inigo, Libertas and Cirrus, and none of those accounts were able to access this page.