5.Ilhwan Yum — Direct (Part 1)
766 linesDIRECT EXAMINATION BY MR. HOWARD:
MR. HOWARD: Good morning, Mr. Yum.
ILHWAN YUM: Good morning.
MR. HOWARD: Where do you work?
ILHWAN YUM: FTI Consulting, that's "T" as in technology.
MR. HOWARD: And back in 2013, where did you work?
ILHWAN YUM: FBI, the Federal Bureau of Investigation.
MR. HOWARD: And back then, what was your position with the FBI?
ILHWAN YUM: Special agent.
MR. HOWARD: And where were you based?
ILHWAN YUM: New York office.
MR. HOWARD: Were you assigned to a particular squad at the time?
ILHWAN YUM: Yes. I was assigned to Squad CY2 which handled cybercriminal intrusion matters.
MR. HOWARD: And how long were you a member of that cybersquad?
ILHWAN YUM: About five and-a-half years.
MR. HOWARD: Now, while you were working as a cyberagent at the FBI, did you have any experience searching computer servers?
ILHWAN YUM: Yes, I did.
MR. HOWARD: What is a computer server?
ILHWAN YUM: It's nothing different than a regular computer but it's dedicated to run services online, services like web pages, email servers and anything else that you do online.
MR. HOWARD: Approximately how many servers did you search during the course of your career as an FBI agent?
ILHWAN YUM: About 50 or more.
MR. HOWARD: Were you involved in the Silk Road investigation?
ILHWAN YUM: Yes, I was.
MR. HOWARD: Mr. Evert, can you please publish Government Exhibit 264, which is already in evidence.
MR. HOWARD: Now, Mr. Yum, during your involvement in the Silk Road investigation, did you review files recovered from the defendant's laptop?
ILHWAN YUM: Yes, I did.
MR. HOWARD: Are you familiar with this file?
ILHWAN YUM: Yes, I am.
MR. HOWARD: What is this file generally?
ILHWAN YUM: It appears to be a list of computer servers and details and descriptions about those computer servers.
MR. HOWARD: Mr. Evert, can we zoom in on the top here, about halfway through the page.
MR. HOWARD: Here we have one that the alias is listed as gala, ggb; the notes column says backup and the IP address says 207.106.6.25.
MR. HOWARD: Are you familiar with that server?
ILHWAN YUM: Yes, I am.
MR. HOWARD: And how are you familiar with that server?
ILHWAN YUM: I obtained a warrant to search and seize this server back in September 2013.
MR. HOWARD: Directing your attention to September 9 of 2013, were you involved in an execution of the search warrant on that server on that date?
ILHWAN YUM: Yes, I was.
MR. HOWARD: Now, where was this server physically located?
ILHWAN YUM: The server was physically located at a data center that was about 30 minutes in the suburbs of Philadelphia. Yes, Philadelphia.
MR. HOWARD: And did you go to where it was physically located?
ILHWAN YUM: Yes, I did.
MR. HOWARD: Now, what was the first thing you did after you arrived at the location where the server was located?
ILHWAN YUM: So, that day, I went to the data center with computer scientist Thomas Kiernan. And when we arrived there, it looks like a warehouse but inside, it's clean. It has security doors. We were greeted by the administrator of the data warehouse, data center, and he -- I had called ahead and prearranged so that he was expecting us. And then upon identifying myself, he took us to the rack space where the server was located.
MR. HOWARD: And what do you mean by "rack space"?
ILHWAN YUM: It's a metal frame structure in a data center. It's metal-framed -- rows and rows of metal frames, and each one of those frames contains a bunch of computers that are mounted on to it.
MR. HOWARD: And what did you do after you arrived at the location at the rack space where the server was located?
ILHWAN YUM: First thing I did was I looked at the outside of the server to make sure I had the right server, and I noticed a sticker that was attached to it, which had the IP address, same thing here, 207.106.6.25, and I was assured that I had the right server that I was looking for.
MR. HOWARD: Could you flip to what's been marked for identification purpose in your binder as Government Exhibit 602.
ILHWAN YUM: I don't have a binder in front of me.
MR. HOWARD: May I approach.
THE COURT: Mr. Howard will have some binders for you.
MR. HOWARD: Sorry about that.
THE COURT: That's all right.
ILHWAN YUM: Thank you.
MR. HOWARD: Now, that you have the binder, could you please flip to Government Exhibit 602.
ILHWAN YUM: Yes.
MR. HOWARD: Do you recognize Government Exhibit 602?
ILHWAN YUM: Yes, I do.
MR. HOWARD: What is it?
ILHWAN YUM: It's the picture I took of the server on that date using my FBI Blackberry.
MR. HOWARD: The government offers Government Exhibit 602.
MR. DRATEL: No objection, your Honor.
THE COURT: Received.
(Government's Exhibit 602 received in evidence)
MR. HOWARD: Mr. Evert, could you actually leave 264 on the top half of the screen and zoom into the same line we were looking at, and then put 602 on the bottom of the screen, please.
MR. HOWARD: Mr. Yum, this sticker was what you just testified about with the description of the server?
ILHWAN YUM: Yes, it is.
MR. HOWARD: The IP address, the address that matched with what was listed on the defendant's -- the spreadsheet on the defendant's computer, correct?
ILHWAN YUM: Correct.
MR. HOWARD: And here it says ggb on the sticker. Is that also found on the spreadsheet that was located on the defendant's computer?
ILHWAN YUM: Yes, it is.
MR. HOWARD: So after taking the photograph and confirming that this was the right server, what did you do next?
ILHWAN YUM: So, the data center prepared a separate room for us. There's hundreds of computers in there, so with the fan noise is extremely loud to work in there. So we turned the computer off and removed the hard drive from the computer and we took it to that designated work area where we began making a forensic copy of the server.
MR. HOWARD: And what did you do to make a forensic copy?
ILHWAN YUM: For this instance, we used a small device that's preconfigured to make the job a lot easier for us, so this device, what it does is, you plug in the hard drive that you want to copy, and it's preconfigured where it's write-protected, it's read-only, so you can't alter anything on the original hard drive. And on the other side, you plug in another hard drive that you want to make the copy onto.
MR. HOWARD: By the way, what do you mean by forensic copy?
ILHWAN YUM: Forensic copy is an exact bit-by-bit copy of any data out of a hard drive so that you have a true, accurate image of anything that you want to copy.
MR. HOWARD: Now, after you make the forensic copy, do you do anything to verify that it's an identical and accurate copy of the original server?
ILHWAN YUM: Yes, I do. So in the forensic industry, we do hashing. In this case, we did MD5 Hash and a SHA1 hash. And basically it's an algorithm that calculates through a massive set of data and you get a simple -- it's not really simple -- it's a long string but much simpler than the entire data that you're looking at. And it serves as a condensed fingerprint of what you're looking at and it's a one-way algorithm. You can't alter it. The original always gives you the same value.
MR. HOWARD: So if one bit of data got changed during the copy process, what would have happened to the hash value?
ILHWAN YUM: So you get a different answer, different hash of the data you calculated. So if you change anything, you get a different hash value.
MR. HOWARD: And after you imaged -- made a forensic copy of this server located outside of Philadelphia, did you compare the hash values?
ILHWAN YUM: Yes, I did.
MR. HOWARD: What did you discover?
ILHWAN YUM: I noted that the original hard drive hash and the copy that I made had the same hash value and they matched.
MR. HOWARD: May I approach.
THE COURT: You may.
MR. HOWARD: So Mr. Yum, I just handed you what's been marked for identification purposes as Government Exhibit 604. Do you recognize what this is?
ILHWAN YUM: Yes, I do.
MR. HOWARD: And what is it?
ILHWAN YUM: It's the copy that I made of that server at the data center.
MR. HOWARD: How do you recognize it?
ILHWAN YUM: I recognize it by the labeling that's on the hard drive that we -- I made on the day the copy was made; and it also matches -- the serial number hard drive matches what I wrote down when I checked this batch -- checked this into FBI evidence.
MR. HOWARD: The government offers Government Exhibit 604.
MR. DRATEL: No objection.
THE COURT: Received.
(Government's Exhibit 604 received in evidence)
MR. HOWARD: Mr. Yum, can you please flip in your binder to what's been marked for identification purposes as Government Exhibit 604A.
Do you recognize what this is?
ILHWAN YUM: Yes, I do.
MR. HOWARD: And what is this?
ILHWAN YUM: It's the log file that gets generated when you used the device that makes the forensic copy.
MR. HOWARD: Were you involved in generating this log file?
ILHWAN YUM: Yes.
MR. HOWARD: And it's the log file for this server, Government Exhibit 604?
ILHWAN YUM: Yes, it is.
MR. HOWARD: The government offers government Exhibit 604A.
MR. DRATEL: No objection.
THE COURT: Received.
(Government's Exhibit 604A received in evidence)
MR. HOWARD: Now, Mr. Evert, can we just zoom into this section here.
MR. HOWARD: Briefly, Mr. Yum, here it says source hash SHA1 and MD5 and to the right of SHA1 and MD5, there are these long string of characters, numbers and letters.
What are those?
ILHWAN YUM: Those are the corresponding hash values.
MR. HOWARD: The hash values for what specifically?
ILHWAN YUM: Oh. For the server that came -- for the hard drive that came out of the server.
MR. HOWARD: And then right below that, there's a verification hash, SHA1, MD5 and again, long strings of numbers and letters to the right.
What does this represent?
ILHWAN YUM: So that's the hash value of the image, the copy that I made.
MR. HOWARD: And do they match?
ILHWAN YUM: Yes, they do.
MR. HOWARD: What did you do with the forensic copy of the drive, Government Exhibit 604, after you made the copy?
ILHWAN YUM: I brought it back to FBI New York and I checked it into evidence.
MR. HOWARD: Now, had you been involved in a review of the contents of the server?
ILHWAN YUM: Yes, I had.
MR. HOWARD: And generally, what have you found that server to contain?
ILHWAN YUM: Accurate to the description on the first spreadsheet that was displayed, it contained what appeared to be backup files of Silk Road Marketplace.
MR. HOWARD: Now, Mr. Evert, could you please publish Government Exhibit 264 again, the server spreadsheet, and focus a little high real on the lines that begin with the words "BTC" and "bora." Go halfway down.
MR. HOWARD: Mr. Yum, here we have the top row says bora and it indicates an IP address of 193.107.86.49. Under the location column it says Iceland. And in the notes column it says market backhand. Is that correct?
ILHWAN YUM: Correct.
MR. HOWARD: And on the line under it, it says BTC in the left-most column. The IP address is 193.107.86.34. The location is listed as Iceland. And the notes column says live wallets and in parentheses archive wallets. Correct?
ILHWAN YUM: Correct.
MR. HOWARD: Are you familiar with these two servers which are labeled as being located in Iceland?
ILHWAN YUM: Yes, I am.
MR. HOWARD: How are you familiar with that?
ILHWAN YUM: Those are the two servers that I searched and seized -- assisted in searching and seizing with the Iceland police back in October of 2013.
MR. HOWARD: Was that on or about October 2, 2013?
ILHWAN YUM: Yes.
MR. HOWARD: So taking you to October 2, 2013, what initiated the start of your seizure of these servers?
ILHWAN YUM: So, the plan was to wait for the team that's on-ground in San Francisco, the FBI arrest team, and wait for them to give me a confirmation that the defendant has been arrested. The reason why we went with that tactic was we wanted to make sure if I touch -- if I altered anything on these servers prior to defendant being arrested, I was afraid that it was going to tip off that there was some kind of law enforcement action.
MR. HOWARD: So where were these servers physically located?
THE COURT: Which servers are you talking about?
MR. HOWARD: We're both -- were these servers located in different locations or were they in the same facility?
ILHWAN YUM: The same facility.
THE COURT: These are the Iceland servers?
MR. HOWARD: Yes.
MR. HOWARD: And where in Iceland was it located?
ILHWAN YUM: It was, again, hosted or located at a data center in Iceland.
MR. HOWARD: Did you go to the facility?
ILHWAN YUM: Yes, I did.
MR. HOWARD: What was the first thing you did after you arrived at the facility where these two servers were located?
ILHWAN YUM: So, we arrived at the data center with Icelandic police officers. And, again, we were greeted by the data center administrator and he was notified by the Icelandic police that we were on our way. So when we identified ourselves, he took us to the location, the server rack location where the servers were found in the data center.
MR. HOWARD: Which server did you go to first?
ILHWAN YUM: The first one we seized was the market backhand up there. It's listed as IP address 193.107.86.49.
MR. HOWARD: Now, once you arrived at where the server was located in the facility, what could you tell about how the server was configured?
ILHWAN YUM: So, again, we examined the computer server first and we noticed that the way the server was set up had two hard drives that were written to -- identically at the same time.
So the reason why is anybody runs a server this way is you have two identical hard drives and if one of them fails, the other one could take over and the website would never go down.
Noting that, we turned the server off and we took one of the hard drives as the true, best original evidence at that point.
MR. HOWARD: Now, were you doing anything to monitor the Silk Road website as this was occurring?
ILHWAN YUM: Yes. So when we went into the data center, I had a separate laptop that was configured to use Tor and I had gone to the Silk Road website on Tor. And prior to turning the server off to seize the hard drive, I was able to view the contents of Silk Road Marketplace on Tor.
When I turned the computer off to take the hard drive, the Tor -- the Silk Road website on Tor was no longer accessible. And once removing the second hard drive, I needed to turn the computer -- the server back on; and soon after, I was able to access the Silk Road website again.
MR. HOWARD: Now, why did you turn the Silk Road Marketplace back on?
ILHWAN YUM: So there were two phases to the approach that we took that day. The first thing, after seizing the hard drive, the first thing we needed to do -- the next thing we needed to do was to seize the bitcoins on the other server listed there with IP address 193.107.86.34.
MR. HOWARD: Now, how did you know the bitcoins were located on that server?
ILHWAN YUM: So, if you recall back, the backup server that I seized in Philadelphia back in September, the month prior, I noticed that there were programs in there that indicated that Marketplace was set up with the bitcoins being at a different location to separate the two; and we knew that there was another server containing all the bitcoins related to the Silk Road Marketplace.
MR. HOWARD: Was this code that was located on the backup server itself that referenced the bitcoin server?
ILHWAN YUM: Yes.
MR. HOWARD: And did it specify the IP address of the bitcoin server?
ILHWAN YUM: Yes, it did.
MR. HOWARD: So how did you withdraw -- why did you have to keep --
THE COURT: Let me ask, when you say that the Philadelphia server specified the IP address of the bitcoin server, is that equivalent to saying that the Philadelphia server specified the IP address of the server located in Iceland?
ILHWAN YUM: Correct.
THE COURT: Thank you.
You may proceed.
MR. HOWARD: You said that you put the Marketplace back online with one -- there were two -- sorry. Let me step back.
You said there were two hard drives that operated the server for the Silk Road Marketplace, correct?
ILHWAN YUM: Correct.
MR. HOWARD: And you took one of the two hard drives as evidence for the case, correct?
ILHWAN YUM: Yes.
MR. HOWARD: And then you turned the server back on with one of the hard drives in place because you said you had to seize bitcoins?
ILHWAN YUM: Right.
MR. HOWARD: Can you explain why you needed to turn the Marketplace back on in order to do that.
ILHWAN YUM: So, again, we didn't want to alert the users of Silk Road Marketplace that their bitcoins are being seized, so as I mentioned before, the bitcoins in the Marketplace were separated and the Marketplace had a program that reached out to the bitcoin server to get the current balance and it would update every five minutes or periodically.
And in order for me to seize all the bitcoins, I needed to leave the Marketplace remaining online, but I discontinued that update process so the balance was stuck at the last known amount. And as I was seizing the bitcoins, the users wouldn't be aware that the balance of the bitcoins on Silk Road was depleting.
MR. HOWARD: And how did you actually seize the bitcoins? What did you do?
ILHWAN YUM: So prior to going over to Iceland, I created a bitcoin address that was dedicated for the government to seize and transfer and receive the bitcoins that came out of Silk Road Marketplace.
MR. HOWARD: And how did you move them from the bitcoin server in Iceland to the FBI address?
ILHWAN YUM: I logged onto the Silk Road bitcoin server and executed instructions to move that -- to make that transfer happen.
MR. HOWARD: Approximately how much did you move over to the FBI?
ILHWAN YUM: On that day of October 2, it was a little over 20,000 bitcoins.
MR. HOWARD: What was the approximate value in U.S. dollars that day?
ILHWAN YUM: There's different bitcoin prices at different indices, so I would say approximately depending on the price that you used before 16- to $18 million. Oh. Wait. I'm sorry. Let me go back and do my math.
MR. HOWARD: You said there were 20,000?
ILHWAN YUM: Oh, 2- to $3 million.
MR. HOWARD: Now, earlier you said that there were two reasons that you had to turn the Marketplace back up. One reason was to seize the bitcoins, correct?
ILHWAN YUM: Correct.
MR. HOWARD: And prevent the balance from being updated so that users wouldn't know the bitcoins were being seized, correct?
ILHWAN YUM: Yes.
MR. HOWARD: What was the other reason that you had to turn the Marketplace back on?
ILHWAN YUM: So the last part of seizing these servers, we did want to make a statement that the U.S. Government had seized and taken over Silk Road Marketplace, so using the Marketplace infrastructure, we had replaced the contents of the Silk Road Marketplace and replaced it with a picture showing the government seized Silk Road Marketplace.
MR. HOWARD: Could you please look in your binder to what's been marked for identification purposes as Government Exhibit 600, please. What is this?
ILHWAN YUM: It's a picture that I created based on a template that was provided to me to place it on the Silk Road website once the seizure was completed.
MR. HOWARD: The government offers Government Exhibit 600.
MR. DRATEL: No objection.
THE COURT: Received.
(Government's Exhibit 600 received in evidence)
MR. HOWARD: Mr. Yum, this was the seizure banner that replaced the contents of the Silk Road homepage. Is that correct?
ILHWAN YUM: That's correct. Another thing that I want to note here is just like when I first turned the computer off, I was monitoring the Silk Road website, and prior to putting this picture up, I needed to turn the web server off. And I noticed on my laptop I was no longer able to access Silk Road Marketplace. And once I swapped the files and put this back on, I turned the web server back on, and on my separate laptop on my Tor browser, the Silk Road Marketplace that wasn't accessible was now showing this page.
MR. HOWARD: So instead of the Silk Road homepage, you would get the seizure banner, right?
ILHWAN YUM: Correct.
MR. HOWARD: Could users that go to the Silk Road then do transactions on the Silk Road once you'd put that up on the website?
ILHWAN YUM: No. They would be stopped at that screen.
MR. HOWARD: Now, did you also seize the bitcoin server?
ILHWAN YUM: Yes, I did.
MR. HOWARD: The second server in Iceland?
ILHWAN YUM: Yes.
MR. HOWARD: First, let's focus on what you did on the Marketplace server.
ILHWAN YUM: Sure.
MR. HOWARD: What did you do with the market -- you said you took one hard drive from there?
ILHWAN YUM: Yes.
MR. HOWARD: What did you do with that after you took it?
ILHWAN YUM: I brought it back to New York and then I made a working copy out of that and checked the original hard drive into evidence.
MR. HOWARD: Your Honor, may I approach.
THE COURT: You may.
MR. HOWARD: Mr. Yum, I'm showing you what's been marked for identification purposes as Government Exhibit 603. Do you recognize what this is?
ILHWAN YUM: Yes, I do.
MR. HOWARD: And what is this?
ILHWAN YUM: It's the original -- one of the original hard drives that came out of the Silk Road Marketplace server.
MR. HOWARD: Is that the server that you had previously identified as having the IP address 193.107.86.49?
ILHWAN YUM: Yes, it is.
MR. HOWARD: How do you recognize that?
ILHWAN YUM: I recognize this because the server -- some of the server hard drives they look different than a normal computer hard drive, so it's a little different than what I normally see. So I recognize it just by the physical appearance, but also the serial number that was marked on it matches my form that I filled out when I checked it into evidence.
MR. HOWARD: And the government offers Government Exhibit 603.
MR. DRATEL: No objection.
THE COURT: Received.
(Government's Exhibit 603 received in evidence)
MR. HOWARD: Could you please look in your binder to what's been marked for identification purposes as Government Exhibit 603A. Do you recognize this exhibit?
ILHWAN YUM: Yes, I do.
MR. HOWARD: What is it?
ILHWAN YUM: It's the log file that was generated after I made a working copy from this original hard drive.
MR. HOWARD: Did you make the copy in a similar manner as to the way you copied the server in Philadelphia?
ILHWAN YUM: Yes. I used a similar device.
MR. HOWARD: And does this log file -- were you involved in generating this log file?
ILHWAN YUM: Yes, I was.
MR. HOWARD: Government offers Government Exhibit 603A.
MR. DRATEL: No objection.
THE COURT: Received.
(Government's Exhibit 603A received in evidence)
MR. HOWARD: Zoom in on the bottom section.
MR. HOWARD: Mr. Yum, here is another MD5 and SHA1 hash of the working copy that you made?
ILHWAN YUM: Yes.
MR. HOWARD: Now, this log file only has one MD5 and one SHA1. Can you explain that?
ILHWAN YUM: Yes. So I have the original which I can always go back and confirm that what I have is what I took. And any time I'm making a copy of this, that device that I'm using, that is write-protected so it can never be altered. And if it ever gets altered, you could tell right away.
So this is the hash value for MD5 and SHA1 that was calculated for the image that I created. So anyone else who is working on this image afterwards, they could be assured that the copy hasn't been altered since it was first made.
MR. HOWARD: And does anything in this document indicate whether the copy was an accurate copy of the original?
ILHWAN YUM: Yes. Right above the highlighted section it says total errors which is zero, and the copy was completed without any problem.
MR. HOWARD: Now, were you also involved in seizing the bitcoin server in Iceland?
ILHWAN YUM: Yes.
MR. HOWARD: How was that server configured?
ILHWAN YUM: I believe that one had a hard drive that was in there and after seizing all the bitcoins, at that time I turned it off and I seized the hard drive that was on the server.
MR. HOWARD: What did you do with that hard drive?
ILHWAN YUM: I also brought that back to FBI New York.
MR. HOWARD: Your Honor, may I approach the witness.
THE COURT: You may.
MR. HOWARD: Mr. Yum, I'm showing you now what's been marked for identification purposes as Government Exhibit 605. Do you recognize this exhibit?
ILHWAN YUM: Yes, I do.
MR. HOWARD: And what is it?
ILHWAN YUM: It's the original hard drive that came out of the bitcoin server.
MR. HOWARD: How do you know that?
ILHWAN YUM: Again, I recognize it by the physical appearance of the hard drive itself. More importantly, the serial number matched -- the serial number on the hard drive matches the form that I used to check it into evidence.
MR. HOWARD: You called it the bitcoin server. Is that the server you testified earlier had the IP address of 193.107.86.34?
ILHWAN YUM: Yes, it is.
MR. HOWARD: And how did you make a copy of this one?
ILHWAN YUM: I used the similar device that I had used previously with the Marketplace server.
MR. HOWARD: Did you also verify that it was an accurate copy based on hash values?
ILHWAN YUM: Yes.
MR. HOWARD: Both the MD5 and the SHA1?
ILHWAN YUM: Yes. I generated the MD5 and the SHA1 and verified that there were no errors triggered when the copy was made.
MR. HOWARD: Could you please take a look at Government Exhibit 605A, please. Do you recognize what this is?
ILHWAN YUM: Yes, I do.
MR. HOWARD: What is this?
ILHWAN YUM: This is the log file that was generated once the bitcoin server hard drive was copied.
MR. HOWARD: Were you involved in imaging and creating this log file?
ILHWAN YUM: Yes, I was.
MR. HOWARD: The government offers Government Exhibit 605A.
MR. DRATEL: No objection.
THE COURT: Received.
And did you offer 605?
MR. HOWARD: If I didn't, I mean to offer it now.
MR. DRATEL: No objection.
THE COURT: Received.
(Government's Exhibits 605, 605A received in evidence)
MR. HOWARD: Mr. Evert, zoom in on the bottom section.
MR. HOWARD: Again, is this where the MD5 and SHA1 hash values are located, Mr. Yum?
ILHWAN YUM: Yes, it is.
MR. HOWARD: And does this also indicate that there were no errors, it was made successfully and that the copy was a true and accurate copy of the original?
ILHWAN YUM: Yes.
MR. HOWARD: What did you do after you made a copy of the bitcoin server?
ILHWAN YUM: I checked it into evidence.
MR. HOWARD: Now, earlier you testified that you were involved in putting up the seizure banner on the Silk Road Marketplace server, correct?
ILHWAN YUM: Correct.
MR. HOWARD: Are you familiar with setting up websites to run on the Tor network?
ILHWAN YUM: Yes, I am.
MR. HOWARD: Mr. Yum, could you please flip in your binder to what's been marked for identification purposes as Government Exhibit 106D. Do you recognize what this is?
ILHWAN YUM: Yes. It appears to be a simplified diagram of how the Tor network operates.
MR. HOWARD: Would this aid your testimony today?
ILHWAN YUM: Yes.
MR. HOWARD: The government offers 106D for demonstrative purposes.
MR. DRATEL: No objection.
THE COURT: Received.
(Government's Exhibit 106D received in evidence)
THE COURT: For demonstrative purposes.
MR. HOWARD: Mr. Yum, here we have a diagram of the Tor network, correct, simplified diagram?
ILHWAN YUM: Yes.
MR. HOWARD: And so, what is required to put -- and right here we have a web server hidden service, right?
ILHWAN YUM: Correct.
MR. HOWARD: What is required to put a website on the Tor network?
ILHWAN YUM: The first and most important thing is you need to know how to run a website first, how to run a web server. Once you know how to do that, if you also know how to use Tor technology, all you need to do is change a couple of lines of code and it's almost plug and play. Everything is handled by Tor itself and your web server is no longer accessible on the Internet but only through Tor.
MR. HOWARD: Mr. Yum, to be clear, do you need to understand anything about what's going on inside the Tor network?
ILHWAN YUM: No. You don't need to understand how exactly Tor works.
MR. HOWARD: That's done for Tor for you?
ILHWAN YUM: Right. All the actual transmission back and forth is handled by how Tor is designed.
MR. HOWARD: Now, are instructions available for how to set up a Tor hidden service?
ILHWAN YUM: Yes, they are.
MR. HOWARD: Where are they located?
ILHWAN YUM: On the main Tor project page, as well as some other users have their own instructions as well.
MR. HOWARD: Now, Mr. Yum, do you have any experience with bitcoins?
ILHWAN YUM: Yes, I do.
MR. HOWARD: Have you engaged in any bitcoin transactions?
ILHWAN YUM: Yes, I have.
MR. HOWARD: And approximately how many?
ILHWAN YUM: I would say hundreds of bitcoin transactions.
MR. HOWARD: Including the bitcoin transactions you talked about earlier, you seized bitcoins?
ILHWAN YUM: Correct, for the government seizure of bitcoins as well.
MR. HOWARD: What are bitcoins?
ILHWAN YUM: Bitcoins are -- it's digital currency. It's money that works online to buy products online or even in real person or paid-for services. It's kind of like cash for the Internet. It's similar to cash in that when people conduct transactions, you don't really see who is doing the transactions, but it's different than cash that every single transaction, the transaction itself, it gets permanently documented on this thing called the block chain. So even though you don't know who made the transactions, you get to see every single transaction that was performed using bitcoins.
MR. HOWARD: Can you explain the block chain a little more fully, please.
ILHWAN YUM: So block chain, in accounting terms it's similar to a public ledger which means, you know, published financial records of everything that's taking place. So block chain, it's a file that's online on the Internet access and shared and used by all the bitcoin users and what it contains is every single transaction of bitcoins ever since the creation of bitcoins.
MR. HOWARD: Now, can bitcoins be used for legitimate purposes?
ILHWAN YUM: Yes, they can.
MR. HOWARD: Can they also be used for illegitimate purposes?
ILHWAN YUM: Of course.
THE COURT: Let me ask about the block chain again.
I'm not clear what information is in the block chain. In other words, I understand from your testimony that you can follow that there has been a transaction, then another transaction, then another transaction and you can follow the transaction history of a particular bitcoin --
ILHWAN YUM: Right.
THE COURT: -- or a portion of bitcoin.
ILHWAN YUM: Yes.
THE COURT: What is the information in the block chain?
ILHWAN YUM: So the information that's contained in the block chain, first of all, you would have the information about the block chain itself, so the size of the current block and the date and the time that block was added to the block chain, so it's constantly growing. I think the current size of the block chain is over 20 gigabytes I think. So it's a considerable size because it contains all the history of bitcoins.
So within the block, there's additional information of every single transaction that was added to that block, so you'll see all the addresses that were used to send the payment and all the addresses that were used to receive a payment in bitcoins.
THE COURT: IP addresses?
ILHWAN YUM: There is no direct IP address of who is sending and receiving bitcoins.
THE COURT: So what kind of address is it?
ILHWAN YUM: I believe you might be able to obtain the IP address of --
THE COURT: Don't speculate. I'm wondering when you use the word "address," what were you referring to, what kind of address.
ILHWAN YUM: Bitcoin addresses. So it's a long string of alphanumeric value and it works almost like an email address. You need to give somebody your bitcoin address in order for whoever that wants to pay you to make sure they pay you the correct amount of bitcoins to the right person.
So if I were to email Tim, I wouldn't know how to send him an email until Tim gave me his email address. So in the same manner, if I need to send Tim ten bitcoins, there's no way for me to deliver those bitcoins to him unless he gives me his bitcoin address first.
BY MR. HOWARD:
MR. HOWARD: Mr. Yum, let's skip ahead. We'll come back to where we want to go next to show an example of a block chain. Look at Government Exhibit 601, which is in your binder, please.
Do you recognize what this is?
ILHWAN YUM: Yes, I do.
MR. HOWARD: What is this?
ILHWAN YUM: It's a screenshot of a popular block chain explorer, blockchain.info. You could obtain information about the block chain and transactions.
MR. HOWARD: Is that website available to the public?
ILHWAN YUM: Yes.
MR. HOWARD: Were you involved in the preparation of this exhibit?
ILHWAN YUM: Yes.
MR. HOWARD: Does this exhibit fairly and accurately depict information from the block chain?
ILHWAN YUM: Yes, it does.
MR. HOWARD: Government offers Government Exhibit 601.
MR. DRATEL: No objection.
THE COURT: Received.
(Government's Exhibit 601 received in evidence)
MR. HOWARD: Mr. Yum, this is something you could pull up in an ordinary Internet processor, correct?
ILHWAN YUM: Yes.
MR. HOWARD: Let's focus on the top section.
ILHWAN YUM: So the top section is a high-level summary about that address.
MR. HOWARD: So where is -- do you have your laser pointer up there?
ILHWAN YUM: Yes, I do.
MR. HOWARD: Can you point to what a bitcoin address is?
ILHWAN YUM: It would be the first line right there.
MR. HOWARD: Mr. Evert, can we zoom in on that for a moment.
MR. HOWARD: So it's this long string of numbers and letters, correct?
ILHWAN YUM: Correct.
MR. HOWARD: Earlier you gave the example of sending an email. You'd need to know the email address of someone you're sending an email to in order to send the email to them, right?
ILHWAN YUM: Correct.
MR. HOWARD: Is this what you would need to know from someone else if you wanted to send them bitcoins?
ILHWAN YUM: Right. That would be the address that I would need to send the bitcoins to if I owed the owner of that address money or bitcoins.
MR. HOWARD: It's a long, ugly string of numbers and characters, right?
ILHWAN YUM: Yes.
MR. HOWARD: Can we zoom out.
MR. HOWARD: What other information is there at the top here?
ILHWAN YUM: On the right side, it has the history of that bitcoin address. So that bitcoin address was used in six different transactions and it received a total of 7,225 bitcoins and the final balance is zero. So all of those bitcoins that were received to that address has afterwards been sent to somewhere else.
MR. HOWARD: Can we zoom out, please.
MR. HOWARD: What does this section of the report include?
ILHWAN YUM: That would be the detailed transaction of that summary that was mentioned above, the six transactions.
MR. HOWARD: Would that be all the transactions that were associated with that address?
ILHWAN YUM: Yes.
MR. HOWARD: Let's focus on the bottom one for an example.
Can you describe how this depicts information about a bitcoin transaction.
ILHWAN YUM: Yes. So I'll go from the top right first. So that long string of alphanumeric value there, that is a transaction ID. So on the block chain, every transaction is tagged with a unique ID that only represents one unique transaction. So with that transaction ID, you know this transaction happened.
On the block, you also get a timestamp over there, which was -- the transaction occurred in March 31, 2013 and below it on the body of this transaction detail, you see the four addresses on the left. Those four addresses together sent 1,670 bitcoins to that address on the right.
MR. HOWARD: To be clear, it's 1,670 bitcoins in total across all four of those addresses?
ILHWAN YUM: Yes.
MR. HOWARD: To the one address on the right, correct?
ILHWAN YUM: Yes.
MR. HOWARD: So if someone has a bitcoin address, like the one on the right, this is information they can just pull up on a public website, correct?
ILHWAN YUM: Correct.
MR. HOWARD: If you have the unique transaction number, could you also pull up all these transaction details on a public website?
ILHWAN YUM: Yes.
MR. HOWARD: Now, can we zoom out, please.
MR. HOWARD: So now if you have the bitcoin address, this is the report you can get that's publicly available, right?
ILHWAN YUM: Right.
MR. HOWARD: Does the report include any information about who -- the identity of the person who owns the bitcoin address?
ILHWAN YUM: No, it doesn't. So you would only get the information what you see up there. If you were the actual party in that transaction, you could -- if you know who sent you the money, you could kind of -- you could tie in -- certain addresses might belong to somebody. But other than that, the block chain itself, you can't tell who is sending or receiving bitcoins.
MR. HOWARD: You would need information from somewhere else, correct?
ILHWAN YUM: Right.
MR. HOWARD: Not from the block chain itself?
ILHWAN YUM: Correct.
MR. HOWARD: Could you please flip in your binder to what's been premarked for identification purposes as Government Exhibit 608, please. Are you familiar with how the basics of a bitcoin transaction works?
ILHWAN YUM: Yes.
MR. HOWARD: What is Government Exhibit 608?
ILHWAN YUM: It is a simplified illustration to explain how a bitcoin works.
MR. HOWARD: Would this aid your testimony today?
ILHWAN YUM: Yes.
MR. HOWARD: The government offers government Exhibit 608 for demonstrative purposes.
MR. DRATEL: No objection.
THE COURT: Received for demonstrative purposes.
(Government's Exhibit 608 received in evidence)
MR. HOWARD: Mr. Yum, could you please explain, what is a bitcoin wallet?
ILHWAN YUM: So a bitcoin wallet, it's a container that holds all the bitcoin addresses relating to a person. So in this picture here, we had Alice. Alice is using bitcoin and she has a bitcoin program on her computer. That program creates a wallet file and inside the wallet file, it contains all the addresses that belong to Alice; as well as you could see the balances that are inside each one of those addresses, but more importantly, the wallet file contains -- and here, it has a red key, but in bitcoin terms, it's called a private key. And what private key allows is the user, Alice, to control and see all of the information about her bitcoins.
MR. HOWARD: What else does having the private keys allow you to do with bitcoins?
ILHWAN YUM: So if you own any bitcoins in any one of these addresses, the corresponding key allows you to spend those bitcoins.
MR. HOWARD: And the wallet is basically just a computer file, correct?
ILHWAN YUM: Yes. It's a computer file, yeah.
MR. HOWARD: Is Alice able to see all of her own addresses?
ILHWAN YUM: Yes.
MR. HOWARD: Just to be clear, on this demonstrative that we say BTC Address 1 and down to 5.
How many addresses could a wallet contain?
ILHWAN YUM: As many as you want. In here for example purposes there's only five addresses listed, but you could create hundreds, thousands of addresses in one wallet file.
MR. HOWARD: Can anyone else other than Alice see all of the addresses in her wallet?
ILHWAN YUM: Only if they know what the address is, but if you don't have the private key, you can't just guess someone else's address.
MR. HOWARD: To be clear, each those addresses is one of those long, ugly string of numbers and letters, right?
ILHWAN YUM: Correct.
THE COURT: Where do you get an address?
ILHWAN YUM: So, the bitcoin program generates a long string of numbers and that acts as a seed to the private key. And the program again uses that private key to calculate something that is similar to the MD5 hashes and a hash value is represented as a public key which is a lot easier to pass to someone else, although it looks very long and confusing.
THE COURT: All right.
MR. HOWARD: How easy is it to create a new bitcoin address?
ILHWAN YUM: If you're using a bitcoin program all you have to do is click a button and request the program to create a new bitcoin address.
MR. HOWARD: It will assign a new bitcoin address to you?
ILHWAN YUM: Yes.
MR. HOWARD: Will it give you the private key necessary to spend the bitcoins in that address?
ILHWAN YUM: Right. In the background of the program, you'll get a private key and then you'll get the public address that you can freely give out to other people if you want to receive bitcoins to that address.
MR. HOWARD: Could you explain what is depicted on the second slide, please.
ILHWAN YUM: I'm going to walk you through a simplified demonstration of how a transaction would occur. So, again Alice, she owes Bob ten bitcoins, but just as I said, Alice has no idea where to send the bitcoins to, so she needs to ask Bob for a bitcoin address first.
So Alice wants to send ten bitcoins and she's asking where to send it to. And Bob, in his wallet, he only has two addresses, but as stated before, he could have many more if he wants to. So Bob picks his Bitcoin Address 2, and can we go to the next screen, please, and tells Alice to send ten bitcoins to Address 2.
Alice doesn't really need to worry about where the bitcoins are coming from her wallet. The program handles that in the most efficient manner it could, so once Alice tells her bitcoin program to send ten bitcoins to Bob's Address 2, Alice's program picks Address 1 and Address 4 in her wallet and sends ten bitcoins to Bob's Address 2.
MR. HOWARD: So Alice doesn't have to pick and choose between her own addresses, correct?
ILHWAN YUM: Right. It's very simple to use.
THE COURT: It could be five out of one address, five out of another or two out of one address, eight out of another, or some other combination of pieces?
ILHWAN YUM: Correct.
THE COURT: All right.
MR. HOWARD: So what's depicted on the third slide?
ILHWAN YUM: In our demonstration, there were seven bitcoins in Address 1 that was sent and three bitcoins in Address 4 of Alice's bitcoin that were sent to Bob's Address 2 in the amount of ten bitcoins.
MR. HOWARD: And then what's reflected on the bottom of the slide?
ILHWAN YUM: So the bottom would be an example of what would be recorded onto the block chain as we saw in the prior block chain info screenshot. So in here, you would see a unique transaction number that identifies this particular transaction and the date and time this transaction was documented onto the block chain.
And in here, again, you see only the two addresses that were used to make this transaction of ten bitcoins that were sent to Bob's Address 2.
MR. HOWARD: So now Bob could get this information off the block chain and see what addresses Alice's wallet used to engage in this transaction, correct?
ILHWAN YUM: Correct. Bob, he knows his address, so he could easily search his own address and figure out this transaction and note that Alice used these two bitcoin addresses to send Bob ten bitcoins.
MR. HOWARD: Now, would Bob know all of Alice's other bitcoin addresses?
ILHWAN YUM: No. Address 2, 3 or 5, Bob would have no idea what the -- who those addresses belong to.
MR. HOWARD: And why couldn't he see those?
ILHWAN YUM: The addresses aren't announced or anything. So unless you directly have a transaction with somebody, you can't really figure out who owns what address.
MR. HOWARD: You need the private keys to see all the rest of the wallet?
ILHWAN YUM: Right. The only way Bob may be able to see these addresses is if he had the private key in his wallet allowing him to calculate the same private address -- public address.
MR. HOWARD: Now, Mr. Yum, earlier you testified that you seized approximately 20,000 bitcoins from the Iceland bitcoin server, correct?
ILHWAN YUM: Correct.
MR. HOWARD: Now, apart from that seizure, were you involved in any other seizures of bitcoins in the Silk Road investigation?
ILHWAN YUM: Yes, I was.
MR. HOWARD: Where were those bitcoins located?
ILHWAN YUM: The wallet file for the other bitcoins were obtained from the laptop that was seized from the defendant on the day of his arrest.
MR. HOWARD: And how did you get access to that wallet file?
ILHWAN YUM: So, Mr. Kiernan actually analyzed and reviewed the laptop and he had located the wallet file and copied it onto a thumb drive and handed it over to me.
MR. HOWARD: And what did you do with that wallet file after it was provided to you by Mr. Kiernan?
ILHWAN YUM: So, I loaded that wallet file onto my bitcoin program instance, and checked the current balance that was contained inside all the addresses inside the wallet file.
MR. HOWARD: And what was the balance?
ILHWAN YUM: It was approximately 144,000 bitcoins.
MR. HOWARD: And what were those bitcoins worth approximately at the time of the defendant's arrest?
ILHWAN YUM: So at the time of the arrest, which was prior to when I received that wallet file, it was -- again, using the varying bitcoin price of that day, it would have been anywhere between 16- to $18 million.
MR. HOWARD: Now, what did you do after you determined the balance of the bitcoins that were in the wallet that was in the defendant's computer?
ILHWAN YUM: I had another bitcoin address that was prepared for the government's seizure, and I transferred all the bitcoins from the defendant's wallet file into the government address.
MR. HOWARD: You said it was an FBI bitcoin wallet, correct?
ILHWAN YUM: Correct.
MR. HOWARD: Is this the same or different wallet that you used in Iceland to get the bitcoins from the bitcoin server?
ILHWAN YUM: Different address. I wanted to separate the two so the bitcoins didn't mix.
MR. HOWARD: Was there any balance in the FBI controlled log when you created it?
ILHWAN YUM: No. It was a newly -- brand new created bitcoin address and since it's never been -- there's never been a transaction conducted using that address, it wouldn't have shown in the block chain, so no one else knew what that address was.
MR. HOWARD: Now, did the wallet file that was provided to you by Mr. Kiernan from the defendant's laptop contain the private keys for the bitcoin addresses in that wallet?
ILHWAN YUM: Correct. That would be the most important thing. Without those private keys, I wouldn't have the right to send the bitcoins from the defendant's wallet to the government seizure address.
MR. HOWARD: Did those private keys also allow you to see all of the bitcoin addresses that were located in that wallet?
ILHWAN YUM: Yes.
MR. HOWARD: Can you please flip in your binder to what's been marked for identification purposes as Government Exhibit 607. Do you recognize what this is?
ILHWAN YUM: Yes, I do.
MR. HOWARD: And what is this?
ILHWAN YUM: It's a screenshot of a search engine named duckduckgo, and it's the search result for a bitcoin address starting 1FfmbH, which is the address that I created for the government to seize all of the bitcoins from the defendant's laptop.
MR. HOWARD: And had you previously used this website to obtain public information from the block chain?
ILHWAN YUM: Yes, I have.
MR. HOWARD: Does this website accurately reflect bitcoin transactions that you've conducted in the past?
ILHWAN YUM: Yes, it does.
MR. HOWARD: You took this screenshot?
ILHWAN YUM: Yes.
MR. HOWARD: The government offers Government Exhibit 607.
MR. DRATEL: No objection.
THE COURT: Received.
(Government's Exhibit 607 received in evidence)
MR. HOWARD: Mr. Yum, right up here at the top next to the cute little picture of the duck, there's 1Ff and a long string of characters. What is this?
ILHWAN YUM: That's the address created for the government.
MR. HOWARD: The bitcoin address?
ILHWAN YUM: The bitcoin address, yes.
MR. HOWARD: And you were involved in creating that, correct?
ILHWAN YUM: Yes.
MR. HOWARD: Can we zoom out, please.
MR. HOWARD: Here it says total received, 144,341 and change. What does that number represent?
ILHWAN YUM: So that's the total amount of bitcoins that was sent to this address above.
MR. HOWARD: And where were they sent from?
ILHWAN YUM: So that total number is a little higher than the actual amount, but the majority of those were sent from the defendant's laptop -- the wallet file located in the defendant's laptop.
MR. HOWARD: Mr. Evert, could you please publish Government Exhibit 201L, which is already in evidence.
MR. HOWARD: Have you seen this before? It's on the screen.
ILHWAN YUM: Yes, I have.
MR. HOWARD: And what is this?
ILHWAN YUM: It's a summary sheet. It's a picture screenshot of the defendant's laptop when it was seized on the day of his arrest.
MR. HOWARD: So I want to focus here on the fifth line down here. Can we zoom in here. And here it says cold BTC and under that 144,336.4.
How does this number that was on the defendant's computer screen compare to the number of bitcoins that you seized?
ILHWAN YUM: It matches almost exact to the amount that was seized.
MR. HOWARD: And right above that, there's the word "cold BTC"?
ILHWAN YUM: Yes.
MR. HOWARD: Are you familiar with the bitcoin term "cold storage"?
ILHWAN YUM: Yes, I am. It's a term that's commonly used within the bitcoin community and bitcoin users.
MR. HOWARD: What is it used to refer to?
ILHWAN YUM: It's a way to store your wallet file. So it's important to secure your wallet file because it has all the keys that allows you to spend your bitcoins. So cold storage is -- the most common example is not having your wallet file attached a bitcoin program. So instead of -- that would be hot, so instead of having a hot wallet, you have a cold storage where if you separate from a computer that's running a bitcoin program, so even if the computer gets comprised or damaged or if it fails, you still have your bitcoins secure and tucked away in your cold storage.
MR. HOWARD: What does cold storage refer to with a bitcoin wallet with respect to a website?
ILHWAN YUM: For a website, if you're running a website and if your website crashes or if your website gets compromised, you don't want to lose everything that's in there, so you create a cold storage. And the idea would be to move all the important parts or your bitcoins to cold storage so if anything ever happens to the website, you don't lose your bitcoins.
MR. HOWARD: Now, Mr. Yum, earlier you testified that you are currently working at FTI Consulting, correct?
ILHWAN YUM: Correct.
MR. HOWARD: What is your position?
ILHWAN YUM: Senior director.
MR. HOWARD: Now, in your capacity at FTI, have you recently been involved in an analysis of bitcoin transactions related to the Silk Road investigation?
ILHWAN YUM: Yes, I was.
MR. HOWARD: Now, are you being paid for your work with respect to that?
ILHWAN YUM: Yes, I am.
MR. HOWARD: And how much are you getting paid for that?
ILHWAN YUM: For this project, not myself directly, but my company is charging an hourly rate of $468.
MR. HOWARD: Did you work on this alone or did others at FTI assist you?
ILHWAN YUM: I worked with one other -- one other person in my team.
MR. HOWARD: To be clear now, you got paid for the work you did on this analysis, correct?
ILHWAN YUM: Just on analysis.
MR. HOWARD: Are you being paid to testify today?
ILHWAN YUM: No, I'm not.
MR. HOWARD: Now, what was the overall subject matter of your recent work?
ILHWAN YUM: I'm sorry --
MR. HOWARD: What is the overall matter of your recent work?
ILHWAN YUM: I was asked by the government to see if there's any -- if any at all link between the bitcoin addresses that were found on Silk Road and the bitcoin addresses that were found on the defendant's laptop.
MR. HOWARD: So let's break that down. Where were these bitcoin addresses located?
ILHWAN YUM: So, one side, we had the Silk Road bitcoins. I received evidence items from the government and I reviewed the Philadelphia server that was mentioned before, as well as the bitcoin Marketplace -- the Silk Road Marketplace bitcoin servers in Iceland and located -- examined and located, identified all the bitcoin wallet files that were found on those two servers.
MR. HOWARD: Those are two servers that you were actually personally involved in seizing, correct?
ILHWAN YUM: Yes, when I was still with the government.
MR. HOWARD: Did you find the private keys on those servers for those wallet files?
ILHWAN YUM: Yes. So I obtained the wallet files, so I had all the private keys that are also inside those wallet files.
MR. HOWARD: So did that allow you to see all of the bitcoin addresses that were associated with those wallets on the Silk Road servers?
ILHWAN YUM: Yes.
MR. HOWARD: Now, how about the defendant's laptop?
ILHWAN YUM: So, I took the same approach. I got a forensic image copy of the defendant's laptop and I examined and analyzed the laptop to locate at least three wallet files and extracted all the bitcoin addresses there because I had the private keys that were contained inside those wallet files.
(Continued on next page)
MR. HOWARD: Now, you testified that you examined -- you received certain pieces of evidence from the FBI to perform this analysis, correct?
ILHWAN YUM: Correct.
MR. HOWARD: So what pieces of evidence did you specifically receive?
ILHWAN YUM: I got three forensic images -- one of the Philadelphia server, the backup server, one of the Iceland bitcoin server that was seized over in Iceland, and an image of the defendant's laptop, which was seized at the time of his arrest.
MR. HOWARD: So if you could please flip in your binder -- actually, just real fast. After you received copies of those three pieces of evidence, did you do anything to verify that they were true and accurate copies of the original evidence?
ILHWAN YUM: Of course. I calculated my own MD5 and SHA1 hashes. I calculated those two hash files to make sure my starting point is the same as what was originally copied.
MR. HOWARD: So did you compare those MD5 and SHA1 hash values to the ones that were originally generated for those pieces of evidence?
ILHWAN YUM: Yes.
MR. HOWARD: What did you discovery?
ILHWAN YUM: They all matched.
MR. HOWARD: Could you please flip in your binder to what has been marked as Government Exhibit 606, please.
How many pages is this exhibit?
ILHWAN YUM: Three pages in total.
MR. HOWARD: And what is it?
ILHWAN YUM: Each one of those pages are a screenshot that I made after I calculated the hash values.
MR. HOWARD: Those are the hash values of each of the three pieces of evidence that you received from the FBI?
ILHWAN YUM: Correct.
MR. HOWARD: The government offers Government Exhibit 606.
MR. DRATEL: No objection.
THE COURT: Received.
(Government's Exhibit 606 received in evidence)
MR. HOWARD: So each contains an MD5 and a SHA1, correct?
ILHWAN YUM: Correct.
MR. HOWARD: Just flip through the pages, Mr. Evert.
MR. HOWARD: And all of those values match the values on the various log files we've seen today, correct?
ILHWAN YUM: Yes, they do.
MR. HOWARD: And also match the log file from the image of the defendant's computer that you received from the FBI?
ILHWAN YUM: Yes.
MR. HOWARD: The laptop computer?
ILHWAN YUM: Yes.
MR. HOWARD: Could you please look in your binder to what has been marked for identification purposes as Government Exhibit 609.
Do you recognize this exhibit?
ILHWAN YUM: Yes, I do.
MR. HOWARD: And what is it?
ILHWAN YUM: It's a simplified illustration of the work that I did to compare all the addresses that was obtained from Silk Road Marketplace and all the addresses that were obtained from the defendant's laptop.
MR. HOWARD: And would this aid your testimony today?
ILHWAN YUM: Yes.
MR. HOWARD: The government offers Government Exhibit 609 for demonstrative purposes.
MR. DRATEL: No objection for demonstrative purposes.
THE COURT: 609 is received for demonstrative purposes.
(Government's Exhibit 609 received in evidence)
BY MR. HOWARD:
MR. HOWARD: Could you please explain what your analysis consisted of?
ILHWAN YUM: Sure. So I examined the forensic copy of the defendant's laptop and carefully went through the files and located three Bitcoin Wallet files. Some of those wallet files may be duplicates or used that one time and then switched over to a different wallet, so there were some duplicates. But at the end I sorted the addresses down to 11,135 unique individual bitcoin addresses.
And this is possible because the wallet file contains the private key that I was talking about. So without the private key I would not be able to extract all these addresses.
MR. HOWARD: The fact that the private keys were located on the defendant's computer, what does that indicate?
ILHWAN YUM: It indicates the defendant's laptop, the wallet file, controlled these bitcoin addresses. So these are the only keys that could spend the bitcoins that are in these wallet files.
MR. HOWARD: So the user of the computer could spend the bitcoins in those addresses?
ILHWAN YUM: Correct. And if we could go to the next page.
So from the other side, those are the two servers -- images of two servers that I obtained, one from the Philadelphia backup server and one from the Iceland Silk Road bitcoin servers. So from those two images, I carefully went through them, examined it, and identified and located 22 Bitcoin Wallet files. Again, some of these might be backups or an address that was used at one point and moved on to another address. So initially I found over 10 million bitcoin addresses. Some of them are duplicates, but I narrowed it down to a little over 2 million unique bitcoin addresses.
MR. HOWARD: Go to the next page, please.
ILHWAN YUM: So now I have two sets of addresses, a set of over 2 million bitcoins that were found on servers that are related to Silk Road Marketplace. And on the other side I had over 11,000 bitcoin addresses that were recovered from the laptop belonging to the defendant that was seized at the time of the arrest.
MR. HOWARD: Sorry, how many address? 2,105,527 unique addresses?
ILHWAN YUM: Yes. The exact number would be 2,105,527 addresses from Silk Road Marketplace and 11,135 bitcoin addresses from the defendant's laptop.
MR. HOWARD: Go to the next page, please.
ILHWAN YUM: Wait. Actually, can we go back one?
So I could explain using this screen and the next screen, but the analysis that I did, I didn't do any complicated analysis. I wanted to look for the most simple direct link between those two sets of addresses. So I had the addresses from the Silk Road Marketplace and I had the addresses from the defendant's laptop, and I went back to the block chain, which is publicly available and agreed by all the bitcoin users, and identified all the transactions where the money was being sent from Silk Road Marketplace and bitcoins were received to the addresses on the defendant's laptop.
MR. HOWARD: Are these direct one-to-one transactions?
ILHWAN YUM: Direct one-to-one. It didn't skip over anywhere else. It went straight directly from Silk Road Marketplace directly to the addresses found on the defendant's laptop.
So if you could go to the next screen.
So just to give you an example of the raw information that I had to work with, this is not the entire list but just a portion of addresses from each side. So on the left you see all the addresses, the public addresses for Silk Road Marketplace, and the unique list had over 2 million bitcoin addresses and I could obtain these because of the private key that was also inside the wallet files.
On the right side you have the laptop addresses in there. These are the unique addresses, over 11,000 bitcoin addresses that were found on the defendant's laptop and. I was able to tell these because the wallet file contains the private keys to generate these public addresses, which also allows the owner of those private keys to spend those bitcoins.
MR. HOWARD: Your Honor, may I approach?
THE COURT: Yes.
MR. HOWARD: So I'm handing you what has been marked for identification purposes as Government Exhibits 650 and 651.
Do you recognize what these are?
ILHWAN YUM: Yes, I do.
MR. HOWARD: And what are they?
ILHWAN YUM: Each one of theses discs contain the text file that you saw a portion of just now.
MR. HOWARD: What are in those text files?
ILHWAN YUM: One of the text files contains all the addresses -- all the unique list of addresses from the Silk Road Marketplace, and the other disc contains all the unique addresses found on the defendant's laptop.
MR. HOWARD: And just to be clear: I gave you two CDs. Which one is which?
ILHWAN YUM: Exhibit 650 is the Silk Road Marketplace bitcoins, and Exhibit 651 is all the addresses that were found on the defendant's laptop.
MR. HOWARD: And how do you recognize these CDs?
ILHWAN YUM: I was involved in the creation of these CDs.
MR. HOWARD: And are your initials on them?
ILHWAN YUM: Yes. After I created them, I initialed them and dated the CDs.
MR. HOWARD: The government offers Government Exhibits 650 and 651.
MR. DRATEL: No objection.
THE COURT: Received.
(Government's Exhibits 650 and 651 received in evidence)
MR. HOWARD: Your Honor, may I approach?
THE COURT: You may.
MR. HOWARD: So, Mr. Evert, could you please publish Government Exhibit 650. Just bring it up in the text file itself.
MR. HOWARD: So, Mr. Yum, this the list of the two-million-plus unique bitcoin addresses that were recovered from Silk Road-related servers, correct?
ILHWAN YUM: Correct.
MR. HOWARD: If you can scroll this to show how large this is.
(Indicating)
MR. HOWARD: I think we get the idea.
Can we go to Government Exhibit 651, please.
MR. HOWARD: Mr. Yum, this is a list of the 11,000-plus unique bitcoin addresses that were found on the defendant's laptop computer, correct?
ILHWAN YUM: Correct.
MR. HOWARD: And the private keys for all these addresses were also located on the laptop?
ILHWAN YUM: Yes, they were.
MR. HOWARD: Would you scroll on this one.
(Indicating)
MR. HOWARD: Now, Mr. Yum, could you please flip in your binder to what's been marked for identification purposes as Government Exhibit 610.
Do you recognize this exhibit?
ILHWAN YUM: Yes, I do.
MR. HOWARD: What is this?
ILHWAN YUM: It's a collection of screenshots that I made to spotcheck and go through the link analysis that I performed.
MR. HOWARD: Were you involved in the creation of this exhibit?
ILHWAN YUM: Yes.
MR. HOWARD: So what are the screenshots taken from?
ILHWAN YUM: So there is three screenshots. In the center is the --
MR. HOWARD: Mr. Yum, we'll describe them once we -- what are the sources of the information for these screenshots?
ILHWAN YUM: From the block chain and the list of addresses found on Silk Road Marketplace and a list of addresses found on defendant's laptop.
MR. HOWARD: Have you verified that this exhibit reflects true and accurate copies of information from the block chain and true and accurate screenshots from each of the lists of bitcoin addresses?
ILHWAN YUM: Yes.
MR. HOWARD: The government offers Government Exhibit 610.
MR. DRATEL: Just with respect to the screenshots?
THE COURT: Just with respect to the screenshots?
MR. HOWARD: We're offering the entire exhibit as a summary exhibit under 1006.
THE COURT: All right. Mr. Dratel, this is the one that we were talking about?
MR. HOWARD: It is Government Exhibit 610.
THE COURT: Right. I only have one page in my --
MR. HOWARD: It is just one page, your Honor.
THE COURT: It is just a single page.
MR. DRATEL: It is one page.
THE COURT: All right. Received.
(Government's Exhibit 610 received in evidence)
MR. HOWARD: Could you please publish Government Exhibit 610.
MR. HOWARD: So, Mr. Yum, can you please walk us through what this shows?
ILHWAN YUM: Sure. I guess it is best to start from the middle. So that section is, as you've seen before from the example of blockchain.info, the website where you can look up all the bitcoin transactions, this is a transaction that I identified which had bitcoin addresses from the marketplace making 3,900 bitcoin transactions to a bitcoin address that was found on the defendant's laptop.
So that's the unique transaction ID. It was -- the transaction was made April 3rd, 2013. Again, you see the address starting on 1GarVY. And up top it has a screen capture of the list of the addresses from the marketplace that you had seen previously and a location where that can be found in that list.
On the bottom this has the portion of the list of all the addresses from the defendant's laptop, and you could see that the address found in there, starting "17t6V," matches the received bitcoin address in this transaction.
MR. HOWARD: So this exhibit shows 3,900 bitcoins were sent from an address that was located on Silk Road servers to a bitcoin address that was located on the defendant's laptop?
ILHWAN YUM: Yes. Exactly.
MR. HOWARD: And that happened on April 3rd, 2013, according to publicly available information on the block chain?
ILHWAN YUM: Yes.
MR. HOWARD: Now, was this the only transaction that you found linking the bitcoin addresses on the Silk Road servers to the defendant's -- the addresses on the defendant's laptop, or were there others?
ILHWAN YUM: No. There were almost 4,000 unique transactions from Silk Road Marketplace to the addresses that were found on the defendant's laptop.
MR. HOWARD: So could you please flip in your binder to what's been marked for identification purposes as Government Exhibit 620.
Do you recognize this exhibit?
ILHWAN YUM: Yes, I do.
MR. HOWARD: And what is this exhibit?
ILHWAN YUM: This is a list of all the transactions that I was successfully able to identify.
MR. HOWARD: Did you participate in the creation of this exhibit?
ILHWAN YUM: Yes.
MR. HOWARD: Does this exhibit accurately summarize information from the bitcoin addresses that you found -- that you reviewed from wallets found on the Silk Road servers and the defendant's computer?
ILHWAN YUM: Yes.
MR. HOWARD: Does this exhibit accurately summarize information that you retrieved from the block chain regarding bitcoin transactions?
ILHWAN YUM: Yes.
MR. HOWARD: The government offers Government Exhibit 620.
MR. DRATEL: Objection, your Honor. Crawford, foundation, hearsay.
THE COURT: All right. Those objections are overruled. Government Exhibit 620 is received.
(Government's Exhibit 620 received in evidence)
BY MR. HOWARD:
MR. HOWARD: So, Mr. Yum, what was the date range of the transactions that you located?
ILHWAN YUM: The first transaction occurred in September 24th, 2012, and the latest transaction I was able to identify was August 21st, 2013.
MR. HOWARD: And were the transactions spread across -- the thousands of transactions were spread across that time period?
ILHWAN YUM: Right. It was spread across almost all of that entire one-year span.
MR. HOWARD: So, Mr. Evert, could you just go to the top, please. Just zoom in on the first few rows.
MR. HOWARD: Could you just describe what is depicted here?
ILHWAN YUM: So it is a simplified version of all the screenshots that you saw before, prior. So that's -- the first column is there is the time stamp, the time that this transaction was included onto the block chain. The second column there is the unique transaction ID that you could locate, pinpoint to the exact transaction that's happened. So behind those transactions you would actually see the addresses that are used to send bitcoins to another receiving address, but you could easily also refer to those two transactions by that transaction ID.
And the last column there, that's all the bitcoins that were involved in that transaction that ended up in the wallets found on bitcoin addresses found on the defendant's laptop.
MR. HOWARD: So to be clear, Mr. Yum, you could put that unique transaction number into the block chain on the website to get the addresses that were involved in the transaction?
ILHWAN YUM: Correct.
MR. HOWARD: And those addresses matched the addresses that you found on the Silk Road servers and the defendant's laptop?
ILHWAN YUM: Yes.
MR. HOWARD: Can we just scroll to the bottom of the chart.
(Indicating)
MR. HOWARD: This is page 64 of the exhibit. Could you zoom in on the bottom.
MR. HOWARD: And so the total was 700,253.91 bitcoins, is that correct?
ILHWAN YUM: That's correct.
MR. HOWARD: Now, Mr. Yum, can you please flip in your binder to what's been marked for identification purposes as Government Exhibit 620C.
What is this?
ILHWAN YUM: It appears to be a price index from a website coindesk.com. It shows the date and the closing price of the bitcoins in U.S. dollar amount.
MR. HOWARD: According to coindesk?
ILHWAN YUM: According to coindesk.
MR. HOWARD: Is that information available on a public website?
ILHWAN YUM: Yes.
MR. HOWARD: Now, is coindesk widely recognized and used by the bitcoin community for bitcoin pricing?
ILHWAN YUM: Yes, not only bitcoin pricing but other data and news and information about bitcoins.
MR. HOWARD: Now, based on your knowledge of the bitcoin community, would you agree that the reputation of coindesk carries some weight and is recognized as accurate in the community?
ILHWAN YUM: Yes.
MR. HOWARD: Does this exhibit accurately summarize pricing information for bitcoins from coindesk?
ILHWAN YUM: Yes, it does.
MR. HOWARD: The government offers Government Exhibit 620C.
MR. DRATEL: No objection.
THE COURT: Received.
(Government's Exhibit 620C received in evidence)
THE COURT: We're going to -- Mr. Howard, in about three minutes we are going to break for lunch.
MR. HOWARD: Can you just briefly explain what is depicted here?
ILHWAN YUM: So on the left column it has the date of these records. On the right column it has the end-of-the-day closing price of bitcoins, represented in U.S. dollar amounts, for each corresponding date.
MR. HOWARD: Now, could you please flip in your binder to what's been marked for identification purposes as Government Exhibit 620A.
What is this exhibit?
ILHWAN YUM: It is a summary spreadsheet of the analysis that I conducted.
MR. HOWARD: Did you participate in the creation of this exhibit?
ILHWAN YUM: Yes.
MR. HOWARD: Does the exhibit accurately summarize information from the bitcoin addresses you reviewed from bitcoin wallets found on the Silk Road servers and on the defendant's computer?
ILHWAN YUM: Yes, it does.
MR. HOWARD: Does the exhibit accurately summarize information from the block chain regarding bitcoin transactions?
ILHWAN YUM: Yes.
MR. HOWARD: The government offers Government Exhibit 620A.
MR. DRATEL: Objection. The same grounds, your Honor. Hearsay, foundation --
THE COURT: All right. Those objections are overruled. Government Exhibit 620A is received.
(Government's Exhibit 620A received in evidence)
MR. HOWARD: Can we zoom in on the top, please.
MR. HOWARD: Mr. Yum, could you please describe what's depicted in this chart?
ILHWAN YUM: Yes. So it's a monthly summary breakdown of all the transactions that took place between addresses found on Silk Road Marketplace sending bitcoins to the addresses found on the defendant's laptop.
So the span, again, starts from September 2012 all the way down to August 2013. And for each month the second column shows you the number of transactions that were conducted. The third column shows you how many bitcoins in those transactions were sent from Silk Road Marketplace to the addresses found on the defendant's laptop. And the last column is the, I guess, realtime conversion of U.S. dollar amounts for each one of those dates where the transactions were identified.
MR. HOWARD: And did you use the coindesk information to convert to U.S. dollars?
ILHWAN YUM: Yes.
MR. HOWARD: What do you mean by "realtime" conversion?
ILHWAN YUM: So I didn't just take one day, let's say -- you were asking me before how much bitcoins were at the time of the arrest. I didn't use one dollar amount. From the prior exhibit, I took each individual day's closing and matched it to each of the individual day's transactions and correctly calculated how much bitcoins were worth at the time of that transaction.
MR. HOWARD: So this exhibit reflects that there was a total of $13 million worth of transactions at the time that each transaction took place?
ILHWAN YUM: Yes.
MR. HOWARD: And a total of 700,254 bitcoins received --
ILHWAN YUM: Correct.
MR. HOWARD: -- from Silk Road servers to the defendant's laptop wallets?
ILHWAN YUM: Yes.
MR. HOWARD: And 3,760 transactions, correct?
ILHWAN YUM: Correct.
MR. HOWARD: Could you please take a look at 620B in your binder.
Do you recognize what this is.
ILHWAN YUM: Yes, I do.
MR. HOWARD: And what is this?
ILHWAN YUM: It's a pie chart that I created also summarizing an analysis that I did.
MR. HOWARD: Did you participate in the creation of this exhibit?
ILHWAN YUM: Yes, I did.
MR. HOWARD: Does this exhibit accurately summarize information from the bitcoin addresses you reviewed from wallets found on the Silk Road servers and the defendant's computer?
ILHWAN YUM: Yes.
MR. HOWARD: And does it accurately summarize information from the block chain regarding bitcoin transactions?
ILHWAN YUM: Yes.
MR. HOWARD: The government offers Government Exhibit 620B.
MR. DRATEL: The same objections, your Honor.
THE COURT: All right. Those objections are overruled. 620B is received.
(Government's Exhibit 620B received in evidence)
MR. HOWARD: Mr. Yum, could you please explain what is depicted here?
ILHWAN YUM: So you see a pie chart in there, and the biggest, red part has the 700,254 bitcoins that I correctly identified coming from Silk Road Marketplace and being transferred to the addresses found on the defendant's laptop.
I didn't stop there. I went back and analyzed all the addresses on the defendant's laptop. And I've also found 89,000 other bitcoins that were sent to the addresses that were found on the defendant's laptop.
So to, I guess, give you a summary of what I just said, the defendant's -- addresses found on the defendant's laptop received a total of almost 790,000 bitcoins, and out of that 88 -- almost 89 percent were bitcoins that were transferred from the Silk Road Marketplace directly to the defendant's laptop in the amount of 700,254 bitcoins.
MR. HOWARD: When you say "directly," you mean one-to-one transfers, correct?
ILHWAN YUM: One-to-one transfers.
So that 89,854, it could have came from other sources but it could have also --