Case 1:15-cr-00088-SJ Document 65 Filed 10/16/15 Page 1 of 33 PageID #: 264 1 UNITED STATES DISTRICT COURT EASTERN DISTRICT OF NEW YORK - - - - - - - - - - - - - X UNITED STATES OF AMERICA, -against- ADAMOU DJIBO, Defendant. : : : : : : : : : : : : : 15-CR-00088(SJ) United States Courthouse Brooklyn, New York Thursday, September 3, 2015 9:30 a.m. - - - - - - - - - - - - - X TRANSCRIPT OF CRIMINAL CAUSE FOR HEARING BEFORE THE HONORABLE STERLING JOHNSON, JR. UNITED STATES SENIOR DISTRICT JUDGE A P P E A R A N C E S: For the Government: KELLY T. CURRIE, ESQ. United States Attorney Eastern District of New York 271 Cadman Plaza East Brooklyn, New York 11201 BY: KAREN L. KONIUSZY, ESQ. Assistant United States Attorney For the Defendant: Court Reporter: LAW OFFICE OF ZACHARY MARGULIS-OHNUMA 260 Madison Avenue 18th Floor New York, New York 10016 BY:ZACHARY MARGULIS-OHNUMA, ESQ. VICTORIA A. TORRES BUTLER, CRR 225 Cadman Plaza East/Brooklyn, NY 11201 VButlerRPR@aol.com Proceedings recorded by mechanical stenography, transcript produced by Computer-Aided Transcription. VB OCR CRR Case 1:15-cr-00088-SJ Document 65 Filed 10/16/15 Page 2 of 33 PageID #: 265 Proceedings 2 1 (In open court.) 2 (Judge STERLING JOHNSON, JR. is in the courtroom.) 3 THE COURTROOM DEPUTY: 4 THE COURT: 5 MS. KONIUSZY: U.S. versus Djibo. We have your guy on the stand? Yes. Last time we were here, one 6 month ago for the second appearance, the defense expert 7 testified. 8 and defense counsel was unprepared to cross him at that time, 9 asked for Your Honor to give him another opportunity to come 10 back, said he needed time to consult with his own witnesses, 11 and we scheduled today's date specifically for the purposes of 12 giving him an opportunity to prepare cross and also today was 13 the date that he was told to bring any witnesses that he had. 14 They were supposed to testify today. 15 16 His direct exam lasted approximately ten minutes This is our third appearance on this suppression hearing. This has been going since early July. 17 THE COURT: 18 MS. KONIUSZY: 19 THE COURT: 20 MS. KONIUSZY: 21 David Bauer, B-A-U-E-R. 22 23 THE COURT: I am aware. I have been here. Thank you. Put your guy on the stand. The Government calls Special Agent You are still under oath, you remember that? 24 THE WITNESS: Yes. 25 MR. MARGULIS-OHNUMA: VB May I inquire? OCR CRR Case 1:15-cr-00088-SJ Document 65 Filed 10/16/15 Page 3 of 33 PageID #: 266 Bauer - cross - Margulis-Ohnuma 1 THE COURT: 3 You may. 2 CROSS EXAMINATION 3 BY MR. MARGULIS-OHNUMA: 4 Q Have you and I ever spoken before? 5 A We have not. 6 Q You are -- testified last time that you were an expert 7 in, I think the field was forensic computers? 8 9 THE COURT: No, he did not testify as an expert. I qualified him as an expert. 10 MR. MARGULIS-OHNUMA: Forgive me, Your Honor. 11 Q 12 a forensic computer examiner. 13 A Sure. 14 Q You do not have any certifications in that field; is that 15 correct? 16 A That's not. 17 Q What certifications do you have, sir? 18 A I believe I mentioned on the resume that I provided. 19 don't keep them all current, although I've had an IACIS 20 certification, which is a certification offered by one of the 21 vendors that manufactures one of the suites we use, very 22 commonly used. 23 Let me ask you a little bit about your qualifications as Am I saying that right? I I've also held A plus certification in the past and 24 still do, which is computer hardware-software. 25 ones I'm trying to think of. VB Number other BlackBag Technologies is a OCR CRR Case 1:15-cr-00088-SJ Document 65 Filed 10/16/15 Page 4 of 33 PageID #: 267 Bauer - cross - Margulis-Ohnuma 4 1 company that offers certification in a product called 2 BlackLight, which is something we commonly use with Apple 3 devices. 4 Q 5 particular software or hardware devices; right? 6 A So far that I've mentioned, yes. 7 Q And those are offered by the manufacturers of those 8 devices; correct? 9 A 10 Sir, am I correct that those are all certifications on With the exception of the A plus certification. There are others that I am trying to -- 11 THE COURT: You talk too fast. 12 THE WITNESS: Okay. 13 Q The A plus certification you ask guy in July of 2003; 14 correct? 15 A That's correct. 16 Q Have you renewed that since? 17 A That is actually a permanent certification or at least it 18 was at that time. 19 Q 20 time in 2003; correct? 21 A 22 that I went through in my general forensic training, that 23 certification is a particular requirement. 24 not required to test for it, because I had already gotten the 25 certification, I actually went through the training again also But it's based on the information technology as of that Actually, let me correct myself. VB OCR As part of the program CRR So although I was Case 1:15-cr-00088-SJ Document 65 Filed 10/16/15 Page 5 of 33 PageID #: 268 Bauer - cross - Margulis-Ohnuma 5 1 in 2012. 2 Q 3 software; correct? 4 A That's correct. 5 Q Now aside from that, would you agree with me that the 6 leading certification in this field is offered by, not by a 7 manufacturer, but by the International Society of Forensic 8 Computer Examiners? 9 A Okay. And that is generally on computer hardware and There are actually a quite a number of credentials out 10 there so I would not agree to any one in particular. I think 11 they all offer some benefit, but, no, I would not. 12 Q 13 certified in any general certification as opposed to one that 14 is for a particular platform; correct? 15 A 16 called advanced computer evidence recovery training. 17 offered at the Federal Law Enforcement Training Center. But you don't have any -- you haven't been recently Actually, just in July I went through a program which is 18 THE COURT: 19 THE WITNESS: It was In Glynco? Exactly. 20 A And that is a program offered about once a year to us, so 21 that covers a pretty broad base of topics. 22 Q 23 correct? 24 A 25 involved, which are pass/fail. And that's training but that's not a certification; That's correct, although there are some practicals VB OCR CRR Case 1:15-cr-00088-SJ Document 65 Filed 10/16/15 Page 6 of 33 PageID #: 269 Bauer - cross - Margulis-Ohnuma 1 Q 2 certification you mentioned, there's actually two levels of 3 BlackLight certification that are available; am I correct 4 about that? 5 A 6 which is Certified BlackLight Examiner. 7 Q 8 as Defendant's Exhibit B, and see if that refreshes your 9 recollection at all. 10 THE COURT: 11 And, in fact, with respect to the BlackLight The only one that I am aware of is the CBE certification Right. Let me hand you, I'll mark it for identification Sustained. Did not say recollection needed refreshing. 12 13 MR. MARGULIS-OHNUMA: Q Okay. Is there anything -- withdrawn. 14 As an expert in the field of forensic analysis, you 15 keep up to date generally on what certifications are 16 available; correct? 17 A I do. 18 Q Okay. 19 recollection as to the two different certifications that 20 BlackBag Technologies offers? 21 A 22 6 So is there anything that might help reflect your No, not particularly. MR. MARGULIS-OHNUMA: Your Honor, I do not, because 23 of the situation with our expert, I'm not sure I am going to 24 have my own witness to offer this. 25 him and ask him if it is the sort of thing that he, as on VB OCR I would like to show it to CRR Case 1:15-cr-00088-SJ Document 65 Filed 10/16/15 Page 7 of 33 PageID #: 270 Bauer - cross - Margulis-Ohnuma 7 1 expert in the field, relies on. 2 from the BlackBag Technologies's website and reveal that 3 there's two different certifications, one for certified 4 BlackLight examiner and one specific to IOS certified 5 forensic -- 6 MS. KONIUSZY: 7 THE COURT: 8 testifying yourself. 9 10 I object to this. I am going sustain and you are MR. MARGULIS-OHNUMA: Sorry. I didn't understand what the objection was to. 11 12 It is, and I will proffer THE COURT: a question. 13 You are testifying. You were not asking You have to ask a question of the witness. MR. MARGULIS-OHNUMA: Right. I would like to ask 14 permission to show him the BlackBag Technologies's website and 15 see if he can comment on it. 16 17 THE COURT: MR. MARGULIS-OHNUMA: MS. KONIUSZY: We never received copies of any of 21 this in advance. 22 copy of our own Exhibit -- 23 25 That's marked for identification as Defense Exhibit B. 20 24 Go ahead, show it to him. 18 19 Comment on it? I don't know what this is. THE COURT: We would like a He is showing it to you. evidence. (Pause in the proceedings.) VB OCR CRR It is not in Case 1:15-cr-00088-SJ Document 65 Filed 10/16/15 Page 8 of 33 PageID #: 271 Bauer - cross - Margulis-Ohnuma 8 1 A Thank you. Okay. 2 Q Sir, after looking at Defense Exhibit B, does that in any 3 way help you understand that there's also a more particular, 4 more advanced, certification for BlackLight on IOS-specific 5 devices? 6 A Let me just look again, if you would. 7 I can see that there are two certifications offered, 8 yes. I have the former and not the latter. I'm not sure how 9 it's relevant to this particular matter because this software 10 wasn't used in this particular case, but there are a lot of 11 manufacturers that offer a lot of different certifications and 12 while -- 13 14 THE COURT: We have a court reporter here, have mercy. 15 THE WITNESS: Okay. Sorry about that. 16 A There are a lot manufacturers that offer a lot of 17 different certifications and while I keep tabs on most of 18 them, or as many as them as possible, I certainly am not aware 19 of them all. 20 Q 21 generalist, you don't -- your expertise is not specific to 22 IOS, like that particular certification is; is that right? 23 A 24 that's a fair question, sure. 25 Q Is the reason for that because you're more of a I wouldn't say that I'm a specialist in any one area, so So, let's talk about what you relied on and reviewed in VB OCR CRR Case 1:15-cr-00088-SJ Document 65 Filed 10/16/15 Page 9 of 33 PageID #: 272 Bauer - cross - Margulis-Ohnuma 1 9 preparing for you testimony in this proceeding. 2 What can you -- can you just go over with us, what 3 did you look at to prepare for this? 4 A 5 experience with the particular device in question. 6 technical -- 7 Q Let me stop you there. 8 A Well, I believe the device in question here is the IP-BOX 9 that was referenced in my earlier testimony. I consulted with other examiners that have some 10 Q 11 withdrawn. Experience with which device? So was it -- was your testimony actually based on -- 12 Did you have any experience yourself with IP-BOX 13 prior to preparing for this proceeding? 14 A I did. 15 Q What else did you rely on? 16 17 I read a THE COURT: Just a second. How many versions of the IP-BOX are there? 18 THE WITNESS: Well, it's actually a piece of 19 hardware and there are different versions of software that you 20 can update the hardware with. 21 different versions and they built on the previous one. 22 THE COURT: 23 Q 24 prepare? 25 A To my knowledge, there's three Okay. What else did you look at or what else did you do to I believe I mentioned consultation with other examiners. VB OCR CRR Case 1:15-cr-00088-SJ Document 65 Filed 10/16/15 Page 10 of 33 PageID #: 273 Bauer - cross - Margulis-Ohnuma 1 There is a single technical paper out there that I am aware 2 of, which I have also read, and I've also done some my own 3 testing. 4 Q What's that single technical paper? 5 A I don't recall the exact title off the top of my head, 6 but it's something to effect of IP-BOX breaking simple pass 7 codes on IOS devices. 10 8 THE COURT: 9 The phone that you worked on, what was the operating 10 system for that phone, do you know? 11 12 Just a second. THE WITNESS: I do. All Apple iPhones use what they call IOS. 13 THE COURT: What is the version of the IOS? 14 THE WITNESS: 15 THE COURT: 16 MR. MARGULIS-OHNUMA: It was 8.1.2. 8.1.2, okay. Your Honor, I'll get right to 17 it. Obviously you're ahead me. 18 Q And according to the published literature, IP-BOX 19 requires an adapter to work with anything higher than 8.0.0; 20 correct? 21 A 22 that's correct. 23 Q 24 actually does not, is not compatible with 8.1.2; isn't that a 25 fact? Actually, I believe it's 8.1.1, but there is an adapter; Right. And according to the published literature, it VB OCR CRR Case 1:15-cr-00088-SJ Document 65 Filed 10/16/15 Page 11 of 33 PageID #: 274 Bauer - cross - Margulis-Ohnuma Actually, no, that is not a fact. 11 1 A 2 literature, and again the only document that I see available, 3 says that it should, in fact, work. 4 Q And that's a document by a police officer -- withdrawn. 5 Can you produce that? 6 A 7 for you. Do you have that? I don't have it with me, but I can certainly produce it 8 9 The published MR. MARGULIS-OHNUMA: I would ask for production of that since he relied on it for his opinion. 10 Q You said you did testing of your own; right? 11 A I have. 12 Q And did you test on Mr. Djibo's iPhone? 13 A I did not. 14 Q So, you don't know whether it would actually work on 15 Mr. Djibo's iPhone or not, because you didn't test it; right? 16 A 17 test it on his iPhone because, as it was presented to me, it 18 is already unlocked. Well, actually, I would not have had the opportunity to 19 That is first. Secondly -- 20 Q 21 a little bit. 22 Wait. Can I stop you right there? Let's break that down When you say it was unlocked, you mean the pass code 23 had been removed by somebody? 24 A I believe that's the case, yes. 25 Q Do you know who removed the pass code? VB OCR CRR Case 1:15-cr-00088-SJ Document 65 Filed 10/16/15 Page 12 of 33 PageID #: 275 Bauer - cross - Margulis-Ohnuma 12 1 A I don't. 2 Q But you have the pass code for Mr. Djibo's iPhone; right? 3 A Yes. 4 an unlocked form. 5 in order to test it. 6 modify evidence. 7 getting to. 8 Q 9 somebody modified it to remove that pass code, so it was Either it was given to me, or it was presented in But either way, I wouldn't modify the phone I wouldn't change the pass code and So that was really the other reason I was But you are saying somebody did before you got the phone, 10 unlocked when you got it. 11 A Is that what -- I understand it -- 12 MS. KONIUSZY: 13 THE COURT: 14 MS. KONIUSZY: 15 THE COURT: 16 THE WITNESS: 17 THE COURT: Objection. What is the objection? It's a compound question. Did you understand the question? I did. Overruled. 18 A I'm saying that it was either unlocked when presented to 19 me, or I was presented the phone with the pass code. 20 either case, I could access the contents of the phone. 21 Q Okay. 22 A Correct. 23 Q Okay. 24 way have prevented from you testing IP-BOX on that phone; 25 right? In You just don't remember either way? So, there's nothing about that that would in any VB OCR CRR Case 1:15-cr-00088-SJ Document 65 Filed 10/16/15 Page 13 of 33 PageID #: 276 Bauer - cross - Margulis-Ohnuma 1 A 2 for me to test the phone, I would have to re-enable the 3 security settings in the device that would require a pass 4 code, which would modify the contents of that device. 13 Well, you wouldn't do that because, for me to do that, 5 You just wouldn't do that. 6 forensically sound. 7 Q 8 right? 9 A Okay. That's just not But you don't remember if that was the situation; What I'm saying is, I wouldn't have tested it either way 10 in that fashion. 11 Q 12 answer and ask you not to speculate as to what happened. 13 want to just know what you remember or don't remember. I'm going to ask you -- I am going to have to strike that I 14 Okay. So if you can just let us know if you don't 15 remember, can you do that? 16 A I'm sorry. I don't understand the question. 17 Q All right. You don't -- what I think you testified to, 18 tell me if this is correct, is that you don't remember whether 19 it came to you unlocked with the pass code removed -- 20 THE COURT: 21 MR. MARGULIS-OHNUMA: 22 Q 23 phone. 24 unlocked; correct? 25 A Asked and answered. Asked and answered. Okay. Again, I'm trying to understand why you didn't test the It had nothing to do with whether or not it was May I explain? VB OCR CRR Case 1:15-cr-00088-SJ Document 65 Filed 10/16/15 Page 14 of 33 PageID #: 277 Bauer - cross - Margulis-Ohnuma 1 Q Sure. 2 A Okay. 3 which you would be doing if you were to re-enable the pass 4 code on the phone. 5 device, because if I were to do that, I would be modifying 6 evidence. 7 14 You would not modify a person's phone in any way, I wouldn't make changes to a user's I am not willing to do that. As far as testing a phone in that particular 8 configuration, you are correct, that I can't do that simple 9 because I don't have an exemplar phone, i.e, a nonevidentiary 10 device that is an iPhone 5 running that particular version of 11 the software. 12 What I can tell you are two things: One, I have 13 spoken with other examiners who have actually broken pass 14 codes on phones that have operating systems that are more 15 recent than this particular version that we are talking about 16 in your client's phone. 17 secure and more difficult to break into. 18 Those versions would arguably be more So I have that. The other thing is, there's actually some new 19 information that's been released since my last testimony that 20 would have also provided another option to get into this 21 phone, which we just found out about recently. 22 Q 23 break it down. 24 A Sure. 25 Q So if I understood your answer, Agent Bauer, directly at Okay. Sorry, there was a lot there and I want to try to VB OCR CRR Case 1:15-cr-00088-SJ Document 65 Filed 10/16/15 Page 15 of 33 PageID #: 278 Bauer - cross - Margulis-Ohnuma 15 1 the beginning I think you said that you wouldn't have done the 2 testing because that could have somehow affected the evidence, 3 it could have spoliated the evidence; is that correct? 4 A 5 phone; that's correct. 6 Q Because that phone cause evidentiary; right? 7 A Correct. 8 Q And then you said that you spoke to others who have 9 successively broken into other iPhones; is that correct? I would not have done the testing on this particular 10 A That's correct. 11 Q Who are those people you spoke to? 12 A I don't recall the names offhand, but they are other 13 examiners like myself. 14 Q Okay. 15 And did they demonstrate -- withdrawn. Did they say that they had used IP-BOX to do that? 16 A Yeah, I can recall specifically that one was able to 17 access a device running version 8.1.3. 18 an iPhone 4s. 19 I believe that was on Also, another that was able to access a phone 20 running the current version 8.4, or the current major version, 21 at least. 22 Q 23 that person's name? 24 A No, I do not, not offhand. 25 Q Was that a Government employee? So, the first person you spoke to, you can't remember VB OCR CRR Case 1:15-cr-00088-SJ Document 65 Filed 10/16/15 Page 16 of 33 PageID #: 279 Bauer - cross - Margulis-Ohnuma 1 A Not a Federal Government employee. 2 enforcement person. 3 Q And did they show you that or how did you -- 4 A No, this was not a local person. 5 Q Was that person a certified forensic examiner? 6 A I don't know. 7 of some sort, but I don't have their exact credentials. 8 Q It was a local law They were in a computer forensics division And -- sorry. 9 10 16 As an expert in the field, do you typically rely -withdrawn. 11 And then someone else told that you they used -- 12 sorry -- that they were able to break into 8.4; is that right? 13 A That's correct. 14 Q And what kind phone was that on? 15 A That was on an iPhone 5s, I believe. 16 Q That's a more advanced phone than the iPhone 5 here; 17 right? 18 A Correct. 19 Q And the first one you said was actually less advanced 20 hardware than the 5, right, 4s? 21 A The 4s precedes the 5; that's correct. 22 Q So in both cases they are different configurations from 23 the phone here; right? 24 A Well, yes, that's correct. 25 Q You've answered the question. VB OCR And you will find -- CRR Case 1:15-cr-00088-SJ Document 65 Filed 10/16/15 Page 17 of 33 PageID #: 280 Bauer - cross - Margulis-Ohnuma 17 1 A Okay. 2 Q So, with the second person, what was that person's name? 3 A I don't have names offhand, I'm sorry. 4 Q Was that person a U.S. Government employee? 5 A Not Federal Government, no. 6 for a prosecutor's office. 7 Q Which office was that? 8 A Local, I believe, Bergen County. 9 Q New Jersey? 10 A Correct. 11 Q Now, have you yourself ever broken into a phone with 12 IP-BOX? 13 A I have. 14 Q What version was that phone running? 15 A I believe an iPhone 4s running 7.0.something. 16 sure the exact version. 17 Q 18 little for websites regarding IP-BOX? 19 A Sure. 20 Q And did you see any website by the manufacturer of 21 IP-BOX? 22 A It's not a company that makes the box, so, no. 23 Q Well, if it's not a company, who makes the box? 24 A It's actually made in China by a single individual. 25 not a forensic tool. I believe this person worked Actually, I know they did. I'm not It clearly works on IOS 7 devices. In preparing for today's testimony, did you look around a VB OCR CRR It's Case 1:15-cr-00088-SJ Document 65 Filed 10/16/15 Page 18 of 33 PageID #: 281 Bauer - cross - Margulis-Ohnuma 18 1 Q What do you mean it's not a forensic tool? 2 A I mean it's not designed with forensic purposes in mind. 3 It's, probably my best description of it, honestly, would be 4 that it's a hacking tool. 5 Q 6 China that it obtains; right? 7 A I can't answer that question. 8 Q In order to use it, let's just go through a little bit 9 about how to use it. And, in fact, it sends some of the data back and forth to 10 You have to take the iPhone and pull off the screen; 11 right? 12 A That's not correct, no. 13 Q How do you use the version you are familiar with? 14 A Well, there's a couple different ways you can use it, but 15 basically the way the device works is it connects to the 16 phone, and as I think I described earlier, it attempts 17 guesses -- 18 Q Let me step you through it. 19 MS. KONIUSZY: 20 THE COURT: Objection. Sustained. You ask him a question then 21 you interrupt him. 22 A 23 numbers using a simple pass code, i.e., 0000 through 9999, and 24 what will happen when you successfully enter the pass code on 25 most iPhones is that you will get a change in the color, or Okay. Sustained. So, the device queries the phone with different VB OCR CRR Case 1:15-cr-00088-SJ Document 65 Filed 10/16/15 Page 19 of 33 PageID #: 282 Bauer - cross - Margulis-Ohnuma 1 rather the light. 2 actually are affixing a small light sensor to the surface of 3 that phone, not taking the screen off. 4 the sensor to the surface of the phone. 5 19 The screen contrast will change and you You're simply affixing When correct the guess is made, the sensor detects 6 the change in light, and basically, that's where the system 7 stops and the correct pass code is recorded. 8 Q 9 Every time you enter a pass code incorrectly, something Now, let's go back to the iPhone itself and how it works. 10 changes on the phone itself; correct? 11 A Ah -- 12 Q It's a yes or no answer. 13 quickly. 14 A 15 the numbers will shake slightly to let you know you've guessed 16 incorrectly. 17 Q 18 correct? 19 A In some cases, yes, and in some, no. 20 Q Okay. 21 to be records the guess as the security password; correct? 22 A That's correct. 23 Q So, I'm only going to talk about 8.1.2 on an iPhone 5; is 24 that okay? 25 A I'll try step you through The phone will flicker a bit. Right. In some versions basically But the phone itself records the incorrect guess; On the iPhone -- on an iPhone 5 running 8.1.2, the Sure. VB OCR CRR Case 1:15-cr-00088-SJ Document 65 Filed 10/16/15 Page 20 of 33 PageID #: 283 Bauer - cross - Margulis-Ohnuma 20 1 Q So, on that particular device, every time you guess, it 2 records the guess and it then increases the length of time 3 before it will respond to the next guess as a security 4 measure; is that correct? 5 A Somewhat, but it's not quite correct. 6 Q Tell me what's not correct. 7 A Basically, you're allowed five guesses, beginning with 8 8.1.1. Need to tell you. 9 From that point forward, you're correct in that 10 there's a time penalty that begins to be assessed. 11 lock you out for a temporary period. 12 It will As you continue up the ladder with the number of 13 incorrect guesses, that time penalty will increase and 14 eventually you get to the point where you can be essentially 15 locked out, although it's not a permanent thing. 16 that's what you're referring to? 17 Q 18 in your direct testimony you can be locked out for 43 years? 19 A 20 something similar; correct. 21 Q 22 automatically wipes the phone after ten incorrect guesses; 23 correct? 24 A That's correct. 25 Q And the purpose, the point of IP-BOX is to get around Yes. So I think It's not a permanent thing, but I think you told us There is a phone on my desk that has that situation or There's also a setting that the user can set where it VB OCR CRR Case 1:15-cr-00088-SJ Document 65 Filed 10/16/15 Page 21 of 33 PageID #: 284 Bauer - cross - Margulis-Ohnuma 1 that system you just described; isn't that right? 2 A It gets around one of them. 3 Q How is that? 4 A Actually, I should probably correct that. 5 21 Explain that to me. The adapter you mentioned, and I'm talking now 6 specifically about the temporarily getting locked out thing we 7 just discussed, the adapter will basically connect to the 8 phone and reboot the phone after a certain number of tries, 9 essentially wiping the slate clean, so to speak. So, that 10 that process can continue without the time penalty being 11 assessed. 12 Q 13 killing the power to the battery prior to it writing the 14 information to the flash memory, which is static; is that 15 correct? 16 A Essentially that's correct. 17 Q Let me break that down. All right. 18 And the adapter I mentioned does that by It's a little confusing. The iPhone has system memory and flash memory. 19 Those are two different things; correct? 20 A 21 knowledge, but there are different partitions of memory; 22 that's correct. 23 Q Which processor does this phone run? 24 A I don't know offhand. 25 Q Okay. All of the memory on the iPhone is flash memory, to my Well, it's the A7 or the A8, I think; isn't that VB OCR CRR Case 1:15-cr-00088-SJ Document 65 Filed 10/16/15 Page 22 of 33 PageID #: 285 Bauer - cross - Margulis-Ohnuma 22 1 right? 2 A I don't know offhand. 3 Q That processor itself has its own internal memory; 4 correct? 5 A Yes. 6 Q Okay. 7 fact that you did that is written to the processor's memory, 8 starting in 8.11; is that correct? 9 A That's correct. 10 Q And in that way the device you're talking about can't 11 defeat that unless it somehow cuts the power, because the 12 phone remembers that you have put in that number of password 13 attempts; isn't that correct? 14 A 15 repeat that, please? 16 Q 17 And when you put in an incorrect password, the I'm not quite sure I understand the question. Could you Yeah. In order for IP-BOX to work it has to interrupt -- 18 I'm not repeating it. I'm trying to rephrase. 19 A That's fine. 20 Q In order for IP-BOX to work, it has to interrupt the 21 phone's automatic writing of the fact that you entered an 22 incorrect password; isn't that correct? 23 A 24 to physically be attached to the phone with the cover off. 25 you're basically connecting it directly to the battery, and I didn't design the box. VB I do know that the adapter has OCR CRR So Case 1:15-cr-00088-SJ Document 65 Filed 10/16/15 Page 23 of 33 PageID #: 286 Bauer - cross - Margulis-Ohnuma 23 1 the reason for that is because it is cutting power, and 2 rebooting the phone essentially wiping that slate clean, as I 3 just described. 4 So, that's the reason that it's able to circumvent 5 the penalty you begin to incur after five wrong guesses. 6 Q 7 cover off to use that adapter, don't you? 8 A Correct. 9 Q And by the cover, you mean the actual screen; right? 10 A No. 11 Q But that separates the back from the screen, does it not? 12 A Actually, the back cover comes off quite easily on 13 iPhones. 14 access to the battery. 15 Q 16 to attach the adapter; right? 17 A Yes. 18 Q And in opening it up, there is some risk, is there not, 19 of damaging the hardware? 20 A 21 you could incur some form of risk in anything you do. 22 Q 23 we've been talking about? 24 A 25 device that I can test it on. So, for this particular phone, you do need to take the I mean the back cover. You remove two screws, slide it off, you have direct Okay. The screen remains intact. But, so you would have had to open it up in order I've never opened a phone and damaged it, but I'm sure Have you used the IP-BOX with this particular adapter I have not. And again, that's because I don't have a VB OCR CRR Case 1:15-cr-00088-SJ Document 65 Filed 10/16/15 Page 24 of 33 PageID #: 287 Bauer - cross - Margulis-Ohnuma 1 Q 2 wouldn't work for this phone higher than IOS 8; correct? 3 A 4 I would not, because again, in my discussion with other 5 examiners, I have actually, specifically the one I mentioned 6 that was able to bypass version 8.4, this person apparently 7 got into a phone running 8.4 without the adapter. 8 This is not an exact science. And you would agree that the IP-BOX, without the adapter, Actually, I haven't verified this independently, but no, 9 Q But you don't remember that person's name; right? 10 A Offhand, I don't. 11 Q Now, what is the, if not the manufacturer, what are the 12 seller's claim when they sell the adapter? 13 14 THE COURT: Where are we going with this line of questioning? 15 MR. MARGULIS-OHNUMA: 16 8.1.2, with this phone or not. 17 Whether it was compatible with I realize he just said based on some discussions in 18 his community that he thinks it is, but, I mean, I have a 19 website right here that says it's not. 20 prepared to testify it's not. 21 22 23 24 25 24 And I have an expert So I want to ask him about that and see if maybe he can harmonize it. THE COURT: Well, you have an expert who says that it is and you have a piece of paper that says it is not. MR. MARGULIS-OHNUMA: VB Right. OCR I'd like to confront CRR Case 1:15-cr-00088-SJ Document 65 Filed 10/16/15 Page 25 of 33 PageID #: 288 Bauer - cross - Margulis-Ohnuma 1 him with the piece of paper. 2 THE COURT: 3 MR. MARGULIS-OHNUMA: 4 You have already done that. This is a different piece of paper. 5 THE COURT: 6 MR. MARGULIS-OHNUMA: 7 25 Let's wind it up. I have nothing further except to confront him with this, Your Honor. 8 THE COURT: Have you confronted him with it? 9 MR. MARGULIS-OHNUMA: 10 THE COURT: 11 MR. MARGULIS-OHNUMA: 12 Government, just so I'm ready. 13 No, I have not. Confront him then. I'll give a copy to the So I've marked as Defendant's Exhibit A for 14 identification a printout of a website entitled GSM Server 15 that purports to sell IP-BOX adapter for IOS 8. 16 BY MR. MARGULIS-OHNUMA: 17 Q You want to take a look at that, sir? 18 A Sure. 19 Q And so you are familiar with this one? 20 A I am. 21 Q Okay. 22 -- these claims by sellers are the kind of thing that you rely 23 on to form your opinion; isn't it? 24 A No, not necessarily. 25 Q You don't rely on claims by sellers? Yes, I have seen it. And would you agree with me -- actually, is this VB OCR CRR Case 1:15-cr-00088-SJ Document 65 Filed 10/16/15 Page 26 of 33 PageID #: 289 Bauer - cross - Margulis-Ohnuma 1 A 2 them. 3 Obviously, I am limited in that ability here. I would certainly consider them, but I don't rely on To the best of my ability, I do my own testing. 4 I'm aware that this paper you're presenting me with 5 says that it's supported in certain versions and not in 6 others. 7 8 I am also aware that only company that I'm aware of that sells the adapter -- 9 10 THE COURT: Just a second. Have you marked that as an exhibit? 11 MR. MARGULIS-OHNUMA: Yes, Defendant's Exhibit A. 12 Since he's familiar with it, I would like to move it into 13 evidence, Your Honor. 14 THE COURT: 15 MR. MARGULIS-OHNUMA: 16 And just Defendant's Exhibit A? Correct. I'll give a copy to the Court. 17 THE COURT: 18 MS. KONIUSZY: 19 MR. MARGULIS-OHNUMA: 20 26 Have you seen it, Counsel? We're just looking at it now. Sorry, did the Court have a question? 21 THE COURT: No, I am waiting for an objection. 22 Do you have any objection to it? 23 MS. KONIUSZY: Yes, Your Honor. We don't have a 24 problem with him questioning the witness on it, but we object 25 to moving it into evidence. VB This isn't even a complete OCR CRR Case 1:15-cr-00088-SJ Document 65 Filed 10/16/15 Page 27 of 33 PageID #: 290 Bauer - redirect - Koniuszy 1 document. 2 certainly doesn't encapsulate the full website. 3 that -- 27 It's only a fragment of the print-off. 4 THE COURT: 5 MS. KONIUSZY: 6 BY MR. MARGULIS-OHNUMA: 7 Q 8 reviewed; correct, sir? 9 A It Even the page Sustained. Thank you. Is this one of the -- this is one of the things that you In some form, yes. I've seen this in different areas, 10 but yes, that's correct. 11 Q 12 very specific that it is not compatible with anything higher 13 than 8.1.0; correct? 14 A And when you say this advertisement for the device is I understand -- excuse me. 15 That's correct that that's what it said here, yes. 16 Q 17 could have gotten to, was higher than 8.1.1; correct? 18 A 19 20 Okay. And the phone that you examined that you claim you Yes. MR. MARGULIS-OHNUMA: Nothing further for this witness, Judge. 21 THE COURT: 22 MS. KONIUSZY: 23 REDIRECT EXAMINATION 24 BY MS. KONIUSZY: 25 Q Any redirect? Very briefly, Your Honor. Special Agent Bauer, I believe on cross you were asked VB OCR CRR Case 1:15-cr-00088-SJ Document 65 Filed 10/16/15 Page 28 of 33 PageID #: 291 Bauer - redirect - Koniuszy 1 what the basis was for your conclusions, and you had started 2 to name a number different sources that you had consulted. 3 28 Do you recall that? 4 A Yes. 5 Q I think you got cut off before you finished. 6 In addition to the consultation with other examiners 7 and the paper you mentioned, and your own testing, did you 8 consult with anyone else about the IP-BOX? 9 A I consulted with the author of the only technical paper 10 I'm aware of, which is the one I mentioned. 11 Q 12 running the IOS 8.1.2 version? 13 A I did. 14 Q And was there anyone else that you discussed the specific 15 capabilities of the IP-BOX with respect to the defendant's 16 specific phone? 17 A 18 no, but those 3 combined, yes. 19 Q And you said you conducted your own testing as well? 20 A I did. 21 Q And that was on an iPhone device; correct? 22 A That's correct. 23 had success with one. 24 with other exemplar devices. 25 the pool of what we have available. And did you consult specifically about the iPhone 5 Other than the two examiners that I mentioned earlier, And in terms of real world devices, I've I've also done and had some success VB Again, we are pretty limited by OCR But I've had some varied CRR Case 1:15-cr-00088-SJ Document 65 Filed 10/16/15 Page 29 of 33 PageID #: 292 Bauer - recross- Margulis-Ohnuma 29 1 success in that regard as well. 2 Q 3 research and all of your own testing, in your expert opinion 4 would this defendant's iPhone be able to be cracked, using the 5 IP-BOX? 6 A 7 apparently, from other examiners. And based on the collective results of all of your Yes. 8 9 10 It could be done and it actually has been done, I've also seen videos of it being done online, although I'm pretty reluctant to cite YouTube video, I have seen it, and that's about it. 11 MS. KONIUSZY: 12 THE WITNESS: Thank you. Thank you. 13 RECROSS EXAMINATION 14 BY MR. MARGULIS-OHNUMA: 15 Q 16 using IP-BOX yourself, you had quote, unquote, varied success 17 with earlier versions of the phone; is that correct? 18 A Yes. 19 Q So sometimes it actually did not work; is that right? 20 A Yes. 21 Q How often did it work and how often did it not work? 22 A I couldn't really give you an exact ratio. 23 you it's very finicky. 24 that I did, I was attempting to do, and had it fail in the 25 first try. I think you just testified that you had -- when you were I can tell For example, the one real world phone The second try it worked just fine. VB OCR CRR Case 1:15-cr-00088-SJ Document 65 Filed 10/16/15 Page 30 of 33 PageID #: 293 Bauer - recross- Margulis-Ohnuma 1 30 That's attributable to a number different factors. 2 One, placement of the light sensor seems to make a big 3 difference. 4 The other is, there is a window in which the phone 5 can consider potential correct guesses as the password. 6 you have to actually set the software of the IP-BOX to time 7 that accordingly. 8 when the open window is. 9 And So you're basically taking a best guess at Generally, from my understanding, that time period 10 has been roughly 4500 to 7,000 milliseconds, 4-and-a-half to 7 11 seconds. 12 correct in your guess, but you're fairly accurate. 13 And you're obviously not going to be completely What can happen, as this process continues, is if 14 you're off by a little bit in the beginning and going through 15 10,000 numbers, you'll be off by quite a bit more towards the 16 end. 17 that's off, off beat by a little bit with the band, you know. 18 Maybe not so noticeable at first, but by the end of that 19 process, quite a bit so. 20 that the box could actually come up with the correct number 21 and yet not realize it, because it's missed the window. 22 Q 23 with IP-BOX? 24 A One, as I mentioned. 25 Q And how many test phones have you tested with IP-BOX? Sort of like a drummer, I guess, would be a good analogy And if that happens, it's possible So, how many real world phones have you actually tested VB OCR CRR Case 1:15-cr-00088-SJ Document 65 Filed 10/16/15 Page 31 of 33 PageID #: 294 Proceedings 31 1 A We have two exemplar devices in the lab and I have 2 probably run tests on them five to ten times. 3 Q 4 in with IP-BOX? 5 A Yes. 6 Q But sometimes the device failed; right? 7 A Yes. 8 Q And if it had been -- withdrawn. And were you able, on all three of these, to actually get 9 And none of those exemplars were running 8.1.2; 10 correct? 11 A No. 12 THE COURT: You can step down. 13 THE WITNESS: 14 (Witness excused.) 15 THE COURT: 16 MR. MARGULIS-OHNUMA: Thank you. You have a witness? Your Honor, I do. 17 here. I'd like to be heard at side-bar about that. 18 write a letter to the Court about that. 19 heard at side-bar about that. 20 21 THE COURT: morning? I did I would like to be It refers to CJA resources. That's what we got off the ECF this Last night you wrote it? 22 MR. MARGULIS-OHNUMA: 23 THE COURT: 24 MR. MARGULIS-OHNUMA: 25 They're not That's correct. And he's not here. When can he be here? I don't know. He was prepared to come today, but was not willing to, because of the CJA VB OCR CRR Case 1:15-cr-00088-SJ Document 65 Filed 10/16/15 Page 32 of 33 PageID #: 295 Proceedings 1 issue. 2 3 Possibly he will be. THE COURT: 32 I could speak to him now. Well, I am not going to wait around for him to come. 4 MR. MARGULIS-OHNUMA: No, I would suggest that -- 5 well, we have to resolve the CJA issue first, and if it's 6 resolved, I would suggest that we set it for maybe sometime 7 early next week and hopefully we can get him here. 8 THE COURT: 9 MS. KONIUSZY: 10 What is a good day next week? for me. 11 THE COURT: 12 MS. KONIUSZY: 13 Whenever is good for you. THE COURT: 15 MS. KONIUSZY: 17 18 19 20 Yes. We're available any day the week of September 28th. THE COURT: We will be on trial, but let's get a -- let's put it down, see how we work it out the 28th. THE COURTROOM DEPUTY: Put it down for that Thursday or Friday, October 1st. 21 THE COURT: 22 MS. KONIUSZY: 23 Could I just check my calendar for one minute, please? 14 16 Your Honor, next week doesn't work Put it on October 1st, Ana. Your Honor, I will just note that this is now going to be our fourth appearance. 24 THE COURT: I understand that. 25 MR. MARGULIS-OHNUMA: VB Your Honor, I'm not available. OCR CRR Case 1:15-cr-00088-SJ Document 65 Filed 10/16/15 Page 33 of 33 PageID #: 296 33 Proceedings 1 I have a Second Circuit oral argument that morning. 2 it in the afternoon that day. 3 4 THE COURT: Let's get another day. I want to do it in the morning and get it over with. 5 The next day? 6 THE COURTROOM DEPUTY: 7 MR. MARGULIS-OHNUMA: 8 THE COURT: 9 THE COURTROOM DEPUTY: Friday the 7th? Yes, that's fine, Judge. Okay. 10 THE COURT: 11 MR. MARGULIS-OHNUMA: 12 We can do At 9:30. Get a CJA form for him. We have one prepared, Your Honor. 13 THE COURT: Okay. Thank you. 14 ALL: 15 (Matter concluded.) Thank you, Your Honor. 16 17 oooOooo 18 19 20 21 22 23 24 25 VB OCR CRR I certify the foregoing is a correct transcript from the record of proceedings in the above-entitled matter. /s/ Victoria A. Torres Butler September 15, 2015