IN THE UNITED STATES DISTRICT COURT FOR THE EASTERN DISTRICT OF CALIFORNIA BEFORE THE HONORABLE KIMBERLY J. MUELLER, JUDGE ---o0o--UNITED STATES OF AMERICA, Plaintiff, vs. No. 2:13-CR-00082 MATTHEW KEYS, Volume 4 Pages 471 through 624 Defendant. / ---o0o--REPORTER'S TRANSCRIPT OF PROCEEDINGS JURY TRIAL VOLUME 5 FRIDAY, OCTOBER 2, 2015, 8:30 A.M. ---o0o--- For the Government: BENJAMIN B. WAGNER, U.S. ATTORNEY 501 I Street, Suite 10-100 Sacramento, California 95814 BY: MATTHEW DEAN SEGAL and PAUL ANDREW HEMESATH Assistant United States Attorneys (Appearances continued next page...) Reported by: KATHY L. SWINHART, CSR #10150 Official Court Reporter, 916-446-1347 501 I Street, Room 4-200 Sacramento, California 95814 Proceedings reported by mechanical stenography, transcript produced by computer-aided transcription. 1 APPEARANCES (Continued) 2 For the Government: UNITED STATES DEPARTMENT OF JUSTICE Computer Crime and Intellectual Property Section 1301 New York Avenue NW, Suite 600 Washington, D.C. 20530 BY: JAMES ANTHONY SILVER Deputy Chief For the Defendant: LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 BY: JASON SCOTT LEIDERMAN 3 4 5 6 7 8 9 10 11 TOR EKELAND, P.C. 195 Plymouth Street, Fifth Floor Brooklyn, New York 11201 BY: TOR EKELAND and MARK H. JAFFE 12 13 14 15 16 17 18 19 20 21 22 23 24 25 KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 1 INDEX 2 GOVERNMENT'S WITNESSES: PAGE: 3 4 SAM COHEN 5 DIRECT EXAMINATION (Cont'd) BY MR. HEMESATH CROSS-EXAMINATION BY MR. JAFFE REDIRECT EXAMINATION BY MR. HEMESATH RECROSS-EXAMINATION BY MR. JAFFE 6 474 475 482 483 7 8 JASON JEDLINSKI 9 DIRECT EXAMINATION BY MR. SEGAL CROSS-EXAMINATION BY MR. EKELAND REDIRECT EXAMINATION BY MR. SEGAL 10 486 521 526 11 ALAN SCHMIDT 12 DIRECT EXAMINATION BY MR. SILVER 529 13 14 JOHN CAUTHEN 15 DIRECT EXAMINATION BY MR. SILVER 556 16 17 18 19 20 21 22 23 24 25 KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 1 2 GOVERNMENT'S EXHIBITS RECEIVED IN EVIDENCE NO.: DESCRIPTION: PAGE: 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 128 130 131 204 205 206 thru 232 307 503 504 505 507 508 602 603 605 606 607 608 609 610 611 614 615 616 901 903 904 E-mail dated 12/14/10 E-mail, 12/14/10, 10:22 p.m. E-mail, 12/14/10, 10:23 p.m. Keys written statement Keys annotation of logs Portions of Keys statement dated 10/04/12 514 552 552 573 578 563 Assembler log entries Screenshot from Keys computer Screenshot from Keys computer Screenshot from Keys computer Screenshot from Keys computer Screenshot from Keys computer IRC chat IRC chat IRC chat IRC chat IRC chat IRC chat IRC chat IRC chat IRC chat IRC chat IRC chat IRC chat Records from Yahoo Records from AT&T Records from Overplay 588 588 588 588 588 588 588 588 588 588 588 588 588 588 588 588 588 588 588 588 588 18 19 20 21 22 23 24 25 KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 471 1 SACRAMENTO, CALIFORNIA 2 FRIDAY, OCTOBER 2, 2015, 8:39 A.M. 3 ---o0o--- 4 (Jury not present.) 5 THE CLERK: 6 States versus Matthew Keys. 7 today is day five. 8 THE COURT: Good morning. 9 MR. SEGAL: Good morning, Your Honor. 10 MR. EKELAND: 11 THE COURT: 12 13 14 present. Good morning, Your Honor. All counsel are present. Just a few questions from the Court. Agent Cauthen is Is the power point now in a form that it's eliminated all objections? MR. EKELAND: 16 THE COURT: 17 MR. EKELAND: 18 MR. SILVER: 20 This is on for jury trial, and Mr. Keys is present. 15 19 Calling criminal case 13-82, the United Yes, Your Honor. All right. Except for -There is an extending Cancer Man objection from the defense I think still. THE COURT: All right. All right. So I'll allow you 21 to note that objection, but otherwise the power point can be 22 used during Agent Cauthen's exam. 23 MR. SILVER: Yes, Your Honor, and with one note. I 24 think the defense has objected to it going back to the jury, so 25 I would ask the Court to advise the jury of that, and then I KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 472 1 can make notes of which exhibits are being referenced in the 2 power point if the jury would wish to take notes to help them 3 with their deliberations. 4 5 THE COURT: MR. EKELAND: 7 MR. SILVER: Yes. And there's one animation within the power point as well. 9 10 So it's a demonstrative essentially. 6 8 Got it. THE COURT: All right. And the defense has had a chance to review that? 11 MR. EKELAND: 12 THE COURT: Yes, Your Honor, we're fine with it. All right. In terms of excerpts, is the 13 defense requesting additional portions of that recording be 14 played? 15 16 MR. LEIDERMAN: Under the rule of completeness, we're requesting the whole recording be played. 17 THE COURT: 18 about that. 19 today. All right. So we'll need some time to talk We won't do that now, but we'll do it on a break 20 Agent Cauthen will go on today you think? 21 MR. SILVER: 22 THE COURT: It's likely, Your Honor, very likely. All right. Well, that portion won't be -- 23 you can work with the power point, but not the excerpts until 24 we resolve the completeness objection. 25 MR. SILVER: Your Honor, it was our plan to use the KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 473 1 audio first before the power point. 2 3 THE COURT: Well, we need to resolve the objections first. 4 MR. SILVER: 5 THE COURT: 6 Anything else we need to discuss before we bring the 7 8 9 jury in? Mr. Segal? MR. SEGAL: All right. So you just need to be flexible. Mr. Ekeland? Samantha Cohen -- there's just one thing that may help shorten things a little bit. Samantha Cohen gave 10 us, and the defense has marked, a chat conversation between 11 Samantha Cohen and Matthew Keys that occurred in December 2012. 12 In it, Keys talks about, you know, the event and -- and other 13 hackers and prosecutions and media reports about it. 14 offering it, and if offered by the defendant, it's hearsay and 15 not subject to any, you know, relevancy certainly when he's 16 talking about things two years after the fact. 17 18 We're not So I don't know if the defense is planning on offering that exhibit, but -- 19 THE COURT: What's the exhibit identifier? 20 MR. SEGAL: It's defense -- 21 THE COURT: Is it now added -- 22 MR. JAFFE: Your Honor, I could save the time. 23 24 25 The defense was not planning on introducing that, Your Honor. THE COURT: All right. Let's bring Ms. Cohen in, and we'll bring the jury in. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 474 1 (Jury present.) 2 THE COURT: 3 and Gentlemen of the jury. 4 morning. 5 6 Welcome back, Ladies We're ready to go again this We had a little bit of housekeeping this morning. So at this point we will continue with the direct examination of Ms. Cohen. 7 SAM COHEN, GOVERNMENT'S WITNESS, PREVIOUSLY SWORN 8 9 You may be seated. THE COURT: Ms. Cohen, you were sworn yesterday. continue to testify subject to that oath. 10 THE WITNESS: 11 THE COURT: 12 MR. HEMESATH: 13 You Understood? Yes. All right. Mr. Hemesath. Thank you, Your Honor. DIRECT EXAMINATION (Continued) 14 BY MR. HEMESATH: 15 Q. Good morning. 16 A. Okay. 17 Q. You testified about this briefly yesterday, but to get us 18 back on track, do you recognize this? 19 A. Yes. 20 Q. And what are these line items? 21 A. They would be, ah, permission settings within our CMS 22 system. 23 Q. Is this something you would see on the CMS? 24 A. Yes. 25 Q. That's how you recognize it? Could you turn to Exhibit 505, please. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 475 1 A. Yes. 2 Q. Thank you. 3 You spoke yesterday about the iPad giveaway contest e-mail 4 list. Could you walk me through on the CMS how you accessed 5 viewer e-mail addresses from that list on the CMS? 6 A. 7 entered the contest, when I logged into the CMS, there was a 8 tab that said UGC, user generated content, and that's where -- 9 when you enter the contest, that's where your information went. If I needed to find an e-mail address for somebody who had 10 By clicking on that tab, it then opened up a database within 11 the CMS that I could search for a person's name. 12 Q. Okay. Thank you very much. 13 MR. HEMESATH: 14 THE COURT: All right. 15 MR. JAFFE: Could I have just one moment, Your Honor? 16 THE COURT: You may. 17 Thank you, Your Honor. Mr. Jaffe. CROSS-EXAMINATION 18 BY MR. JAFFE: 19 Q. 20 counsel for the defendant. 21 A. Hello. 22 Q. Ms. Cohen, you testified -- 23 24 25 No more direct. Good morning, Ms. Cohen. MR. JAFFE: My name is Mark Jaffe. I beg your pardon. I'm I have to bring one more thing up. THE COURT: All right. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 476 1 BY MR. JAFFE: 2 Q. 3 December of 2010 where you didn't have access to the CMS; is 4 that correct? 5 A. Correct. 6 Q. All right. 7 working properly at the time; is that correct? 8 A. It was not working for me. 9 Q. Right. You testified that there was a period of time around But you have no knowledge that the CMS wasn't But it was working -- it was your understanding it 10 would have been working; is that correct? 11 A. Correct. 12 MR. HEMESATH: 13 THE COURT: Objection, speculative. Overruled. 14 BY MR. JAFFE: 15 Q. 16 the CMS; is that correct? 17 A. Correct. 18 Q. And those other individuals would have access to the same 19 information that you had; is that correct? 20 A. Not necessarily. 21 Q. Did you lose any documents as a result of your not having 22 access to the CMS? 23 A. I didn't lose any documents. 24 Q. Did you lose any e-mails? 25 A. Not to my knowledge. But other individuals that you worked with had access to KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 477 1 Q. When you were given new access, you testified that your 2 access was restored; is that correct? 3 THE COURT: 4 THE WITNESS: I don't think there's been an answer yet. I'm sorry. Could you ask the question 5 again? 6 BY MR. JAFFE: 7 Q. 8 your password, you were given a new username and password; is 9 that correct? You testified that after you were unable to get in with 10 A. Yes. 11 Q. And when you did that, you had access to the same 12 information that you had prior; is that right? 13 A. To the best of my knowledge. 14 Q. To the best of your knowledge. 15 And you would -- and during a period of time where you did 16 not have access to your e-mail with your username and password, 17 you could have used someone else's username and password to get 18 into the CMS; is that correct? 19 A. Ah, yes. 20 Q. Yes. 21 And you worked closely with other people who had access to 22 the system; is that right? 23 A. They were my co-workers. 24 Q. And you worked in the same office with people who had 25 access to the same CMS? KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 478 1 A. Not the same level that I did. 2 Q. Ms. Cohen, you testified yesterday that, due to your lack 3 of access to the CMS, you were out for approximately 40 hours; 4 is that right? 5 A. Yes. 6 Q. And I'd like to call your attention to what was previously 7 introduced as Government Exhibit 112. Was that your testimony? 8 MR. JAFFE: 9 MR. LEIDERMAN: 10 THE WITNESS: 11 MR. JAFFE: That was in evidence, yes. Okay. Okay. Are you reviewing that? If you could start 12 on page 6 because that would be -- if you can start on page 6, 13 please. 14 Q. 15 correct? 16 A. Correct. 17 Q. They go backwards chronologically. 18 That would be the beginning of the series of these e-mails, And Mr. Pollyea was in a different time zone at the time; 19 is that right? 20 A. Correct. 21 Q. And so when we see for instance here 8:15 a.m., it would 22 have to be really two hours ahead? 23 A. Correct. 24 Q. Otherwise -- otherwise he wouldn't have responded to you 25 before you asked the question, right? It would be 10:15 a.m.? KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 479 1 A. Correct. 2 Q. Okay. 3 that you didn't have access to the system at 10:15 a.m. on 4 December 6th; is that right? 5 A. Correct. 6 Q. And that Mr. Pollyea responded to you approximately 10 7 minutes later that you were given a new password; is that 8 right? 9 A. Correct. 10 Q. And the next time that you contacted him, I believe on page 11 5, was 10:50 a.m. 12 A. Yes. 13 Q. And again at 11:08, your password was reset? 14 A. Yes. 15 Q. Okay. 16 is that right? 17 A. Yes. 18 Q. Okay. 19 reported it was two days later; is that right? 20 A. Yes. 21 Q. At 11:19, you said your access wasn't working? 22 A. Yes. 23 Q. And then 11:40, again you said it wasn't working; isn't 24 that right? 25 A. And so what it appears here is that you reported You requested your password be reset again? And at 11:09, you reported that you reset it again; And then according to this, the next time that you Is it 11:40? Yes. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 480 1 Q. That starts on page 3. 2 MR. HEMESATH: 3 MR. JAFFE: 4 THE WITNESS: Page 3, Mark? Yes, the bottom of page 3. Yes. 5 BY MR. JAFFE: 6 Q. 7 day; isn't that right? 8 A. Yes. 9 Q. You reported several hours later it appears, in the middle And then at 1:28, Mr. Pollyea reset your password that same 10 of page 3, that your password was working again; isn't that 11 right? 12 A. Yes. 13 Q. Okay. 14 Moving on, I believe we're on page 2 now. It appears to be six full days before the next time that 15 you report that you didn't have access to the system; is that 16 right? 17 A. Yes. 18 Q. Okay. 19 A. Yes. 20 Q. Your access was restored at 11:18 a.m.; isn't that right? 21 A. Ah, yes. 22 Q. Okay. 23 And that's at 11:05 a.m.? Thank you, Ms. Cohen. You reported that you were frustrated based on your lack of 24 access to the system; isn't that right? 25 A. Yes. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 481 1 Q. 2 been introduced as Defense Exhibit F and what may be in your 3 binder as No. 6 in the defense exhibits. 4 Okay. If I may call your attention to what has already THE COURT: Do you have the defense exhibits there? 5 There's a binder behind you. 6 exhibits. 7 BY MR. JAFFE: 8 Q. Do you see that? 9 A. I'm sorry. 10 Q. I believe in your binder it would be Defense Exhibit 6. 11 Are they numbered or lettered? 12 A. Numbers. 13 Q. Okay. 14 A. Okay. 15 Q. Are you reviewing it? 16 I believe that is the defense You said which number? It would be No. 6. Do you recall receiving this e-mail, Ms. Cohen? 17 A. I don't recall it, but it looks like an e-mail I sent. 18 Q. And if you look below the e-mail that you sent, if this can 19 refresh your recollection, did you receive an e-mail from 20 Brandon Mercer that said that they cannot prosecute unless you 21 reach $5,000 in damages? 22 A. I don't remember it, but it appears so. 23 Q. Ms. Cohen, did you work at all for the L.A. Times around 24 December of 2010? 25 A. I did not. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 482 1 Q. Did you edit any content for the L.A. Times around December 2 of 2010? 3 A. I did not. 4 Q. Did you ever have access to articles from the L.A. Times in 5 December of 2010? 6 A. 7 touched their content, I do not know to what level my access 8 would have granted me access. I had permissions within the CMS, but because I never 9 10 MR. JAFFE: Thank you, Ms. Cohen. No further questions. 11 THE COURT: 12 MR. HEMESATH: 13 All right. Any redirect? Briefly, Your Honor. REDIRECT EXAMINATION 14 BY MR. HEMESATH: 15 Q. 16 documents or e-mail with regard to this incident; is that 17 correct? 18 A. Yes. 19 Q. And you didn't; is that correct? 20 A. To the best of my knowledge. 21 Q. Did you lose the ability to do your job during this period 22 of time? 23 A. I did. 24 Q. Mr. Jaffe showed you a series of e-mails with time stamps 25 indicating access restored, access lost. Ms. Cohen, Mr. Jaffe asked you whether you lost any KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 483 1 Does that -- do those e-mails reflect all of the 2 difficulties that you had during that week? 3 A. No. 4 Q. With regard to Exhibit F that Mr. Jaffe showed you with the 5 prosecution reaching $5,000, did that have any effect on your 6 reporting of your password difficulties and your ability to do 7 your job? 8 MR. JAFFE: 9 MR. HEMESATH: 10 THE COURT: Compound question, Your Honor. I'll rephrase. All right. 11 BY MR. HEMESATH: 12 Q. 13 your reporting of your e-mail difficulties? 14 A. No. 15 Q. Did it have any effect on whether or not you were able to 16 do your job during that period of time? 17 A. Did that $5,000, the knowledge of that have any effect on No. 18 MR. HEMESATH: 19 MR. JAFFE: May I, Your Honor? 20 THE COURT: Pardon me? 21 MR. JAFFE: May I redirect, Your Honor -- recross? 22 THE COURT: You may within the scope. 23 Thank you. RECROSS-EXAMINATION 24 BY MR. JAFFE: 25 Q. Ms. Cohen, you testified earlier that you could have access KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 484 1 to the CMS through other usernames and passwords of people that 2 you worked with, correct? 3 MR. HEMESATH: Objection, beyond the scope. 4 MR. JAFFE: That was not beyond the scope, Your Honor. 5 THE COURT: Overruled. 6 MR. JAFFE: Okay. 7 Q. You testified yesterday that your job responsibilities 8 include managing the website; is that correct? 9 A. Correct. 10 Q. If you had logged on -- 11 THE COURT: That's yesterday, Mr. Jaffe. 12 MR. JAFFE: Yes. 13 THE COURT: So this is just -- stay within the scope of 14 the most recent redirect. 15 MR. JAFFE: I beg your pardon? 16 THE COURT: Stay within the scope of the recent 17 redirect. 18 MR. JAFFE: Okay. This -- okay. 19 Q. Would you be able to manage the website using another 20 employee's username and password? 21 MR. HEMESATH: 22 THE COURT: 23 effect on the job. 24 BY MR. JAFFE: 25 Q. Asked and answered and beyond the scope. Overruled given the testimony about the The question is would you be able to manage the website KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 485 1 using another username and password during that time, 2 Ms. Cohen? 3 A. 4 password gave me. 5 Q. And would you be able to write stories during this time? 6 A. If I had wanted to use someone else's log-in. 7 Q. And you would be able to produce content during that time? 8 A. If I had wanted to use someone else's log-in. 9 Q. And you would be able to operate the social media during Not to the level that my access with my username and 10 that time? 11 A. 12 share content, which was my job. I didn't. The social media I still had access to, I just couldn't 13 MR. JAFFE: Okay. 14 THE COURT: All right. 15 MR. HEMESATH: 16 THE COURT: 17 MR. HEMESATH: 18 THE COURT: Mr. Jaffe? 19 MR. JAFFE: No further questions. 20 THE COURT: All right. 21 MR. JAFFE: Yes, Your Honor. 22 THE COURT: All right. 23 I didn't. No. No further questions. Mr. Hemesath? Thank you, Your Honor. All right. Is this witness excused? Yes, Your Honor. Excused subject -- But subject to re-call? Ma'am, you may step down. You may be re-called. 24 THE COURT: The government's next witness? 25 MR. SEGAL: Your Honor, the United States calls Jason KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 486 1 Jedlinski. 2 THE COURT: All right. 3 THE CLERK: Mr. Jedlinski, please come forward. I need 4 to take your photograph this morning. If you can stand with 5 your back against the wall facing me. Thank you. 6 7 Step into the witness stand behind you, remain standing, and raise your right hand. 8 JASON JEDLINSKI, GOVERNMENT'S WITNESS, SWORN 9 THE WITNESS: 10 11 THE CLERK: I do. Thank you. You may be seated. Will you please say and spell your first and last name for the record. 12 THE WITNESS: Yes, Jason Jedlinski, J-E-D-L-I-N-S-K-I. 13 THE COURT: Mr. Segal, you may proceed. 14 MR. SEGAL: Thank you, Your Honor. 15 DIRECT EXAMINATION 16 BY MR. SEGAL: 17 Q. Good morning, sir. 18 A. Good morning. 19 Q. In what industry -- well, what's the company that you've 20 worked for for the most time in your career? 21 A. Tribune Interactive. 22 Q. Okay. 23 just Tribune Interactive? 24 A. I've had several positions elsewhere in the company. 25 Q. Okay. And have you had other jobs at Tribune Company or Can you summarize your experience at Tribune, KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 487 1 please. 2 A. 3 Sure. I began as a journalist in newsrooms at WGN. Moved into 4 the corporate world in 2006 running content on TV station 5 websites, taking on operations, product development, and 6 revenue responsibility, and ultimately running the digital 7 business for a number of TV stations and newspapers. 8 Q. Okay. 9 A. Producing, writing, investigative work. 10 Q. What was WGN? 11 A. WGN television, a TV station in Chicago. 12 Q. Okay. 13 were you for them? 14 A. 15 special projects, which means things other than day-to-day 16 fires, shootings, news stories, but original reporting. What was WGN? It was content. And what kind of stories -- what kind of reporter I was a producer, started general assignment and got into 17 THE COURT REPORTER: 18 MR. SEGAL: 19 THE WITNESS: I need you to slow down, please. You're in California now. People in New York tell me I go too slow. 20 BY MR. SEGAL: 21 Q. Where do you work now physically? 22 A. Chicago. 23 Q. All right. 24 reporting to the business side? 25 A. In what year did you make the transition from 2006. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 488 1 Q. Okay. 2 your responsibility? 3 A. Vice president of products for Tribune Digital. 4 Q. Okay. 5 A. My responsibility was the web hosting platform or content 6 management system as it's called in the industry for Tribune's 7 newspaper, television, radio station properties as well as 8 external customers, other media companies who paid us to use 9 that software to run their websites. Okay. And by December of 2010, what was your title and 10 Q. So this was a single system for all of those content 11 producers? 12 A. Correct. 13 Q. Okay. 14 a problem with CMS, who was their first line office that they 15 would call or e-mail? 16 A. My team. 17 Q. And if you had a problem, to whom would you escalate it? 18 A. The technology managers, the technology support teams. And if somebody out at a station or a newspaper had Ah -- 19 So the best way to think of my group was a bridge between 20 the newsrooms that use the software and the technology -- the 21 IT folks who operated and managed the infrastructure. 22 the translators between the users and the people who worked 23 under the hood. 24 Q. Okay. 25 A. Yes. We were And did you have business responsibilities also? KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 489 1 Q. Okay. And explain those, please. 2 A. Most significantly negotiating, supporting and bringing 3 other media companies to use our software. 4 software, our platform as a commercial business to other 5 newspaper and TV companies, and I was solely responsible for 6 that revenue and those customers' satisfaction. 7 Q. 8 newspapers about sort of what their business needs were and how 9 CMS could support that? All right. Ah, we extended our And did you talk to the Tribune stations and 10 A. Absolutely. 11 slowly, my team, myself would be someone who an editor or a 12 publisher or a station manager would call saying, you know, 13 this doesn't meet our needs. 14 with Craigslist for classifieds. 15 us have traffic times on our mobile app. 16 anything that they wanted to offer, that they wanted to sell, 17 that they wanted to extend to advertisers, they would bring 18 that to my group. 19 get it done or project the idea. 20 Q. 21 best you can recall, stations and newspapers within the Tribune 22 family were served by your CMS? 23 A. Yes. 24 Q. Please do. 25 A. We had, give or take one or two, about 23 television Okay. So, election night, if something was running Or we need a product to compete We need something that let's Any digital product, We would work with the corporate office to So geographically can you explain to us what, as KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 490 1 stations, one radio station, 14 to 15 daily newspapers. 2 would generally characterize it as from WPIX in New York City 3 in the far northeast down to KSWB in San Diego in the 4 southeast, KCPQ in Seattle in the Pacific northwest down to the 5 Sun Sentinel in Miami in the southeast. 6 the U.S. give or take 60 or so primary websites with many other 7 smaller hangers on. 8 Q. 9 Sacramento used the CMS? Okay. And I So all four corners of So among those, who -- what Tribune property in 10 A. Fox 40 KTXL television. 11 Q. And what Tribune property in Los Angeles used the CMS? 12 A. The Los Angeles Times, KTLA television, and about six daily 13 newspapers that were regional properties, as well as Calendar 14 Live, which did the Emmy and Oscar entertainment coverage, L.A. 15 Times Deals. 16 websites beyond just the core flagship news sites. 17 Q. 18 in December of 2010? 19 A. All right. Do you recall having any problems with the CMS Yes. 20 21 There were a host of ancillary products and MR. SEGAL: Let's look at Government Exhibit 114, which is already in evidence, so let's put it up, please. 22 May I have a moment, Your Honor? 23 Q. Can you -- can you read that on your screen, sir? 24 A. Yes. 25 Q. Okay. What was your relationship with Brandon Mercer at KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 491 1 this time? 2 A. 3 or editors in the newsrooms, I provided a service to them, the 4 software that ran their websites. 5 of, you know, several hundred customers as the department head 6 at the station. 7 Q. Okay. 8 A. Internal customer, yeah. 9 Q. Okay. I thought of Brandon as a customer. So the news directors So I considered Brandon one All within the same corporate -- all Tribune? What was happening on December 1st of 2010 that you 10 were personally involved in that led to Brandon Mercer sending 11 this e-mail to you? 12 A. 13 individual with e-mail addresses of Fox 40 viewers and some 14 threat to take action in contacting those individuals. 15 Brandon relayed the e-mails to me saying -- prior to this 16 e-mail, saying where did these come from, who could have had 17 them, et cetera. 18 information asking how would this get out, where would it come 19 from. 20 Q. 21 for logs; is that right? 22 A. He's saying who from my station has been in the system? 23 Q. Okay. 24 25 As I recall, Brandon had received e-mails from an Okay. So So he presented me with that viewer And let's look at your -- so here he's asking you Let's pull out and look at your reply. MR. EKELAND: Your Honor, we're just going to object and restate our relevancy objection on the basis of the Cancer KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 492 1 Man e-mails at this point. 2 THE COURT: All right. That objection is recorded. 3 It's overruled. 4 questioning with respect to those e-mails. 5 It can serve as a standing objection to any MR. SEGAL: All right. 6 Q. Is 7:18 p.m. within your sort of regular work hours? 7 A. I would generally be heading home by that time. 8 Q. Okay. 9 A. At the time, I had six individuals, six or seven Who was on your team? 10 individuals reporting to me that answered questions from the TV 11 stations and newspapers. 12 when I said I have gathered a team, I'm referring to my support 13 folks in the technology division, the people I go to with 14 issues. 15 But the word you highlighted there, So I had engaged several system admins, you know -- 16 Q. So Armando Caro kind of people? 17 A. Not him directly. 18 to, but folks who could tell me who had logged into the system. 19 That wasn't something I could see on my own, so I called folks 20 who could answer Brandon's question of who had logged into the 21 system recently. 22 Q. Okay. 23 A. He worked for me. 24 meant -- markets are how we defined L.A. Times, Fox 40. 25 the person they would call with questions, so a customer Tom Comings was the first person I went Who is Marques? His title was market liaison, which He was KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 493 1 service person. 2 Q. What did you direct him to do? 3 A. To reset the passwords of individuals who had access to the 4 information that was in the e-mail Brandon received. 5 Q. Why did you order that on December 1st? 6 A. In case one of those users had an easy to guess password or 7 had their password compromised, it was the quickest first step 8 I could take to secure the viewer information that was in the 9 system. Here's the universe of Fox 40 employees who have 10 access to it, and I have now forced their passwords to be 11 changed. 12 would have access to the system. 13 Q. 14 15 So if someone had it that shouldn't, they no longer Okay. MR. SEGAL: And can we put up 119, please, which is in evidence already. 16 THE COURT: 119? 17 MR. SEGAL: Yes, it is in -- 18 THE COURT: I'm not showing that's in evidence. 19 can please kill the screen. 20 MR. SEGAL: 21 at Government Exhibit 119. 22 that was in. 23 THE WITNESS: 24 BY MR. SEGAL: 25 Q. If you Would you look in the white book, please, 119. I apologize, Your Honor, I thought Yes. Who is that a reply chain between? KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 494 1 A. This is me responding to a message from Brandon where 2 Brandon is asking his department heads and others at Fox 40 to 3 please document the time you spent investigating this issue. 4 Q. Okay. 5 A. In this case, I'm replying to Brandon. 6 Q. Okay. 7 what's the date on your reply? 8 A. December 2nd, 9:13 p.m. 9 Q. Okay. And who is replying to Brandon? Did you type that at or about the time of -- well, And did you type this at or about the time that you 10 were doing this work? 11 A. Yes, that aligns with my recollection. 12 Q. Okay. 13 A. I wrote, you can put me down for the two hours yesterday 14 and an hour today. 15 Q. 16 please. 17 A. Yes. 18 Q. Do you see that? 19 A. I do. 20 Q. At what time was that e-mail -- well, who sent that e-mail? 21 A. I sent the e-mail to Andy Friedman. 22 Q. Who is Andy Friedman? 23 A. He ran a central content team that produced national news 24 stories for Tribune's newsrooms. 25 Q. I'd ask you to read it to the jury, please. All right. Now can you look in your book at Exhibit 137, That's another e-mail. What was the reporting relationship between you and KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 495 1 Friedman? 2 A. We were colleagues. 3 Q. Okay. 4 A. This project? 5 Q. Were you both involved in the X files e-mail incident? 6 A. Yes, we were. 7 Q. Okay. 8 A. 9:35 p.m. 9 Q. Is that outside your ordinary work hours? 10 A. Yes. 11 9:35 p.m. 12 Q. 13 14 Were you working on this project together? And what time did you send this e-mail? Well, it was unusual for me to be at the office at Okay. MR. EKELAND: I'm sorry. What exhibit are you on right now? 15 MR. SEGAL: 137. 16 THE COURT: In the binder, not on the list. 17 MR. EKELAND: 18 (Counsel conferring.) It's in this one. Okay. 19 THE COURT: It's in the binder, not on the list. 20 MR. SEGAL: Right. 21 These were -- I can explain that with this witness or if the -- 22 THE COURT: Well, just keep asking your questions. 23 MR. SEGAL: We need to submit a new list. 24 THE COURT: Well -- 25 BY MR. SEGAL: KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 496 1 Q. Sir, have you refreshed your recollection with some e-mails 2 about this case? 3 A. Yes. 4 Q. Okay. 5 A. We spoke on Wednesday evening. 6 Q. Okay. 7 A. I did. 8 Q. Okay. 9 possession? When's the first time that you and I ever talked? And after we talked, did you call us back? What did you tell us about what you had in your 10 A. 11 vague memories of the incidents from five years ago. 12 remembered it happening. 13 remembered working late at night and ordering pizza with people 14 who were digging into the issue with me, but I didn't remember 15 the exact sequence of what happened when to confidently answer 16 your questions. 17 I said that when we had spoken two hours earlier, I had I remembered being involved. I I I retrieved a disk, one of several on which I had archived 18 e-mails over the years that I worked at Tribune, and I reviewed 19 e-mail I sent from December of 2010. 20 Q. Okay. 21 A. E-mails I sent from my Tribune account in the month of 22 December of 2010. 23 Q. 24 those to us? 25 A. And those were e-mails from Tribune? So who did you talk to before you -- did you end up giving I did. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 497 1 Q. Okay. 2 A. 3:30 yesterday afternoon. 3 Q. Okay. 4 A. My attorney from Tribune who represented the company when I 5 was an employee there. 6 Q. 7 8 And at what time -- when did that happen? And who did you need to talk to first? Okay. MR. SEGAL: and the defense has them. 9 THE COURT: 10 MR. EKELAND: 11 MR. SEGAL: 12 MR. EKELAND: 13 Disclosed when? Last night, Your Honor. Last night. We got access to them last night after we figured out the technical issues about -- 14 15 And, Your Honor, these have been disclosed, THE COURT: All right. So we may need to talk more about this outside the presence of the jury -- 16 MR. SEGAL: Okay. 17 THE COURT: -- just because there are some evidentiary 18 questions that may be raised. 19 regular break. 20 MR. SEGAL: But we'll do that on a break, a All right. 21 Q. So at 9:35 p.m. on December 1st, what was the incident you 22 were still working on? 23 A. 24 threatening to contact Fox 40 viewers. 25 Q. The messages to Brandon Mercer from an individual All right. And did you make any communications about what KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 498 1 your plan for the rest of the evening was at 9:35? 2 A. I did. 3 Q. Okay. 4 A. Yes. 5 Q. Okay. 6 7 Is it in this e-mail? MR. SEGAL: Your Honor, I offer Government Exhibit 119 into evidence. 8 THE COURT: 9 MR. EKELAND: 10 hearsay, Your Honor. Any objection? We're going to object on the basis of 11 THE COURT: Sustained. 12 MR. SEGAL: Then existing state of mind or plan. 13 THE COURT: Sustained at this point. 14 BY MR. SEGAL: 15 Q. At 9:35 p.m., what did you plan to do? 16 A. Leave the office and go home. 17 Q. To see whom? 18 A. My family. 19 Q. And to whom did you communicate that? 20 A. My colleague Andy Friedman. 21 Q. Through what medium did you communicate that you were going 22 home to your family? 23 MR. EKELAND: 24 THE COURT: 25 THE WITNESS: Objection, Your Honor, relevance. Overruled. E-mail. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 499 1 MR. SEGAL: Okay. 2 THE COURT: Does the objection stand? 3 MR. EKELAND: 4 MR. SEGAL: That's fine. 5 THE COURT: I'm deferring a final ruling. 6 Offer 137 into evidence, Your Honor. Same objection, Your Honor. We'll talk about this on a break. 7 MR. SEGAL: Okay. 8 Q. Would you look at Government Exhibit 138, please, sir. 9 A. Yes. 10 Q. What precautions did you take with regard to KTXL in light 11 of the X files e-mails? 12 A. 13 clearly tied to a current employee. 14 Q. 15 December 1st? 16 A. That as well as further investigation of what happened. 17 Q. Okay. 18 A. Yes. 19 Q. Now what did Mr. Mercer ask you to cross-reference against 20 your CMS? We reset user passwords and deleted accounts that were not Okay. And is that what you were doing that night of Can you look at Government Exhibit 136, please. 21 MR. EKELAND: 22 THE COURT: 23 Actually that is sustained. 24 25 Objection, leading. Overruled. You can ask a foundational question. MR. SEGAL: Okay. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 500 1 Q. 2 send out some e-mails. 3 So you explained earlier that there were these threats to What -- did Mercer send you any e-mail addresses? 4 A. Brandon shared the viewer e-mail addresses that were sent 5 to him within the threats, yes. 6 Q. 7 addresses? 8 A. 9 those addresses matched what was available through our content Okay. And what did you do to investigate those e-mail I confirmed that the addresses as well as the sequence of 10 management system. 11 Q. 12 technical support was kind of the regular business of your 13 office; is that right? 14 A. Correct. 15 Q. Okay. 16 your internal customers for things like technical support? 17 A. Largely e-mail. 18 Q. Largely e-mail. 19 Okay. Was this -- now you said customer, internal customer And was e-mail -- how did you guys get requests from Okay. And were these e-mails then automatically generated on your 20 server and saved when people sent you e-mails? 21 A. 22 understand e-mail operates. 23 Q. Okay. 24 A. Yes. 25 Q. Okay. I don't have direct knowledge of that. That's how I Well, did it show up in your Outlook? And you saved it? KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 501 1 A. Yes. 2 Q. And did it show up at about the time that it happened? 3 A. Yes. 4 Q. Okay. 5 MR. SEGAL: And, Your Honor, when we get to the 6 break -- 7 Q. 8 your business supporting your internal customers for the CMS 9 system? So these were ordinarily generated in the regular course of 10 A. Yes. 11 Q. Okay. 12 13 MR. SEGAL: On that basis, Your Honor, I offer 136 into evidence and understand we'll get to it. 14 THE COURT: All right. 15 MR. SEGAL: All right. 16 Q. Now I'd like you to look please at 135. 17 A. Okay. 18 Q. What time was this -- who sent this e-mail? 19 A. It was an e-mail I sent. 20 Q. At what time? 21 A. 7:47 p.m. on Thursday, December 9th, 2010. 22 Q. What were you being asked, what is the subject matter that 23 you're being asked about before you reply? 24 A. 25 viewers was available in the system I managed. The subject matter was what information about Fox 40 KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 502 1 Q. Okay. Why was that important? 2 A. Fox 40 wanted to determine if other information, presumably 3 things like phone numbers or addresses, would be available to 4 whoever had obtained these e-mail addresses. 5 Q. Physical addresses you mean? 6 A. Correct. 7 Q. Okay. 8 A. Used my knowledge of the system that I ran. 9 Q. Okay. And what did you do to answer that question? But what could -- what possibility could you not -- 10 well, what did you answer about the CMS system? 11 the truth about the CMS system more importantly? 12 MR. EKELAND: 13 THE COURT: And what was Objection, vague, compound. Sustained. Sustained. 14 BY MR. SEGAL: 15 Q. 16 ran? 17 A. 18 and the date that a viewer had entered a contest or submitted a 19 form on the website. 20 through this system. 21 Q. 22 uncertainty about what was available to Fox Mulder? What information was available on the CMS system that you A Fox 40 user could access the screen name, e-mail address Okay. That was the only information available Now for you guys at this time, what is still the 23 MR. EKELAND: Objection. 24 MR. SEGAL: Goes to the -- 25 THE COURT: What's the objection? KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 503 1 MR. EKELAND: 2 THE COURT: It's vague. Uncertainty? Sustained. 3 BY MR. SEGAL: 4 Q. Did you add any provisos to your answer, sir? 5 A. I did. 6 Q. Why did you add that proviso? 7 A. Because I'm thorough. 8 Q. And how did you qualify your answer? 9 A. I said this is what someone could get through this software 10 program. 11 gotten elsewhere. 12 I can't speak to what they could or could not have In other words, there are other systems that have phone 13 numbers, home addresses, et cetera. 14 I'm answering your literal question, here's what they can get 15 in this piece of software. 16 information. 17 Q. Okay. 18 19 And I was telling Brandon There are other ways to get Would you turn -- MR. SEGAL: And, Your Honor, I offer 135 into evidence and understand. 20 THE COURT: All right. 21 BY MR. SEGAL: 22 Q. Would you turn, please, in your book to Exhibit 134. 23 A. Yes. 24 Q. Did you receive a warning about any other attack on -- 25 relative to your CMS? KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 504 1 A. One was relayed to me, yes. 2 Q. Okay. 3 A. By Brandon at Fox 40. 4 Q. What Tribune property -- well, what internal CMS customer 5 did Brandon refer to? 6 A. 7 as a target. 8 Q. 9 By whom? Brandon sent me an article that referred to the L.A. Times Okay. Sent you an article. Okay. And what was your relationship as the -- I'm sorry. Can 10 you tell me your title again? 11 A. Vice president of product. 12 Q. What was your relationship as VP of product to the L.A. 13 Times? 14 A. 15 build, offer, develop, sell anything pertaining to their 16 websites, mobile apps, they had to come through my group in 17 corporate to get that done. 18 or offer was coordinated through my division of the company. 19 Q. 20 content? 21 The way Tribune was set up, if the L.A. Times wanted to So anything they wanted to build And you hosted their web content or you ran their web Ran is vague. What was your relationship to the L.A. Times web content? 22 A. We hosted and operated the latimes.com website. The 23 advertising, the news content, the availability of the site 24 were all run through Tribune Interactive, Tribune Digital. 25 Q. Same as Fox 40? KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 505 1 A. Yes. 2 Q. Okay. 3 A. Okay. 4 Q. Do you recognize that? 5 A. Yes. 6 Q. Okay. 7 generated. 8 happen between you and the internal customers? 9 A. The incident was not typical. 10 Q. Okay. 11 A. Dan Gaines. 12 Q. What did Dan Gaines consult you about on December 14th, 13 2010, in the after -- well, in the early evening, late 14 afternoon? So next I want to show you Government Exhibit 133. Now you told us that e-mails were ordinarily Is this the kind of support e-mail that would The e-mail was very typical. And to whose e-mail are you responding? 15 MR. EKELAND: Objection, calls for hearsay. 16 THE COURT: What's the exception? 17 MR. SEGAL: This is a business record, and I'm moving 18 it in pursuant to the testimony that he says these are business 19 records. 20 For now, I think the important part is just that this is what 21 gives impetus to this witness's next action where he's spending 22 a lot of time. 23 24 25 I understand you want to rule on that at the break. MR. EKELAND: Your Honor, e-mails are not business records. THE COURT: That's a separate question. I asked for KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 506 1 the hearsay exception apart from the business records. 2 MR. SEGAL: Gaine's -- 3 THE COURT: Testimony. 4 MR. SEGAL: Right. Gaine's report at this time will 5 not be offered for the truth. 6 business record exception, and we can argue that later, I 7 understand. 8 9 10 THE COURT: All right. I believe it's subject to the Well, the content of what the witness may say was communicated to him is not being offered for the truth of the matter, but for its effect on him. 11 So you may answer the question. 12 BY MR. SEGAL: 13 Q. 14 December 14th? 15 A. Yes. 16 Q. What did you hear that got you working or read in an 17 e-mail? 18 A. 19 edit to a story on the L.A. Times website. 20 Q. Now, what kind of a reaction at Tribune did that trigger? 21 A. Panic. 22 Q. Can you compare the emotion -- panic you said. 23 Did you hear anything that got you working on the night of Dan Gaines reported that someone had made an unauthorized Okay. Who was your boss? 24 A. Don Meek, president of the digital. 25 Q. Who is Steve Gable? KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 507 1 A. Our chief technology officer for the company. 2 Q. How many people were between you and Steve Gable? 3 A. Steve and Don, my boss, were roughly counterparts. 4 Q. Okay. 5 night? 6 A. Yes. 7 Q. Were you there when he made any reports to anybody else? 8 A. Yes. 9 Q. How did he make that report? Were you present -- did you see Steve Gable that 10 MR. EKELAND: 11 THE COURT: Objection. Ask the threshold question. 12 BY MR. SEGAL: 13 Q. Who did he report to? 14 A. Steve Gable reported to Randy Michaels, who is president or 15 CEO of the company. 16 Q. You were there for that conversation? 17 A. I was present when Steve used his cell phone to call Randy 18 Michaels about the vandalism on L.A. Times. 19 Q. 20 How did that reaction -- okay. Thank you. And what did you do for the rest of the night? 21 A. Looked for opportunities for individuals to get access to 22 the system and close those off. 23 closing the windows and locking the doors of your house. 24 Q. Would you look at Government Exhibit 132. 25 A. Yes. I would compare it to, ah, KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 508 1 Q. Did you have dinner that night? 2 your family that night? 3 A. Did you have dinner with No. 4 MR. EKELAND: 5 THE COURT: 6 BY MR. SEGAL: 7 Q. Objection, Your Honor, relevance. Sustained. Where did you have dinner that night? 8 MR. EKELAND: Objection. 9 MR. SEGAL: The hours are -- 10 THE COURT: The hours are, yes, so ask about that. 11 BY MR. SEGAL: 12 Q. Did you work past dinner? 13 A. Yes. 14 Q. With how many colleagues did you have to -- well, did you 15 have to make dinner arrangements with other colleagues? 16 A. I did. 17 Q. Okay. 18 You did. All right. About how many? 19 A. At least a dozen. 20 Q. Okay. 21 A. Pizza. What did you guys eat? 22 MR. EKELAND: Objection. 23 THE COURT: That objection is sustained. 24 MR. SEGAL: Okay. 25 THE COURT: I don't know if you can get the image of KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 509 1 pizza out of your mind, but if you can, please do. 2 MR. SEGAL: He actually said it about 10 minutes ago, 3 too. 4 Q. 5 please. 6 A. Yes. 7 Q. Is there a difference between those two e-mails, please? 8 A. There is. 9 Q. What is the difference? 10 A. Exhibit -- And so would you look at Government Exhibit 130 and 131, 11 MR. EKELAND: 12 THE COURT: 13 MR. EKELAND: 14 Objection. What's the objection? Calls for speculation, and it also calls for opinion. 15 THE COURT: 16 asking him to look at 130? 17 MR. SEGAL: 18 Q. 19 Mr. Jedlinski? 20 A. 21 We're looking at 130 and 131? You're Yeah. Look at 130 and 131. Who wrote those e-mails, I did. THE COURT: You may look at those e-mails. Just so 22 it's clear, this witness is not being offered as any kind of 23 expert, so he's providing lay testimony. 24 25 MR. SEGAL: Q. Yeah. You wrote them? KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 510 1 A. I wrote them. 2 Q. Okay. 3 right? 4 A. Correct. 5 Q. Can you explain the difference between the distribution 6 lists? 7 A. 8 newspaper newsrooms, so Tribune's daily newspapers across the 9 country, people who use the web content management system to 10 They're to different distribution lists; is that The distribution list in Exhibit 130 are users at Tribune post articles, photo galleries, update headlines. 11 In 131, the distribution list are newsroom workers at 12 properties owned by a company called Schurz Communications. 13 these are newspapers, radio, TV stations not owned by Tribune, 14 but they used the same software to run their websites. 15 Q. And what are you telling them the plan is to do? 16 MR. EKELAND: 17 MR. SEGAL: This is incident response. 18 THE COURT: What's the objection? 19 MR. EKELAND: 20 So Objection. Relevance, and it also calls for hearsay and lack of foundation. 21 MR. SEGAL: Your Honor? 22 THE COURT: Overruled. 23 MR. SEGAL: Offer 130 and 131 into evidence, Your THE COURT: We'll again talk about these on the break. 24 25 Honor. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 511 1 MR. SEGAL: Okay. 2 Q. 3 you're going to do? 4 A. 5 that can access the system, that we are taking action on 6 accounts that haven't logged in recently, accounts that we 7 can't connect to an identifiable person or accounts that don't 8 have a corporate or official e-mail address with them. 9 What are you telling users of the CMS at this point that I'm notifying them that we are reviewing log-in accounts So I'm telling these users and newsrooms across the country 10 you might not be able to log in because we're tightening our 11 security. 12 call, here's an e-mail address, and we'll help get back in if 13 you're an employee that has a legitimate need to access the 14 system. 15 Q. Go ahead. 16 A. So I'm saying that was typical in the course of my job to 17 notify people there's been a change of status to something 18 you're used to, here's what's going on, here's what you can do 19 about it. That was the nature of my employment. 20 Q. So you sent this to the Tribune print properties, to 21 this outside customer. 22 A. 23 company called Local TV LLC, that was based out of Ohio. 24 Q. 25 would have -- was on this list; is that right? Okay. If you have problems, here's a toll free number to Sorry. Who else received this notification? The Tribune broadcast companies and the newsrooms of the All right. So any Tribune print property like L.A. Times KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 512 1 A. The newsroom users. 2 Q. Newsroom users. 3 Okay. And any Tribune broadcast company like KTXL newsroom users 4 were on this list, too? 5 A. Correct. 6 Q. Okay. 7 128, please. 8 A. Yes. 9 Q. Did you -- around what time did you get back into the Would you turn in that book to Government Exhibit 10 office on the morning of December 15th? 11 A. About 9:00 a.m. 12 Q. Okay. 13 Gaines in the loop? 14 A. 15 calls. 16 Q. 17 night -- let me ask you this. 18 Did you -- what, if anything, did you do to keep Dan I would have been sending him e-mails more than phone Okay. Have you found anything -- during the previous Do you know what a super user account is? 19 A. In the context of our system, yes. 20 Q. Okay. 21 user account is? 22 A. 23 levels for employees, who needed what level of access to the 24 system. 25 access levels and teach the newsrooms what those access levels What is a super user? How do you know what a super Because I was responsible for helping determine access And I trained my team on how to understand those KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 513 1 were. So -- 2 Q. 3 the CMS, the Tribune CMS system in 2010. 4 A. 5 edit content, delete content, edit or delete users, change 6 permissions of users within the content application itself. 7 Regardless of where you worked, regardless of your job duties, 8 you could change anything in the application and in the 9 software. Please explain to the jury what a super user account was on In the context of our system, a super user account could 10 Q. All right. That night of December 14th, what did you do to 11 investigate what credentials had super user level access or 12 permissions? 13 A. Access the list of super users in the program. 14 Q. Okay. 15 A. Yes. 16 Q. Do you recall any of them? 17 A. Yes. 18 Q. Okay. 19 A. Anon1234 and arseface were two super user accounts that we 20 deleted that had no legitimate purpose in the system. 21 Q. Did any stick out to you? Which ones did you report back to Dan Gaines? Okay. 22 MR. SEGAL: 23 Exhibit 128 into evidence. 24 long time. 25 THE COURT: Actually, Your Honor, I offer Government This one has been in the book for a Any objection? KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 514 1 MR. EKELAND: 2 THE COURT: No objection, Your Honor. All right. 128 is admitted. 3 (GOVERNMENT'S EXHIBIT 128, e-mail dated 12/14/10, 4 ADMITTED INTO EVIDENCE.) 5 BY MR. SEGAL: 6 Q. 7 accounts anon1234 and the other one? What did that mean to your work that there were super user 8 MR. EKELAND: 9 THE COURT: 10 MR. EKELAND: 11 THE COURT: 12 MR. EKELAND: 13 mean to your work? 14 THE COURT: Objection. What's the objection? Sorry. I didn't hear Your Honor. What is the objection? It's vague and overbroad. What does it It's also compound if I understand, so 15 sustained. 16 BY MR. SEGAL: 17 Q. 18 your work planning was it and your incident response -- how 19 important to your incident response was it that you had found a 20 user ID called anon1234? How important to your next few days -- how important to 21 MR. EKELAND: 22 THE COURT: 23 BY MR. SEGAL: 24 Q. 25 account arseface? Objection, same objection, Your Honor. You're characterizing in the question. What is the significance of your finding a super user KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 515 1 MR. EKELAND: 2 THE COURT: 3 Objection, same objection, Your Honor, Well, you can answer that. If there's any significance, you can answer that. 4 THE WITNESS: By discovering these super user accounts, 5 it told us that a level of access that was supposed to be 6 reserved for a handful of central corporate employees had 7 accounts we didn't recognize. 8 security breach. 9 BY MR. SEGAL: So that was a significant 10 Q. You say security breach. Why is that? 11 A. They were accounts with enormous power in our system that 12 we could not recognize and appeared to have no legitimate 13 purpose. 14 they had been there, and that's incredibly concerning. 15 Q. 16 accomplishing with regard to accounts like that? 17 A. Deleting them. 18 Q. Okay. 19 A. At this time -- I know earlier I said six to eight. 20 was in the context of the market services team. 21 I had about 35 directly to me. 22 Q. Can you look, please, at Government Exhibit 129. 23 A. Yes. 24 Q. Do you recognize that? 25 A. I do. We didn't understand why they were there, how long And what did you have to spend the next several days Sir, how many people reported to you? That At this time, KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 516 1 Q. That's one of your e-mails as well? 2 A. Yes. 3 Q. Who is Robin Ross or who was she? 4 A. She was the manager of the unix server team. 5 Q. And what's being tallied as of December 16th of 2010? 6 MR. EKELAND: 7 THE COURT: 8 THE WITNESS: 9 Objection. Overruled. She provided a list of hours that her team spent responding to this security incident and tightening 10 our security controls. 11 BY MR. SEGAL: 12 Q. And what did break fix hours mean? 13 A. Break fix hours were -- I would compare -- 14 THE COURT: 15 MR. EKELAND: 16 THE COURT: 17 MR. EKELAND: Hold on. What's the objection? Calls for speculation. Sustained. I don't know if he's got -- 18 BY MR. SEGAL: 19 Q. Do you know what break fix hours mean? 20 A. Yes. 21 Q. How do you know? 22 A. From the context of operating and supporting the software 23 for four years of my career. 24 Q. 25 December of 2010? Were you personally involved in the break fix in mid KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 517 1 A. Yes. 2 Q. What does break fix hours mean? 3 A. Break fix I would compare to locking a door, closing a 4 window. 5 a bug, be it a crash, be it an outage, it is stopping the 6 bleeding. 7 Q. Who is Brian -- 8 A. Heusinkveld. 9 It is taking action as a result of an incident. MR. SEGAL: Be it I'll spell that for the reporter. 10 H-E-U-S-I-N-K-V-E-L-D. 11 Q. Who is that? 12 A. One of the best system administrators I've ever worked 13 with. 14 Q. Did you personally observe him working on this project? 15 A. I did. 16 Q. Who is Sabrina Downard? 17 A. Another system admin. 18 Q. Conor Casey? 19 A. System admin. 20 MR. EKELAND: 21 THE COURT: Objection, Your Honor, relevance. Overruled. 22 BY MR. SEGAL: 23 Q. Craig Hancock? 24 A. They may not all have the title, but their functions were 25 unix server administrators, everyone on this list. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 518 1 Q. Satish -- can you pronounce that? 2 A. I can't help you with that. 3 4 MR. SEGAL: Brian I can help with. I'm going to spell it for the reporter. S-A-H-A-S-R-A-B-U-D-H-E. 5 THE WITNESS: 6 BY MR. SEGAL: 7 Q. 8 Same team, same job. Computer guy? Joe Bazooka? 9 A. Bezouska, but we called him Bazooka Joe. 10 Q. Okay. 11 A. Same team, unix server admin. 12 Q. And Robin Ross you already described? 13 A. Manager of that team. 14 Q. Okay. 15 worked the break fix hours indicated in this e-mail? 16 A. No. 17 Q. Okay. 18 A. Yes. 19 Q. How do you know they worked the incident? 20 A. I worked it with them and observed them firsthand. 21 Q. Okay. 22 to any other security incident that happened on CMS while you 23 were at Tribune? This is a yes or no. Do you know if these people Do you know if they worked the incident? In terms of urgency, how does this incident compare 24 MR. EKELAND: 25 THE COURT: Objection, calls for speculation. Sustained. You can lay a foundation if KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 519 1 you're able. 2 BY MR. SEGAL: 3 Q. 4 incidents? 5 A. No significant ones outside of December 2010 that I recall. 6 Q. This one? 7 A. I said outside of this incident of December 2010, no. 8 Q. All right. 9 other incidents you're thinking about? 10 A. So when you were at CMS, did you have other security So how does this one compare to any of the Night and day. 11 MR. EKELAND: Objection, asked and answered. 12 THE COURT: Overruled. 13 MR. SEGAL: All right. 14 Q. How much time did you personally spend on this incident? 15 A. This incident being -- 16 Q. Good point. 17 e-mail list. 18 I'm sorry. Let's start with the X files Is that specific -- with the KTXL piece, how much did you 19 spend on that? 20 A. 21 and the distance of five years, I would say I spent about five 22 hours on the initial investigation, probably 20 hours helping 23 direct the, what I call, remediation afterwards. 24 would be putting a deadbolt on your door, you know, just better 25 protecting the house. I spent -- with these e-mails refreshing my recollection The analogy KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 520 1 Q. Okay. 2 A. So 25 hours on the Fox Mulder e-mails. 3 Q. Okay. 4 right? 5 A. Yes. 6 Q. Okay. 7 on the same CMS system, how much time did you spend on incident 8 response? 9 A. 15 hours. 10 Q. 15 hours. 11 So -- but five hours on incident response; is that And on L.A. Times with -- for that internal customer Okay. Did you have a lower -- did you once give us a slightly 12 lower estimate for KTXL? 13 A. When we spoke on Wednesday I did. 14 Q. Okay. 15 A. Reviewing these e-mails and seeing how much work went 16 into -- we did more than I remembered before the L.A. Times 17 incident. 18 Q. Okay. 19 A. Yes. 20 Q. Okay. 21 already of everyone. 22 A. 23 for 2010, and Tribune reported paying me 170,000 for the year. 24 Q. That's 170 on your W-2? 25 A. Correct. And what changed? So that's a total of 20 hours? And, I mean, everybody has heard everyone ask this What was your salary in December of 2010? I don't recall my salary, but I looked at my tax statement KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 521 1 Q. And that's for calendar year 2010? 2 A. Yes. 3 Q. Okay. 4 compensation for your personal services? 5 A. Yes. 6 Q. Okay. 7 can we assume a 52-week year? 8 A. Yes. 9 Q. Okay. And that's -- well, it's your W-2 so that's Were you -- for that you were expected to work 52 -- And we saw that you sometimes worked late, but can 10 we assume a 40-hour week? 11 A. If you'd like. 12 Q. Technically what were they paying you for? 13 A. 40 hours a week. 14 Q. Okay. 15 A. Yes. 16 Q. Okay. 17 18 But you're a hard worker when you have to be? MR. SEGAL: That's all I have on direct. All right. Cross-exam. Thank you. 19 THE COURT: 20 MR. EKELAND: 21 All right. Yes, Your Honor. It's going to take a second because we have -- we've just got all these exhibits. 22 (Pause in proceedings.) 23 CROSS-EXAMINATION 24 BY MR. EKELAND: 25 Q. Good morning, Mr. Jedlinski. Am I saying that right? KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 522 1 A. Yes. 2 Q. My name is Tor Ekeland. 3 over there at the table. 4 Jaffe, my co-counsel. 5 about what you just testified to. 6 I represent defendant Matthew Keys And that's Jay Leiderman and Mark I'm going to ask you a few questions I want to just go to the subject area of the hours that you 7 spent working on the responses to -- we call them the Cancer 8 Man e-mails. 9 e-mails. 10 I believe Mr. Segal was calling them the X files As a normal part of your job, did you log your hours? 11 A. No, I did not. 12 Q. Did you use any kind of timer when you recorded your time 13 that you spent on these e-mails? 14 A. No, I did not. 15 Q. Okay. 16 the L.A. Times website article, you didn't use a timer to 17 record your time for that? 18 A. No. 19 Q. Okay. 20 response to it. 21 last night, and I scanned them, so I'm hoping I'm understanding 22 what I'm reading in them from, you know, my quick read of them. 23 Maybe you can correct me if I'm wrong. 24 25 Turning your attention to the December 14th edit of Now just turning to the L.A. Times edit, your I just got -- I just got your e-mails late But as part of your response, when you looked at the accounts that were able to access the CMS, you discovered that KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 523 1 there were a number of old accounts for employees that were no 2 longer at Tribune, correct? 3 A. Yes. 4 Q. And you went about -- part of your response was actually 5 cleaning up the system and removing a bunch of users that 6 shouldn't have been there because they left the company? 7 A. Yes. 8 Q. And you found additional accounts and whatnot that you 9 needed to remove as well, correct? 10 A. Yes. 11 Q. So it's fair to say that a good portion of your time was 12 just spent actually cleaning up the system because there were 13 all sorts of users who shouldn't have had access to the CMS 14 system; is that correct? 15 A. Correct. 16 Q. Then I just want to go real quick to what -- your 17 understanding of what happened on December 14th with the L.A. 18 Times edit. 19 Now it's correct that a user named N. Garcia is what was 20 used to access the CMS system, correct? 21 A. Username N. Garcia edited that story, correct. 22 Q. Right. 23 So it was a username N. Garcia with a password accessed the 24 system, and then they edited the story; is that correct? 25 A. Yes. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 524 1 Q. So -- okay. And so essentially when the CMS, you know, got 2 the N. Garcia username and got the password, the system 3 basically let N. Garcia in as if it was a valid username and 4 password combination. 5 Garcia was able to edit the L.A. Times article exactly as any 6 other authorized user on the CMS would be able to do? 7 A. I'll say yes. 8 Q. Sure. 9 A. I don't have direct knowledge that that's what happened in And whoever was using that username N. May I qualify that? 10 this incident. 11 how the system is designed to work, but I couldn't testify that 12 that is how that person or any person on that day made that 13 change. 14 Q. Right. 15 A. What you described is exactly how it's supposed to work, 16 yes. 17 Q. 18 It is by far the most likely scenario. That's But -- Right. And that's your understanding of what happened, correct? 19 MR. SEGAL: Asked and answered. 20 THE COURT: Overruled. 21 THE WITNESS: 22 But I would expect it to have worked that way because 23 that's how it's supposed to work, but I don't know yes or no. 24 I have no facts either way. 25 looking at how did that person do that. I have no knowledge either way. I never -- I was never involved in I was focused on KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 525 1 making sure it didn't happen again. 2 BY MR. EKELAND: 3 Q. 4 cleaning up the CMS system because it's fair to say that it was 5 full of accounts that were no longer active or shouldn't have 6 been on there, correct? 7 A. 8 accounts that did not belong, yes. 9 Q. 10 And as you testified, part of that response was basically I wouldn't characterize it as full, but there were many Okay. So there were many accounts that didn't belong on there. 11 And do you recall -- you reviewed all these e-mails that 12 you turned over to the government yesterday at 3:30, right? 13 A. Yes. 14 Q. And do you recall saying in your e-mails that the CMS 15 system -- I'm sorry. 16 Let me back up. As part of your response, it's my understanding that as you 17 were looking at all these unauthorized accounts or old 18 accounts, you essentially reset the usernames and passwords for 19 the system; is that correct? 20 A. 21 account. 22 Q. 23 then you sent out e-mails to those accounts saying, hey, we 24 need confirmation that you're an actual account, and we'll let 25 you back in? For accounts that we could not confirm, yes. Okay. So -- okay. Not for every So there were a certain number -- and KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 526 1 A. 2 users, the whole universe, if you can't get in, here's why. 3 Q. Right. 4 A. So we didn't just notify the people who we reset. 5 the ones we couldn't vouch for and then told everyone, if 6 you're having trouble getting in, please do these steps. 7 Q. 8 9 We reset suspicious or unknown accounts and then told all We reset Right. And do you recall writing in these e-mails that I saw last night that the CMS was functioning normally at this time? 10 A. 11 functioning normally. 12 night of December 14th, as we were removing so many accounts, 13 users could not log in to the content management system. 14 Q. Right. 15 A. The software was working, but journalists in several 16 newsrooms had problems logging in because we were cleaning up 17 so much. 18 Q. 19 20 The content management -- the content management system was What I said in the e-mail was, on the Okay. MR. EKELAND: Well, thank you very much. No further questions. 21 THE COURT: Any redirect? 22 MR. SEGAL: Yes, Your Honor. 23 REDIRECT EXAMINATION 24 BY MR. SEGAL: 25 Q. So this process of killing passwords, is that a fair way KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 527 1 to -- do you know what I mean when I say that? 2 A. Yes. 3 Q. Okay. 4 explain how it fits into the burglarized house, the analogy 5 that you used before? This process of killing user accounts, can you 6 MR. EKELAND: 7 THE COURT: 8 THE WITNESS: 9 What's its function? Objection. Overruled. Changing the locks so people that had a key that shouldn't have a key couldn't get back in. 10 BY MR. SEGAL: 11 Q. 12 had been used? 13 A. And what concerned you about the way that the N. Garcia key It was used to deface a story on latimes.com. 14 MR. EKELAND: Objection. 15 MR. SEGAL: Within the house analogy. 16 THE COURT: You may answer. 17 THE WITNESS: It would be as if someone was in the 18 house writing on the walls. 19 BY MR. SEGAL: 20 Q. 21 your systems? 22 A. What are you referring to by this? 23 Q. Thank you. 24 25 And was this all part of your restoring the integrity of Finding unauthorized user accounts and killing them. A. That was the most important thing we could do at that KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 528 1 moment. 2 Q. Okay. 3 MR. SEGAL: Thank you, Your Honor. 4 THE COURT: Anything further, Mr. Ekeland? 5 MR. EKELAND: 6 THE COURT: 7 No, Your Honor. All right. This witness is excused, Mr. Segal? 8 MR. SEGAL: Yes, Your Honor. 9 THE COURT: Mr. Ekeland? 10 MR. EKELAND: 11 THE COURT: 12 Thank you. Yes, Your Honor. All right. You may step down, sir. excused. 13 The government's next witness? 14 minutes. 15 in, feel free. We have about 20 more If you want to stretch while this witness is coming 16 Who is the government calling now? 17 MR. SILVER: 18 THE COURT: 19 20 You're The government calls Alan Russell Schmidt. All right. (Pause in proceedings.) THE CLERK: Mr. Schmidt, please come forward. You can 21 set your boxes on the counter there, and then I need to take 22 your photograph. 23 You can just set them on the counter in front of where 24 you'll sit. If you can stand here in front of the wall, sir. 25 I need to take your photograph this morning. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 529 1 Judge, can I do the photo at the end? 2 THE COURT: That's fine. 3 THE CLERK: If you'll step into the witness stand, 4 remain standing and raise your right hand. 5 ALAN SCHMIDT, GOVERNMENT'S WITNESS, SWORN 6 THE WITNESS: 7 THE CLERK: 8 Will you please say and spell your first and last name 9 I do. Thank you. You may be seated. for the record. 10 THE WITNESS: 11 THE COURT: 12 MR. SILVER: 13 Alan Schmidt. A-L-A-N, S-C-H-M-I-D-T. You may proceed. Thank you, Your Honor. DIRECT EXAMINATION 14 BY MR. SILVER: 15 Q. Good morning. 16 A. Good morning. 17 Q. Where do you work, sir? 18 A. For the Federal Bureau of Investigation. 19 Q. And how long have you worked there? 20 A. Since June 2003. 21 Q. And what are your current duties? 22 A. I am a computer analysis response team forensic examiner. 23 Q. And what does that mean? 24 A. That means I am a digital forensic examiner. 25 umm, computers or take data off of anything that really stores I take apart, KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 530 1 data, cell phones, computers, hard drives. 2 Q. What training have you received for this position? 3 A. I started training in February '05 and was certified by the 4 Federal Bureau of Investigation in June '06 to do, ah, 5 forensics on what's called Wintel, which is the Windows 6 operating system on the Intel platform. 7 was certified in Mac for Mac operating system forensics. 8 Q. Have you worked on the investigation of Matthew Keys? 9 A. Yes. 10 Q. Can you describe how your involvement in that investigation 11 started? 12 A. 13 response team, we use the term CART in the FBI. 14 Yes. And then later on, I The case agent submitted a -- the computer analysis So he -- 15 Q. I'm sorry. 16 A. Computer analysis response team. 17 CART stands for something? And so the case agent submits a CART service request 18 requesting that evidence that, ah, we obtain in the case be 19 processed and available for review. 20 Q. And what did you do in response to that request? 21 A. I checked the evidence out of our evidence control room and 22 proceeded to follow our standard operating procedures to make 23 an exact duplicate image of the media, ah, that was obtained in 24 the case. 25 Q. What's in the boxes? KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 531 1 A. This is the evidence that I checked out and processed and 2 prepared for the case agent. 3 Q. You said earlier an exact forensic copy; is that right? 4 A. Yes. 5 Q. Can you explain to the jury what that means. 6 A. That means I take the hard drive -- in this case, there was 7 a laptop and two external hard drives. 8 out of the laptop. 9 had a piece of hardware attached to it that prevented anything It's the original evidence. I took the hard drive I plugged it into one of my systems that 10 from my computer writing to the original evidence hard drive. 11 And then, in addition, my computer is installed with software 12 that prevents -- that mounts to the piece of evidence or the 13 hard drive as read only. 14 evidence. 15 16 So nothing changes on the original And -Q. 17 Let me interrupt you there. You said it's read only? 18 A. Read only. 19 Q. What does that mean exactly? 20 A. Well, that means that, umm, I can see the data, but I can't 21 write anything to the -- to the piece of media, to the hard 22 drive. 23 Q. 24 blocker? 25 A. I see. So this is a -- I think you said it's a write That's correct. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 532 1 Q. Please continue. 2 A. And then I run some software that makes a forensic -- an 3 image or a bit-for-bit copy. 4 Q. 5 I'm sorry. Let me stop you there again. You said image? 6 A. Image. 7 Q. And bit-for-bit copy? 8 A. Yes, it's a bit-for-bit duplicate of the original. 9 Q. What do you mean by bit for bit? 10 A. Every user-accessible piece of the hard drive, ah, in 11 evidence is copied to an image file, and that is actually our 12 working copy. 13 forward instead of working with the original evidence, so that 14 nothing happens to the original evidence. 15 Q. So after you make the forensic image copy, do you check it? 16 A. I do. 17 a mathematical algorithm and a computation, if you will, that 18 provides a unique value or identifier. 19 creates that for the hard drive, and it creates it for the 20 image, and then it compares the two to make sure that they're 21 identical. 22 Q. 23 one Word document. 24 described? 25 A. That's what we're going to be working with going There's -- as part of the tool that we use, there is And it compares -- it Let's say that on the original one letter was changed on Would that change this value that you just Yes. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 533 1 Q. And so if the two values are the same, what does that mean? 2 A. If the two values are the same, then it's an identical 3 copy. 4 Q. What was the relationship of the two values here? 5 A. They were verified as an exact duplicate. 6 files were verified as an exact duplicate of the original. 7 Q. 8 did it end up? 9 A. My -- my image And what did you do with the exact duplicate copy? Where It ended up -- at the FBI, we have a system that we upload, 10 ah, images to. 11 that's where we do all of our processing and that's where the 12 images ended up for processing. 13 Q. 14 investigation? 15 A. 16 back together, and I resubmit it to evidence control for 17 storage. 18 it for the case agent to review. 19 It's a network attached storage system, and And after uploading it, what was your next step in the So, after that was completed, I put all of the evidence And then I begin processing the image and preparing In this case, we used Access Data Lab, ah, Version 3. 20 Q. Do you have training -- what is Access Data Lab? 21 A. Access Data Lab is a software tool that is -- it basically 22 takes our image file and looks through it. 23 finding files and categorizing those files and putting them 24 into a format that the case agent can more easily look through 25 and -- and locate things that he's looking for in his case. It actually starts KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 534 1 Q. Have you received any training on this Access Data tool? 2 A. I have. 3 Q. What training is that? 4 A. The FBI sends us to regular training. 5 each of the new versions comes out, there's some training that 6 goes along with that. 7 trainer, so I'm able to train people on, ah, the actual tool, 8 the use of the tool. 9 Q. Can you show the jury what's in those boxes? 10 A. I can. 11 Q. Please do. 12 13 THE COURT: MR. SILVER: 15 THE COURT: 16 MR. SILVER: THE COURT: 19 THE WITNESS: 20 THE COURT: THE WITNESS: 23 THE COURT: 25 Are you asking the witness just to remain Yes, Your Honor. -- and open the boxes? All right. Unless the Court has another preference to No, that's the best practice at this point. So, in this -If you need to move binders to the cart behind you to allow a little more stability -- 22 24 And so a lot of training, I guess. approach. 18 21 There is -- I went through training the on the stand -- 14 17 I've been to -- when Thank you. -- you may do that. (Off-the-record discussion with Courtroom Deputy.) THE WITNESS: In this first box, I have -- so in this KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 535 1 first box, I have two envelopes, ah, that contain two brown 2 paper bags that contain the -- this is one of the hard drives I 3 was examining and one of the external hard drives I was 4 examining. 5 And I have -- on both of them, I have written the case number, 6 the evidence item that we give it, which is -- this particular 7 one is 1B2, hard drive zero -- and the date I examined it and 8 my initials. 9 10 This one is the same. It's got the case number, 1B3, hard drive zero, and the date 12/19/2012 and my initials. 11 12 This is the other hard drive that was examined. The documents inside the box are our chain of custody and description of the items. 13 In the larger box, I have a brown paper bag that the 14 actual evidence did get shipped in and then MacBook Pro laptop 15 and power supplier to power the MacBook Pro. 16 the case number, the date and initialed it as well. And I also put 17 MR. SILVER: 18 At this time, Your Honor, nothing further with this 19 Thank you, sir. witness. 20 THE COURT: All right. Any cross? 21 MR. LEIDERMAN: 22 THE COURT: 23 MR. LEIDERMAN: 24 THE COURT: Pardon me? 25 MR. SEGAL: Your Honor, this might be a good time for a No cross. All right. Did we fill 20 minutes? KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 536 1 2 3 break because we've got to put on Agent Cauthen. THE COURT: Well, we'll let Mr. Schmidt gather up his items, and then Ms. Schultz still needs to take your photo. 4 Are you ready for that now, Ms. Schultz? 5 THE CLERK: Fingers crossed. 6 THE COURT: All right. 7 8 9 10 And then we will plan on taking our break. But just to -- I think the best choreography is to allow the witness to complete his work and leave before you leave, so just hold on a minute or two. 11 THE CLERK: 12 THE WITNESS: 13 THE CLERK: 14 THE WITNESS: 15 THE COURT: Sorry. Let's try the picture again. Sure. Thank you. We'll all set. Thank you. Thank you. All right. Ladies and Gentlemen of the 16 jury, we have come to a good time for the morning break. 17 think this will be at least a 20-minute break given some of the 18 housekeeping we have to do. 19 During the break, as always, please remember my 20 admonitions not to discuss the case or do any research. 21 anyone attempts to reach out to you, let me know. 22 Have a good break. 23 (Jury not present.) 24 THE COURT: 25 e-mail set. I If We'll be back as soon as we can. All right. Two things really. One is the My exhibit list, just so you know, jumps from 127 KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 537 1 to 201. 2 MR. SEGAL: May I approach, Your Honor? 3 THE COURT: Yes. 4 MR. SEGAL: Okay. 5 There's a reason for that, which is that we got these e-mails yesterday. 6 THE COURT: Well -- okay. I see that. So the exhibit 7 list you meant to give the Court did stop at 127 leaving the 8 possibility of an additional 100 series. 9 MR. SEGAL: Yes. 10 THE COURT: All right. 11 point that 128 had always been in the binder. 12 13 MR. SEGAL: THE COURT: MR. SEGAL: No, it's been -- you know, I mean, it's MR. HEMESATH: 19 additional exhibits. 20 counsel. 21 believe. THE COURT: 23 MR. EKELAND: binder. I'm sorry. Your Honor, there were two sets of They've all been discussed with defense 128 was added to everyone's binder yesterday, I 22 25 And there was no objection, so I'm just hard on Friday, Judge. 18 24 I know trying to get clear on any disconnect. 16 17 I must have been wrong about that. we added 128 before last night. 14 15 So -- but you had said at one All right. Well, the -- That's correct. We had it in your So -MR. HEMESATH: So what I can do is get you a new KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 538 1 exhibit list as soon as I possibly can that reflects those 2 changes. 3 4 THE COURT: You can do that. Obviously the key is -- I'm just trying to figure out timing here. 5 So the set covered with -- I'm sorry -- 6 MR. SEGAL: Jedlinski. 7 THE COURT: -- Jedlinski is really 133 to 138? 8 MR. SEGAL: I'll have to go back and -- I didn't move 9 every one of them in either, so -- 10 MR. LEIDERMAN: 11 THE COURT: 12 MR. HEMESATH: 13 MS. WALDROP: 14 MR. HEMESATH: I see 129 is the table. All right. It would have started at 129, I believe. To 138. There were 10 additional exhibits. And 15 to be exceedingly clear about what else was added, there was an 16 additional exhibit that we also handed over last night with 17 regard to the power point slides, the Assembler logs. 18 THE COURT: 19 MR. HEMESATH: 20 What exhibit numbers are those? And that was in light of the meet and confer. 21 THE COURT: What was that? 22 MR. HEMESATH: 307 was added last night, and 303 was 23 added the day before that. 24 THE COURT: 25 MR. HEMESATH: 303 is in. It's in, but it's probably not on your KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 539 1 exhibit list. 2 THE COURT: 3 MR. HEMESATH: 4 I handwrote it in. Okay. So 307 was added last night. controversial, just not on your list. 5 THE COURT: I just want to talk about Jedlinski at this 6 point. 7 Mercer with additional material. 8 representation is it did not have these until Wednesday. 9 Some of the e-mails are e-mails covered with Brandon MR. SEGAL: So the government's Representation with witness testimony. 10 MR. EKELAND: 11 THE COURT: 12 MR. LEIDERMAN: 13 Not And we don't dispute that, Your Honor. All right. So -- We had them very late last night. I don't think we got them until after 9:00 o'clock. 14 MR. SEGAL: 15 MR. EKELAND: Well, there's a little bit -Just to clarify, the government, when we 16 met to talk about the power point slide show, gave me a disk of 17 these e-mails. 18 went to go open the disk, I couldn't open it up. 19 little bit of time figuring out how to get these e-mails open. 20 I got them probably open about 9:30 last night. 21 22 23 I went back to the hotel to work, and when I MR. LEIDERMAN: We spent a To be fair, the government was rather helpful. MR. EKELAND: Yeah, this is not -- I don't see any bad 24 faith there on the part of the government. I think this stuff 25 just showed up at the last minute, and now we're dealing with KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 540 1 it. 2 MR. SEGAL: If you want more complexity, we -- 3 THE COURT: Well, the defense has had a chance now to 4 ask questions. 5 believe any portion of the Mercer e-mail came in or was 6 reviewed with Mr. Mercer. 7 My main question was about 137, which I don't MR. SEGAL: I don't need 137 in. 9 THE COURT: All right. 10 MR. SEGAL: I mean, he's testified to -- the importance 8 I'll just withdraw it. 11 of this e-mail -- well, you don't care. 12 it. 13 THE COURT: All right. I just said I withdraw Which other -- is the 14 government attempting to introduce in that series between 129 15 and 138? 16 17 18 MR. SEGAL: Could I have one minute with co-counsel to answer that question? THE COURT: Why don't you meet and confer during the 19 break and just be clear which ones does the government want in 20 and which ones is the defense objecting with 137 withdrawn. 21 MR. EKELAND: Okay. 22 MR. SEGAL: And then -- 23 THE COURT: And then on the completeness, so help me 24 understand the defense argument. It is the case as a general 25 rule, is it not, that a defendant, if he doesn't testify, KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 541 1 doesn't have the right to get in exculpatory testimony through 2 a back door. 3 So that's a guiding principle. MR. LEIDERMAN: That's true unless, of course, it helps 4 understand the testimony in light of what's given. 5 were a lot of -- there were a lot of answers that were 6 revisited. 7 becomes, well, what I told you before about this -- and I don't 8 remember -- I have specifics. 9 And there And, you know, as you go through the transcript, it THE COURT: I understand that, and I've read -- I've 10 read most of -- but it seems to me there are portions that 11 don't need to be played, at least certain portions that just 12 are truly tangential or don't provide necessary context. 13 MR. LEIDERMAN: 14 THE COURT: 15 Have you gone through and pinpointed where the essential context is? 16 MR. LEIDERMAN: 17 THE COURT: 18 Okay. No, I have not. All right. I think that's -- without that, unless your argument really is the whole -- 19 MR. LEIDERMAN: I think the whole -- I think the whole 20 tape should come in because it shows the whole manner of what 21 goes on. 22 You have a repetitive theme from Agent Cauthen that 23 we're the government, we're your friends, we're not here to 24 hurt you, we're here to help you, we need you to tell the 25 truth, and that informs his testimony in each regard. I mean, KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 542 1 it is said -- as you look at, for example, the beginning 2 portions, it is said in repetition before any substantive or 3 important question is asked. 4 THE COURT: No, I understand all of that. 5 And the prosecutor isn't -- is expressly not seeking to 6 have the testimony or the statement of Agent Cauthen that 7 prosecutors are people, too, which -- 8 MR. SEGAL: All I want -- 9 THE COURT: Here it's an agent, and the agent concedes. 10 So here are my questions just looking at what I've 11 looked at. 12 change of tape? 13 14 15 16 17 18 First of all, the second recording, is that just a MR. SEGAL: He was wearing two devices just to make THE COURT: But -- so that's my question. sure. Are there two recordings? MR. SEGAL: There are two recordings of the same conversation 19 THE COURT: Are they identical? 20 MR. SEGAL: You know, one of them was in his -- they're 21 identical in that -- 22 THE COURT: Mr. Hemesath just shook his head. 23 MR. SEGAL: It's because one starts a little later than 24 25 the other. MR. LEIDERMAN: There you go. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 543 1 2 MR. SEGAL: It starts at different times. Other than that, yeah, it's the same conversation. 3 THE COURT: So is this the most inclusive -- 4 MR. SEGAL: The transcript is a composite of where the 5 agent kind of listened to both recordings and did the best he 6 could to convey what happened. 7 not both recordings. 8 best captured that point in the conversation. 9 10 11 12 We've got -- our snippets are Our snippets are from the device that MR. LEIDERMAN: Which, of course, didn't capture the beginning where they woke him up out of bed. THE COURT: Well, that's -- at least there's reference to that in what I have. But -- so this is a cut and paste? 13 MR. SEGAL: No. 14 THE COURT: My -- is there something that would 15 No. The -- represent the most inclusive transcript that has everything? 16 MR. SEGAL: That's it. 17 THE COURT: This is it? 18 MR. SEGAL: Yes. 19 THE COURT: You agree with that? 20 MR. LEIDERMAN: 21 THE COURT: All right. 22 MR. SEGAL: Now -- 23 THE COURT: Do we know the start time? 24 MR. SEGAL: It's probably on the -- it's probably on 25 the warrant, on the return. I do agree with that, yes. I don't know exactly. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 544 1 THE COURT: All right. 2 MR. LEIDERMAN: 3 THE COURT: Is it? So then, I mean, I think one contextual 4 would be to identify the date and the time of the recording. 5 But then -- here's -- there are some examples where I think 6 there is context that has not been included based on what's 7 highlighted to provide some clarity -- 8 MR. SEGAL: For example, Your Honor? 9 THE COURT: -- of what Mr. Keys is saying. 10 MR. SEGAL: Okay. 11 THE COURT: Well, on page 15, I understand the 12 recording says -- starts with Mr. Keys' statement, "Just wanted 13 to get that out." 14 15 16 17 None of that is included. MR. SEGAL: Is the Court looking at ECF document 72 THE COURT: I'm looking at what I was handed as a or -- transcript -- 18 MR. SEGAL: Last night? 19 THE COURT: -- the most -- whatever you provided 20 Ms. Schultz, who gave to me the current set -- 21 MR. SEGAL: Okay. 22 THE COURT: -- of the excerpts. 23 MR. SEGAL: Okay. 24 THE COURT: So just -- it's minor, but on page 15, it 25 would appear that some of the lines above "Just wanted to get KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 545 1 that out" should come in for context. 2 MR. SEGAL: Okay. 3 THE COURT: On page 19 -- 4 MR. SEGAL: I need to catch up with you, Your Honor. 5 THE COURT: I'm just giving you some examples here, 6 because I think the problem is, in terms of timing, either I'm 7 going to give you back a copy of this transcript indicating 8 additional material that needs to be added -- and I don't know 9 how quickly you can move to do that. 10 So there are at least certain cases where I believe context needs to be added. 11 So the question for the government would be would you 12 simply want to play the whole tape or wait for preparation of 13 something that includes context? 14 as I understand it, the recording begins "I didn't want to do 15 the logging." If you're looking at page 19, 16 I think that requires going back to page 18 -- 17 MR. SEGAL: Okay. 18 THE COURT: -- to clarify what the logging refers to. 19 MR. SEGAL: So I think we're looking at different 20 versions actually. 21 THE COURT: 22 23 We plan -Well, I'm looking at what you represented to me is -MR. HEMESATH: I believe what I sent Ms. Schultz 24 yesterday, and I'm reading directly from that attachment, has 25 all of the 19 highlighted. Is that what you're looking at? KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 546 1 THE COURT: It does have all 19 highlighted. My point 2 is, at the top, it says "I didn't want to do the logging." 3 I do think for context -- I believe the last excerpt doesn't 4 say anything about logging. 5 MR. HEMESATH: 6 THE COURT: 7 MR. HEMESATH: 8 THE COURT: 9 The last excerpt? Which is on page 17. Okay. Right? So if you're going to make sense of logging, you really need to start on page 18. 10 11 So MR. SEGAL: We're not just going to play these in a single stretch. 12 THE COURT: Well, that's my next question. 13 MR. SEGAL: So we can explain, you know, did you ask 14 him about logging, what is logging, and then play -- and then 15 play that recording. But it's not just going to be like a -- 16 THE COURT: No, I understand that's your plan. 17 MR. SEGAL: Okay. 18 THE COURT: There's still the question of context. 19 MR. SEGAL: If the context is the meaning of that word, 20 we can explain it without, you know, finding some part of the 21 tape. 22 Because this is a conversation between -THE COURT: Even if Mr. Keys' statements are not just 23 exculpatory but provide meaning to his answers, isn't there a 24 possibility that there is non-exculpatory text that you have 25 not included that provides -- that explains what he is saying? KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 547 1 MR. SEGAL: So here's the thing. I don't know. I'm 2 not here to make the defendant's argument. 3 that there's a single piece -- they have not attempted to do 4 what you're doing, which is to go hunt around for six lines of 5 text -- 6 7 THE COURT: They haven't argued Well, where is the burden? as a gatekeeper to ensure -- 8 MR. SEGAL: Right. 9 THE COURT: -- fundamental fairness. 10 MR. SEGAL: Right. 11 I have a duty hearsay. And your duty -- and this is not That is -- it's in, right? The question is just -- 12 THE COURT: Yeah, it's not hearsay. 13 MR. SEGAL: Oh, sure. And so then the next question 14 is, if they want to offer some other piece of evidence on the 15 argument that we opened the door, this is evidence that -- that 16 will come in in their cross as part of their effort to show 17 that what we played is misleading or incomplete. 18 19 20 21 22 23 THE COURT: So are you going to object to their playing any portion? MR. SEGAL: Yes, unless they can show the foundational showing that what we showed -- what we selected was incomplete. THE COURT: I understand all that. But on rule of completeness, who has the burden? 24 MR. SEGAL: They do. They -- 25 THE COURT: But then they're saying the entire -- their KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 548 1 fundamental position is the entire recording. 2 MR. SEGAL: Right. 3 THE COURT: So does that not then obligate me to 4 considerate the entire recording and whether or not they have a 5 point? 6 MR. SEGAL: I think what you have to -- what you have 7 to answer is the argument that they have made, which is that 8 you need to know -- the jury needs to be made to understand 9 the -- kind of the idea that the agent is, you know, engaging 10 in this sort of ordinary rapport building. 11 professionals, I'm a nice guy, blah, blah, blah, that makes 12 people confess. 13 Hey, we're two And that is precluded by United States versus Vallejos, 14 which is Ninth Circuit 742 F.3d 902, where the Ninth Circuit 15 expressly rejected this idea that a defendant can bring in his 16 own cross-examine -- his own cross-examined, out-of-court 17 statements to give the flavor of the interview. 18 interview is actually the Ninth Circuit's -- the exact language 19 of the argument -- 20 THE COURT: 21 22 23 24 25 the interview. Flavor of the It's not -- I don't care about flavor of I'm talking about essential context. MR. SEGAL: Right, but he is. That's the only argument they're making. What the Court, if I understand correctly, is worried about is I, as the Court -- you, as the Court, cannot let in KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 549 1 some defendant's statement absent some showing -- absent some 2 idea that it's been kind of previewed for the jury as complete, 3 and that's not how it works. 4 The way it works is we put in something. They try to 5 make an argument that we have opened the door to more testimony 6 or -- I'm sorry -- a larger part of that statement, and it 7 would come in during cross-examination. 8 have not -- but the way that they're -- 9 THE COURT: But that's -- they So, at most, your position is it doesn't 10 matter, you get to play these, and then the only debate is do 11 they get to play additional portions during cross? 12 13 MR. SEGAL: Right. And their bet is all or nothing right now. 14 THE COURT: That's what they've argued. 15 MR. SEGAL: Yes. 16 THE COURT: So, Mr. Leiderman, response to that 17 argument? I mean, I have been here before. 18 MR. LEIDERMAN: 19 THE COURT: 20 MR. LEIDERMAN: Right. But I'm just trying to -Well, let's start with the practical 21 matter is I don't believe we have the software to cut it up. 22 So, as a practical matter, we wouldn't be able to do such a 23 thing, number one. 24 25 Number two -- well, maybe we could find somewhere to buy it and download it this weekend, I don't know. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 550 1 But, number two, what the Court is talking about are 2 small portions that place context into what the government is 3 saying, which, of course, would be out of context in 4 cross-examination or in our part of Agent Cauthen's 5 presentation. 6 7 THE COURT: Does the transcript give you what you need for effective cross? 8 MR. LEIDERMAN: 9 THE COURT: 10 For impeachment? MR. LEIDERMAN: 11 of the transcript. 12 THE COURT: The transcript does, yes. Yes. I can certainly ask questions out So is there -- what's the essential 13 prejudice if that's the way we proceed, the government plays 14 its cherry-picked portions, and your cross using the 15 transcript? 16 MR. LEIDERMAN: 17 THE COURT: 18 MR. LEIDERMAN: 19 THE COURT: What's the essential prejudice? Uh-huh. I don't know that there is. All right. 20 it. 21 conclusion during the break. 22 about the exhibits. 23 Well, that may be the end of But -- I'll let you know if I'm -- if I reach any other MR. LEIDERMAN: You're going to meet and confer I mean, I think the problem is going to 24 be is that I'm going to want to ask questions on larger areas 25 than the government is going to want to allow questions on. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 551 1 We're going to come to loggerheads consistently on that 2 portion -- on that issue. 3 4 5 6 7 8 9 10 11 THE COURT: And then I would resolve on an objection-by-objection basis -(Counsel conferring.) THE COURT: All right. MR. SEGAL: I was trying to save the Court time. I apologize. THE COURT: If you want to meet and confer to see if you can figure this out. MR. LEIDERMAN: 13 MR. SEGAL: 15 I'm still here, Mr. Segal. 12 14 I'm still in court. Pardon me? I'd like to hear the Court. I'm sorry, Your Honor. save time, but it didn't. THE COURT: I was trying to I'm sorry. Well, I'm going to ultimately rule on the 16 objection. 17 should be played during the government's case in chief. 18 objection is overruled. 19 think there's anything more I need to do at this time except 20 think about what happens on cross and be ready for objections. 21 22 23 The objection is, I believe, that the whole thing MR. LEIDERMAN: That And given what I've heard, I don't I mean, I think it's going to be a storm of objections. THE COURT: I understand that, but that's where I may 24 try to provide some guidance and just allow a standing 25 objection. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 552 1 MR. SEGAL: Thank you, Your Honor. 2 THE COURT: All right. 3 I'll be back at this point in about 10 minutes. 4 (Recess taken.) 5 (Jury not present.) 6 THE CLERK: Come to order. 7 THE COURT: All right. 8 9 Do you have an agreement? MR. EKELAND: 11 THE COURT: 13 14 We have an agreement, Your Honor. If you have an agreement, quickly tell me what it is. MR. SEGAL: The United States moves in Government Exhibit 130 and Government Exhibit 131. 15 MR. EKELAND: 16 MR. SEGAL: 17 Can we just talk about the exhibits at the end of the day? 10 12 Court is back in session. No objection, Your Honor. And it's my understanding that 128 is already in. 18 THE COURT: Yes. 19 MR. SEGAL: That's all. 20 THE COURT: All right. Thank you, Your Honor. I'll let the jury know that. 21 (GOVERNMENT'S EXHIBIT 130, e-mail, 12/14/10, 10:22 p.m., 22 ADMITTED INTO EVIDENCE.) 23 (GOVERNMENT'S EXHIBIT 131, e-mail, 12/14/10, 10:23 p.m., 24 ADMITTED INTO EVIDENCE.) 25 THE COURT: And I understand that if we get to cross, KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 553 1 Mr. Ekeland would begin the cross. 2 3 Any objection, given Mr. Ekeland's schedule, then, having another attorney pick up on Monday? 4 MR. SEGAL: No, Your Honor. 5 THE COURT: All right. 6 MR. EKELAND: cross, Mr. Leiderman may do it. 8 MR. LEIDERMAN: 10 go. THE COURT: All right. Anyway, you have the flexibility. 13 14 If we're stuck with a real short time period where it's just the beginning, I'll just go ahead and 11 12 That's -- Your Honor, if it's just a half hour of 7 9 Thank you. MR. EKELAND: initially. 15 Yeah. That's not the way we prepared it Trials move as they do. THE COURT: 16 the schedule. 17 today. 18 evidence on Monday. All right. Thank you, Your Honor. And the jury is asking about I will let them know certainly before they leave But it looks as if we're on track to conclude with 19 MR. SEGAL: Yes. 20 THE COURT: They may be instructed on Monday or Tuesday 21 morning. Once they begin deliberating, I let them set their 22 own schedule. 23 want to continue deliberating, for instance, on Tuesday all 24 day, that's fine with me. 25 through my criminal calendar on Wednesday morning, and I would Ms. Schultz has let them know that. So if they And also they could deliberate KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 554 1 just take breaks as needed. 2 MR. SEGAL: Your Honor? 3 THE COURT: Yes. 4 MR. SEGAL: Does this court instruct before or after 5 our argument? 6 THE COURT: 7 MR. LEIDERMAN: 8 9 10 11 12 After. Is there a way we can request the Court to instruct before? THE COURT: You can request. MR. LEIDERMAN: The defense would greatly prefer that and makes that request, Your Honor. THE COURT: I do allow -- you'll have the final 13 instructions before closing, and you may use the final 14 instructions and the verdict form in your closings. 15 MR. LEIDERMAN: 16 THE COURT: 17 MR. LEIDERMAN: 18 Okay. All right. We're allowed to tell them that this is what they're going to be instructed? 19 THE COURT: 20 MR. LEIDERMAN: 21 That's fair enough. Yes. All right. That will allay my concerns. 22 THE COURT: All right. 23 MR. LEIDERMAN: 24 THE COURT: 25 MR. LEIDERMAN: Thank you. All right. Let's bring the jury back in. We should be closed certainly Tuesday KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 555 1 by noon and maybe even early Tuesday morning or, in a miracle, 2 late Monday afternoon. 3 4 5 THE COURT: Before we leave today, you can tell me how long you think you need for closing. All right. (Jury present.) 6 THE COURT: 7 and Gentlemen. 8 witness. 9 You may be seated. Welcome back, Ladies We'll proceed now with the next government Just so you know, I'll tell you more as we go forward, 10 but it does appear we're on track to conclude with the 11 presentation of evidence sometime on Monday. 12 have closing arguments, and I need to instruct you. 13 you a further update first thing Monday morning. 14 we're on track with the original schedule. 15 let you know, once you start deliberating, we let you set your 16 own schedule as long as you let us know so we can be on call. We still will I'll give But I think And as Ms. Schultz 17 All right. 18 MR. SILVER: The United States calls Special Agent John THE CLERK: If you can stand against the wall facing me 19 20 21 22 23 24 25 Next witness for the government. Cauthen. so I can take your picture, I would appreciate it. I think we have it. Judge, we may have to do it again at the end, but I'll try. If you'll step into the witness stand, remain standing, and raise your right hand. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 556 1 JOHN CAUTHEN, GOVERNMENT'S WITNESS, SWORN 2 THE WITNESS: 3 THE CLERK: 4 Will you please say and spell your first and last name 5 Thank you. You may be seated. for the record. 6 7 I do. THE WITNESS: My name is John Cauthen, spelled C-A-U-T-H-E-N. 8 THE COURT: 9 MR. SILVER: You may proceed. Thank you. 10 DIRECT EXAMINATION 11 BY MR. SILVER: 12 Q. Good morning, sir. 13 A. Good morning. 14 Q. Where do you work? 15 A. I work at the FBI. 16 Q. What do you do there? 17 A. Currently I'm an FBI agent in Tampa, where I do computer 18 forensic examinations. 19 computer analysis and response team. 20 Q. What is a computer forensic examination? 21 A. A computer forensic examination entails taking digital 22 media, like a computer or a hard drive that we saw earlier, and 23 we need to identify that media as digital media. 24 is to get the data off of that media, and then we examine it 25 trying to find what's relevant in that vast amount of stuff, I'm a CART examiner. CART stands for Then our job KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 557 1 what's interesting. And then we present it in such a way that 2 the jury or lay people can understand it. 3 Q. 4 special agent? 5 A. That's correct, I'm a special agent. 6 Q. And were you the case agent on the investigation of Matthew 7 Keys? 8 A. Yes, I was. 9 Q. What does it mean to be a case agent? 10 A. In 2010, I was a case agent or an investigator, a special 11 agent here in Sacramento. 12 then was to investigate criminal acts and, ah, collect the 13 evidence and turn my findings in to the U.S. Attorney's office. 14 Q. How long have you been with the FBI? 15 A. I've been an FBI agent since 1996. 16 Q. Have you received any training related to computer forensic 17 examinations? 18 A. Yes, I have. 19 Q. What training have you received? 20 A. I've been a cyber agent since about 2002 when the FBI 21 started the cyber division, and I've received a lot of training 22 regarding computer examinations and cyber investigations. 23 FBI has a lot of courses on that, of course. 24 all the courses I've taken, but I have taken a number of 25 external classes outside of the FBI as well pertaining to cyber In addition to being a CART examiner, are you also a I was on the cyber squad, and my job The I can't highlight KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 558 1 investigations, pertaining to digital forensics. 2 Some of those courses involve testing provided by outside 3 vendors. I've taken the tests, passed them, achieved a variety 4 of certifications in the area of cyber investigations, computer 5 security and digital forensic. 6 Q. You said outside vendors? 7 A. Yes, sir. 8 Q. Outside vendors of what? 9 A. These are companies, third party companies, not government 10 agencies, that provide training and provide testing that 11 validate knowledge in certain areas pertaining to computers. 12 Q. Roughly how many hours of training have you received? 13 A. Ah, hours of training. 14 can't specify specifically how many hours over the past ten 15 years. 16 Q. 17 performed? 18 A. 19 since 2008 as a certified examiner. 20 number, but it's fair to say that I've examined thousands, 21 hundreds if not thousands of computers. 22 Q. 23 kinds of computer systems? 24 A. I do. 25 Q. Are you FBI certified in Linux? I would say roughly hundreds, but I Roughly how many computer forensic examinations have you Again, I've been doing computer forensics for -- at least I don't have a specific Do you have any FBI certifications in forensics for certain KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 559 1 And can you spell Linux for the Court Reporter, please. 2 A. Linux is spelled L-I-N-U-X. 3 Q. What about Macintosh? 4 A. I am certified to examine Macintosh, but only limited to 5 certain types of forensics software. 6 FBI's expert in Macintosh computers. 7 Q. Have you ever taught computer forensics to others? 8 A. I have. 9 Q. Where have you done that? 10 A. At University of California, Davis. 11 forensics in the forensic science department to graduate 12 students. 13 Q. Have you taught computer forensics anywhere else? 14 A. Other FBI agents, other interns, but not in a formal 15 classroom setting. 16 thought of -- I have been sent out to do additional training 17 actually in two foreign governments, to learn about computer 18 forensics, and I've done that on a couple of occasions. 19 Q. Can you describe your formal education? 20 A. Yes. 21 Q. Did you go to college? 22 A. Yes. 23 Q. Where? 24 A. I went to undergraduate at the University of Wisconsin, 25 Madison, Wisconsin. I'm not considered the I taught computer Although, let me correct that. I just KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 560 1 Q. Did you receive a degree? 2 A. Yes. 3 Q. What was it? 4 A. Accounting, a Bachelor in business administration. 5 Q. Any graduate school? 6 A. I did. 7 Q. Where? 8 A. University of Tampa, Tampa, Florida. 9 Q. What degree? 10 A. I have a Master's in business administration with an 11 accounting concentration. 12 Q. Any military service? 13 A. Yes. 14 Q. What branch? 15 A. U.S. Navy. 16 Q. Final rank? 17 A. Commander. 18 Q. You said earlier you worked on the investigation of Matthew 19 Keys? 20 A. Yes. 21 Q. Could you identify Mr. Keys if you saw him? 22 A. I can. 23 Q. Do you see him now? 24 A. I do. 25 Q. Where is he sitting? KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 561 1 A. Mr. Keys is sitting at farthest to the left at the defense 2 table wearing glasses and a black jacket. 3 4 MR. SILVER: May the record reflect the witness has identified the defendant? 5 THE COURT: It shall. 6 BY MR. SILVER: 7 Q. 8 during the course of your investigation? 9 A. I did. 10 Q. Where was Mr. Keys' residence at that point in time? 11 A. Secaucus, New Jersey. Did you obtain a search warrant for Mr. Keys' residence I think it's spelled -- 12 MR. SILVER: 13 later, if that's convenient. 14 THE COURT: I can give the Court Reporter a spelling The Court can take judicial notice of the 15 spelling of Secaucus or we can have a spelling bee. 16 spelled S-E-C-A-U -- 17 18 MR. SILVER: I believe it's sea like the ocean and the sea, and then caucus like a political caucus. 19 THE COURT: 20 MR. SILVER: 21 S-E-A, I believe. It's C-A-U-C-U-S. I'm pretty sure. I was a local spelling champion. 22 THE COURT: All right. 23 BY MR. SILVER: 24 Q. Agent Cauthen, did you execute the search warrant? 25 A. Yes. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 562 1 Q. When you executed the warrant, did you give it to Mr. Keys? 2 A. I did. 3 Q. What, if anything, did Mr. Keys do with it? 4 A. He read it. 5 Q. Did you talk to Mr. Keys during the execution of the search 6 warrant? 7 A. Yes, I did. 8 Q. Did you record that conversation? 9 A. I did. 10 Q. Please turn to Government Exhibits 206 through 232 in the 11 binder. 12 Do you recognize those items? 13 A. Yes. 14 Q. And what are they? 15 A. These are portions of the audio recording that I did in the 16 interview back on October 4th, 2012. 17 Q. 18 interview? 19 A. I had two recording devices. 20 Q. And you provided the contents of those recording devices to 21 the staff here handling the audio for the courtroom? 22 A. 23 24 25 These are -- yes. And you were wearing a recording device during the I did. MR. SILVER: Your Honor, I move to admit Government Exhibits 206 through 232. MR. LEIDERMAN: I'm going to object based upon -- well, KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 563 1 I'm going to renew my objections that we discussed during the 2 break. 3 THE COURT: 4 MR. SILVER: 5 THE COURT: 6 MR. LEIDERMAN: 7 THE COURT: 8 9 10 11 12 13 THE COURT: displayed. THE COURT: That's the Court's understanding. That is the plan. Nothing will be Yes, Your Honor. I guess we didn't Well, it's the audio that's being admitted. The audio is being admitted. All right. The objection is overruled. The audio recordings are admitted. (GOVERNMENT'S EXHIBITS 206 through 232, portions of Keys statement dated 10/04/12, ADMITTED INTO EVIDENCE.) MR. SILVER: May we show the transcript solely for the purpose of facilitating understanding what the -- 22 THE COURT: 23 MR. SILVER: 24 THE COURT: 25 I mean, that's -- that discuss the transcript this morning. 16 21 With no transcript? MR. SILVER: MR. SILVER: 20 It's incomplete. We're going to hear something? 15 19 All right. MR. SILVER: THE COURT: 18 Yes, Your Honor. is the Court's understanding. 14 17 You are admitting audios? No. It's the audio that is being admitted. If we could play Government Exhibit 206. Hold on one second. What's your question, Madam Court Reporter? KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 564 1 (Off-the-record discussion with Court Reporter.) 2 3 THE COURT: Is it acceptable that the Court Reporter not take down -- 4 MR. SILVER: 5 THE COURT: 6 MR. SILVER: Yes, Your Honor. All right. Thank you. Let me pause first. 7 Q. Agent Cauthen, trying to set the scene there, you are there 8 in Mr. Keys' residence with Mr. Keys; is that right? 9 A. Yes, I was. 10 Q. And was there anyone else in the room with you during this 11 recording? 12 A. Yes. 13 Q. Who was that? 14 A. My colleague, Gabe Andrews. 15 16 MR. SILVER: 19 If we could play 206, please. (Exhibit 206 played, not reported.) 17 18 He was another FBI agent. THE COURT: That's the loudest you can play it, MR. SILVER: I hit the volume up several times. correct? 20 try that again. 21 they were able to capture that at all? 22 Perhaps the Court wants to ask the jury if THE COURT: 23 raising their hand. 24 introduced. 25 I can I'm going there. I didn't see anyone It is the audio recording that is being UNIDENTIFIED JUROR: It is a little low. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 565 1 THE COURT: If that's the best the government has, 2 that's all we can do. 3 the volume. 4 THE CLERK: 5 MR. SILVER: 6 I have it. I can hit this button several times and play it again. 7 THE COURT: 8 the highest, so -- 9 MR. SILVER: 10 time, I believe. 11 like, but -- Ms. Schultz, is that the highest? THE COURT: 13 MR. SILVER: 14 THE COURT: 15 MR. SILVER: And the audio quality does improve over Well, no. I'm just -- it is what it is. Thank you, Your Honor. All right. If we could play Government Exhibit 207, please. 17 (Exhibit 207 played, not reported.) 18 BY MR. SILVER: 19 Q. 20 you say IRC? 21 A. Yes, I did. 22 Q. What is IRC? 23 A. IRC are initials for Internet relay chat. 24 Q. And we'll discuss that more later. 25 It's at I can ask the witness that if the Court would 12 16 I don't know if there's a way to boost Agent Cauthen, during the course of that conversation, did Did you also say colloquy? KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 566 1 A. I did. 2 Q. And is that something else that we will get to later on in 3 your testimony? 4 A. We will address it later, yes, I believe. 5 Q. You mentioned the nickname AEScracked; is that right? 6 A. I did. 7 Q. Mr. Keys said that he used that nickname? 8 A. The tape speaks for itself. 9 Q. And what is AES, Agent Cauthen? 10 A. AES stands for advanced encryption standard. 11 algorithm used to encrypt data so that you can't read it unless 12 you have the key or password. 13 Q. And in connection with encryption, what does cracking mean? 14 A. Cracking means being able to break that algorithm, access 15 the data without having the key. 16 having the password. 17 MR. SILVER: 18 It's an Or, correction, without If we could play 208, please. (Exhibit 208 played, not reported.) 19 BY MR. SILVER: 20 Q. Agent Cauthen, you said screen grabs? 21 A. Yes. 22 Q. What are screen grabs? 23 A. A screen grab, what you're doing when you're using your 24 computer and you just want to get a copy of what you see on 25 your screen, you might do something like print screen, and it KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 567 1 will save that picture of what's displayed on your screen to a 2 file someplace. 3 just hitting print screen, but the net result is a file is 4 saved somewhere. 5 you saw on your screen. 6 Q. Do some people call it screen grab, screenshot? 7 A. That would be a similar term for the same thing. 8 You can do it in a variety of ways other than That is called a screen grab, which is what MR. SILVER: 9 If we could play 209, please. (Exhibit 209 played, not reported.) 10 MR. SILVER: 11 If you could play 210, please. (Exhibit 210 played, not reported.) 12 BY MR. SILVER: 13 Q. 14 there? 15 A. Yes. 16 Q. And what is Internet Feds? 17 A. Internet Feds -- I'm sorry. 18 the IRC chat room. 19 Q. And the term "credentials" was used? 20 A. When we speak of credentials, when I speak of credentials 21 in this context, we're talking about a username and a password. 22 Q. And the term "CMS"? 23 A. The CMS, we're talking about the content management system, 24 Tribune's content management system or CMS. 25 Agent Cauthen, was it Internet Feds that was discussed MR. SILVER: Internet Feds was the name of If we could play 211, please. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 568 1 (Exhibit 211 played, not reported.) 2 MR. SILVER: 3 If we could play 212, please. (Exhibit 212 played, not reported.) 4 MR. SILVER: 5 214. (Exhibit 214 played, not reported.) 6 MR. SILVER: 7 215. (Exhibit 215 played, not reported.) 8 MR. SILVER: 9 216. (Exhibit 216 played, not reported.) 10 MR. SILVER: Can we pause here. 11 Q. Agent Cauthen, with regard to that last statement by 12 Mr. Keys that somebody at Tribune had to have gone in there and 13 unlocked a lot of doors, did you find evidence to the contrary 14 to that? 15 A. That someone at Tribune had unlocked a lot of doors? 16 Q. Yes. 17 MR. LEIDERMAN: 18 THE WITNESS: 19 THE COURT: Objection, that misstates the question. I'm sorry. Well, I'm going to sustain the objection. 20 You can rephrase. 21 BY MR. SILVER: 22 Q. 23 statements we've heard so far, at first that the credentials he 24 provided were not working, did you obtain evidence that that 25 statement was not in fact true? Agent Cauthen, taking you back to a few of Mr. Keys' KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 569 1 A. Yes. 2 Q. He also said that he was not monitoring the progress of 3 those he gave the credentials to. 4 that statement was not true? 5 A. Yes. 6 Q. And he said that somebody at Tribune had unlocked a lot of 7 doors. 8 A. Did you find evidence that that was not true? Yes. 9 MR. SILVER: 10 Did you find evidence that If we could resume the play back, please. (Exhibit 216 played, not reported.) 11 BY MR. SILVER: 12 Q. Agent Cauthen, you mentioned Chippy 1337? 13 A. I did. 14 Q. Is that sometimes also pronounced Chippy leet? 15 A. Yes. 16 Q. Why? 17 A. Ah, computer hackers use leet speak, and they substitute 18 numbers for letters in their text messages and in their 19 defacements. 20 abbreviated to leet, which would be translated to leet speak as 21 1337 for a computer hacker. 22 MR. SILVER: 23 24 25 And so the word "elite" would be kind of 217, please. (Exhibit 217 played, not reported.) MR. SILVER: 218, please. (Exhibit 218 played, not reported.) KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 570 1 BY MR. SILVER: 2 Q. Did you understand that last word he said there? 3 A. Yes. 4 Q. What was it? 5 A. Hooliganism. 6 MR. SILVER: 7 219, please. (Exhibit 219 played, not reported.) 8 BY MR. SILVER: 9 Q. Agent Cauthen, you and Mr. Keys were discussing a virtual 10 private network? 11 A. Yes. 12 Q. And that's abbreviated VPN? 13 A. Yes. 14 Q. And a company called Overplay? 15 A. Yes. 16 Q. And we'll discuss those later. 17 18 19 20 21 22 MR. SILVER: 220, please. (Exhibit 220 played, not reported.) THE COURT: Can you clarify whether anonymous was used with a capital A or a lower case A in that clip, if you -MR. SILVER: That particular clip is the lower case A and the adjective form of the word, Your Honor. 23 THE COURT: All right. The witness agrees with that? 24 THE WITNESS: 25 Yes, anonymous with a little A. Bear with me one moment. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 571 1 THE COURT: 2 MR. SILVER: 3 All right. 221, please. (Exhibit 221 played, not reported.) 4 MR. SILVER: 5 223, please. (Exhibit 223 played, not reported.) 6 MR. SILVER: 7 224, please. (Exhibit 224 played, not reported.) 8 MR. LEIDERMAN: 9 THE COURT: 10 You may proceed. Object to this. Please stop the tape. What's the objection? 11 MR. LEIDERMAN: Objection, Officer Cauthen's statements 12 are improper opinion. 13 He's relating what other people are telling him. 14 effect on the listener. 15 THE COURT: They're hearsay without any exception. They're not Well, the objections are overruled. The 16 jury is to understand that the questions being posed by the 17 agent on the tape are not being offered for the truth of the 18 content of what is stated in the questions. 19 MR. LEIDERMAN: 20 questions. 21 him. 22 If I may, Your Honor, they're not He's making statements about what other people told THE COURT: Well, they're a preface to questions. 23 Nothing of the content, including any statements that precede 24 questions, is being offered for the truth of the content. 25 All right. You may proceed. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 572 1 (Exhibit 224 played, not reported.) 2 MR. SILVER: 3 No. 225, please. (Exhibit 225 played, not reported.) 4 MR. SILVER: 5 226. (Exhibit 226 played, not reported.) 6 MR. SILVER: 7 227. (Exhibit 227 played, not reported.) 8 MR. SILVER: 9 228. (Exhibit 228 played, not reported.) 10 MR. SILVER: 11 229. (Exhibit 229 played, not reported.) 12 MR. SILVER: 13 230. (Exhibit 230 played, not reported.) 14 MR. SILVER: 15 231. (Exhibit 231 played, not reported.) 16 MR. SILVER: 17 232. (Exhibit 232 played, not reported.) 18 BY MR. SILVER: 19 Q. 20 he write anything in front of you? 21 A. Yes. 22 Q. Turning your attention to Government Exhibit 204. 23 take a look at that, please. 24 A. Yes. 25 Q. What is that? Agent Cauthen, after this conversation with Mr. Keys, did Can you KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 573 1 A. That's his confession written. 2 Q. Did he write it in front of you? 3 MR. LEIDERMAN: 4 THE COURT: 5 word "confession." 6 BY MR. SILVER: 7 Q. Did he write that in front of you? 8 A. Yes. 9 MR. SILVER: Object to the characterization. Sustained. The jury shall disregard the Move to admit Government's 204. 10 THE COURT: Any objection? 11 MR. LEIDERMAN: 12 THE COURT: Objection, unreliable. Overruled. 204 is admitted. 13 (GOVERNMENT'S EXHIBIT 204, Keys written statement, 14 ADMITTED INTO EVIDENCE.) 15 MR. SILVER: Your Honor, since this is a copy that is 16 hard to read, I would propose either the original be placed on 17 the Elmo or given to the jury for review. 18 THE COURT: 19 MR. SILVER: 20 THE COURT: 21 MR. SILVER: 22 THE COURT: 23 24 25 Well, put it on the Elmo. Try the Elmo first? Uh-huh. Very well. May I approach the witness? He has the original? All right. You may approach. MR. SILVER: Would the Court be willing to ask if this is legible to the jury? KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 574 1 THE COURT: 2 I mean, that's the whole document. 3 Can the jury see that? should be able to zoom in. 4 UNIDENTIFIED JUROR: 5 THE COURT: 6 That's much better. It's a one-page document. Thank you. You've seen the page generally. 7 Do you have questions about it? 8 All right. 9 The government Do you have questions, any further questions? 10 MR. SILVER: Yes, Your Honor. 11 Q. Agent Cauthen, whose signature is this here? 12 A. That's my signature. 13 Q. And this signature on the bottom left? 14 A. That was the signature of my colleague Gabe Andrews. 15 Q. And finally on the right? 16 A. That is the signature of Matthew Keys. 17 18 19 20 MR. SILVER: I'm returning this to the binder, Your Honor. THE COURT: Unless you need the witness to have it, you can keep it there and return it on a break -- 21 MR. SILVER: Very well. Thank you. 22 THE COURT: 23 How many more questions do you have of this witness? 24 MR. SILVER: 25 THE COURT: -- which we'll have fairly soon. Probably in the hundreds, Your Honor. All right. Well, let's take a second KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 575 1 break. We have a second break due. 2 break now. 3 admonitions. During that break, as always, remember all of my We'll see you back in 15 minutes. 4 (Jury not present.) 5 THE COURT: 6 All right. You may step down. Please be back in 15 minutes. 7 8 Let's take a 15-minute Do you believe you'll use the rest of the day going to 1:30? 9 MR. SILVER: 10 THE COURT: 11 I would estimate so, yes. All right. All right. Back in 15 minutes. (Recess taken.) 12 THE CLERK: Come to order. 13 THE COURT: All right. Let's bring the jury back in. All right. You may be seated. 14 Court is back in session. (Jury present.) 15 THE COURT: 16 Welcome back, Ladies and Gentlemen. 17 1:30. 18 exam of Agent Cauthen. 19 We'll go now till I'm informed that that may continue to be all direct I forgot to advise you that on the last break I did 20 admit Exhibits 130 and 131 without objection, so that resolved 21 the issue with exhibits. 22 see in the jury room when you do retire to deliberate. 23 That affects the exhibits you will So, Mr. Silver, you may continue. 24 BY MR. SILVER: 25 Q. Agent Cauthen, before the break, we were discussing the KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 576 1 letter that Mr. Keys wrote in front of you; is that correct? 2 A. Yes. 3 Q. Did he write anything else in front of you that day? 4 A. Yes. 5 Q. Could you please turn to Exhibit 205. 6 A. I see it. 7 Q. Do you recognize that document? 8 A. Yes, I do. 9 Q. How do you recognize it? 10 A. This was a document that was present when I was 11 interviewing Mr. Keys. 12 Q. And what is the document? 13 A. This is part of his written statement, ah, that has some 14 text that I have supplied and written, which was excerpts from 15 the IRC chat rooms, as well as writing by Matthew Keys on it. 16 Q. And how did it come to be that Mr. Keys was writing on it? 17 A. I gave this document to him and asked him to write on it. 18 Q. And you saw him write on it? 19 A. Yes. 20 MR. SILVER: 21 THE COURT: 22 MR. SILVER: 23 THE COURT: 24 25 Move to admit Government's Exhibit 205. How many pages? Six. Did the witness just testify to his own handwriting being on the document? MR. LEIDERMAN: He testified to Mr. Keys' handwriting KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 577 1 being on the document. 2 3 THE COURT: excerpts. 4 5 MR. SILVER: THE COURT: 10 MR. SILVER: I believe Mr. Cauthen put excerpts from IRC chat logs on the document. And then, after that, Mr. Keys initialed them in a certain way. 11 12 Is that supposed to be on the document that I'm looking at? 8 9 I can clean that up, if you like, Your Honor. 6 7 There was reference to something that says THE COURT: I'm trying to understand, did the agent testify that he wrote something by hand on the document? 13 MR. SILVER: 14 THE COURT: 15 MR. SILVER: 16 THE COURT: 17 MR. SILVER: I don't believe he did. All right. He may have said -All right. Clarify that. Sure. 18 Q. Agent Cauthen, this document has typewritten language on 19 it; is that right? 20 A. Yes. 21 Q. And where did that come from? 22 A. That came from me. 23 Q. And how did you put that on there? 24 A. I printed it on there. 25 Q. Where did that come from? KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 578 1 A. Computer. 2 Q. And where did that computer come from? 3 of that information? 4 A. 5 from IRC chat logs from a computer that the FBI seized in Ohio. 6 And I printed out these excerpts on blank pieces of paper and 7 gave those excerpts to Mr. Keys. The source of that computer was, ah, these are excerpts 8 9 What was the source THE COURT: All right. So you're admitting that. think that clarifies the Court's question. 10 MR. LEIDERMAN: 11 THE COURT: Any objection? Yes, to foundation. Overruled. 205 is admitted. 12 (GOVERNMENT'S EXHIBIT 205, Keys annotation of 13 logs, ADMITTED INTO EVIDENCE.) 14 BY MR. SILVER: 15 Q. 16 parts of this document? 17 A. Agent Cauthen, did you ask Mr. Keys to initial certain Yes. 18 MR. SILVER: Can we zoom in on the left side there, if 19 possible. 20 Q. And did he also write something out on the document? 21 A. Yes. 22 23 I MR. SILVER: Would the Court be willing to ask if this handwriting here is visible to the -- legible to the jury? 24 THE COURT: 25 MR. SILVER: All right. I see many heads shaking no. Perhaps Agent Cauthen could read it. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 579 1 THE COURT: 2 MR. LEIDERMAN: 3 THE COURT: 4 MR. LEIDERMAN: 5 Any objection, Mr. Leiderman? It's Agent Cauthen reading the text? Yes. I still think it lacks foundation, Your Honor. 6 THE COURT: I'd be prepared to pass around the 7 original. 8 it is fully legible, and so I don't know that someone can read 9 it without translating. 10 11 You have to pass the original. MR. SILVER: I'm not certain that Shall I pull it out of the binder and distribute it to the jury, Your Honor? 12 THE COURT: If that's the original. Why don't you 13 elicit testimony, and then we'll take a moment and pass it 14 around once you're done with this exhibit. 15 MR. SILVER: 16 I'm getting the sense this may be more legible, this 17 Very good. version we have now. 18 UNIDENTIFIED JUROR: 19 THE COURT: 20 BY MR. SILVER: 21 Q. 22 document? 23 A. Yeah. All right. Did you see Mr. Keys write this in the margins of the Yes. 24 25 Thank you. THE COURT: Can you delete the red marks showing on the screen. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 580 1 MR. SILVER: If we could go back to the whole document. 2 Q. Agent Cauthen, there is a pound target at the top of this 3 page. 4 A. 5 target. 6 Q. And that says AEScracked at the top there? 7 A. Yes. 8 Q. And that's the nickname that Mr. Keys told you that he 9 used? What does that refer to? Pound target refers to an IRC chat room called pound 10 A. Yes. 11 Q. After it says attack Fox News, it says PM me; is that 12 right? 13 A. Yes. 14 Q. What does PM mean in this context? 15 A. PM means private message. 16 more private chat room for one-on-one conversation where 17 everyone else in the chat room can't see it. 18 Q. And just below that, another PM. 19 A. Yes. 20 Q. Same meaning? 21 A. Yes. 22 Q. Do you see the asterisk that is at the end of that -- each 23 end of that statement? 24 A. I do. 25 Q. Do those mean anything? It means to go to a separate, KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 581 1 A. I don't know. 2 Q. Where it says operation payback, Agent Cauthen, is that the 3 name of a different chat room? 4 A. Yes. 5 Q. And, again, you see the AEScracked nickname that Mr. Keys 6 said he uses? 7 A. Yes. 8 9 MR. LEIDERMAN: mischaracterization. 10 THE COURT: I'm going to object to the He said he used. Sustained. The jury shall disregard that 11 answer. 12 BY MR. SILVER: 13 Q. 14 what that is an abbreviation for? 15 A. Yes. 16 Q. What is it? 17 A. Username and password, credentials. 18 Q. There as well? 19 A. Yes. There where it says user/pass, user slash pass, do you know 20 MR. SILVER: If we could zoom back out, please. 21 Could we go to the next page, please. 22 Q. Agent Cauthen, just to the left of that dot, do you 23 recognize those initials? 24 A. Yes. 25 Q. Whose initials are they? KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 582 1 A. Matthew Keys'. 2 Q. You saw him write those initials there? 3 A. I did. 4 Q. What did you understand that to mean at the time? 5 A. That he recognized those as being accurate as they were 6 reflected in the chat room that he was in. 7 Q. Another one here? 8 A. Yes. 9 MR. SILVER: If we could zoom back out, please. 10 Q. Agent Cauthen, in the first line in this zoomed-in version, 11 it's a little bit cut off, is that also AEScracked? 12 A. Yes, it is. 13 Q. And what is a super user username and pass code? 14 A. A super user username and pass code is a pass code or are 15 the credentials to a super user. 16 account that has the ability to create and change other 17 accounts. 18 Q. Down by the red mark, do you recognize those initials? 19 A. Yes. 20 Q. Whose initials are those? 21 A. Matthew Keys'. 22 MR. SILVER: 23 Next page, please. And a super user is an If we could zoom back out. 24 Q. Up at the top, that's AEScracked again? 25 A. Yes. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 583 1 Q. 2 Then there's a user colon and then something after that. What does that look like, Agent Cauthen? 3 A. That's a username. 4 Q. The next entry, is that a password? 5 A. That's a password. 6 Q. And are they a pair that go together? 7 A. Yes, forming credentials. 8 Q. Do you recognize the initials to the left of the dot? 9 A. I do. 10 Q. Are those Mr. Keys' initials again? 11 A. Yes. 12 MR. SILVER: If we could go back out, please. 13 Q. Agent Cauthen, is that the same VPN that was being 14 discussed in the conversation? 15 A. 16 that. I believe it is, but I don't have specific knowledge about Oh, I'm sorry. 17 MR. LEIDERMAN: 18 THE COURT: 19 Objection, move to strike. Sustained. That motion is granted. jury shall disregard that last answer. 20 (Government counsel conferring.) 21 BY MR. SILVER: 22 Q. 23 you wanted to clarify something? 24 25 The Agent Cauthen, did you have another observation to add that THE COURT: Well, let's start over given what the Court has just -- KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 584 1 MR. SILVER: 2 THE COURT: Very well, Your Honor. -- ordered. 3 BY MR. SILVER: 4 Q. By the arrow, does that say VPN IP addresses? 5 A. Yes. 6 Q. And did the subject of VPNs come up in the recorded 7 conversation? 8 A. Yes. 9 Q. So here is AEScracked. He's saying he has VPN IP 10 addresses? 11 A. Yes. 12 Q. And offering them as a form of assistance to others? 13 A. Yes. 14 MR. SILVER: If we could go back out, please. 15 Next page, please. 16 Q. Are those Mr. Keys' initials again? 17 A. They are. 18 MR. SILVER: If we could zoom back out, please. 19 Q. Agent Cauthen, that's AEScracked again making that 20 statement? 21 A. That is. 22 Q. What does it mean to delete a super user account? 23 A. To render it nonfunctional. 24 MR. SILVER: If we could zoom back out, please. 25 Next page, please. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 585 1 Q. Are those Mr. Keys' initials again to the left of the 2 arrow? 3 A. Yes. 4 MR. SILVER: If we could zoom back out, please. 5 And back out again, please. 6 Can we zoom in with that text on the left? And the next page, please. 7 Q. Did you see Mr. Keys write that on the document? 8 A. I did. 9 Q. In the left margin? 10 A. Yes. 11 MR. SILVER: If we could zoom out, please. 12 Q. Agent Cauthen, on the top there, it says edit web servers. 13 A. Yes. 14 Q. What are web servers? 15 A. Those are computers that provide access to web content, 16 Internet pages. 17 on a website, you're going to a web server. 18 Q. Next line down, what are DNS names? 19 A. DNS names are names that are assigned to websites. 20 computers actually don't use English when they're talking. 21 They'll be www dot FBI dot gov. 22 system that kind of translates between the name www dot FBI dot 23 gov and that computer gobbledygook that is really happening in 24 the back is called the domain name service or system. 25 that's what he's referring to here is DNS name, would be the So if you want to go on the Internet and click They use numbers. So And the And KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 586 1 English version of the website name. 2 Q. Do you know what doc roots means? 3 A. Ah, I don't. 4 MR. SILVER: 5 Your Honor, at this time I would move to the summary. 6 There's a little bit of housekeeping in terms of stipulations 7 that I wanted to read into the record as I think we agreed to 8 before. 9 defense regarding the admissibility of the documents underlying 10 11 If we could back out of that one, please. I believe there is an oral stipulation with the the summary? (Counsel conferring.) 12 MR. LEIDERMAN: 13 THE COURT: Pardon us, Your Honor. Do we have -- there's a reference to -- I 14 understand there's a kind of slide show or power point that's 15 going to be shown to you, so we're figuring out some of the 16 details for that. 17 18 19 20 (Counsel conferring.) THE COURT: So just so I'm clear, you're going to read some of the written stipulations, offer of -MR. SILVER: Yes. If the Court agrees, there are two 21 stipulations that pertain to the documents underlying the 22 summary, and I think the defense and the government have 23 reached an agreement about the admissibility of the other 24 documents underlying the summary. 25 underlying documents en masse, saving some time. So we can move in the KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 587 1 And then I would just ask the Court to advise the jury 2 that this summary will not itself be going back with the 3 jury -- 4 5 THE COURT: I understood that. 6 MR. SILVER: 7 THE COURT: 8 And I'm prepared to do that. Okay. So how long is the list of underlying exhibits? 9 MR. SILVER: The list of underlying exhibits, I can 10 move them in with -- just by listing them out. 11 take -- 12 THE COURT: 13 MR. SILVER: -- a minute or so. 14 THE COURT: How long is the list? 15 are identified in the list? 16 MR. SILVER: 17 THE COURT: It will only That's what I'm -- How many exhibits It is a list of about 20, I would say. All right. So just read the numbers off, 18 and then you can provide to Ms. Schultz a written copy of that 19 list. 20 MR. SILVER: Certainly. 21 Move to admit Government Exhibit 307, 503, 504, 505, 22 506, 507, 508, 602, 603, 605, 606, 607, 608, 609, 610, 611, 23 614, 615, 616, 801, 901, 903 and lastly 904. 24 THE COURT: All right. 25 MR. LEIDERMAN: No objection to those exhibits? They're in by stipulations. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 588 1 2 THE COURT: All right. So those exhibits are admitted, and they may be incorporated into this presentation. 3 (GOVERNMENT'S EXHIBIT 307, Assembler log entries, 4 ADMITTED INTO EVIDENCE.) 5 (GOVERNMENT'S EXHIBITS 503 through 508, screenshots 6 from Keys computer, ADMITTED INTO EVIDENCE.) 7 (GOVERNMENT'S EXHIBITS 602, 603, 605, 606, 607, 8 608, 609, 610, 611, 614, 615, 616, IRC chats, 9 ADMITTED INTO EVIDENCE.) 10 (GOVERNMENT'S EXHIBIT 901, records from Yahoo, 11 ADMITTED INTO EVIDENCE.) 12 (GOVERNMENT'S EXHIBIT 903, records from AT&T, 13 ADMITTED INTO EVIDENCE.) 14 (GOVERNMENT'S EXHIBIT 904, records from Overplay, 15 ADMITTED INTO EVIDENCE.) 16 17 THE COURT: Mr. Silver is correct, the slide show itself will not go back to you, but the exhibits will. 18 MR. SILVER: If we can have the PDF, the slide show. 19 Q. Agent Cauthen, in connection with your review of computers 20 and digital evidence in this case, did you create a 21 presentation? 22 A. I did. 23 Q. And does that presentation cover electronic evidence from a 24 number of different places? 25 A. Yes. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 589 1 Q. 2 records and where they come from? 3 A. Yes. 4 Q. Can you start with -- is there some color coding happening 5 here, Agent Cauthen? 6 A. There is. 7 Q. And is it orange for Overplay? 8 A. Yes, it is. 9 Q. Yellow for Yahoo? 10 A. Yes. 11 Q. And it's green for Tribune because turquoise was too hard 12 on the eyes; is that right? 13 A. That's actually true. 14 Q. So starting with No. 1, if you could just summarize for the 15 jury what each type of record here is and where it came from. 16 A. 17 Can you walk us through these different categories of Yes, I can. All right. So No. 1 are the Tribune CMS logs, and that's 18 all of the computer records that the CMS had in terms of the 19 logging that it kept. 20 June of 2010 to sometime in January of 2011, all those records. 21 No. 2 is the Overplay logs, Overplay being the company that And I looked at the period from about 22 provided the VPN services. And they kept logs about who was 23 using these computers, these VPN computers, and what those 24 computers were doing, who was logging in and where they were 25 going to. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 590 1 The Yahoo records were provided to me showing -- relating 2 to the Yahoo e-mail accounts from all of the X Files related 3 e-mails. 4 the IP address where the person was logging into, and so on and 5 so forth, but not the actual content. 6 All right. And so they showed the log-in times, the The AT&T records were the specific records for a particular 7 IP address that I looked up that you'll see in the 8 presentation. 9 recovered from the computers that I seized from Matthew Keys 10 You'll also see presentation files that I during the search warrant. 11 And, finally, a lot of it you will see the Internet relay 12 chat logs, pound Internet Feds being one of them, and I think 13 there's others, showing these IRC chats that we obtained by 14 doing a search of the computer in Ohio. 15 Q. 16 same place as the IRC chats we just saw in Exhibit 205? 17 A. They are. 18 Q. How about the CMS logs? 19 were those if they had been printed out on paper? 20 A. 21 specific, but it is -- you're into the realm of not human 22 readable. 23 in PDF format, and this was just a small portion of it, and it 24 worked out to 16,000 PDF pages. 25 logs that were there. Agent Cauthen, are the IRC chats in No. 6 coming from the Can you tell the jury, how big If you would have printed this out on paper, I can't be I think I printed out a portion of them by mistake And that's just not all the So it is extraordinarily voluminous from KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 591 1 a human standpoint. 2 Q. 3 Next slide, please. So where did this screen here come from, Agent Cauthen? 4 A. This is an excerpt from the IRC chat channel pound Internet 5 Feds that was shown to Mr. Keys in our previous exhibits. 6 it came from a computer that we seized in Ohio that was 7 maintaining logs of that chat channel, that IRC chat channel 8 pound Internet Feds and others. 9 Q. And And is this -- this is Exhibit 611 essentially, Agent 10 Cauthen? 11 A. This is Exhibit 611, yes. 12 Q. Agent Cauthen, at the top here, we see the nickname 13 Sharpie, and then a number, and then AEScracked, and then that 14 statement. 15 Can you explain, if you can, the meaning of -- the 16 significance of the number and the fact that there's a nickname 17 and something and then another nickname rather than just a 18 nickname and -- 19 A. 20 just go through entire first line. 21 Q. That's quickest. 22 A. Okay. 23 Q. Yes. 24 A. So if we look at the first line, we see December 8th, 25 17:57:19. Yes, I can. To do that, I think it might be helpful if I So you'll notice a little asterisk there, and that KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 592 1 asterisk is something I put in there to show you that these 2 logs are actually recording in a different time zone, and I've 3 converted the times to California time so that they're 4 consistent in the presentation. 5 And 17:57 is about 5:57 p.m. 6 7 MR. LEIDERMAN: a true and accurate copy. 8 9 10 THE COURT: So you're saying this does not faithfully reproduce the exhibit on which it's based? I'm not -- I thought the content was stipulated. 11 12 I'm going to object in that they're not MR. LEIDERMAN: That's fine, Your Honor. I'll withdraw the objection. 13 THE COURT: All right. I should say you rattled off a 14 list of exhibits, and you included 801 on that list. 15 double-checking -- 16 MR. SILVER: I'm sorry. 17 THE COURT: So 801 is not admitted? 18 MR. SILVER: 801 is not admitted. 19 THE COURT: All right. And in That's not on there. All right. 20 BY MR. SILVER: 21 Q. 22 for time zones? 23 A. Yes, I did. 24 Q. And that is the -- that is the meaning of -- there's a 25 footnote at the bottom here that we'll get to, but that's a Agent Cauthen, you were explaining that you just adjusted KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 593 1 marker to show off the bat that you were adjusting for time 2 zones here? 3 A. 4 made to this log was that asterisk and the times that made 5 it -- to reflect California time. 6 Correct. I just wanted to reflect that the only change I What you'll see here is Sharpie is a user in this Internet 7 Feds chat room, and he's making an announcement to everybody in 8 there, in the room. 9 text from someplace else, another IRC chat channel, where he's And what he's doing here, he's copying 10 pulling the chat of AEScracked, who is saying in this other 11 location -- not in the Internet Feds IRC chat room. 12 AEScracked said someplace else, it takes a while to grant 13 one username permission to every site. 14 AEScracked in this chat room, but it's what Sharpie has copied 15 into this chat room at that time. 16 So that's not And the same thing occurs on the next line down. He's 17 copying into this chat room a statement by AEScracked saying 18 I'm doing that now. 19 Then we go down, and we see participant Sabu says great. 20 And then another user says -- Switch says, I'm talking to him, 21 too. 22 chat channel? 23 chat by AEScracked from another location. 24 comments that AEScracked is saying, in the meantime, there are 25 the URLs to access the CMS. Why can't we just invite him here into this particular Sharpie then adds two more comments, referencing And those two KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 594 1 And URLs, like I explained before with DNS, when people 2 talk about URLs, that's kind of the English words you would 3 type in like www dot FBI dot gov. 4 That's a URL. AEScracked passes a URL, and in this case, it's HTTP colon 5 forward slant forward slant Assembler dot Tribune interactive 6 dot com. 7 Sharpie then writes okay. And then we see an asterisk, and we see the comment Switch 8 invited AEScracked into the channel. 9 that that's not any particular participant talking, that's the 10 the software running this IRC conversation making it kind of a 11 general computer announcement saying that Switch has invited 12 AEScracked into this particular channel. 13 MR. SILVER: And that asterisk means If we could zoom out and then zoom in on 14 the lower half, please. 15 Q. 16 everyone now in the same room? 17 A. Yes. 18 Q. And then starting with the statements from AEScracked, can 19 you walk us through this one. 20 A. 21 Agent Cauthen, so after that message from the server, is Yes. So at 5:59 p.m., you have AEScracked saying I'm not a 22 hacker, I'm an ex-employee. And then you have Sharpie again 23 posting comments by AEScracked from not this location, but 24 someplace else, saying that is known as oxygen Assembler. 25 is their old CMS. It You can publish -- I believe the word is KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 595 1 content. I can't read it, I'm sorry. Change user settings. 2 And then he publishes other statements by AEScracked 3 showing other URLs, including the URL P2P Tribune interactive 4 dot com. 5 WYSIWYG, which is a kind of a computer term for what you see is 6 what you get, website builder content publisher. 7 And then another comment by AEScracked, this is their MR. SILVER: 8 Q. 9 channel? Next page, please. Is this a continuation of the same chat in the same 10 A. 11 you. 12 room in the same session. 13 Yes. This is just for the purposes of making it clear to This is the same conversation continued in the same chat Now here is AEScracked in this chat room, the Internet Feds 14 chat room, saying finally this is their video CMS. 15 writes or AEScracked writes the HTTP bid off dot Tribune dot 16 com. 17 MR. SILVER: And then he If we can zoom in on the bottom half, 18 please. 19 Q. 20 that you pointed out earlier? 21 A. Agent Cauthen, is that the same username and password pair Yes, it is. 22 MR. SILVER: 23 Next page, please. 24 Thanks. 25 Q. If we could zoom out, please. If we can zoom in on the top half. Agent Cauthen, do you know what the Assembler site refers KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 596 1 to here? 2 A. Yes. 3 This refers to the CMS. MR. SILVER: If we can zoom in on the bottom half, 4 please. 5 Q. 6 conversation was occurring on December 8th at about 5:57 Los 7 Angeles time; is that right? 8 A. Yes. 9 Q. Did you come across records from another computer that had Agent Cauthen, you've explained that these were -- this 10 related entries also from 5:57 Los Angeles time? 11 A. I did. 12 MR. SILVER: Next slide, please. 13 Q. I see this is green. 14 A. Yes, it is. 15 Q. Is there a relationship between this entry and the previous 16 chat conversation we were looking at? 17 A. Yes, there is a relationship. 18 Q. Can you please explain that relationship? 19 A. So, if you recall, at 5:57 p.m. on December 8th, this 20 conversation is going on in the Internet Feds chat room. 21 went to the CMS logs to see what was happening there, and what 22 I noticed is actually right at 15:57, we have this particular 23 entry which shows the creation of this account, anon1234, in 24 the CMS. 25 This must be the CMS logs? So I It also shows that this was created by a user who was at IP KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 597 1 address 80.74.135.87. 2 Q. What's an IP address? 3 A. As you previously heard, an IP address is like a telephone 4 number, and it's really important to understand the concept in 5 the Internet. 6 address assigned to it, just like a telephone call. 7 they're unique, everybody has a unique number on the Internet, 8 and only one person can have an IP address at a particular 9 time. 10 Because every computer on the Internet has an IP And And when one computer is talking to another computer, 11 they're using these IP addresses to identify each other and 12 send information back and forth, just like a telephone 13 conversation with two telephone numbers. 14 Q. 15 screen up there as well -- 16 A. Oh, I'm sorry. 17 Q. -- if that is useful for you. Agent Cauthen, let me just remind you that you have a touch 18 MR. SILVER: Next slide, please. 19 Q. Agent Cauthen, you testified that you reviewed these 20 voluminous logs; is that right? 21 A. Yes. 22 Q. Did you look for instances of the anon1234 username in the 23 logs? 24 A. I did. 25 Q. And when was the first one? KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 598 1 A. December 8th is the first time that anon1234 appears in all 2 the logs on the CMS between June of 2010 and January of 2011. 3 Q. Is that significant? 4 A. Yes. 5 edit and the save and the fact that it's the first occurrence, 6 that means that this instance, this log entry is recording the 7 creation of those credentials, anon1234, password whatever. 8 Q. 9 I'll just call it the 80.87 IP address, which is the beginning That means that when you see that log-in with the Can you explain, Agent Cauthen, that the IP address -- and 10 and end of it, that's the IP address associated with that 11 log-in entry? 12 A. 13 Yes, that's correct. There was another point on that log entry I probably should 14 mention as well. 15 Q. Shall we go back to it? 16 A. The last part starting with Mozilla and then a bunch of 17 computer gobbledygook, that is the user agent. 18 identifies the type of computer operating system being used by 19 the person using IP 80 -- and I'm going to shorten that, if 20 that's okay. 21 and then the last one, 80.87, just to make it go faster, if 22 that's okay. 23 Q. 24 now. 25 A. And that Instead of reading it all out, I'll just say 80 That's fine with me. Okay. One slide, please. Actually I suggested it myself just So let's talk about IP address 80.87 creating the KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 599 1 anon1234 account. And what we know about that particular 2 computer is that they were using an Apple computer, and they 3 were using Firefox as their browser. 4 program you put on your computer to help you go to the 5 worldwide web. 6 Q. 7 Firefox browser, that's the kind of log entry you're going to 8 get? 9 A. Firefox is a type of So if you connect to this server with a Macintosh running a That's correct. 10 MR. SILVER: Next if we could go forward two slides, 11 please. Actually if we can go to -- if we can go to the 12 demonstrative, please. 13 Q. 14 you investigate that IP address specifically? 15 A. I did. 16 Q. Did you learn anything about who controlled it? 17 A. I did. 18 Q. Was there a company involved? 19 A. Yes, there was. 20 Q. What was the company's name? 21 A. Overplay. 22 Q. Overplay? 23 A. Yes. 24 Q. That's the same Overplay that came up during the recorded 25 conversation? Agent Cauthen, with regard to this 80.87 IP address, did KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 600 1 A. Correct. 2 stands for virtual private network services. 3 Q. 4 works? 5 A. Yes. 6 Q. And is this the animation here? 7 A. Yes. Have you prepared an animation that demonstrates how VPN 8 9 Overplay is a company that provides VPN, which MR. SILVER: If we could go ahead and hit the first button. 10 THE WITNESS: All right. 11 BY MR. SILVER: 12 Q. What just happened there, Agent Cauthen? 13 A. When you're using a VPN, what you're doing is that 14 you're -- well, let me first preface it by saying VPN works 15 like call forwarding. 16 You ever make a phone call from another number, and then 17 that number calls you on your phone? 18 phone, it's the number you made the call forwarding to, right? 19 So there's an extra step in there that it makes the final 20 recipient think that that phone call came from the intermediary 21 phone, right? 22 how this all works. 23 And when you pick up your So I'm going to run you through that and explain So, in this example, we're going to have an IP address here 24 in Sacramento, and I've picked this 75.11 IP address here in 25 Sacramento. And he's going to dial into the Overplay server. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 601 1 In this case, I think it's Switzerland where the 80.87 is, 2 right? 3 log into my VPN. 4 So he logs in there, says I've arrived, I now want to And what he sees on the screen when he does that is -- if 5 you're going to Switzerland actually, what probably happens, as 6 when I did it, you get -- your Google page changes. 7 in English any more, it becomes German because the Internet 8 thinks you're in Switzerland. 9 It's not Does that make sense? And what you're doing here is logging into that computer 10 just like you would be remotely dialing into work, and now that 11 computer overseas in Switzerland becomes your computer. 12 everything you do on the Internet, it looks like it's coming 13 from Switzerland. 14 And It's coming from the 80.87 IP. So when you hit a command, it goes from 80.87. And if 15 you're going to be basically using that VPN server to log into 16 a computer and say Los Angeles, like we were doing in this 17 case -- 18 Q. Shall we hit the -- 19 A. Go ahead and hit it. 20 Angeles. 21 command, and it thinks that that command came from that 22 computer in Switzerland. 23 came from Sacramento. 24 Q. 25 That sends that command to Los And the computer in Los Angeles responds to the But, in reality, the original command So let me see if I can boil this down, Agent Cauthen. After initial connection to the VPN, the VPN gives you a KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 602 1 new IP address that from then on becomes your IP address? 2 A. That's correct. 3 Q. Any connections you make from that point on come back to 4 the VPN IP address? 5 A. 6 front of it, even though you're remotely controlling it from 7 back here in Sacramento. 8 Q. Did you obtain any records from Overplay? 9 A. I did. 10 Q. Did you obtain any records about the particular 80.87 IP 11 address? 12 A. Yes, I did. 13 Q. Did the records say anything about who was using it? 14 A. Yes. It is as if you were at that computer, sitting right in 15 MR. SILVER: If we could go to the back to the PDF 16 slide 8, please. 17 Q. Agent Cauthen, is this a record from Overplay? 18 A. Yes. 19 Q. And can you walk us through these different fields and what 20 they mean here. 21 A. Sure. 22 The first name is the Overplay name, the username Overplay 23 gives or selected by their user, whoever logged into their VPN 24 server. 25 The next frame or the next thing, this 80.87, shows that KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 603 1 this was the computer that Overplay had that they were 2 connecting to, their computer in Switzerland. 3 time and a stop time. 4 the morning going to December 9th at roughly 4:00 a.m. in the 5 morning. 6 You have a start So you see December 9th at 1:31 in the Now these times are in London, so you have to back out the 7 time zones, which I haven't done here, if you're going to 8 convert to Los Angeles time. 9 The next IP address, that 10.10, that's an internal one 10 that the Overplay network uses. 11 shows that is the computer that is in -- remotely controlling 12 that Swiss server. 13 75.11 and is logged into 80.87 on the Internet. 14 But the final one, the 75.11, So user Keys JOM is at computer IP address And what that means is any computers on the Internet would 15 see the 80.87 IP address is where the computer is, but in 16 reality it's being controlled by Keys JOM from IP address 17 75.11. 18 MR. SILVER: Next slide, please. 19 Q. Did you compare those Overplay records to records from the 20 IRC chat logs and also records from the CMS logs? 21 A. Yes, I did. 22 So what I had here is the three slides all together showing 23 the CMS logs of what's happening on the CMS, showing the log-in 24 by that 80.87 IP, the Overplay logs showing that that log-in is 25 actually coming from Keys JOM from IP 75.11. And it's all KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 604 1 occurring during this chat on pound Internet Feds with 2 AEScracked saying that he's logging in.. 3 anon1234 credentials. 4 Q. 5 happening at the same time on three different computers? 6 A. 7 they're doing their own logging. 8 Q. Where are each of these computers, Agent Cauthen? 9 A. The content in green, the Tribune CMS, is in Los Angeles. And providing the So just to boil it down a bit more, these are three things All of these computers are independent in the sense that 10 IP address 75.11 used by Keys JOM is here in Sacramento 11 someplace. 12 IP that IP 75.11 was logged into was in Switzerland. 13 Q. Did you determine who Keys JOM is? 14 A. Yes. 15 And the IRC logs, ah, were in Ohio. MR. SILVER: And the 80.87 Next slide, please. 16 Q. What did Overplay records say about who Keys JOM was? 17 A. Overplay, according to their records, said this account, 18 Keys JOM, belonged to Matthew Keys; and that he had signed up 19 for this service in September of 2010, and that he used the IP 20 address 75.53.168.11 to the sign up for the service. 21 Q. 22 say geolocates to Sacramento? 23 A. 24 determined that. 25 identify that regionally it was assigned to a computer here in And you previously said that the 75.11 IP address did you I said it was here in Sacramento but, in fact, that's how I I geolocated it using Internet tools to KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 605 1 the Sacramento area. 2 Q. 3 JOM at Overplay; is that right? 4 A. Yes, that's correct. 5 Q. And got the 80.87 IP address from Overplay? 6 A. Yes. 7 Q. Which connected to the Tribune CMS logs? 8 A. That's correct. 9 Q. Which created the username anon1234? 10 A. Yes. 11 Q. At the same time, in the chat room, the nickname AEScracked 12 sent the username anon1234? 13 A. Shortly after that was actually created, yes. 14 Q. And Matthew Keys said that he used the nickname AEScracked? 15 A. Yes. 16 Q. Did you come across any mention of VPN IP addresses in the 17 IRC channels? 18 A. 19 So just to boil this down a bit more, Matthew Keys was Keys Yes, I did. MR. SILVER: Next slide, please. 20 Q. Who was talking about VPN addresses in the IRC channels? 21 A. This is Matthew Keys as AEScracked. 22 Q. And this is also from Exhibit 611; is that right? 23 A. I think it is, yes. 24 MR. SILVER: Slide 13, please. 25 If that's 13, then how about 14? Thank you. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 606 1 Q. Agent Cauthen, you were talking before about the 2 information at the end of the entry that collects the 3 characteristics of the computer on the other side of the 4 connection; is that right? 5 A. Yes. 6 Q. Is there a term for that? 7 A. That's called the user agent string or the user agent. 8 Q. So here we have -- this is green, so it's CMS again? 9 A. Yes. 10 Q. And, in fact, is this also Government's Exhibit 303, based 11 on 303? 12 A. 303, yes. 13 Q. What does this log entry say about the computer that was 14 connecting to the CMS here? 15 A. 16 anon1234 was using an Apple computer with a Firefox browser. 17 Q. Apple Computer with a Firefox browser? 18 A. That's right. 19 Q. That's a particular combination of make of computer and 20 browser? 21 A. Yes. 22 Q. But there are other makes of computers, right? 23 A. Of course. 24 Q. PC? 25 A. Windows, Lanix, Apple. What it says is that the computer -- the creator of KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 607 1 Q. And there are other browsers besides Firefox? 2 A. Chrome, Internet Explorer, Safari, Opera. 3 MR. LEIDERMAN: 4 THE WITNESS: 5 THE COURT: I think they were yes or no questions. Oh, I'm sorry. Sustained. 6 BY MR. SILVER: 7 Q. 8 fair to say? 9 A. Yes. 10 Q. Several possibilities? 11 A. Yes. 12 Q. When you executed that search warrant at Mr. Keys' 13 residence, did you notice what kind of computer and browser -- 14 scratch that. 15 16 This is one particular combination out of several; is that Did you notice what kind of computer he had? A. 17 Yes. MR. SILVER: If we can go to the next slide, please. 18 Q. What kind of computer was there at -- when you executed the 19 search warrant? 20 A. 21 removable hard drives that we seized and you saw. 22 Q. Did you -- what is depicted here, Agent Cauthen? 23 A. This is a screenshot that I found on that digital media of 24 a web page. 25 Q. He had an Apple computer, a laptop, and he had some And can you tell by looking at it what browser this is? KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 608 1 A. Yes. 2 Q. What browser is it? 3 A. This is a web page -- it's a Firefox browser. 4 Q. Is that the actual Firefox itself over there? 5 A. That's correct. 6 if you will. 7 Q. 8 the user agent string look like? 9 A. That's the logo for Firefox or the mascot, If this computer had connected to the CMS logs, what would Just what we saw previously. This is -- if that had gone 10 to the CMS logs, the records we saw in the CMS logs is what 11 you'd expect to find from a computer with this configuration, 12 using Apple software and a Firefox browser to connect. 13 would reflect just as we saw in the CMS logs. 14 Q. Is this screenshot representative of Exhibit 508? 15 A. Yes. 16 MR. SILVER: It Next slide, please. 17 Q. This is from Exhibit 101, Agent Cauthen; is that correct? 18 A. That's correct. 19 Q. Did you do any work to determine who Fox Mulder was? 20 A. I did. 21 Q. How did you go about doing that, Agent Cauthen? 22 A. Well, the investigative steps that I had were essentially 23 and initially twofold. 24 e-mail account. 25 was any potential correlations. One is I had the Yahoo records for that And then I could look at CMS and see if there KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 609 1 MR. SILVER: Next slide, please. 2 Q. 3 related to the e-mail incident? 4 A. I did. 5 Q. And how did you go about pulling those? 6 A. I did -- I had the entire contents of the CMS logs 7 available to me, and I just did search terms to scrub any 8 references to or identify any references to the e-mail. 9 Q. Do the entries you pulled have anything in common? 10 A. Yes. 11 referencing KTXL, which was the call sign for Fox 40, and 12 e-mails showed an IP address of 75.11 and are associated with 13 the date of November 3rd, 2010. 14 each of these is associated with an Apple computer and a 15 Firefox browser. 16 Q. 17 refer to the file size of the particular transaction described 18 in the entry? 19 A. Yes. 20 Q. If you can point on the touch screen to explain to the jury 21 where those are, please. 22 A. 23 number -- oops, no. 24 as a computer guy. 25 Did you pull particular CMS records that you thought were So the first set of entries I pulled here came up And the user agent string for Agent Cauthen, are there some numbers in these entries that All right. Well, on this screen, I think if I press this Sorry. You would think I would know this I'm sorry. But that number there, 178316, refers to the size of the KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 610 1 file or the amount of data being transferred. 2 another large one down here, 63795 and then 28689 and 24523. 3 Those are big amounts of data relative to a lot of the other 4 stuff I observed on the CMS. 5 Q. 6 "get" appear on all of these entries as well? 7 A. Yes. 8 Q. What, if anything, does that mean? 9 A. Get means the data went from the CMS to IP 75.11. 10 Q. So to boil it down, these entries describe the downloading 11 of large files? 12 A. 13 What about the word "get"? And there's I see that -- does the word Yes. I shouldn't say files. What it means is it's large amounts 14 of data. 15 depends how the packets were moved. 16 Q. Were these all done by a Macintosh running Firefox? 17 A. According to the information supplied to the CMS, it did. 18 It was a -- that was what it was sent to. 19 It might be one file kind of spread out. MR. SILVER: Next page, please. 20 Q. Are these more smaller entries, Agent Cauthen? 21 A. Similar entries, a different date. 22 November 22nd, about three weeks afterwards. 23 It just The date on this is Again, it's a portion of the logs in the CMS referring to 24 e-mail page. 25 IP 75.11. It's also sending data referring to this topic to It has the same user agent showing an Apple computer KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 611 1 with a Firefox browser. 2 data moving on that first line. 3 MR. SILVER: 4 Q. 5 category? 6 A. 7 And we have, again, a large amount of Next slide, please. And these entries, Agent Cauthen, are they in the same That looks like the same slide to me. Ah, there we go. So what I've done here is, looking at just the term "e-mail 8 page," I did a search on everything indicating who could have 9 possibly downloaded e-mail. And the only IP that showed up in 10 the CMS logs is this one right here, 75.11. 11 hit for that query on e-mail page. 12 That was my only And what I've done here is kind of combined them together 13 with the large amounts for November 3rd and November 22nd, 14 indicating that this event, the sending of data related to 15 e-mail page was sent twice to that IP address belonging to -- 16 Q. 17 conversation just now, hasn't it? 18 A. That IP address 75.11 has already come up in our Yes. 19 MR. SILVER: Next slide, please. 20 Q. That's orange for Overplay we're looking at? 21 A. That's correct. 22 Q. So the 75.11 IP address was there in the Overplay logs for 23 Keys JOM; is that right? 24 A. Yes. 25 Q. And that's the only IP address in all of the CMS logs KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 612 1 associated with the e-mail page? 2 A. That's correct. 3 Q. That was the only IP address in the pages of logs we just 4 saw that was pulling down those large files as you described? 5 A. That's correct. 6 Q. And that was the 75.11 IP address in the Keys JOM Overplay 7 logs which Overplay said was Matthew Keys? 8 A. That's correct. 9 Q. And that IP address geolocates to Sacramento? 10 A. Yes. 11 MR. SILVER: Next slide, please. 12 Q. This is Exhibit 101; is that right, Agent Cauthen? 13 A. That's right. 14 Q. The fourth and fifth pages of Exhibit 101? 15 A. From Exhibit 101. 16 Q. Thank you for the clarification. 17 Did you further investigate who was behind the Fox Mulder 18 e-mails? 19 A. I did. 20 MR. SILVER: The next slide, please. 21 Q. This is yellow for Yahoo? 22 A. Yes. 23 Q. And is Yahoo -- what information is Yahoo giving you here 24 in the yellow? 25 dates and numbers are? Can you explain to the jury what exactly these KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 613 1 A. 2 I can. Yahoo is keeping track of the IP addresses of the person 3 who is logging into the Fox Mulder 4009 e-mail account. 4 when they log in, they keep track of the time and the IP 5 address they're logging into or they're logging from. 6 So what we learned when we went to Yahoo for that So 7 particular Fox Mulder e-mail account is we had all of these 8 times here, and these are California time, the person logging 9 into Fox Mulder came from IP address 91.172. 10 MR. SILVER: 11 THE WITNESS: Next slide, please. So I went to the CMS, all of the logs in 12 the CMS, and I said, oh, here's a new IP address, 91.172. 13 they log into the CMS? 14 Did And I found that they did. In fact, they seem to go back and forth. And at least 15 on one occasion, the person is logging into the Fox Mulder 16 e-mail account and just minutes later logs into the Yahoo 17 e-mail account, the Fox Mulder e-mail account. 18 BY MR. SILVER: 19 Q. 20 that -- 21 A. Yes. 22 Q. In terms of time? 23 A. So here we have -- let's see if I can find one that is 24 extremely close, within a few minutes. 25 Q. So some of these entries are very close together; is I think -- is the white helpful? KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 614 1 A. 2 Yes, I can see that. Okay. So if you can see the white, there's a December 4th entry 3 at 4:28 p.m. 4 logging into the Fox Mulder e-mail account, they log into the 5 CMS e-mail account. 6 And then roughly four minutes later, after Four minutes is very quick, right after it. So they'd have 7 to log out of the Fox Mulder, go over to the CMS log-in or be 8 concurrently logged in. 9 person using that IP to do both. What that tells me is that's the same It's coming from the same 10 computer. 11 the same person who is logging into the Fox Mulder e-mail 12 account, based on the IPs, based on times and two different 13 services. 14 That IP address is logging into the CMS, and it's MR. SILVER: Next slide, please. 15 Q. 16 investigation the username that Matthew Keys was assigned to 17 access the CMS? 18 A. Yes, I did. 19 Q. As you reviewed the logs, did you notice any patterns with 20 regard to M. Keys in the user agent string associated with M. 21 Keys entries? 22 A. 23 relating to M. Keys from June to July. 24 25 Agent Cauthen, did you learn during the course of your I did. It was M. Keys, M-K-E-Y-S. I went onto the CMS, and I looked for everything MR. SILVER: Q. Next slide, please. Was there any relationship between the user agent string KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 615 1 for the M. Keys entries and, on the other hand, the 91.172 2 entries? 3 A. 4 Matthew Keys used when he was employed at Fox 40, I did a 5 search for everything. 6 entries or log-ins related to M. Keys over that time frame, and 7 I found that almost all of them came from that IP address 8 75.11. 9 from 75.11. 10 Correct. So with regard to M. Keys, the username that And actually I found roughly 194 I think out of 194 times he logged in, 184 times was And when I looked at those, they all had the same user 11 agent string showing that he had logged in using an Apple 12 computer with a Firefox browser. 13 string used by M. Keys, Matthew Keys. 14 That was the user agent And when I went to the user agent logs or the CMS logs for 15 that IP address 91.172, which had logged into Fox Mulder, I 16 found that same user agent string for that computer, Apple with 17 Firefox. 18 MR. SILVER: Next slide, please. 19 Q. This slide has -- this is yellow and orange, Agent Cauthen? 20 A. Yes. 21 Q. This is Yahoo and Overplay? 22 A. Yes, it is. 23 Q. And what's being laid out here, Agent Cauthen? 24 A. So what I did here is I compared the Yahoo logs for the 25 person logging into Fox Mulder going to Overplay to see if KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 616 1 Overplay had any information about that 91.172 IP, and sure 2 enough they do. 3 perfectly. 4 on the computers overseas in Overplay were off by about 15 5 minutes. 6 of these calls, it was a perfect match. 7 In fact, in some instances they overlap But based on my investigation, I believe the clocks So if I adjusted the 15-minute differential on some In the first two, I didn't need to make an adjustment 8 because the session that he was logged on at Overplay 9 overlapped, so that it didn't matter if there was a 15-minute 10 error. 11 But in some cases, they did. And what you find, specifically looking back on December 12 6th, is that Keys JOM from IP 75.53.168.11 is logged in on 13 Overplay to the IP address 91.172, which was being used to 14 access the Fox Mulder e-mail account at Yahoo. 15 Q. 16 cases where the Keys JOM account is getting that 91.172 IP and 17 then connecting to the Fox Mulder account? 18 A. 19 back to Matthew Keys according to Overplay. 20 Q. Who is Fox Mulder? 21 A. A TV character on a TV show called X Files. 22 Q. Who was controlling the Fox Mulder e-mail account? 23 A. Matthew Keys. 24 Q. What about Cancer Man, Agent Cauthen? 25 Again, just to try to boil this down, these are repeated Every single one of the Yahoo log-ins on Fox Mulder tracks Next slide, please. This is Exhibit 104, is that right, which is redacted? KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 617 1 104, I think page 3 of that? 2 A. 3 forgot the number. 4 December 2nd. Yeah, this came from Exhibit -- one of the exhibits, I 5 It's a Cancer Man e-mail. It's dated It's a Yahoo e-mail. MR. SILVER: If we could skip forward to the slide that 6 starts with who was Cancer Man, please. 7 Q. 8 Overplay records? 9 A. Agent Cauthen, does this slide, again, compare Yahoo and Correct. I did the same thing that I did before with the 10 Cancer Man e-mail. 11 Which IP logged into the Cancer Man e-mail account? 12 me the IP 91.172. 13 comes back to Matthew Keys. 14 Q. Who was using the Cancer Man 4099 e-mail account? 15 A. Matthew Keys. 16 I went to Overplay. I went to Yahoo. They gave I looked at the Overplay records, and it And of particular note in this IP right here. 17 changed. 18 what that says is Matthew Keys on this date is logged into 19 Cancer Man Yahoo from this IP, 75.204, to the Overplay VPN. 20 Q. Did you investigate the 75.204 IP address? 21 A. I did. 22 subpoena to AT&T. 23 Q. 24 25 There's a new one. It's It's 75 and ends in dot 204. So That was an IP assigned to AT&T, so we sent the That's okay. Sorry. My bad. You said you sent a subpoena to AT&T? A. Yes. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 618 1 Q. And is that what you got back in part? 2 A. In part, yes. 3 Q. Can you explain what all these numbers and letters on here 4 are referring to? 5 A. 6 Well, not all of them, but in part I can. In short, that's the start date down there when this IP was 7 assigned. That's the termination date when it stopped. 8 this is information relating to the user. 9 other computer data here about ISPs, how Internet service And there is some 10 providers keep track of their customers. 11 Q. And the record continues on the next page? 12 A. Yes. 13 And And specifically they identify the customer and the service 14 where this IP was assigned to, and it's here in Sacramento at 15 3381 Shadow Tree Drive. 16 Q. 17 and connecting to Cancer Man? 18 A. That's correct. 19 Q. Did you look at CMS entries -- And this IP address was in the Overplay records as Keys JOM 20 MR. SILVER: Your Honor, we're beginning a new section, 21 and I notice the hour. 22 to -- 23 24 25 And it's assigned to Matthew Keys. THE COURT: I don't know if the Court would want me We can take our break for the day and the weekend at this point. So as we break, given the length of the break -- we'll KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 619 1 start up again on Monday morning at 8:30. I'll give you a more 2 clear schedule at that point in time after I confer with 3 counsel. 4 agent on Monday, perhaps hear from a few more witnesses, and 5 I'll have a better sense by Monday morning of the schedule for 6 closing argument and instructing you. But I understand that we'll likely finish with the 7 So as we leave, particularly given that we're getting 8 closer to the end, please keep in mind all of the admonitions 9 I've been giving you at every stage. Don't discuss the case 10 with anyone, including fellow jurors, family members, friends, 11 anyone you might see this weekend. 12 about the case with you. 13 believe is a news report related to this case, please disregard 14 it immediately. 15 tries to talk to you about the case, please let me know. 16 do any research of any kind, electronic or otherwise. 17 18 If anyone does approach you at any point and Don't We'll see you Monday Thank you. 19 (Jury not present.) 20 THE COURT: 21 If you hear or see anything that you Have a very good weekend. morning. Don't allow anyone to talk You may step down. Please be back in your seat at 8:30. 22 So how much longer do you believe you have on direct? 23 MR. SILVER: 24 25 An hour and a half, outside limit, I would say. THE COURT: All right. And then at this point, KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 620 1 Mr. Leiderman, you'll be doing the cross. 2 estimate, do you know -- I realize you have a lot to hear yet. 3 MR. LEIDERMAN: If you had to I don't even know what to do with all 4 of this, with all of this material. 5 Court -- 6 THE COURT: 7 MR. LEIDERMAN: 8 THE COURT: 9 So who -- the government may call two more people? 10 All right. I couldn't give the That's -- -- an estimation. I won't pin you down, then. Who would those people be, if you do call them? 11 MR. SEGAL: We might call Jerry Del Core. 12 call Soto -- probably not. 13 might call Jerry Del Core for about half an hour and Davis and 14 Soto maybe for 10 minutes each, but I don't think we need them. I think it will -- if we call -- we 15 THE COURT: All right. 16 MR. SEGAL: I want to wrap this up. 17 THE COURT: All right. 18 19 20 21 22 Well, depending on cross, I think evidence will be done Monday. How much time do you anticipate for closing? Or are you requesting for closing, I should say. MR. HEMESATH: We spoke about this briefly, Your Honor, and I'll have Mr. Leiderman speak with me on that subject. 23 He has an estimate for his -- 24 MR. LEIDERMAN: 25 We might I think we were estimating two hours each side based upon our discussions. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 621 1 2 THE COURT: All right. You agree with that, Mr. Hemesath? 3 MR. HEMESATH: Yes, Your Honor. And is my 4 understanding correct that whatever is not used may be used for 5 rebuttal? 6 THE COURT: 7 MR. HEMESATH: 8 THE COURT: 9 If you reserve time, yes. And when would we reserve time? Well, you would tell me at the beginning if you want me to give you a warning sign when you're coming up on 10 a point. Say if you want to reserve 20 minutes, I'd give you a 11 notice when you have 20 minutes left out of two hours. 12 MR. HEMESATH: 13 THE COURT: 14 I see. Then you'll have -- I run the clock, and so I give you equal time. 15 MR. HEMESATH: 16 THE COURT: All right. 17 MR. SEGAL: If we get equal time, then we have to -- 18 Okay. We'll let you know at that time. okay. 19 MR. HEMESATH: If I end at the -- if I request 30 20 minutes out of that for reservation for rebuttal, and I end 21 early -- 22 THE COURT: You get two hours total -- 23 MR. SEGAL: Okay. 24 THE COURT: -- regardless of when you end in your 25 opening before rebuttal, your first part of closing. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 622 1 All right. Two hours is a long time, but if you say 2 that's what you need. 3 check in on that on Monday morning. 4 Think about that this weekend, and we'll Ms. Schultz has a working set of instructions she'll 5 e-mail you and a verdict form. 6 instructions, at this point I've been generally over-inclusive. 7 So there are certain areas where I have questions myself, but 8 we'll review those -- I think at this point we'll review them 9 initially -- I think we can do this right at the end of day on 10 When you look at the Monday. 11 So we'll have a working session on jury instructions. 12 I'll get you a revised version of instructions probably later 13 in the day. 14 start a little later on Tuesday morning so as to finalize the 15 jury instructions so they will be in final form before you give 16 your closing. 17 We'll have another working session -- we might So it sounds to me as if it will go to the jury by the 18 end of the day Tuesday. 19 think about whether or not they want to deliberate later on 20 Tuesday; that is, past 1:30. 21 deliberate until 4:30 or 5:00, that you can be available. 22 On Monday, I'm going to ask them to And I'm assuming if they want to And then on Wednesday the same, let us know if they 23 want to start deliberating in the morning even though I'll have 24 criminal calendar that morning. 25 MR. HEMESATH: A clarification, Your Honor. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 623 1 THE COURT: Uh-huh. 2 MR. HEMESATH: Am I understanding that no matter what 3 happens with the length of witnesses on Monday, that we're 4 planning on closing on Tuesday? 5 THE COURT: Unless you wrap up much more quickly. 6 MR. SEGAL: We have to have the charge conference on -- 7 there's no way the charge conference happens before Monday 8 afternoon, so I don't see how we could close by -- 9 THE COURT: I mean, if you came in Monday morning and 10 say, oh, I only have five more minutes with Agent Cauthen, and 11 you decided your cross is very truncated, then we would give 12 the jury a long break, and we would do what we could -- 13 MR. SEGAL: Okay. 14 THE COURT: -- to get the jury instructions done. 15 MR. SEGAL: Right. 16 THE COURT: So -- but I do think it's likely your 17 closings will start first thing Tuesday, whenever we start with 18 the jury on Tuesday. 19 MR. SEGAL: Have a nice weekend, Your Honor. 20 THE COURT: Did you have questions over here? 21 MR. JAFFE: No, I think it's -- I think we understand 22 23 that. MR. LEIDERMAN: 24 and everyone else. 25 THE COURT: Yes. All right. Have a nice weekend, Your Honor, We'll see everybody on Monday KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 624 1 2 morning at 8:30. THE CLERK: Court is in recess. 3 (Proceedings were adjourned at 1:34 p.m.) 4 ---o0o--- 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 1 2 I certify that the foregoing is a correct transcript from the record of proceedings in the above-entitled matter. 3 4 5 /s/ Kathy L. Swinhart KATHY L. SWINHART, CSR #10150 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347