IN THE UNITED STATES DISTRICT COURT FOR THE EASTERN DISTRICT OF CALIFORNIA BEFORE THE HONORABLE KIMBERLY J. MUELLER, JUDGE ---o0o--UNITED STATES OF AMERICA, Plaintiff, vs. No. 2:13-CR-00082 MATTHEW KEYS, Volume 6 Pages 625 through 790 Defendant. / ---o0o--REPORTER'S TRANSCRIPT OF PROCEEDINGS JURY TRIAL VOLUME 6 MONDAY, OCTOBER 5, 2015, 8:30 A.M. ---o0o--- For the Government: BENJAMIN B. WAGNER, U.S. ATTORNEY 501 I Street, Suite 10-100 Sacramento, California 95814 BY: MATTHEW DEAN SEGAL and PAUL ANDREW HEMESATH Assistant United States Attorneys (Appearances continued next page...) Reported by: KATHY L. SWINHART, CSR #10150 Official Court Reporter, 916-446-1347 501 I Street, Room 4-200 Sacramento, California 95814 Proceedings reported by mechanical stenography, transcript produced by computer-aided transcription. 1 APPEARANCES (Continued) 2 For the Government: UNITED STATES DEPARTMENT OF JUSTICE Computer Crime and Intellectual Property Section 1301 New York Avenue NW, Suite 600 Washington, D.C. 20530 BY: JAMES ANTHONY SILVER Deputy Chief For the Defendant: LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 BY: JASON SCOTT LEIDERMAN 3 4 5 6 7 8 9 10 11 TOR EKELAND, P.C. 195 Plymouth Street, Fifth Floor Brooklyn, New York 11201 BY: MARK H. JAFFE 12 13 14 15 16 17 18 19 20 21 22 23 24 25 KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 1 INDEX 2 GOVERNMENT'S WITNESSES: PAGE: 3 4 JOHN CAUTHEN 5 DIRECT EXAMINATION (Cont'd) BY MR. SILVER CROSS-EXAMINATION BY MR. LEIDERMAN REDIRECT EXAMINATION BY MR. SILVER 6 628 650 701 7 GERALD DEL CORE 8 9 DIRECT EXAMINATION BY MR. SEGAL CROSS-EXAMINATION BY MR. JAFFE REDIRECT EXAMINATION BY MR. SEGAL 704 713 717 10 11 12 13 14 15 GOVERNMENT'S EXHIBITS RECEIVED IN EVIDENCE NO.: DESCRIPTION: PAGE: 16 17 612 613 IRC chat IRC chat 634 634 18 19 20 21 22 23 24 25 KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 625 1 SACRAMENTO, CALIFORNIA 2 MONDAY, OCTOBER 5, 2015, 8:37 A.M. 3 ---o0o--- 4 (Jury not present.) 5 THE CLERK: 6 Calling criminal matter 13-0082, the United States versus Matthew Keys, jury trial, day six, Your Honor. 7 THE COURT: 8 MR. LEIDERMAN: 9 THE COURT: 10 All right. Good morning. Good morning. All counsel are present. Agent Cauthen is in the hall? 11 MR. SEGAL: Yes, Your Honor. 12 THE COURT: All right. 13 MR. LEIDERMAN: 14 THE COURT: And Mr. Keys is present? Mr. Keys is present. Yes. And I had forgotten to bid farewell 15 to Mr. Ekeland. 16 let the Court know that he needed to be someplace else and that 17 everyone has agreed to proceeding without him. 18 19 How much longer with Agent Cauthen this morning? 22 23 24 25 Still about an hour and a half? 20 21 I'll advise the jury that he had previously MR. SILVER: I would say closer to 45 minutes, Your Honor. THE COURT: All right. Do you have any estimate on cross at this point? MR. LEIDERMAN: It's difficult to tell. The best I could do is tell the government somewhere between half an hour KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 626 1 and an hour. 2 THE COURT: 3 MR. LEIDERMAN: 4 THE COURT: 5 All right. But that's real rough, Your Honor. All right. And then how many more witnesses will the government be calling? 6 MR. SEGAL: One. 7 THE COURT: And how long will that witness take? 8 MR. SEGAL: Short as I can. 9 10 11 It's Jerry Del Core. was the station manager at the time this was all going on. He I'm going to ask him how much time he spent and sit him down. THE COURT: So is the parties' proposal -- that would 12 mean that we could move into closing today if we were done with 13 jury instructions. 14 to do on those. But obviously we have a fair amount of work 15 So is the thought we would excuse the jury early today? 16 MR. SEGAL: That's ours, yeah. 17 THE COURT: Mr. Leiderman? 18 MR. LEIDERMAN: 19 20 21 I think -- I'm not going to force them into closing if they don't want to, yeah. THE COURT: And are we still talking about two hours each closing? 22 MR. HEMESATH: 23 THE COURT: 24 MR. HEMESATH: 25 THE COURT: Yes, conservative -- No more than two hours. No more than two hours. I'm going to make that a hard limit. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 627 1 MR. HEMESATH: Yes, that's I would say the upper limit. 2 THE COURT: 3 MR. LEIDERMAN: 4 THE COURT: Mr. Leiderman? I can be done in two hours comfortably. All right. Well, I'm going to advise the 5 jury that it looks as if we'll excuse them early today because 6 we're a little ahead of schedule at this point and then be 7 ready to start with closing tomorrow morning. 8 tomorrow morning just to make certain we'll all done with jury 9 instructions. 10 But I guess my thought is they might want to stay later 11 tomorrow once the case goes to them. 12 of that before they leave today. 13 them on that. 14 15 I may say 9:00 All right. We'll try to get a sense Mr. Streeter can check with Let's call the jury in. You can bring the agent in. 16 (Jury present.) 17 THE COURT: 18 Welcome back, Ladies and Gentlemen of the jury. 19 20 You may be seated. hope you had a good weekend. We We are ready to go again. I'm just letting you know what I know at this point 21 about the schedule. It appears that Agent Cauthen will be on 22 the stand for another couple of hours total. 23 that's give or take. 24 then the presentation of evidence may be concluded. 25 know until the parties tell us for certain. That could -- And then we'll have one more witness, and We never KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 628 1 So it may be that we excuse you a bit early today but 2 with the plan of having closing argument tomorrow morning, and 3 then I would instruct you. 4 you before you leave today to see if you had a chance to think 5 about your schedule once you retire. 6 case will go to you tomorrow, and the question is would you 7 want to work past the normal 1:30 end date to deliberate and 8 would you want to work Wednesday morning. 9 you later on that. 10 I'm quite certain the So we'll check with That's what I know. Mr. Silver. 11 JOHN CAUTHEN, GOVERNMENT'S WITNESS, PREVIOUSLY SWORN 12 13 And so Ms. Streeter will check with THE COURT: Cauthen. And you were sworn last week, Agent You continue to testify subject to that oath. 14 Understood? 15 THE WITNESS: 16 THE COURT: 17 MR. SILVER: 18 Yes, ma'am. All right. Thank you, Your Honor. DIRECT EXAMINATION (Continued) 19 BY MR. SILVER: 20 Q. Good morning, Agent Cauthen. 21 A. Good morning. 22 Q. When we broke last week, we were discussing, among other 23 things, Tribune CMS logs; is that right? 24 A. Yes. 25 Q. And those are logs from Tribune Company's content KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 629 1 management system? 2 A. Yes. 3 Q. Did you examine those logs with regard to records relating 4 to Samantha Cohen, formerly Samantha Scholbrock? 5 A. Yes, I did. 6 Q. And did you find anything significant? 7 A. Yes. 8 9 MR. SILVER: Q. Next slide, please. Agent Cauthen, can you walk us through these log entries 10 with regard to what is significant in them? 11 A. 12 Yes. So what these log entries reflect -- 13 UNIDENTIFIED JUROR: 14 THE COURT: 15 16 We can't see it. Is the screen showing at all? nothing on the screen. THE WITNESS: All right. There's There we go. So what these log entries reflect are the 17 dates and times that correspond with the e-mails that Samantha 18 Cohen provided describing the problems that she was having 19 logging in. 20 And so I went through those e-mails, and I correlated 21 what was going on, the times of the e-mails with what was 22 happening in the logs. 23 were being made to her credentials. 24 credentials, I mean the username and password were being -- 25 something about that was being edited. And in that I could see that changes And if you recall, by KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 630 1 And so there's several dates here that correlate to 2 those e-mails, the 6th, the 8th, and the 14th. And those edits 3 were coming from a VPN IP address that belonged to Overplay. 4 And those edits all came from an Apple computer using a Firefox 5 browser. 6 BY MR. SILVER: 7 Q. 8 discussing on Friday? 9 A. Agent Cauthen, is this the same 91.172 address that we were Previous, yes. 10 MR. SILVER: Next page, please. 11 Q. And there in orange are Overplay logs at the bottom? 12 A. Yes. 13 Q. Showing that same 91.172 IP address? 14 A. Yes. 15 correlate with those exact times as well, indicating the origin 16 and the Overplay user assigned. 17 And those are the log entries from Overplay that MR. SILVER: Next slide, please. 18 Q. Agent Cauthen, did you testify last week regarding a 75.204 19 IP address? 20 A. Yes, I did. 21 Q. And did you testify regarding AT&T records pertaining to 22 that IP address? 23 A. Yes, I did. 24 Q. And did those indicate the user of that IP address? 25 A. They did. Those belong to Matthew Keys. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 631 1 Q. Did you look at the CMS logs with an eye for this 75.204 IP 2 address? 3 A. Yes. 4 MR. SILVER: Let's just start with the top four here, 5 zoom in. 6 Q. Agent Cauthen, what is significant here? 7 A. There's a couple things that are significant here. 8 9 The first thing that is significant is the date. January 2nd, 2011. The second thing that is significant is the 10 IP address, the 75.204. 11 assigned to Matthew Keys himself in his home here in 12 Sacramento. 13 It's And, of course, that belongs or is The third thing that is interesting about this is the user 14 agent. 15 And, finally, it shows that they're on the Tribune CMS log-in 16 screen. 17 Q. 18 from the residential AT&T IP address to the CMS logs? 19 A. 20 It shows that it's an Apple computer using Firefox. So Overplay is out of the connection here, it's straight Correct. MR. SILVER: If we could zoom in on the bottom half as 21 well, please. 22 Q. How about these, Agent Cauthen? 23 A. Well, this is similar except for the third one down. 24 all the others are get commands, essentially the computer is 25 sending the information, which would happen just by landing on What is significant here? Where KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 632 1 that screen. 2 The post command means that something was sent to the 3 computer, and it was sent to the log-in module, meaning there 4 was some sort of attempt to log in. 5 But -- 6 THE COURT: 7 THE WITNESS: 8 BY MR. SILVER: 9 Q. Wait for the next question. I'm sorry. And that was the post command rather than the get command 10 you said? 11 A. Correct. 12 MR. SILVER: Next slide, please. 13 Q. Agent Cauthen, here you're comparing two different IP 14 addresses, both starting with 75.53? 15 A. Correct. 16 Q. Does the fact they both start with the same four numbers 17 have any significance? 18 A. Yes. 19 Q. And what significance is that? 20 A. On the Internet, these IP addresses are critical to, ah, 21 making sure data goes from one computer to another computer, 22 and they are assigned. 23 addresses that start with 75.53 belong to AT&T, and AT&T 24 reassigns that to their customers when they buy Internet 25 service. So, in this instance, all the IP So the fact that it's 75.53 is significant in that KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 633 1 it's still AT&T in both instances. 2 That's all I have to say about that. 3 Q. And you had previously discussed the 75.11 IP address in 4 connection with the M. Keys username; is that right? 5 A. Correct. 6 Q. What was the relationship there, if any? 7 A. Well, that was an IP used by Matthew Keys when he was 8 working at Fox 40 and up until December the 8th, and then his 9 IP address was changed to the 75.204 on or about December 8th. 10 Q. 11 IP addresses, do they both have the same user agent string? 12 A. 13 And the entries from these 2 IP addresses, these two AT&T They do. MR. SILVER: Next slide, please. 14 Q. 15 sources of electronic evidence that you reviewed? 16 A. I did, yes. 17 Q. And where was that? 18 A. I found that in those IRC chat logs as well. 19 Did you find the 75.204 IP address in another one of the MR. SILVER: Next slide, please. 20 Q. 21 through 616? 22 A. I -- I don't remember from last week. 23 Q. You'll be able to check the binder. 24 A. I believe it's 612 through 616. 25 Q. Thank you. Thank you. Agent Cauthen, do these excerpts come from Exhibit 614 I'll have to check. Thanks. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 634 1 2 3 Agent Cauthen, what is significant in these IRC excerpts? A. Well, there's three things that are important. The first thing of interest is, of course, the dates on 4 those excerpts. 5 December through January. 6 7 Each identified several different dates from THE COURT: believe are in. Let me just check. 612 and 613 I do not 614 through 616 are. 8 Is the defense stipulating to 612 and 613 as well? 9 MR. LEIDERMAN: 10 I have to see what they are. (Counsel conferring.) 11 THE COURT: Let's just take a moment to make certain. 12 I've told you before that the slide show itself is not 13 an exhibit, but the documents on which the witness is relying 14 are exhibits. 15 16 MR. SILVER: I understand from the defense that they're comfortable stipulating to these as well, Your Honor. 17 MR. LEIDERMAN: 18 THE COURT: 19 MR. LEIDERMAN: 20 21 22 23 I thought we had already -- All right. These are from the same series of evidence that we had previously stipulated to. THE COURT: All right. Well, 612 and 613 are in, then. (GOVERNMENT'S EXHIBITS 612 and 613, IRC chats, ADMITTED INTO EVIDENCE.) 24 THE COURT: 25 THE WITNESS: You may continue. I was talking about dates here. There KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 635 1 are several dates on the screen between December and January. 2 The second thing of interest is, of course, the reference to 3 AEScracked and some of the connections. 4 thing is the fact that AEScracked in these channels is coming 5 directly from the IP address 75.204, which goes back directly 6 to Matthew Keys' home. 7 BY MR. SILVER: 8 Q. 9 AT&T IP address to the IRC chat logs? So, again, no Overplay here. 10 A. Correct. 11 connection. And then the final Straight from the residential There's no VPN connection. It's just a direct 12 MR. SILVER: 13 on the bottom half. 14 Q. 15 being displayed? 16 A. 17 are specific references to this being -- relating to the 18 Internet Feds IRC chat channel. 19 Q. 20 search warrant at Mr. Keys' residence. 21 If we could zoom out, please, and zoom in And here, Agent Cauthen, is this the same type of data That's correct. The second one shows AEScracked, and there Agent Cauthen, last week you discussed your execution of a Did you review the contents of digital devices that were 22 seized from that search warrant? 23 A. 24 25 Yes, I did. MR. SILVER: Q. If we could go forward two slides, please. Agent Cauthen, is this slide based on Exhibit 505? KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 636 1 A. I forgot the specific number. I'd have to refer to the 2 notes here. 3 Q. Okay. 4 A. Yes, that's Exhibit 505. 5 Q. And what is significant about this image here? 6 A. Well, this is an image that -- is what you would see or a 7 portion of what you would see if you logged on directly to the 8 CMS. 9 screen. After you've logged in, you would see this on your So it's an actual image that would appear on the CMS 10 itself after logging in successfully. 11 Q. And where did you find this, Agent Cauthen? 12 A. I found this on Matthew Keys' digital media in one of the 13 external hard drives. 14 Q. 15 Did you find any information -- is -- let me rephrase. Is this what some might call a screenshot or a screen grab? 16 A. Yes. 17 grab. 18 Q. 19 was created? 20 A. Did you find any information about when this screen grab Yes. 21 MR. SILVER: 22 Q. 23 please? 24 A. 25 This could be created by a screenshot or a screen Next slide, please. Agent Cauthen, can you walk us through this information, Yes. The name of this file is screenshot 2010-12-11 and KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 637 1 11.32.28am.png. 2 essentially a screenshot using an Apple computer. 3 you're using an Apple computer, it automatically names whatever 4 you're taking a screenshot of with the word "screenshot," and 5 then it plugs in the date and the time and gives it a PNG, 6 which tells the computer that it's a graphic type of image. 7 And what this tells you is that it was And when So the name of this file as 2010.12.11 indicates that it 8 was a screenshot taken on December 11th at 11:32 in the 9 morning. 10 Q. 11 look for entries from the same time? 12 A. 13 logs recorded by a person who might be on the CMS. 14 Agent Cauthen, did you then go to the Tribune CMS logs to Yes. Yes, I did. MR. SILVER: It's so long ago. I saw what the CMS Next slide, please. 15 Q. And what are we looking at here, Agent Cauthen, in green? 16 A. What the green is, is the actual log entry that correlates 17 to whoever was on the CMS at that exact time of 11:32 a.m. on 18 December the 11th. 19 address, 91.172, which is an Overplay VPN IP address. 20 And we see that it comes back to an IP It refers to username test1234, which we saw before with 21 the e-mail collection. 22 at 11:32. 23 Apple computer with a Firefox browser. 24 25 And it has the user agent indicating that it's an MR. SILVER: Q. It shows the exact time, December 11th If we could zoom in. Was there a corresponding Overplay record as well for this KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 638 1 particular date and time? 2 A. 3 the person assigned IP address 91.172 was in fact Matthew Keys, 4 with his username of Keys JOM, from his IP address in his 5 house, 75.204, which was the one assigned to him there by AT&T. 6 So it was Matthew Keys who was on the CMS on December the 11th 7 with that picture, and it was Matthew Keys who made that screen 8 grab from the CMS. There was. 9 The corresponding Overplay record shows that MR. SILVER: Next slide, please. Next slide, please. 10 Q. Agent Cauthen, did you also find this image on Mr. Keys' 11 digital devices? 12 A. Yes. 13 Q. And could you check Exhibit 503. 14 slide is based on? 15 A. Yes. 16 Q. Agent Cauthen, what is depicted here? 17 A. That is a picture of the alteration on the Los Angeles 18 Times that was affected from the changes to -- or the 19 unauthorized access to the CMS. 20 MR. SILVER: Is that the exhibit this Next slide, please. 21 Q. Did that picture have any dates -- I'm sorry -- data 22 showing when it was created? 23 A. Yes. 24 Q. And what did that data show? 25 A. The file data shows that file was created on December 15th, KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 639 1 2010, at about 4:32 in the morning Sacramento time. 2 Q. Did you find other -- 3 MR. SILVER: Next slide, please. 4 Q. 5 period? 6 A. Yes, I did. 7 Q. And can you explain to us what we're looking at here? 8 I'll start by zooming in on the top half. 9 Did you find other files in the computer from the same time First, Agent Cauthen, you see the FBI note on the top 10 right. 11 A. Yes, I did. 12 Q. That was not on this original file? 13 A. No. 14 Q. Can you explain to the jury what that note means? 15 A. So if you look to the left of that note, you'll see 16 something written by Sharpie, referring to imgur.com and 17 zhzus.jpg. 18 that, it takes you someplace on the Internet. 19 And That's something that you added, right? I wrote that in there in red. That's called a hyperlink, and if you click on And I did this back in August of 2015, I actually went and 20 went to that website and found that that picture that we saw, 21 the Chippy 1337, the screen grab from December I think it was 22 15th, it's still there. 23 and identified them as being the same. 24 which was the web page defacement which was the one we found on 25 Matthew Keys, also dated for December 15th at 4:32. And so I looked at the two pictures It's the Chippy 1337, KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 640 1 And if you look to the right -- oh, I'm sorry. 2 Q. 3 of this? 4 A. 5 Agent Cauthen, you were referring to something to the right Right. If you look to the right, you may not be able to see this 6 well, but you'll see some time stamps there. And right next to 7 that, you'll see 4:30 a.m., 4:32 a.m. 8 you is that picture was created on Matthew Keys' computer, that 9 screen grab was created on December 15th at 4:32 a.m. 10 Which is exactly the same time that this IRC chat And so what that tells 11 conversation is occurring, which is where Sharpie posts the 12 link to that image indicating that Matthew Keys clicked on a 13 link, and that's how that was created on his computer. 14 Q. Agent Cauthen, what program did this image come from? 15 A. That image is created as a screen grab when Matthew Keys 16 created it, and it's an image depicting a colloquy, an IRC chat 17 conversation. 18 Q. 19 conversation with Mr. Keys? 20 A. Yes, it is. 21 Q. And what is Colloquy? 22 A. Colloquy is an IRC client. 23 using an Apple computer system, to participate in the IRC chat 24 channels. 25 Q. And Colloquy is the IRC program that came up during your It's a program that allows you, And can you walk us through this conversation beginning KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 641 1 after the discussion of the link? 2 A. 3 posted the link to the picture, the defaced website. 4 Yes. So what you have here is Sharpie talking -- he's He says, I taught myself the -- there's a spelling error 5 here -- system using N. Garcia, N. Garcia being a username on 6 the CMS. He makes his correction, he puts asterisk system. 7 AEScracked replies, LOL. 8 Sharpie goes on, And had a whole front page layout made for 9 the Chicago Tribune. 10 AEScracked asks, Is it live? 11 Sharpie says, But, damn, their system admins were good. 12 System admins are the people that are responsible for 13 running the computer system, making sure it's working properly 14 and making sure that it's secure. 15 16 Sharpie goes on, Now they killed me. That was up for half an hour. 17 AEScracked replies, Screenshot? 18 Sharpie, No. 19 AEScracked, Sucks. 20 Sharpie goes on, I meant the L.A. Times was up for half an 21 hour. And it's spelled incorrectly. 22 AEScracked replies, I can grant you access again. 23 Sharpie, That would be great. I know how to use it now. 24 Q. If we could zoom in on the bottom portion, please. 25 A. Now it's about 4:33 in the morning. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 642 1 Sharpie says, I know how to use it now. 2 AEScracked says, Stand by. 3 That's using Overplay as a VPN service or some other 4 service such as. 5 6 AEScracked goes on, I -- ah, already. Sharpie says, I see that you can do a bunch of different layouts on different papers. 9 AEScracked interjects, Damn, they cut off my account. 10 11 And I don't know what NVM is. 7 8 Have to VPN to cover my tracks. Sharpie continues from his previous line, And have them all go live at the same time. 12 AES continues, Hang on. 13 I don't need to read the next one, and then the next one is 14 an unhappy face. 15 Nope, I'm locked out for good. And Sharpie says, Yeah. MR. SILVER: Next slide, please. 16 Q. Did you find other files on Mr. Keys' devices from this 17 same time period? 18 A. Yes, I did. 19 Q. And what were they? 20 A. Now, this is another picture referring to the web page 21 story alteration on the L.A. Times. 22 December 15th at 4:45 a.m., about 15 minutes after the first 23 one. 24 Q. Could you check Exhibit 504, please. 25 A. And that is Exhibit 504. This was created on KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 643 1 Q. 2 continue? 3 A. 4 Did the colloquy chat we were just looking at, did it It did. MR. SILVER: 5 Q. 6 this one. 7 A. 8 9 10 11 Next slide, please. Thanks. Agent Cauthen, if you could start there and walk us through So this is about 4:35 in the morning. AEScracked goes on talking in his conversation with Sharpie, Let me see if I can find some other users/pass -passwords -- I created while there. Sharpie, All those other accounts were dead in minutes, and 12 they found N. Garcia damn quick. I got to give props to the 13 sys admins, meaning he's congratulating the systems 14 administrators. He corrects it and says admin. 15 AEScracked, LOL. 16 Sharpie, Any joy? 17 AEScracked, Not yet. 18 Sharpie, Okay, Bro. 19 AEScracked, Will check a little later for sure. 20 Sharpie, I think he's saying after five minutes anyway. 21 22 Meaning were you successful? Cool, and then some sort of emoticon. AEScracked, I have a hard drive full of Tribune crap, but 23 it's in another location. 24 Sharpie, Thanks. 25 AEScracked, Sure thing. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 644 1 2 Sharpie, That was such a buzz having my edit on the L.A. Times. 3 AEScracked, Nice. 4 Sharpie, I could have done so much more if I had known the 5 interface at the start. It's both easy and complicated. 6 Q. 7 entries at the same time period? 8 A. Agent Cauthen, did you look at the Tribune CMS logs for Yes, I did. 9 MR. SILVER: Next slide, please. 10 Q. These are not in green like they usually are because you 11 used a different software program to retrieve these? 12 MR. LEIDERMAN: 13 THE COURT: I'm going to object as leading. Sustained. 14 BY MR. SILVER: 15 Q. Agent Cauthen, can you explain why these are not in green? 16 A. Yes. 17 Q. Why is that? 18 A. Because I used Excel to open the logs with this, and the 19 other ones were just a text. 20 Excel, it's the same data, but it's just presented differently 21 in Excel. 22 and paste, and so I couldn't change the color to green. 23 So -- because you're seeing it in I did a screen grab to create that in lieu of a cut MR. SILVER: Can we zoom in any more on these? 24 Q. Agent Cauthen, first turning your attention to the IP 25 address on the left, is this the same IP address for all of KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 645 1 these entries? 2 A. It is. 3 Q. And is it one we've discussed previously? 4 A. It is. 5 VPN IP addresses assigned to Matthew Keys. 6 This is the 91.172, which is one of the Overplay MR. SILVER: If we could zoom out from there. 7 Q. 8 here. 9 A. Yes. 10 Q. What is the significance of the log-in module on these 11 entries? 12 A. 13 in to the CMS, and it occurs at the same time this chat 14 conversation is going on where Matthew Keys as AEScracked is 15 telling Sharpie I'm trying to get back in. 16 Agent Cauthen, I see the word or the phrase "log-in module" Is that significant? The significance is it indicates a log-in or attempt to log It shows it's a VPN IP address assigned to Overplay, which 17 Overplay has told us belongs to Matthew Keys. 18 Q. And how many entries in total are depicted here? 19 A. I'm having a little trouble seeing that. 20 moment. 21 Q. 22 23 24 25 That's okay. Bear with me a That's okay. And this is exhibit -- can you check Exhibit 307, please. A. Thank you. So this is better defined in Exhibit 307. There are nine entries. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 646 1 Q. Agent Cauthen, did you review multiple IRC channels with an 2 eye toward entries by AEScracked? 3 A. Yes, I did. 4 MR. SILVER: If we could go forward two slides, please. 5 Q. Could you check Exhibit 603, please. 6 A. Yes, I have it. 7 Q. And this is from the IRC channel Target? 8 A. Yes. 9 MR. SILVER: Next slide, please. 10 Q. If you could check Exhibit 602-13. 11 A. Yes. 12 Q. And this is from a different channel, the Command channel? 13 A. Yes, pound command IRC. 14 MR. SILVER: Next slide, please. 15 Q. This is from the Operation Payback channel? 16 A. Yes. 17 Q. And is this based on Exhibit 605? 18 A. Yes. 19 MR. SILVER: Next slide, please. 20 Q. Is this from 606? 21 A. Yes. 22 Q. This is the Operation Payback channel? 23 A. Yes. 24 25 MR. SILVER: Q. Next slide, please. Can you check the second page of 611. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 647 1 A. Yes. 2 Q. That's where this is from? 3 A. Correct. 4 Q. And this is the Internet Feds channel? 5 A. That's correct. 6 MR. SILVER: Next slide, please. 7 Q. Is this from Exhibit 607? 8 A. That's correct. 9 MR. SILVER: Could we zoom it so it has those two lines 10 by AEScracked, please. 11 Q. 12 the bottom of that excerpt, did you go to that link? 13 A. I did. 14 Q. And what was there? 15 A. That's an opinion piece, a story written by the L.A. Times 16 back in December 2010 titled Why the WikiLeakers are not quite 17 Rosa Parks. 18 Thank you. Agent Cauthen, drawing your attention to the web link at MR. SILVER: Next slide, please. 19 Q. Is this from Exhibit 608? 20 A. Yes, it is. 21 MR. SILVER: Next slide, please. 22 Q. Is this 603? 23 A. This one is not 603. 24 Q. Why don't we go to the next one. 25 THE COURT: I can look for it quickly here. I think that's a good plan. Next question. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 648 1 BY MR. SILVER: 2 Q. Agent Cauthen, is this from the Operation Payback -- 3 A. Yes. 4 Q. -- channel? 5 MR. SILVER: And the next slide, please. 6 Q. This is also from Operation Payback? 7 A. Yes. 8 Q. Agent Cauthen, stepping away from the IRC logs for one 9 question about the CMS entries. 10 Between October -- I'm sorry. 11 Between November and January, how many entries in the CMS 12 logs do you associate with Matthew Keys? 13 A. 14 them up, there were too many. 15 16 17 18 19 Hundreds, if not thousands. MR. SILVER: I didn't specifically count Your Honor, if I may have one moment to confer with co-counsel. THE COURT: You may. (Government counsel conferring.) MR. SILVER: Your Honor, the direct is done except we 20 would like just a bit of time to reopen later to pin down the 21 exact numbers those excerpts came from. 22 23 THE COURT: All right. I'll allow that if you're able to do so. 24 MR. SILVER: 25 THE COURT: Thank you. Mr. Leiderman, are you ready? KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 649 1 2 MR. LEIDERMAN: Yes, one second. (Defense counsel conferring.) 3 THE COURT: Before Mr. Leiderman begins, let me also 4 make certain you understand. You probably have noticed that 5 Mr. Ekeland is not with us this morning, and I forgot to advise 6 you on Friday that Mr. Ekeland has previously let the Court 7 know that his schedule had a conflict, he was not able to be 8 with us this week, and so the Court granted him permission to 9 not be here this week. His client is fine with that, his 10 co-counsel and opposing counsel. 11 into his absence. 12 All right. 13 MR. LEIDERMAN: 14 Mr. Leiderman. May I start by briefly approaching the witness, please? 15 THE COURT: 16 MR. LEIDERMAN: 17 THE COURT: 18 So you should read nothing With -A late-breaking exhibit. All right. Have you shown that to the government? 19 MR. LEIDERMAN: 20 THE COURT: 21 MR. LEIDERMAN: 22 THE COURT: I have. All right. You may approach. Thank you. Do you have a courtesy copy for the Court? 23 If you could hand that to Ms. Streeter, who is covering for 24 Ms. Schultz this morning. 25 ///// KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 650 1 CROSS-EXAMINATION 2 BY MR. LEIDERMAN: 3 Q. 4 really briefly. 5 closely because I don't want you going outside of what would be 6 permissible. 7 A. Yes, sir. 8 Q. In the top left-hand corner, do you see a logo? 9 A. Yes. 10 Q. Do you recognize that logo? 11 A. Yes. 12 Q. Does that logo correspond with something you used a number 13 of times? 14 A. Yes. 15 Q. Okay. 16 haven't flipped through it, have you? 17 A. No. 18 Q. What then does that front page purport to be? 19 A. A cached version of a web page. 20 Q. And what website would it be from? 21 website commonly called? 22 A. The Wayback Machine? 23 Q. Yes. 24 Machine from the Sherman and Peabody cartoons, right? 25 A. I am going to ask you some questions about that first just And I want you to listen to the questions What then does that, at least that front page -- you Okay. The -- what's the And you're not talking about the Wayback No. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 651 1 Q. What is the Wayback Machine? 2 A. The Wayback Machine is an Internet service, provided I 3 believe by Google, that offers cached versions of web pages. 4 Q. And what is a cached version of a web page? 5 A. It's essentially a picture of what the web page looked like 6 at a particular date. 7 Q. Are you familiar with something called archive.org? 8 A. Yes, and I think that is associated with the Wayback 9 Machine -- 10 Q. And -- 11 A. -- as far as -- 12 Q. -- does Google own archive.org? 13 A. I don't know. 14 Q. Okay. 15 necessarily Google? 16 A. I think -- I believe you're correct. 17 Q. Okay. 18 possible that they own anything on the Internet? 19 A. Anything is possible. 20 Q. Okay. 21 Wayback Machine. 22 The Wayback Machine is on archive.org and not But with the amount of things that Google owns, it's So we're going to talk about archive.org and the How does the Wayback Machine function? You want a better question than that? 23 A. No. 24 Q. Okay. 25 A. The Wayback Machine goes out to the Internet and takes KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 652 1 pictures of websites and stores them and notes the date. 2 Q. 3 taken? 4 A. I don't recall. 5 Q. Okay. 6 the line at the bottom of the page. 7 Notes the date and the exact time that the snapshot was I think so. If you can look, then, at the -- not the slug line, I forgot what it's called. What's it called, the little line at the bottom of the page 8 that tells you what website you visited? 9 A. The URL? 10 Q. It has another -- I know the URL. 11 12 Never mind. Never mind. If you could look at the URL, does that tell you whether it's down to the precise second? 13 Are you able to see it that small? 14 A. 15 URL. 16 Q. Okay. 17 A. I can see there is something that appears to be a date and 18 a time and then some numbers. 19 Q. 20 I can see it. I'm not confident about the meaning of the And that -THE COURT: The Court's exhibit sticker is covering 21 part of the line you're referring to, so I don't know if that's 22 the case on the witness's copy. 23 MR. LEIDERMAN: 24 THE COURT: 25 MR. LEIDERMAN: It isn't. All right. I apologize for that. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 653 1 THE COURT: All right. That's all right. I just 2 wanted to make certain the witness is looking at the same thing 3 you're referring to. 4 MR. LEIDERMAN: 5 THE COURT: Okay. All right. 6 BY MR. LEIDERMAN: 7 Q. 8 example, on that one does it purport to be from perhaps 2014 in 9 December, on the 14th of December, and then it gives you six So you don't know for sure if that, like -- well, for 10 more numbers? 11 A. Yes. 12 Q. And those six more numbers, if I'm remembering correctly, 13 are -- correspond to, like, 5:00 in the afternoon, something 14 like that? 15 A. I -- 16 Q. You'd have to speculate? 17 A. I would have to speculate. 18 Q. Is that at least -- Would be read as numerical chronological time? 19 THE COURT: 20 MR. LEIDERMAN: 21 You said 2014? THE COURT: 23 MR. LEIDERMAN: 25 Is that what you meant? Didn't I -- I said the 14th of December 2010. 22 24 I'm sorry. Your Honor. I think you said 2014. You meant 2010? If I said 2014, I clearly meant 2010, I apologize. THE COURT: All right. Did you understand the question KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 654 1 to mean 2010? 2 THE WITNESS: 3 THE COURT: Yes, Your Honor, I did. All right. 4 BY MR. LEIDERMAN: 5 Q. What website does that appear to be a cached copy of? 6 A. Www.latimes.com. 7 Q. And that would be what we call the front page of the L.A. 8 Times? 9 A. I believe that is the front page. 10 Q. Is it fair to say some days the Wayback Machine captures 11 several different times of a particular website? 12 A. 13 times per day it would capture a website or which days of the 14 week. 15 Q. 16 it will pick up once a week, once every two weeks, and some 17 websites it will pick up several times a day? 18 A. 19 my experience, that it's sporadic in terms of the dates and 20 times that it captures. 21 Q. So even on a site like the L.A. Times, it might miss a day? 22 A. It's possible. 23 Q. Anything is possible. 24 25 I'm not clear how the machine actually works or how many Well, are you familiar with it being random, some websites I don't use it enough -- I do know it seems to me, based on But a site like the L.A. Times would be captured more often than, for example, like -- I don't know, my law office website KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 655 1 or -- or this court's home page or something like that? 2 A. I don't know. 3 Q. Okay. 4 A. I don't use it a lot. 5 Q. But it is something that is generally reliable; is that 6 fair to say? 7 A. I don't rely on it. 8 Q. I'm just going -- you can't tell me anything more than 9 what's on the paper, and I'm just going to ask you in terms of 10 what's on the paper, if you can look on it, whether the Chippy 11 1337 story has been archived in at least just that version of 12 the Wayback Machine from December of 2010. 13 A. I understand. 14 Q. If you could just take a look and see. 15 A. Oh. You're not an expert on the Wayback Machine? It's not something I rely upon. 16 It's pretty small print. I need to really look just to 17 make sure I get the right answer. 18 long. I'm sorry I'm taking so 19 THE COURT: 20 MR. LEIDERMAN: 21 Could I have a second to confer with the government? 22 THE COURT: 23 24 25 Take as much time as you need. Go ahead. You may. (Counsel conferring.) THE COURT: If the jury wants to stand and stretch quietly without making any noise or talking, you may do that. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 656 1 I heard that yawn. 2 (Pause in proceedings.) 3 MR. LEIDERMAN: 4 THE WITNESS: 5 MR. LEIDERMAN: Okay. I think I'm ready. You think you're ready. 6 Q. Do you have the question in mind? 7 A. Could you repeat it, please? 8 Q. Okay. 9 A. I do not. 10 Q. Presuming that is the only archived copy from -- on the 11 Wayback Machine from December 14th, 2010, then the story would 12 not be on the Wayback Machine, assuming hypothetically, right? Do you see the Chippy 1337 story there? 13 MR. SILVER: 14 THE COURT: Objection, calls for speculation. Sustained. 15 BY MR. LEIDERMAN: 16 Q. 17 on the Wayback Machine, and it doesn't contain a specific item 18 that you're looking for, that means it's not there, correct? 19 A. 20 there, then it's not there? 21 Q. That's what I'm asking. 22 A. Then I agree with that. 23 Q. Okay. 24 six pages that I gave you. 25 If there's only one cached version of a web page on a day If I understand your question, you're asking if it's not Can you just put that toward the defense binder, the Are you familiar with the kind of nuts and bolts of how KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 657 1 VPNs and proxy servers work? 2 A. 3 so. 4 Q. Much more so than the average person might? 5 A. I would assume so, yes. 6 Q. You have some specialized training in these areas? 7 A. I do. 8 Q. Likewise of IRC, you have some kind of specialized training 9 there? Nuts and bolts, I have a familiarity with them. 10 A. 11 haven't personally set up on an IRC server, but I have reviewed 12 thousands of IRC logs. 13 Q. 14 generally, if you know? 15 A. I don't know. 16 Q. Are you familiar with the culture and the language 17 from hacktivist forums like -- are you familiar with the term 18 "hacktivist"? 19 A. I am. 20 Q. What does that word mean? 21 A. Portmanteau. 22 Q. Okay. 23 General training in IRC. I believe I haven't personally used it, I Is that what we heard from Mr. Kulesza about IRCs kind of It's P-O-R-T-M-A-N-T-E-A-U. Portmanteau is a scripting together of two words for lack 24 of a more elegant term? 25 A. In English I think so, but in French it means raincoat. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 658 1 Q. Is that right? 2 3 THE COURT: things. 4 5 This is a tutorial on a whole range of MR. LEIDERMAN: This is great subject matter, Your Honor. 6 THE COURT: 7 MR. LEIDERMAN: 8 Q. 9 hacktivist mean? We're back in school. Okay. Presuming I'm not asking about a raincoat, what does 10 A. 11 newspapers. 12 computer systems or do cyber crimes for political purposes. 13 Q. 14 a hacktivist group? 15 A. 16 I can't be specific in terms of the characterization of the 17 organization as a whole. 18 Q. 19 20 Hacktivism is a term used -- you'll see it in the It refers to people that hack or break into And would you consider Anonymous, capital A Anonymous to be Anonymous is a very large organization and very diffuse, so That's fair enough. How about are there parts or portions, clicks within Anonymous that walk the walk of hacktivists? 21 MR. SILVER: 22 THE COURT: 23 THE WITNESS: 24 25 Objection to foundation and hearsay. Overruled. If you know. There are individuals that claim to be part of Anonymous that purport to be hacktivists, yes. MR. LEIDERMAN: Okay. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 659 1 Q. And you say that purport to be. 2 actually been arrested and convicted for being so; is that -- 3 MR. SILVER: 4 THE COURT: There were some that were Objection. Sustained. 5 BY MR. LEIDERMAN: 6 Q. 7 Internet Feds chat room? 8 A. I don't -- I can't characterize them as such. 9 Q. Do you have a personal opinion of the people in the Would there be what you would consider hacktivists in the 10 Internet Feds room that is preventing you from characterizing 11 them? 12 A. 13 hacktivism and the people in the Internet Feds chat room, I 14 think some of them may have said they were doing hacktivism 15 things or the intent of what they were doing was for political 16 reasons. 17 was criminal acts. 18 what they were doing as hacktivists legitimized the criminal 19 activity. 20 Q. 21 22 Or is it just too broad a term to characterize? Well, I believe in this case, you know, when you talk about Having said that, I also believe what they were doing And so I don't want to, ah, indicate that I understand entirely. Thank you, sir. But at the time, at least some of them thought they were hacking for right or justice or whatever it might be? 23 MR. SILVER: 24 THE COURT: 25 THE WITNESS: Objection, relevance. Overruled. I don't recall that in the Internet Feds KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 660 1 chat room, but I do recall that on other chat sites by others. 2 BY MR. LEIDERMAN: 3 Q. Such as Operation Payback? 4 A. That might be a good example. 5 can't point to a specific instance, but my recollection of that 6 chat room was that there were people indicating, ah, political 7 feelings about what was going on in the chat room. 8 Q. 9 yes or no answer if it suits the question, wasn't Operation 10 Okay. Without getting into it further, other than maybe a Payback itself a political operation, a political motive? 11 12 I don't -- I can't -- I MR. SILVER: Objection, the document speaks for itself. The excerpts speak for themselves. 13 THE COURT: 14 THE WITNESS: Overruled. Overruled. The actual history of Operation Payback, 15 I don't have enough information to give you an accurate answer. 16 I'm sorry. 17 BY MR. LEIDERMAN: 18 Q. 19 Okay. You said the history of it. Are you familiar with what -- again, just yes or no -- with 20 what Operation Payback was about? 21 A. Yes. 22 Q. Okay. 23 political, no? 24 A. 25 started or how it started. That was -- would readily be characterized as Well, the problem I am having is I don't remember when it And I haven't read all of the logs KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 661 1 regarding Operation Payback, and I don't know the history of it 2 and the participants' history of it. 3 narrow subset, and I know it goes back a long time. 4 Q. 5 title was, are you familiar with the second title that was 6 given to sort of the December 8th, 9th and 10th portions of 7 Operation Payback? 8 Okay. I focused on a very Are you familiar -- without telling us what that It had to do with a certain individual. 9 A. I think so. 10 Q. Okay. 11 to what degree -- to what degree of certainty -- you say you 12 think so. 13 A. 14 subject matter, but not the specific name of the chat channel 15 or the participants. 16 Q. 17 So before I ask you another question, I need to know You have reasonable confidence in it? I have a reasonable confidence, and I know the general Okay. Let me ask you this. Do you know the targets that were hit on December 8th, 9th 18 and 10th, separate and apart from -- 19 A. I think so. 20 Q. Okay. And that then would be a political motive, correct? 21 MR. SILVER: 22 THE COURT: 23 Objection, foundation. Do you want him to lay more of a foundation? 24 MR. LEIDERMAN: 25 THE COURT: I can. I'll sustain subject to laying a KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 662 1 foundation. 2 3 MR. SILVER: Honor. 4 5 The foundation seems to be hearsay, Your THE COURT: Overruled. You can try to lay a foundation. 6 MR. LEIDERMAN: Okay. 7 Q. On December 8th, 9th and 10th, were there a series of 8 attacks by Anonymous on websites Paypal, Amazon, Visa and 9 Mastercard having to do with a banking blockade of WikiLeaks 10 and Julian Assange? 11 A. You have refreshed my memory. 12 Q. Okay. 13 Operation Avenge Assange? 14 A. I don't recall that name, but I do remember the event. 15 Q. Okay. 16 did people come into the Operation Payback channel? 17 A. 18 of people in Operation Payback, and they were discussing in 19 that time frame Assange and the WikiLeaks and attacks on 20 financial institutions. 21 Q. 22 older -- as an order operation. 23 Thank you. That is correct. And was that portion of the operation referred to as And did that portion of the operation conglomerate, I don't know where they all came from, but there are a lot Okay. And you said you knew Operation Payback as an Did Operation Payback itself start with kind of a tit for 24 tat, this being the tat portion of the tit for tat, with the 25 RIAA, the Recording Industry Association of America? KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 663 1 A. I don't know if that was the start of it, but there were -- 2 there was talk about that early on, earlier on in that chat 3 room. 4 Q. 5 hiring people from India to hit servers that were sharing -- 6 unlawfully sharing music? 7 A. I don't know about that. 8 Q. Operation Payback was a very busy chat room as of December 9 8th, 9th, and 10th; fair to say? And that it started from the recording industry actually 10 A. Yes. 11 Q. Okay. 12 Overplay? 13 A. Yes. 14 Q. And I believe you already testified -- I know you already 15 testified to this, but I'm just reviewing. 16 In this specific case, you reviewed VPN logs sent by You went over chat logs relevant to -- relevant to the date 17 range in question? 18 A. Yes. 19 Q. As well as CMS logs? 20 A. Yes. 21 Q. In terms of Overplay, the IP addresses from Overplay 22 were -- you used the term "geolocate." 23 A. 24 of the -- 25 Q. Do you recall? I used that in the context of IP address 75.11. In terms Was that the Switzerland one? KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 664 1 A. No, that was Matthew Keys' home IP address. 2 Q. Okay. 3 fair to say? 4 A. 5 Matthew Keys in Sacramento. 6 Q. Matthew Keys' address? 7 A. No, the 75.204 went back to his address. 8 Q. Right. 9 A. I didn't have records for the 75.211 linking to an address. For the one that resolved to his address; is that It resolved to -- yes, here in Sacramento. It resolved to 10 It had already been superseded by the 75.204 one that had 11 replaced it. 12 Q. What date range was the 75.211? 13 A. I don't know the start date, but the -- it ended, I 14 believe, on December the 12th, 2010. 15 And I believe, according to the log -- 16 Q. 17 the last one. 18 A. Okay. 19 Q. Okay. 20 respect to Switzerland. 21 Sorry, sir. There's no question pending. You've answered Thank you. I'm going to use geolocated again, this time with Overplay geolocated their IP addresses, one to Switzerland; 22 is that right? 23 A. I believe that's correct, yes. 24 Q. And another to somewhere in the UK? 25 A. I believe the radius server was in the UK. Ah, there were KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 665 1 others in France and other European countries. 2 off the top of my head which one was one. 3 Q. 4 I don't recall Fair enough. There were multiple addresses, correct? 5 A. Yes. 6 Q. And the logs we've seen show routing out that ties -- that 7 you've tied out to IP addresses to the Keys JOM account? 8 A. Yes. 9 Q. Are you aware that VPN services regularly route multiple 10 users through a given IP address? 11 A. Yes. 12 Q. Okay. 13 Keys JOM is going through that one IP address in the UK or 14 France or Switzerland; is that -- 15 A. Correct. 16 Q. All right. 17 about locking or registering a nick, N-I-C-K. 18 Which, in other words, is more traffic than just the Going back to the IRC, I want to talk to you What is a nick? 19 A. A nick stands for nickname. AEScracked was a nick, as an 20 example. 21 Q. 22 they call it a nick? 23 A. Yes. 24 Q. No one wants to type nickname; is that what's going on? 25 A. I don't know why they do it. And that's the language that people use in IRC about these, I would assume so. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 666 1 Q. 2 Yeah. But that's the point of all these sort of shortcuts, right? 3 A. I believe it is, yes. 4 Q. Yeah. 5 No one wants to type out laugh out loud, so they do LOL? 6 A. I think that's the case. 7 Q. Okay. 8 9 I had one for you. You said AFK was after five minutes. Sharpie telling Mr. Keys AFK 5 minutes you thought was after five minutes. 10 You ever heard of the term "AFK" is away from keyboard, 11 I'll be gone for five minutes? 12 A. You could be right. 13 Q. There are an awful lot of these little shortcuts, aren't 14 there? 15 A. There are. 16 Q. Okay. 17 NVM. 18 I might have misread that. One was -- you know more than me, but one I saw was Did you know what that was? 19 A. I don't. 20 Q. That was never mind maybe -- 21 A. Okay. 22 Q. -- in the context. 23 that. 24 25 All right. I'm just -- that's it, going back to So someone used the nickname AEScracked in the Internet Feds channel, correct? KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 667 1 A. Yes. 2 Q. And you're basically familiar with how usernames work on 3 IRC, correct? 4 A. Correct. 5 Q. And you heard Mr. Kulesza's testimony, correct? 6 A. Yes. 7 Q. So some servers will allow a username to be registered? 8 A. Yes. 9 Q. And you're aware that the Internet Feds channel allowed 10 usernames to be registered. Yes? 11 A. I don't remember. 12 Q. You don't remember? 13 A. I'm sorry. 14 Q. Okay. 15 for example, the Sabu and Kayla nicknames were registered, 16 logged? 17 A. I don't know. 18 Q. So what would be the purpose of registering something, 19 registering a nick on an IRC? You don't know -- are you or are you not aware that, 20 Let me ask a better question. 21 One of the purposes of registering a nick on an IRC is so 22 when you go in, everyone knows it's you? 23 A. Okay. 24 Q. You sure? 25 A. That sounds reasonable. Yes. I'm not 100-percent confident of KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 668 1 all the reasons why a person might want to have their name 2 registered, but that sounds reasonable. 3 Q. 4 from using that nick, correct? 5 A. That sounds correct, yes. 6 Q. You started this investigation in December of 2010, right? 7 A. I did. 8 Q. Were you familiar with really who all these people in 9 Internet Feds were? Okay. And the another one would be to keep other people 10 A. No. 11 Q. Did you become familiar with the grand majority of the 12 people that were in the Internet Feds chat room sometime 13 after -- I see you're nodding already -- sometime after 14 December of 2010? 15 A. Yes. 16 Q. And without saying why or who, most especially after 17 June -- early June, June 8th or so, 2011? 18 A. I don't remember the dates. 19 Q. Okay. 20 at least began to come into focus? 21 A. 22 that it's my birthday. 23 Q. Oh. 24 A. Thank you. 25 Q. Sure. But is that when everything came into full focus or That day doesn't actually ring a bell other than the fact I'd say happy birthday, but I don't think it's June. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 669 1 I'll say it this way, then. There was one big arrest, and 2 that led to a good deal of information that shed light on the 3 Internet Feds chat room; is that fair? 4 MR. SILVER: 5 THE COURT: 6 THE WITNESS: Objection, hearsay, relevance. Overruled. There were a lot of arrests that we made 7 relating -- when I say we, I mean the FBI -- made relating to, 8 you know, these hacking groups. 9 BY MR. LEIDERMAN: 10 Q. Internet Feds specifically? 11 A. Internet Feds. 12 13 MR. SEGAL: Objection, Your Honor, this is covered by a motion in limine. 14 THE COURT: 15 THE WITNESS: I understand that. I'm trying to think. I think -- I think 16 I know what you're talking about, and I'm happy to talk about 17 it. 18 MR. LEIDERMAN: 19 THE WITNESS: 20 MR. LEIDERMAN: Okay. Well, that was -- But I'm not confident. That was all I wanted to know is if 21 that brought the picture into clearer focus, and I think it 22 really was June 8th, 2011. 23 THE WITNESS: 24 MR. LEIDERMAN: 25 Q. And I think you're right, it was. Okay. And it was at that time, six, seven months later that at KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 670 1 least the government began to understand who these people were; 2 is that fair to say? 3 A. 4 working on it prior to that. 5 Q. 6 March of 2012, that the general public became aware of sort of 7 who these people were, real names, actual capabilities, jobs, 8 training, things like that? 9 MR. SILVER: Oh, no, I don't think that's accurate. I think we had been Wasn't from almost a whole year after, or at least until 10 THE COURT: Objection, calls for speculation. Sustained. 11 BY MR. LEIDERMAN: 12 Q. 13 2012? 14 A. 15 do recall several big events that happened relating to various 16 arrests that were made. 17 Q. 18 19 Was it sometime -- did some event happen on March 6th, I don't remember a specific date, on March the 6th, but I Well, let me ask it this way. Were there some indictments unsealed in March of 2012, in early 2012? 20 MR. SILVER: 21 THE COURT: 22 Objection, covered by a motion in limine. Well, it's not just that. Let me just make certain the jury understands. 23 There's only one case being tried here, and whatever 24 might have happened in another case is not relevant to this 25 case. To the extent, Mr. Leiderman is trying to chart a KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 671 1 timeline, I'm allowing some very general questions, and that's 2 all, given the witness's answers so far. 3 of charting a timeline, these general questions are allowed. 4 MR. LEIDERMAN: So for the purposes Okay. 5 Q. Some indictments happened then in March 2012 that give the 6 public a broader view of who these people were? 7 A. 8 remember when they were unsealed, but I do have a recollection 9 about a series of indictments that were released to the public. I don't remember the dates of the indictments, and I don't 10 And I do recall a number of arrests. 11 Q. 12 when he worked for Reuters in March of 2012? Do you recall a news story that was written by Matthew Keys 13 MR. SILVER: 14 THE COURT: 15 THE WITNESS: 16 Objection, hearsay. Overruled. You can answer yes or no. Could you repeat the question? Who wrote it? 17 MR. LEIDERMAN: 18 THE COURT: 19 THE WITNESS: Matthew Keys. Just yes or no. No. 20 BY MR. LEIDERMAN: 21 Q. 22 use of the screenshots that you purported to have found on 23 Matthew Keys' computer was to give to a woman named Parmy 24 Olson, the only actual use of them? 25 As far as you're aware then, as you sit there now, the only MR. SILVER: Objection, calls for speculation. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 672 1 MR. LEIDERMAN: 2 THE COURT: 3 THE WITNESS: I asked if he knows. Overruled. I believe that in the interview that we 4 listened to on the tape, there were several reasons he 5 discussed. 6 7 One was to protect himself. MR. LEIDERMAN: No, no, no. I asked the actual use, what he did with them, who he gave them to journalistically. 8 THE WITNESS: 9 MR. SILVER: Oh, journalistically who he gave them to? Objection, foundation. 10 THE COURT: 11 MR. LEIDERMAN: 12 THE COURT: 13 THE WITNESS: 14 MR. LEIDERMAN: 15 Q. 16 Olson? 17 A. 18 properly. 19 Is this still does he know? Yes. All right. So yes or no. Yes. Okay. And you believe that one person to be a writer named Parmy No. I'm sorry. Maybe I didn't answer the question I believe he did release and have the snapshots, and one of 20 the people he released it to was Parmy Olson. 21 Q. Okay. 22 A. Yes. 23 Q. A writer for Forbes that covered Anonymous? 24 A. Covered Anonymous, yes. 25 Q. And another person would be Adrian Chen; is that right? Parmy Olson was a journalist? KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 673 1 A. That sounds familiar. I don't know all the people. 2 Q. Would another publication be Gawker? 3 A. I don't know. 4 Q. Fair to say you don't recall? 5 A. Ah, no. 6 in terms of where he sent all the screenshots to. 7 the full universe of where he would have sent the 8 screenshots -- or the altered screenshots, where they were sent 9 or to whom. But fair to say it's not an area of investigation I don't know 10 Q. The takeaway, though, is the screenshots were used by 11 journalists; is that right? 12 A. Somewhere, yes. 13 Q. Did Mr. Keys ever refer to himself as a member of 14 Anonymous? 15 MR. SILVER: 16 THE COURT: 17 THE WITNESS: Objection, hearsay. Again, overruled. Yes or no. I don't recall a specific instance, no. 18 BY MR. LEIDERMAN: 19 Q. 20 observing the proceedings, correct? 21 tape that you played? 22 A. Yes. 23 Q. Were you already contacted by the -- someone at Tribune 24 Company, the larger Tribune Company including the affiliates, 25 before December 14th, 2010? He referred to himself many times, though, as a journalist And that's part of the KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 674 1 A. Yes. 2 Q. Was that person Brandon Mercer that contacted you first or 3 do you -- well, let me ask the question differently. 4 Do you know who contacted you first? 5 A. Yes. 6 Q. Who was that? 7 A. Brandon Mercer. 8 Q. Do you know what date that was? 9 A. December 2nd. 10 Q. December 2nd, 2010? 11 A. Yes. 12 Q. And then the L.A. Times, of course, was edited on December 13 14th, 2010? 14 A. Yes. 15 Q. And that's the Chippy article at issue here? 16 A. Yes. 17 Q. And part of your duties were to review what happened with 18 that -- you refer to it as a defacement? 19 A. I -- 20 Q. The term that people use -- 21 A. Are you referring to the hack at the L.A. Times? 22 Q. The Chippy incident. 23 A. The Chippy incident, I refer to that as a hack, a computer 24 intrusion. 25 defacement. Sorry. Yes. And part of that was there was a web page KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 675 1 Q. 2 Okay. So then I'm asking about the web page defacement. Part of your duties was to review information about the 3 response time that the Tribune and L.A. Times employees sent 4 you? 5 A. Yes. 6 Q. To step back for a moment, where is the CMS itself located, 7 physically located, if you know? 8 A. 9 that manages the L.A. Times is in -- and for Fox 40 is in Los I believe the server in the -- at least for the portion 10 Angeles. 11 Q. 12 Company or is it a third party vendor? 13 A. I don't know. 14 Q. Are you familiar with something that I'm going to refer to 15 as N. Garcia edits or how about N. Garcia defacement? 16 A. Yes. 17 Q. That occurred at 3:49 p.m. Pacific time; is that right? 18 A. That time doesn't sound right to me. 19 refer to my notes. 20 Q. 21 22 And who controls that physical location? Is it Tribune Is it -- if I could Hold on one second. Why don't we go ahead and refer to that. I want to get the times right. 23 THE COURT: 24 BY MR. LEIDERMAN: 25 Q. Referring to an exhibit or the power point? Is there an exhibit that would refresh your recollection? KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 676 1 A. I don't know if it's an exhibit, but in the report on the 2 Tribune -- that Tribune prepared, they pulled the logs for the 3 actual edit. 4 time. 5 Q. Okay. 6 A. I'll look for it as fast as I can. 7 Q. Well, I can get it real quick. 8 A. Okay. 9 In that it shows the N. Garcia and the exact Are you able to readily find that? I'm ready. MR. LEIDERMAN: 10 So -- THE COURT: Excuse me one moment, Your Honor. All right. 11 BY MR. LEIDERMAN: 12 Q. 13 that sound right? 14 A. 15 just to verify I'm correct? 16 you did, then that's correct. 17 Q. I -- 18 A. I'm sorry. 19 Q. And it was up for 40 minutes till 4:29 p.m. Pacific 20 standard time? 21 22 3:49 p.m. Pacific standard time is when it went up? I -- in my head, I had 2:49, but can I look at the exhibit MR. SILVER: Did you read it off of there? If Objection, the witness has not been able to refresh his recollection as to the time. 23 MR. LEIDERMAN: 24 THE COURT: 25 Does If he knows. Sustained. Well, ask the question again. BY MR. LEIDERMAN: KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 677 1 Q. Was the article up just a short while? 2 A. On the website, yes. 3 website, but not the mobile. 4 Q. 5 If you just are talking about the Let's talk about the mobile. The mobile was up longer than the website, is that some of 6 the testimony that you've heard in this trial? 7 A. Correct. 8 Q. You've been sitting through this trial inside the 9 courtroom, correct? 10 A. That's correct. 11 Q. You're something known as, designated as an investigating 12 officer? 13 A. I don't know the term. 14 Q. Okay. 15 A. But that sounds right. 16 Q. But you're allowed -- because you're the case agent, you're 17 allowed to sit at counsel table? 18 A. That's what I'm told, yes. 19 Q. And you've been sitting at counsel table? 20 A. Yes. 21 Q. No one has kicked you out? 22 A. Ah, no. 23 Q. Okay. 24 A. Yes. 25 Q. Okay. Has everybody been nice to you? Good. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 678 1 You've heard testimony that it was up a short while, 2 approximately 40 minutes? 3 A. That's correct. 4 Q. And that it came down during the time of a shift change, 5 which would be around 5:00 o'clock? 6 A. That sounds correct. 7 Q. Okay. 8 A. Yes. 9 Q. Well, I think I've asked that. Changes were rolled back by Mr. Hanrahan? 10 THE COURT: 11 MR. LEIDERMAN: 12 THE COURT: You do have a little more yet? I do have a little more, yes. I think we should take our midmorning 13 break, our first break. 14 half. 15 Up for 40 minutes is my recollection. We've been going for an hour and a During that break, and it can be a 15-minute break, 16 please remember my admonitions not to discuss the case, not to 17 do any research. 18 please let me know. 19 If anyone does discuss the case with you, Have a good break. 20 (Jury not present.) 21 THE COURT: 22 minutes. Just be back in 15 If you are looking for an exhibit, that's fine, too. 23 THE WITNESS: 24 THE COURT: 25 You may step down. Yeah, I'm trying to find that -How much longer, Mr. Leiderman, just an estimate? KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 679 1 MR. LEIDERMAN: 2 THE COURT: 3 I'm sorry. All right. I'm looking, Your Honor. You can let me know when we come back. 4 MR. LEIDERMAN: Less than 45 minutes, more than 25. 5 THE COURT: All right. 6 MR. SEGAL: Your Honor, from the motions in limine, we All right. Then redirect? 7 thought that there would be no mention of any other charges 8 against other people. 9 THE COURT: I granted it without prejudice. 10 mentioned to the defense I needed some authority. 11 getting into the guts of those. 12 jury what I understand the defense -- I had We're not I think I've clarified for the 13 MR. SEGAL: Well, I'm not asking you to reconsider. 14 THE COURT: If you want me to give a further clarifying 15 16 instruction, I'm willing to consider that. MR. SEGAL: No, I just want to know if it's going to 17 come up any more in the examination, because then I would want 18 to be heard. 19 THE COURT: You want to ask -- 20 MR. LEIDERMAN: No, it isn't. I wanted to establish 21 something that I wasn't able to establish through this witness, 22 number one. 23 or the linear facts for argument, and I'm not going any further 24 than that. 25 I didn't use names, and I built a straight timeline on it. And, number two, it's part of the linear argument And I think I was judicious where I went with that. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 680 1 MR. SEGAL: And that's the thing. If it's going to be 2 used for argument, the relevancy has to be constrained by what 3 the Court instructed, which is, you know, there's nothing about 4 these -- about that fact except that it helps establish some 5 date. 6 THE COURT: Well, the defense is on notice of the 7 government objection. You can meet and confer. 8 clarified is I understood it is being used to plot a 9 chronology, and that's what I've clarified for the jury. 10 MR. LEIDERMAN: 11 THE COURT: All right. 12 MR. SEGAL: No. 13 MR. LEIDERMAN: 14 THE COURT: 15 THE WITNESS: 16 THE COURT: 17 All right. 18 THE WITNESS: 19 THE COURT: What I've And that's what I've said. Anything else? Thank you, Your Honor. No. All right. I did find that -Well, tell your counsel that. So I can talk to them? Just so you hear what I'm hearing, Agent 20 Cauthen said he found the exhibit that he would have referred 21 to I think on direct. 22 MR. LEIDERMAN: So did we. 23 THE COURT: 24 with it whatever you want. 25 MR. SEGAL: So you've now heard that, and you can do The e-mail exhibit or the 349 -- KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 681 1 THE COURT: 2 have referenced -- He has identified the exhibit that he would 3 THE WITNESS: 4 MR. LEIDERMAN: 5 THE WITNESS: 6 MR. SEGAL: We got that, too. 7 THE COURT: All right. 8 Exhibit 301. The chart? The chart I was looking for. So now you may step down and not talk to government's counsel. 9 (Recess taken.) 10 THE COURT: Let's bring the jury back in. I think 11 we're likely to get through the presentation of evidence before 12 the next break? 13 MR. LEIDERMAN: 14 MR. SEGAL: Our next witness is quite short -- 15 THE COURT: All right. 16 MR. SEGAL: -- in duration and stature. 17 THE COURT: Counsel, stay behind the table while the 18 Yes, I think so. jury comes in, including Mr. Leiderman. 19 (Jury present.) 20 THE COURT: 21 seated. 22 Agent Cauthen. 23 All right. Welcome back. You may be And we will continue with the cross-examination of MR. LEIDERMAN: Agent Cauthen, I wanted to go back to 24 one point just to clean something up. 25 Q. Were you able to find I believe it was Exhibit 301? KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 682 1 A. Yes. 2 Q. Okay. 3 regarding the L.A. -- or the times regarding the L.A. Times 4 story? 5 A. Yes. 6 Q. Was it in fact 3:49 to 4:29 p.m.? 7 A. Central standard time. 8 Q. Central standard time? 9 A. Yes. 10 Q. Okay. 11 4:29 p.m. central standard time? 12 A. The last edit was at 4:30 central standard time. 13 Q. 4:30. 14 15 Did that refresh your recollection as to the times And that was the last of Mr. Hanrahan's edits was at Okay. All right. We were talking about the mobile site when we quit. 16 When was the mobile site last updated with the Chippy 1337 17 story? 18 A. 19 last? 20 Q. When was it modified last? 21 A. I don't know. 22 Q. When did it first appear on the mobile site? 23 A. I don't have a specific time for that. 24 Q. Any other articles on the L.A. Times edited that day that 25 you were able to find? Do you mean when it was created or when was it modified I don't know. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 683 1 A. Were any articles edited for that day? 2 Q. Other than the Chippy 1337, any other articles? 3 A. I don't know. 4 Q. You ever review the official Tribune time logs? 5 A. The official Tribune time logs? 6 Q. If they exist. 7 A. Could you -- 8 Q. Well, let's do this. 9 Do official Tribune time logs, time stamps, timecards exist 10 for the people that we've seen in this case? 11 A. I don't know. 12 Q. Did you ever review their financial data? 13 A. Other than what they provided to me, no. 14 Q. They provided you verbal testimony. 15 A. Correct. 16 Q. You ever look at any of their tax returns? 17 A. No. 18 Q. Did you ever subpoena the Tribune Company for their 19 salaries? 20 A. I don't recall. 21 Q. Let's go to Fox 40. 22 Yes? Did you ever pull salaries there? 23 A. Pull salaries there? I asked them about salaries from 24 people that worked there, yes. 25 Q. You asked the people what their salaries were? KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 684 1 A. Yes. 2 Q. You never subpoenaed or did anything to officially confirm 3 that? 4 A. I don't recall. 5 Q. Well, you would recall if you had done something, wouldn't 6 you? 7 A. 8 keeps track of all the subpoenas that we issued. 9 be very truthful in all of my answers. 10 If I had notes in front of me, I might. I have a log that I'm trying to I just don't have a recollection of sending subpoenas there. 11 I do recall sending subpoenas -- I'll slow down. 12 I recall sending subpoenas. Some of these subpoenas, ah, 13 may have included salary information. 14 specific recollection about asking with a subpoena for salary 15 information. 16 Q. 17 Cohen told you that she spent 40 hours in response, and she 18 made $50,000 a year; is that accurate? 19 A. That's pretty accurate, yes. 20 Q. And you also reviewed e-mails from her that went back and 21 forth between her and Chicago that talked about when her 22 password was out and when she needed it reset? 23 A. Yes. 24 Q. Yes? 25 But I don't have a So you basically talked to people and, for example, Sam And did you add up the times that were -- that would have KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 685 1 accounted for her down time on those e-mails? 2 A. No. 3 Q. Let's talk about Mr. Keys' statement for a minute. 4 You were asked previously about his statement, and you said 5 you didn't tell him what to write exactly. 6 saying that? 7 A. Yes. 8 Q. And at the time Mr. Keys wrote his statement, you came to 9 learn he was under the influence of sleep medication or 10 tranquilizing medications? 11 MR. SILVER: 12 THE COURT: 13 THE WITNESS: 14 Objection, hearsay. Overruled. I heard -- I don't have any information about that other than what one of the prosecutors told me. 15 Apparently in a hearing sometime -- 16 THE COURT: 17 Well, stop there. time he wrote the statement. 18 MR. LEIDERMAN: 19 THE COURT: 20 This was about at the That's the question. That's the question. All right. So what this witness knew at the time -- 21 MR. LEIDERMAN: 22 THE COURT: 23 MR. LEIDERMAN: 24 THE COURT: 25 Do you recall Well, no. -- the statement was being written. What he knows now. All right. I'm sorry. Well, there's your answer, so next question. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 686 1 MR. LEIDERMAN: Got it. 2 Q. 3 you that he wasn't in a cognizant state of mind to write a 4 statement? 5 A. No. 6 Q. Did he tell you that right now I'm in a state of mind where 7 I can -- it's not because I don't want to, it's because I want 8 to be cognizant of an event? 9 A. Yes. 10 Q. And he told you, as of right now, he just didn't -- didn't 11 know, he guessed and sort of stumbled around on that? 12 A. No. 13 Q. No? 14 A. No. 15 Q. Okay. 16 At the time the statement was written, did Mr. Keys tell Let's move on to some other things for a minute. Are you familiar with something called static and dynamic 17 IP addresses? 18 A. Yes. 19 Q. What are they? 20 A. A static IP address remains static, meaning unchanging. 21 And a dynamic IP address changes every time you would log in. 22 So that in the logs, you'd have a different IP address assigned 23 to you when -- over different days depending on how much time 24 you log in and log out. 25 also change it randomly. And your Internet service provider can KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 687 1 A static IP address is like a telephone number for that 2 period of time. 3 Q. And even static IP addresses change from time to time? 4 A. Yes. 5 Q. I want you to clear something up, if you can. 6 It's assigned to you, and it stays the same. Did Mr. Keys quit, was he fired, was he laid off, or is it 7 a combination of all three? 8 MR. SILVER: 9 THE COURT: Objection, foundation. Ask do you know. So ask the question in 10 that way. 11 BY MR. LEIDERMAN: 12 Q. 13 Fox 40, or was he laid off from Fox 40? 14 A. 15 me and what Jerry Del Core also told me. 16 Q. And what Matthew Keys told you. 17 A. And what Matthew Keys told me. 18 Q. And do they all match? If you know, did Mr. Keys quit Fox 40, was he fired from The information I have came from what Brandon Mercer told 19 MR. SILVER: 20 THE COURT: 21 THE WITNESS: 22 Yes? Objection, hearsay. Overruled. I believe that he was fired, but that he also, ah, quit before they could officially fire him. 23 MR. LEIDERMAN: 24 Q. 25 fire you was going on? Okay. Something like you can't fire me, I quit; you can't quit, I KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 688 1 A. I think that sounds about right. 2 Q. Okay. 3 remote access trojan? 4 A. Yes. 5 Q. Can you explain what that is? 6 A. That's a piece of software that you would put on someone 7 else's computer to track their activity on that computer. 8 a -- I think you would understand it as a piece of malware or 9 virus that would get on your computer, that would allow Are you familiar with something called a RAT or a 10 someone, if they got onto your computer, to see what you're 11 doing. 12 Q. 13 computer, correct? 14 A. 15 turn it on. 16 Q. 17 It's A remote access trojan can also be used to activate the Have it execute commands? Activate -- or execute commands, yes. Okay. I thought you meant I'm not sure how you would do that. No, not turn it on. Execute commands, for example, do things? 18 A. Yes. 19 Q. Okay. 20 words? 21 A. Yes. 22 Q. Can someone steal Wi-Fi? 23 A. Yes. 24 Q. How would someone go about doing that? 25 A. You would get access to that user's password, and when you It can make your computer operate remotely, in other KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 689 1 had your device, you could see what the signal is. 2 the password, you can log onto it and be on their network. 3 Q. 4 Your answer presumes a password. Is there a different answer if the Wi-Fi is unsecured? 5 A. 6 log on. 7 Q. Well, then there would be no password, and you would just It would be a no password, if you will. And -- well, never mind. 8 9 If you had MR. LEIDERMAN: I think that's enough. May I have a moment? I'm trying to shave some questions off. 10 THE COURT: 11 You may. (Pause in proceedings.) 12 BY MR. LEIDERMAN: 13 Q. By the way, who is Chippy 1337? 14 A. I don't know. 15 Q. Okay. 16 time in direct going over matching up specific logs, IP 17 addresses, time stamps, things like that to Mr. Keys. 18 You spent a good deal of time, a really good deal of You recall doing that? 19 A. Yes. 20 Q. When you say that something comes from -- and you 21 definitively said, at the termination of each of those areas, 22 that you were able to trace it back to Matthew Keys. 23 A. Yes. 24 Q. Okay. 25 you mean that it comes from his IP, possibly his user password, When you say that something comes from Matthew Keys, KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 690 1 possibly his computer, possibly all three? 2 possibly all four? 3 A. 4 trying to be as specific as possible. 5 Possibly his VPN, Is that what you mean? Well, when I'm trying to link it back to M. Keys, I'm In my mind, what I'm meaning is, in the global context of 6 everything, his computer, his IP and everything. 7 instance, I tried to bring it back at least to his IP in his 8 house. 9 Q. Okay. 10 A. Or his computer in his house. 11 Q. But it could have been someone else typing on the computer? 12 A. Anything is possible. 13 Q. Well, it's not that anything is possible. 14 And in each It's that you can't necessarily in each occasion put his 15 fingers on that keyboard at that time that you're going over in 16 these logs; is that correct? 17 A. I disagree. 18 Q. You disagree? 19 A. Yes. 20 Q. You can put his fingers on those keyboards? 21 because in part of his statement? 22 A. 23 the logs. 24 Q. Okay. 25 A. Want me to explain? No. Is that In part, yes, but also the logs and the activity in But it's -- KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 691 1 Q. 2 were going to say about it, and you've said it. 3 A. Okay. 4 Q. Do you believe Mr. Keys was truthful with you throughout 5 his entire statement? 6 A. Not entirely, no. 7 Q. I'm going to ask you some general questions about the 8 interview you had with Mr. Keys. 9 No, I don't need you to explain. I wanted to know what you This was in December 2012? 10 A. October. 11 Q. October 2012. 12 And we talked a lot about other events involving Anonymous 13 and indictments being unsealed and him working with other 14 journalists. 15 in March 2012, so several months before? 16 A. 17 journalistic activity happened that you've referred to. 18 did occur prior to the interview. 19 Q. 20 when the indictments were unsealed, the indictments I spoke of 21 earlier? 22 A. I don't know when those indictments were unsealed. 23 Q. Or when the articles came out? 24 A. Again, I don't have a specific recollection. 25 right, but I don't remember the dates. That would have -- those events would have been I don't remember the exact date that all of the Okay. But it And did it occur proximate or close to the times March sounds KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 692 1 Q. And it would be consistent with news practice in general 2 that articles would come out real close to an event happening 3 because it's news? 4 A. Yes. 5 Q. Okay. 6 article would have to come out sometime when the news is 7 happening for it to be relevant? 8 A. Correct. 9 Q. You started off your interview with Mr. Keys -- and in I know it seems basic, but an article, a news 10 general terms, I'm not asking for anything specific -- trying 11 to what they call build rapport and put him at ease? 12 A. 13 into rapport building. 14 Q. Okay. 15 A. Well, just introducing yourself to someone. 16 making them as comfortable as possible. 17 frame of mind so that they can understand the questions and 18 answer them. 19 Q. How did you make Mr. Keys comfortable in this case? 20 A. Well, I think -- I don't recall all of the details, but 21 it's customary, if I am interviewing someone after a search, 22 that it's in the morning, and so they're pretty much, you know, 23 probably in a state of undress, you know, ready for bed. 24 you ask them if they'd like to get comfortable with their 25 clothes. I think I started out with the Miranda, and then I went And just real basic, what is rapport building? You know, Getting them in a So You want them to feel comfortable with how they're KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 693 1 dressed in front of you so they can talk to you. 2 They might be thirsty. You know, you offer them something 3 to drink if they want something to drink. 4 the environment, if it's a good place to talk or if they would 5 rather go someplace else. 6 Q. 7 initially; is that fair to say? 8 A. 9 offered to take it someplace else since he lived with It wasn't in fact a good place to talk with Mr. Keys My recollection with regard to the location was that I 10 roommates. 11 were. 12 Q. You mean once you moved? 13 A. No, we did it in the bedroom. 14 Q. So you never moved at all? 15 A. No. 16 You ask them about But, as I recall, he was fine. That's where we He sat on his bed -- 17 Q. Okay. 18 A. -- and I went and got a chair from another room, my partner 19 and I. 20 Q. 21 couple of roommates? 22 A. I don't know the specific timing on the roommates. 23 Q. Did he tell you about a month ago? 24 A. That sounds right. 25 Q. And this interview -- and we've already established the At that point in time, Mr. Keys had just moved in with a I don't recall specific timing. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 694 1 spelling of Secaucus. 2 This interview occurred in Secaucus, New Jersey? 3 A. That's correct. 4 Q. Why wasn't it in Sacramento? 5 A. Because we did it where he lived. 6 Q. Which was in Secaucus, New Jersey? 7 A. Which was in Secaucus, New Jersey. 8 Q. At the time, Mr. Keys was working for Reuters News Service? 9 A. Yes, that's my understanding. 10 Q. Well, did you confirm that or is that just from your 11 interview with Mr. Keys? 12 A. 13 it with Mr. Keys as well. 14 Q. What is Reuters? 15 A. I believe it's a reporting agency or a newspaper, a media 16 company. 17 Q. 18 Associated Press or AP? 19 A. I am. 20 Q. Is it something like that where -- 21 A. Something like that. 22 Q. Reuters is a little bigger? 23 A. I think it is. 24 Q. And have you ever heard the word "news aggregating 25 service"? We checked on that before we did the search and confirmed Is it something like -- are you familiar with the I think they do more. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 695 1 A. Yes, I have. 2 Q. And is that what Reuters and AP and maybe one or two others 3 are? 4 A. 5 a website that got news from a lot of different sources and put 6 it on one web page. 7 is, then. 8 Q. 9 news aggregator? Ah, you know, I thought a news aggregating service was like Maybe I don't know what a news aggregator Well, how would a website get information if not from a 10 A. They go to other news sources and copy the story. 11 Q. Okay. 12 example, Reuters? 13 A. Yes. 14 Q. You woke Mr. Keys up at 5:45 a.m.? 15 A. That seems -- I think we would have started about 6:00, but 16 about that time. 17 Q. But -- 18 A. I'm sorry. 19 Q. I know the warrant said 6:00, but did you in fact start 20 your interview with him at 5:45 a.m.? 21 A. No. 22 Q. Did you serve the warrant at 5:45 a.m.? 23 A. I don't think so. 24 to time. 25 to those notes. And the news source they would go to would be, for I think I started a little after 6:00 a.m. I don't have a specific recollection as Someone else was recording the times. I could refer KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 696 1 MR. LEIDERMAN: May I have a second to see if I can 2 find them quickly, Your Honor? 3 THE COURT: You may. 4 MR. LEIDERMAN: 5 (Pause in proceedings.) 6 MR. LEIDERMAN: Thank you. Forget it. 7 Q. 8 possible? 9 A. Yes. 10 Q. Okay. 11 Mr. Keys referred to as his journalism and the Internet Feds 12 chat room and the saving of the screen logs going to someone 13 named Parmy, P-A-R-M-Y, Olson? 14 A. Yes. 15 Q. Who -- and I think we said she was a journalist who wrote 16 for Forbes, but covered Anonymous. 17 Did you tell Mr. Keys you wanted to be as helpful to him as We talked a little bit about Mr. Keys -- what What else did she do regarding Anonymous? 18 A. She wrote a book. 19 Q. And what relation, if any, did Mr. Keys' logs have to that 20 book? 21 A. I think she used it as source material for her book. 22 Q. Mr. Keys gave her his logs? 23 A. That's my understanding, yes. 24 Q. Can logs be altered? 25 A. Yes. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 697 1 Q. How would that -- how would that work? 2 A. Well, it would be -- you could do it a number of different 3 ways. 4 Q. Simply typing? 5 A. You could. 6 Q. You altered one of the logs in this case by putting an 7 asterisk next to a time, I think? 8 A. Yes. 9 Q. All right. And to do that, did you just put a cursor up 10 there, click and then put asterisk, and that was the end of it? 11 A. That was the end of it. 12 Q. So pretty easy to alter? 13 A. Easy to make a change, but difficult, ah, to alter in such 14 a way that it can't be detected. 15 Q. You mean with respect to metadata? 16 A. Yes. 17 Q. Metadata can be stripped from a document, couldn't it? 18 A. It could be. 19 Q. Now at this point we better -- what is metadata? 20 A. Metadata specifically means data about data. 21 write a file, like those screenshots we talked about that gave 22 a screen name, you know, screenshot 12/15/10, it saves it with 23 a file name so you can find it when you go to your computer 24 looking for a file. 25 file is in a lot of locations in other files saying when it was So when you But the computer saving data about that KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 698 1 created, when it was changed, and that is called metadata. 2 Some documents incorporate metadata within the document 3 itself. Like in a Word document, when you type your Word 4 document, it's actually saving, in some cases, who is the 5 person typing it, what time they're typing it and how many 6 edits were made to it. 7 Q. 8 typed on its own as well, correct? 9 A. Anything is possible. 10 Q. Well, that's something that has been done. 11 A. It's very difficult to do and not be detected. All that is called metadata. And, in fact, metadata can be faked, spoofed, you know, 12 MR. LEIDERMAN: Your Honor, I'm again seeing if I can 13 get rid of some questions to speed up, if I can just have a 14 second. 15 THE COURT: 16 All right. (Pause in proceedings.) 17 BY MR. LEIDERMAN: 18 Q. You give the search warrant to Mr. Keys? 19 A. Yes. 20 Q. Was he able to read the whole thing? 21 A. We gave it to him as soon as we walked in. 22 and was afforded the opportunity to read the whole thing. 23 believe he did, ah, read it as we were there talking with him. 24 Q. 25 pages maybe? He scanned it I It was a long search warrant, wasn't it, 40 or so pages, 50 KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 699 1 A. Yes. It had a number of attachments including these logs 2 that you showed. 3 Q. Had a lot of text in those logs. 4 A. Yes. 5 Q. So you don't know if he scanned it or read it? 6 A. I think he scanned and read portions. 7 specifically that he read in detail, specifically the logs I'm 8 referring to, because he and I talked about those. 9 Q. Yes? Some parts I know I want to talk to you about the overlap between Twitter and 10 the IRC for the people in the chat rooms you were monitoring, 11 Operation Payback, Internet Feds. 12 Did you find a significant overlap between IRC and Twitter, 13 for example, with people being on Twitter and IRC at the same 14 time during these operations, tweeting out what they were 15 doing, and then going back and talking about that, and then 16 tweeting out what they're doing, and then going back and -- 17 MR. SILVER: 18 THE COURT: 19 THE WITNESS: 20 Objection, compound. Overruled. I didn't review any Twitter feeds or logs or chats or tweets. 21 MR. LEIDERMAN: Okay. 22 Q. And I guess you would agree what every other witness said, 23 Twitter in 2010 wasn't like what it is now. 24 you didn't go to Twitter in 2010 to find out what the 25 President's latest statement was? You don't go to -- KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 700 1 A. That sounds right. Everything changes very quickly on the 2 Internet. 3 but I knew what it was. 4 Q. 5 things in his apartment during the interview? 6 A. Yes. 7 Q. Were you able to determine whether he knew the full impact 8 of who the people in the Internet Feds chat room were at the 9 time he was in the Internet Feds chat room in December of 2010? I'm not sure what the state of Twitter was in 2010, Mr. Keys expressed to you concern about people moving 10 MR. SILVER: 11 THE COURT: 12 THE WITNESS: 13 by full impact. 14 hacked? 15 Objection, calls for speculation. Overruled. Just yes or no. I'm not sure I understand what you mean You mean other than the website getting MR. LEIDERMAN: No. I mean if he knew who was -- if he 16 knew the true character, the true capabilities of the people he 17 was walking to. 18 THE WITNESS: Other than the fact that they were, you 19 know, just malicious hackers, no. 20 they had hacked or the full list of things that they had 21 hacked. 22 BY MR. LEIDERMAN: 23 Q. 24 all of that information, correct? 25 A. As of December 2010. I don't know if he knew what But as of October 2012, you did know I believe he had more information, yes. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 701 1 Q. A substantial amount of more information, a lot more 2 information? 3 A. Yes, I believe he did. 4 MR. LEIDERMAN: 5 THE COURT: 6 MR. LEIDERMAN: 7 THE COURT: 8 MR. SILVER: 9 That's all I have, Your Honor. All right. Thank you. Any redirect, Mr. Silver? Yes, Your Honor. REDIRECT EXAMINATION 10 BY MR. SILVER: 11 Q. 12 was entirely truthful during his interview; is that correct? 13 A. Yes, I did. 14 Q. And can you explain why you think that? 15 A. He was, ah, not telling me the truth, and he was doing what 16 I call minimizing. 17 but he wasn't acknowledging his intent so much as he had some 18 excuses earlier on in the interview. 19 progressed, he became more forthcoming about his role. 20 Agent Cauthen, you stated that you did not believe Mr. Keys That is, he was acknowledging the facts, Now, as the interview The example I'm specifically thinking about is where he was 21 saying, you know, I didn't intend for those credentials to 22 work. 23 clearly that was not accurate. 24 continued with the interview, then he kind of changed his tune 25 and acknowledged that he did understand that they would do And as we talked about it during the interview, ah, That was a lie. And as we KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 702 1 damage with it. 2 Q. Anything else, Agent Cauthen? 3 MR. LEIDERMAN: 4 THE COURT: I'm going to object, vague, overbroad. Sustained. 5 BY MR. SILVER: 6 Q. 7 truthful during the interview? 8 A. 9 head, I guess I could go through the whole interview and list 10 out line by line the inconsistencies in his statement, that I 11 had to stop him and put him back on track or -- Further reasons why you believed that he was not entirely I don't have anything else other than, off the top of my 12 THE COURT: 13 MR. SILVER: 14 THE COURT: 15 MR. SILVER: Okay. Wait for the next question. Nothing further, Your Honor. All right. Leaving open the option to redirect when 16 we do find that exhibit that the excerpt came from in the show 17 slide. 18 from. We're still looking for the exact exhibit that came 19 THE COURT: 20 MR. SILVER: 21 THE COURT: 22 MR. SILVER: 23 24 25 All right. That would be a very brief. Well, how -Why don't we just strike it, if that's easier. THE COURT: down for now. Well, all right. So this witness may step Agreed? KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 703 1 MR. SILVER: 2 THE COURT: 3 MR. LEIDERMAN: 4 THE COURT: 5 Yes. Or did you have further -No, I don't have further recross. All right. You may step down, Agent. may be re-called briefly. 6 THE WITNESS: 7 THE COURT: Go back into the hall? Any objection to the agent re-taking his 8 seat at counsel table? 9 MR. LEIDERMAN: No, I don't. 10 THE COURT: 11 The government has an additional witness? 12 MR. SEGAL: 13 14 15 16 17 18 19 20 All right. You may sit at counsel table. Yes, Your Honor. The United States calls Jerry Del Core. Agent Cauthen, can you leave the government exhibit binder on the table there, please. May I step out for a second, Your Honor? I don't know what's happening. (Pause in proceedings.) THE CLERK: Please come forward, sir. If you would stand right on that tape so I can take your photograph, please. 21 THE WITNESS: 22 THE CLERK: If you would step into the witness box. 23 MR. JAFFE: Your Honor, the defense objects to the 24 25 You Sure. testimony on the grounds previously discussed. THE COURT: All right. That's overruled at this point. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 704 1 THE CLERK: 2 Please raise your right hand. GERALD DEL CORE, GOVERNMENT'S WITNESS, SWORN 3 THE WITNESS: 4 THE CLERK: 5 the record, first and last. 6 microphone. 7 8 I do. Please state and spell your full name for THE WITNESS: And please speak into the Gerald Del Core. last name is two words. It's G-E-R-A-L-D. It's D-E-L, and then Core, C-O-R-E. 9 THE COURT: You may proceed. 10 MR. SEGAL: Thank you, Your Honor. 11 The DIRECT EXAMINATION 12 BY MR. SEGAL: 13 Q. 14 job in 2010? 15 A. Yes. 16 Q. What job was that? 17 A. The vice president and general manager of KTXL Fox 40. 18 Q. When did you start there? 19 A. October of 2010. 20 Q. And then just broadly what was your experience in the 21 broadcast business prior to becoming general manager at KTXL? 22 A. 23 in television. 24 Q. 25 reporting located in Sacramento? Sir, in December of two thousand -- well, did you get a new I have worked in the industry since 1977, both in radio and Okay. Was there anybody higher than you in the line of KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 705 1 A. In Sacramento, no. 2 Q. Okay. 3 A. I reported to the senior vice president and the president 4 of the television division. 5 Q. Of? 6 A. Of Tribune. 7 Q. Okay. 8 A. At that point, it was Tribune Company, yes. 9 Q. By the way, did KTXL -- was KTXL actually part of Fox News So to whom did you report? Sorry. Of Tribune Company at that time? 10 at all? 11 A. 12 company owned by Fox. 13 An affiliate is essentially a franchisee. 14 for their Fox name and for their primetime programming and 15 sports. 16 American Idol, 49ers football, things like that. 17 affiliation to the Fox cable news network. 18 Q. No ownership relationship? 19 A. Really any relationship to them. 20 Q. Okay. 21 A. Correct. 22 Q. Okay. 23 manager at KTXL? 24 A. 25 stems from making sure the station is run and delivery of the No, they're completely separate. Fox News is a cable Ah, KTXL is what's called an affiliate. So we would pay Fox So what we got from them essentially are shows like No So you're not Fox News at all? And what were your responsibilities as the general It's the overall operation of the station. Essentially it KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 706 1 community service it needs to. So you have to protect the 2 license. 3 We are delivering the revenue goals, controlling our expenses. 4 It's really done in terms of trying to maximize the amount of 5 viewers that come to the station. 6 generally run a pretty profitable operation. 7 Q. 8 relationship between you and Brandon Mercer? 9 A. It's to make sure the operation is run profitably. Okay. And if you do that, you What was the relationship, the reporting Brandon reported directly to me. He was the news director 10 of the station. 11 Q. 12 2010, do you recall an incident that had to do with some 13 curious e-mails? 14 A. Okay. Yes. 15 16 MR. JAFFE: Objection to the characterization, Your THE COURT: Sustained. Honor. 17 18 In December of two -- I'm going to -- in December of The jury shall disregard the word "curious." 19 MR. SEGAL: Just trying to move it, Your Honor. 20 THE COURT: I understand, but you're not narrating. 21 think that's the -- you're not the narrator. 22 testimony. 23 BY MR. SEGAL: 24 Q. 25 December of 2010. I You're eliciting Describe the e-mails that were called to your attention in KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 707 1 A. 2 gotten an e-mail to the station that said our station database 3 had been compromised. 4 Well, the one that comes to mind was the one where we had We were running a contest where we were giving away iPads 5 at the time, which were very popular. 6 iPad a day giveaway if I remember correctly. 7 said the contest was a fraud, that you really couldn't win. 8 9 I think we were doing an And it basically And it then told people that their personal information had been compromised, which had been their Social Security number 10 and their credit card numbers. 11 Q. 12 well, never mind. 13 Did it say that exactly? Open up Government Exhibit -- Who managed the direct response to this at your station? 14 Who spent the most time on it? 15 A. Brandon Mercer. 16 Q. And how do you know that? 17 A. The amount of time he put into it, and he would constantly 18 give me updates. He -- 19 MR. JAFFE: Objection to hearsay, Your Honor. 20 THE COURT: Overruled. 21 BY MR. SEGAL: 22 Q. He would constantly give you updates? 23 A. Yes. 24 Q. What did that -- why did he have to give you updates? 25 A. It was a problem. We had gotten calls and e-mails to the KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 708 1 station from people who were viewers, who were part of our 2 database, and we built the database to try and get people to 3 watch more frequently. 4 flyer, a frequent stay club. 5 individual newscasts, and people were asked to get the word and 6 then enter it onto the website, and they would earn points. 7 And with points, they had chances to win prizes, money, things 8 like that. 9 Q. So essentially it was like a frequent We would give words out in the How important -- did you keep track, do anything to keep 10 track of how much time you spent personally on this issue? 11 A. Yes. 12 Q. Would you turn, please, to Government Exhibit 304 in your 13 binder, please. 14 A. What number? 15 Q. 304. 16 MR. SEGAL: May I approach, Your Honor? 17 THE COURT: Are you finding that exhibit? 18 THE WITNESS: 19 MR. SEGAL: 20 Q. I found it. Okay. Do you recognize this? 21 THE COURT: This exhibit is not in evidence. 22 MR. SEGAL: Right. 23 THE WITNESS: 24 BY MR. SEGAL: 25 Q. Yes. Do you remember precisely every meeting that you attended KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 709 1 and every person you talked with about this issue? 2 A. No. 3 Q. Okay. 4 A. I typed it. 5 Q. Okay. 6 A. Certainly. 7 through the different parts. 8 9 I looked this up through a calendar of appointments. How do you -- how do you recognize 304, sir? I'm the one who did the research on it. Please explain how you built Government Exhibit 304. There are different parts to it, so if I can go One was setting up the number of meetings that we had. Second was tracking the e-mail conversations that we had. And 10 then the other part was assessing phone calls. 11 last part was really assessing some of the damage that was done 12 by the act. 13 Q. 14 Okay. I just want to ask you about -- THE COURT: Just so the jury is clear, the witness here 15 is, again, not a legal expert. 16 define for you. 17 BY MR. SEGAL: 18 Q. 19 personally and nothing else on that list. 20 And then the The word "damage" is one I will Now I just want to ask you about the time that you spent Do you understand? 21 A. Okay. 22 Q. Okay. 23 A. Okay. 24 Q. Who is Kersting? 25 A. He was president of the television division for Tribune. I want you to turn to the second page, please. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 710 1 Q. And where did he sit? 2 A. In Chicago. 3 Q. And who was Shaun Beck? 4 A. He was the supervisor for the Fox affiliate stations owned 5 by Tribune, and he was based in San Diego. 6 Q. 7 there. 8 A. Yes, that's me. 9 Q. Okay. 10 A. These were the conversations pertaining to someone claiming 11 to have accessed the database and compromised some of the 12 information in there and what we needed to do to protect the 13 database and what we needed to do to protect the viewers. 14 Q. Okay. 15 A. We had -- we had weekly calls, so yes. 16 think in here I noted that there were five that specifically 17 pertained to this. 18 Q. Five -- and you have a time estimate for those -- 19 A. Probably about a half hour on each. 20 Q. Okay. 21 is that right? 22 A. I'm not sure when you say track e-mails. 23 Q. Yeah. 24 25 There's an entry there with your -- with the name Jerry Is that Jerry Del Core? What did you talk to them about? Did you speak with Mr. Shaun Beck a second time? There were -- I And then you did something to track e-mails as well; To track e-mails? Actually let me ask you, you've had a chance to refresh your recollection based on this document; is that right? KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 711 1 A. A little bit, yes. 2 Q. Okay. 3 conservative estimate for how much time you spent on this? 4 A. 5 hours, maybe more. 6 time. 7 Q. 8 about a week ago? 9 A. Yes. 10 Q. Okay. 11 A. Yes. 12 Q. Did we try to -- and did we try to narrow it down, sir? 13 A. Yes. 14 Q. What were we trying to eliminate with you? And so can you -- what is -- do you have a I'd have to tally it. You know, probably 15 hours, 20 I could do the math if you give me the Did -- do you recall meeting with Agent Cauthen and me Did we go over this list? 15 THE COURT: Not eliminate. 16 MR. SEGAL: Narrow it down. 17 down. 18 19 He said, yes, narrow it MR. LEIDERMAN: I don't have a problem with counsel leading. 20 THE COURT: All right. All right. You may answer. 21 BY MR. SEGAL: 22 Q. What were you trying to narrow down? 23 A. I think we were trying to narrow down my actual 24 involvement. 25 Q. Okay. And did we narrow it down to a number that was less KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 712 1 than 15 hours, if you remember? 2 A. I don't remember the exact number. 3 Q. Okay. 4 A. Sorry. 5 Q. That's all right. 6 MR. SEGAL: 7 table, Your Honor? 8 THE COURT: 9 May I have one moment to go to counsel You may. (Pause in proceedings.) 10 BY MR. SEGAL: 11 Q. Sir, in 2010, what was your salary? 12 A. 275,000. 13 Q. 275. 14 Okay. And just technically was that for a 40-hour week? 15 A. Yes. 16 Q. And can we say 52 weeks for the year? 17 A. Yes. 18 Q. Okay. 19 before? 20 A. 21 so -- 22 Q. 23 And today is it possible you told us seven hours I think technically it's seven hours and an hour for lunch, No, no. I mean, is it possible you said you spent seven hours on 24 this issue when you tried to narrow it down? 25 A. Yes. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 713 1 Q. Okay. Would that be -- is that your most conservative 2 estimate? 3 A. That would be conservative, yes. 4 Q. Okay. All right. Thank you, sir. 5 MR. SEGAL: Nothing further. 6 THE COURT: All right. 7 Mr. Jaffe, do you have questions? 8 MR. JAFFE: Yes, Your Honor. 9 CROSS-EXAMINATION 10 BY MR. JAFFE: 11 Q. 12 for the defendant Matthew Keys, and this is my colleague Jay 13 Leiderman, counsel for Matthew Keys. 14 Good afternoon, sir. My name is Mark Jaffe. I'm counsel How are you? 15 A. Well. And you? 16 Q. Okay. Sir, you're no longer at Fox 40; is that correct? 17 A. That is correct, yes. 18 Q. And under the circumstances, were you terminated or did you 19 quit? 20 A. I was terminated. 21 Q. Okay. 22 the operation of the station; is that correct? 23 A. No. 24 Q. No disagreements? 25 You had disagreements with other people regarding Okay. You testified as to e-mails that you recall, correct? KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 714 1 A. Yes. 2 Q. Okay. 3 which was previously introduced as Defendant's Exhibit G. 4 your binder, I believe it's under tab 7. 5 6 I'm going to direct your attention to another e-mail THE COURT: This is admitted, so it can be displayed to the jury. 7 MR. JAFFE: Yes. 8 THE COURT: So it's on the screen. 9 In Can you see the screen clearly? 10 THE WITNESS: 11 THE COURT: 12 BY MR. JAFFE: 13 Q. 14 Yes. All right. Mr. Del Core, do you recall getting this e-mail? This is an e-mail from -- this is an e-mail from Brandon 15 Mercer; is that correct? 16 A. Yes, it is. 17 Q. Do you recall receiving an e-mail from Brandon Mercer that 18 said the FBI cannot prosecute a case unless there's $5,000 in 19 damages? 20 A. Yes. 21 Q. Okay. 22 you; is that correct? 23 A. Correct. 24 Q. Okay. 25 include delivering community service. And you reported that Brandon Mercer reported to I believe on direct you said your responsibilities KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 715 1 A. Yes. 2 Q. Is that right? 3 And you said your job responsibilities include protecting 4 the license? 5 A. Yes. 6 Q. And your job responsibilities include delivering revenue 7 goals? 8 A. Yes. 9 Q. And maximizing viewers? 10 A. Yes. 11 Q. You didn't typically log the hours you spent delivering 12 community service, did you? 13 A. Ah, typically log them, no. 14 Q. And you didn't report the hours you spent delivering 15 community service to Brandon Mercer or to anyone else, did you? 16 A. No. 17 Q. You didn't typically log the hours you spent protecting the 18 license at Fox 40; is that correct? 19 A. No, that's correct. 20 Q. And you did not typically log the hours you spent 21 delivering revenue goals at Fox 40, did you? 22 A. No, I did not. 23 Q. And you did not typically log the hours you spent 24 maximizing viewers at Fox 40; is that correct? 25 A. Correct. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 716 1 Q. Okay. And you did not assign a monetary value to any of 2 the time you spent on any of those responsibilities; is that 3 correct? 4 A. Correct. 5 Q. Okay. 6 A. Correct. 7 Q. And you never had Sam Cohen log -- report the hours spent 8 doing her job responsibilities to you, did you? 9 A. No, I did not. 10 Q. And you never asked -- you never had Jared Jedlinski log 11 hours and report to you on his responsibilities; is that 12 correct? 13 A. 14 responsibility for him. 15 Q. 16 back to you the hours spent on his responsibilities; is that 17 correct? 18 A. Correct. 19 Q. Okay. 20 forensics, do you, Mr. Del Core? 21 A. No, not at all. 22 Q. And you don't have any certifications in computer security; 23 is that correct? 24 A. Correct. 25 Q. Okay. But we could. But you did not? He actually worked in Chicago, so I wouldn't have any And you never had Brandon Mercer log hours spent and report You don't have any specifications in computer And at or around December of 2010, did you work for KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 717 1 the L.A. Times? 2 A. No, I did not. 3 MR. JAFFE: No further questions. 4 THE COURT: All right. 5 MR. SEGAL: Just very briefly, Your Honor. 6 Any redirect? REDIRECT EXAMINATION 7 BY MR. SEGAL: 8 Q. 9 anything did that have to do with any misconduct by you? So you said you were terminated at Fox 40. 10 A. Nothing. 11 Q. Okay. 12 today, do you owe Tribune Corporation? 13 A. Nothing. 14 Q. Okay. What if And by the way, what if anything, as you testified 15 MR. SEGAL: Thank you, Your Honor. 16 THE COURT: Any further recross? 17 MR. JAFFE: No further questions, Your Honor. 18 THE COURT: All right. 19 MR. SEGAL: Yes, Your Honor. 20 THE COURT: All right. 21 24 25 You may step down, sir. You're excused. 22 23 Is this witness excused? Does the government have additional evidence to present? MR. SEGAL: May I have one moment, Your Honor? (Counsel conferring.) KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 718 1 MR. SEGAL: Your Honor, subject to putting in one 2 document that we're not going to have a witness for, it will 3 just go in the exhibit binder, the United States rests. 4 THE COURT: All right. All right. And you understand 5 there's that one additional exhibit that may be provided to the 6 jury for deliberations? 7 MR. LEIDERMAN: 8 THE COURT: 9 Yes, we have spoken about it. All right. So we'll work that out in a housekeeping session. 10 Is there any case in defense? 11 MR. LEIDERMAN: 12 13 There is not, Your Honor. The defense rests. THE COURT: All right. Ladies and Gentlemen, that does 14 mean that the evidence is now in in the case. As I told you 15 earlier, we are going to excuse you a bit early today because I 16 need to work with counsel to finalize the jury instructions 17 that I will provide to you tomorrow. 18 but I need to hear from the attorneys. They're my instructions, 19 And I'm going to ask that you be ready to go promptly 20 at 9:00 a.m. tomorrow just to make certain we have sufficient 21 time, all things considered. 22 argument from the government, then we'll hear from the defense, 23 and then any rebuttal from the government, and then I will 24 instruct you. 25 concluded by about the time we would normally be leaving for And we will start with closing I think at this point, all of that will be KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 719 1 the day. 2 point what you've determined, if you have, about your schedule 3 for tomorrow and Wednesday. 4 So I'll just ask Ms. Streeter to let me know at some As we leave for today, please keep in mind every single 5 one of those admonitions I've been giving you. It's more 6 important than ever, given the stage of the case, that you not 7 discuss the case with anyone, including your fellow jurors, 8 family members, people involved in the trial or anyone else. 9 Don't allow anyone to talk with you about the case. If anyone 10 does approach you and tries to talk to you about the case or 11 anyone tries to contact you in any way, please let me know 12 immediately first thing tomorrow morning. 13 or start to read articles you think may be related to this 14 case, please stop immediately and don't consider or look any 15 further. 16 otherwise. 17 arguments of counsel, the instructions of the Court, and the 18 views of your fellow jurors. 19 do need to communicate with me in any way, you can give a note 20 to Ms. Streeter. 21 If you start to hear Don't do any research of any kind, electronic or Please keep an open mind until you hear the And, as always, remember if you Thank you for your service today, and we'll see you 22 tomorrow morning ready to go promptly at 9:00. 23 much. 24 (Jury not present.) 25 THE COURT: All right. Thank you very My suggestion would be that we KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 720 1 take a break, you review the exhibit list, make certain you 2 agree and your list corresponds with the Court's list so you 3 know what set of exhibits is going in. 4 I had one question about Exhibit 112. At one point, 5 the Court had instructed that the top of the first page would 6 be disregarded, and I think there was some defense questioning. 7 And so if you can clarify for me what your position is on 112 8 at this point or your respective positions? 9 MR. JAFFE: Your Honor, that is the e-mail chain 10 between Sam Cohen and Ryan Pollyea. 11 was an objection based on Ryan Pollyea's statements which 12 weren't covered by the hearsay exception, that objection is 13 withdrawn. 14 To the extent that there The defense did want to speak with the government 15 regarding excerpts of the chain which appear to refer to, ah, 16 statements regarding facts that are not part of what's being 17 accused of him at trial. 18 THE COURT: All right. So that is -- 19 MR. JAFFE: That can be redacted. 20 THE COURT: All right. 21 So meet and confer on 112. 22 MR. SEGAL: That is with respect to 112? I thought the problem with 112 was just 23 that there was a forwarding e-mail. Mercer -- Scholbrock 24 forwards it to Mercer, and then Mercer forwards it to Cauthen. 25 And I -- KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 721 1 THE COURT: Well, my point is there was some 2 discussion, but then there was the eliciting of some testimony 3 that might have modified what the parties' respective positions 4 is. 5 afternoon. 6 7 8 So meet and confer on that. THE CLERK: We'll come back to that this Oh, wait a minute. I think I've got a juror knocking. (Pause in proceedings.) 9 THE COURT: They may want to share the schedule. 10 THE CLERK: They wanted to know if they can talk among 11 themselves regarding whether they want to come and deliberate. 12 THE COURT: Schedule only? 13 THE CLERK: Schedule only. 14 THE COURT: Yes, they may confer about that if I didn't 15 Yes. make that clear. 16 THE CLERK: They just wanted clarification. 17 THE COURT: All right. 18 19 All right. (Pause in proceedings.) THE COURT: All right. So meet and confer on 112. 20 don't think there are any other issues with exhibits unless 21 there are discrepancies in the exhibit lists. 22 23 24 25 MR. SEGAL: I There's that one outstanding issue where we couldn't link a power point slide to an exhibit. THE COURT: That's what you're seeing if you can stipulate to coming in? KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 722 1 MR. SEGAL: Right. 2 THE COURT: All right. 4 THE CLERK: I'll print them the list. 5 THE COURT: All right. 3 So, again, meet and confer on that. My suggestion is we come back 6 at 1:00 and have a housekeeping session on the jury 7 instructions. 8 one by one through the set. 9 We'll take your objections and comments. 10 And what we'll do at this point is we'll just go I'll let you know my questions. And then my plan would be later in the day to e-mail you another set. 11 I'll have a better sense at the end of the working 12 session whether or not what I'm e-mailing you later this 13 afternoon is what I'm prepared to say is my final proposed set. 14 If it is, then tomorrow morning would be for the purpose of 15 lodging objections. 16 afternoon, if you can just stay on call after that 1:00 o'clock 17 session, we might need another session around 4:00. 18 19 MR. SEGAL: If I think we need to meet later on this I may have answered prematurely whether we have another exhibit issue to raise. 20 May I confer for a moment, Your Honor? 21 THE COURT: 22 me know when we come back at 1:00. 23 24 25 Why don't you just meet and confer and let MR. SEGAL: All right. Thank you, Your Honor. We'll THE COURT: Is there anything else that we need to be do that. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 723 1 discussing besides finalizing the exhibits, jury instructions 2 and the verdict form? 3 MR. SEGAL: No, Your Honor. 4 THE COURT: Mr. Leiderman? 5 MR. JAFFE: Okay. 6 7 8 greenness here. I'm going to have to show a little I beg your pardon. The timing regarding moving under Rule 29 for a directed verdict of acquittal, which the defense plans to do. 9 THE COURT: All right. 10 MR. JAFFE: It could be now if it's acceptable. 11 THE COURT: All right. 12 13 That motion is made now. And I'll hear -- how long do you need to argue that? MR. JAFFE: Well, we move under -- the defense's 14 position is that the elements have not been established for any 15 of the counts charged. 16 for all of them. However, the defense -- the motion is 17 About 15 minutes, Your Honor -- 18 THE COURT: All right. 19 MR. JAFFE: -- depending on the government's response. 20 THE COURT: Are you prepared to respond? 21 I would hear the argument now. 22 MR. SEGAL: Okay. 23 THE COURT: I think that makes the most sense. 24 You're still all right, Madam Court Reporter? 25 THE COURT REPORTER: Yes. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 724 1 THE COURT: All right. So, Mr. Jaffe. 2 MR. JAFFE: The defense moves under Rule 29 for a 3 directed verdict of the defendant Matthew Keys on all charges 4 on the basis that the elements of each of the counts alleged 5 against him have not been established and, therefore, a 6 directed verdict is appropriate. 7 Although we move on all of the grounds, the defense 8 wants to point specific attention to Count Three. 9 is the attempt. Count Three And although it's not entirely clear to the 10 defense exactly what -- exactly which attempt the government is 11 referring to, but it is our understanding, based on the trial 12 brief and what was presented, was that the attempt was after 13 the completed offense. 14 website, which changed a headline to Chippy 1337, there was a 15 second attempt to deface the L.A. Times web page, for which 16 AEScracked was unable to do because he was unable and locked 17 out of the system. 18 After the alleged attack on the The evidence presented in support of the attempt 19 charge, which, again, it's our understanding is a separate 20 attempt, is solely based on the statements attributed to 21 AEScracked on a chat log, wherein he tells someone else on the 22 chat log that he can get back into the system. 23 replies something like that would be a good idea. 24 which other people testified is Matthew Keys, AEScracked then 25 says I can't get in, I'm locked out and swears. Someone else AEScracked, This was the KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 725 1 sole evidence presented in support of the attempt charge on 2 Count Three. 3 Attempt, of course, requires -- attempt, of course, 4 requires intent, and it requires a substantial step. 5 the chat log is hardly sufficient evidence of that intent, of 6 this separate attempt, of this wholly separate offense, there 7 has been no evidence at all presented of the substantial step 8 besides the unreliable statement in a chat room of AEScracked, 9 and that is insufficient to support a verdict beyond a 10 11 12 13 Although reasonable doubt of the attempt. THE COURT: All right. Do you wish to argue the other counts as well? MR. JAFFE: It is the defense's position that, under 14 Count One and Count Two, that the requisite damage to the 15 protected -- to the system has not been established because the 16 evidence has shown that the CMS system has operated securely, 17 it operated properly, it did everything that it was supposed to 18 do, and that none of the information was lost. 19 immediately retrieved and, therefore, there is no damage under 20 1030(a)5(A). 21 It was all Furthermore, loss has not been established because the 22 testimony introduced to establish loss was based on 23 speculation. 24 determine what was a reasonable investigation. 25 witness testified as to -- without any precision or any detail There was no expert testimony introduced to Each and every KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 726 1 as to the work done. 2 under Section 1030. 3 introduced was loss attributed to things that had nothing to do 4 with the alleged attack on the L.A. Times. 5 The work was excessive and unreasonable And, moreover, most of the evidence To wit, there was much evidence and prejudicial 6 evidence introduced regarding the Cancer Man e-mails, the 7 Skinner e-mails, tracking the identity of the person behind all 8 of the Cancer Man and Skinner e-mails, tracking the identity of 9 who was interfering with Sam Cohen's system, which all took 10 place days before the alleged L.A. Times attack, and nothing 11 left to establish the requisite loss of $5,000 under Section 12 230. I'm sorry, Section 1030. 13 THE COURT: 14 Who is arguing in opposition? 15 MR. SEGAL: I am, Your Honor. 16 THE COURT: All right. 17 MR. SEGAL: So I'm just going to start and address this 18 19 All right. Understood. in the order presented by the defense. The defendant claims that the only evidence to support 20 the Count Three attempt charge is the chat log in which he's 21 telling Sharpie that -- well, let me help you get back in, and, 22 that's not true. 23 chat log where -- to events in the CMS log that correspond to 24 it exactly. 25 Special Agent Cauthen's power point tied that And if Your Honor -- so 506 and 507 are the chat logs KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 727 1 where, in Internet Feds, Keys is telling Sharpie, let me get 2 back in. 3 Exhibit 307 -- first of all, that would be sufficient anyway 4 because it's the defendant's admission. 5 look at Government Exhibit 307, that's the attempted log-in 6 from the LDAP system of the Tribune CMS. 7 But what the defendant is omitting is that Government But, second, if you And LDAP stands for -- is it lightweight something 8 authentication protocol? 9 Agent Cauthen's testimony. He's trying to log in, and that was So that's a pretty substantial 10 step. Not only is the defendant saying what he's doing and 11 why, he's also actually doing it. 12 jimmying the door on the system, and it's unsuccessful. 13 there's that. We have, you know, the pin So 14 The other claim is that there's no -- so that's the, I 15 think, complete and sufficient response that there's certainly 16 enough for a reasonable -- for a reasonable jury to find beyond 17 a reasonable doubt that there was a substantial step based on 18 that attempted log-in on 12/15, again, Exhibits 307 and 309. 19 Then, with regard to the other counts, witness after 20 witness in this trial testified that there were back doors 21 installed to re-access the system. 22 reasonable juror could certainly find that what Keys did -- you 23 know, again to make the house metaphor -- is he installed 24 scores of back doors and elevated the privileges of each of 25 these passwords for this entire period. And, I mean, there is -- a KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 728 1 Agent Cauthen testified that there were hundreds, if 2 not thousands of commands executed or communications between 3 Keys and the Tribune CMS. 4 what he does is he tells Anonymous, because his hacking skills 5 aren't good enough, he tells Anonymous here's how to get back 6 in, here's a password, here's how to create a new username, 7 here's how to escalate its privileges. 8 the testimony of the IT witnesses, that is a compromise to the 9 integrity of the system because he's building back doors. 10 He's all over the place. And then That -- and based on Then, there are the things that they accomplished once 11 they were in. 12 story, which is what he actually suggested Anonymous do. 13 then there's also the downloading of these e-mails. 14 thing that is particularly special about this case is that what 15 he -- so there's the damage to the integrity of the system and 16 to the availability of data. 17 kind of damage, it's there as well because readers could not 18 read the real L.A. Times story from the L.A. Times when they 19 needed to for 45 minutes from the regular site and for a day 20 from the mobile site. 21 Right? He -- there is the defacement of the Right? And And the I mean, if you want that And it's any impairment to the integrity of data, any 22 impairment to the integrity of a system. And what they're 23 trying to do in their Rule 29 motion is kind of make you think 24 that -- you know, they're hoping that somehow if the system 25 works even for an intruder, that that's not -- that somehow the KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 729 1 system is not impaired. 2 how the security of the system is part of its integrity. 3 But witness after witness talked about Finally, on the issue of loss, there is -- I'll just 4 say there's enough to go to a jury on loss. A lot of people 5 burned a lot of time over this. 6 for the defendant to be arguing that there wasn't enough loss 7 or that certain things cannot be counted as loss because what 8 Keys is doing in this case is not only building all these back 9 doors, not only downloading, you know, this e-mail list which And it's particularly ironic 10 is a valuable asset, not only altering stories in the 11 newspaper, not only calling upon Anonymous to punish the L.A. 12 Times for what it publishes, but he's also sending these 13 e-mails to KTXL to make them spin their wheels. 14 only way to read the Cancer Man e-mails is that way. Right? The 15 I mean, if Keys had only wanted to tell viewers that -- 16 you know, whatever conspiracy theory truth he had about Fox 40, 17 he just would have sent out the blast to the e-mail. 18 But that's not what he does. 19 I'm going to do this, I'm going to do this, I did it. 20 again, drip, drip, drip, I'm going to send another one, I'm 21 going to send another one, by the way, your system is still not 22 secure, to get them doing exactly what they did, which was 23 work. 24 25 Right? What he does is drip, drip, drip, And Right? He worked in that small newsroom that is only twice as big as the jury box, and he knew exactly the effect that it was KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 730 1 going to have, a reasonable juror could conclude. 2 damage -- excuse me -- all of that loss, all of that time spent 3 is exactly what he wanted. 4 All of that Another way that you know that that's what he intended 5 is the e-mail on December 20th. Right? After all this appears 6 to be over -- remember, the last time he hits the LDAP server 7 is January 2nd or 4th, I forgot. 8 Mercer gets an e-mail that is in evidence, and I can't remember 9 the exhibit number, but it's just ding. But on December 20th, Brandon There's no reason to 10 send that e-mail, the ding e-mail except for remember me? 11 still out there. 12 job. 13 14 Go burn some time. I'm Don't do your regular So, I mean, I'll have more to say about it in closing, Your Honor, but we think a reasonable juror could -- 15 THE COURT: This is not closing. 16 MR. SEGAL: Yeah. 17 THE COURT: Rebuttal? 18 MR. JAFFE: With regard to the attempt, first of all, 19 it's not accurate to say that a couple of vague statements 20 attributed to AEScracked in a chat room would be sufficient 21 evidence of intent and certainly not of the substantial step in 22 addition to that, and no evidence was introduced regarding the 23 substantial step. 24 related to the actual defacement of the L.A. Times site which 25 resulted in the Chippy 1337 and not a separate successive Cauthen was to testify regarding information KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 731 1 attempt by AEScracked or Matthew Keys or anyone else. 2 little more to say about that because there was no more 3 presented to that. 4 There's With regard to the government's argument regarding 5 damage and loss, the argument that the damage was the damage to 6 the CMS system, and then the government then proceeded to 7 discuss loss solely in terms of investigation and facts that 8 preceded the damage, the alleged damage to the CMS system. 9 It's true, multiple witnesses testified, multiple 10 witnesses testified as to events and facts and allegations that 11 took place before AEScracked ever allegedly gave Sharpie or N. 12 Garcia any information that would provide access to the CMS. 13 The Cancer Man e-mails, the Skinner e-mails, Sam Cohen having 14 to log in with a username and password, it's noise. 15 back story. 16 distracted us because it's too difficult for us to tell how 17 that even fits into the allegations against Mr. Keys. 18 not part of the indictment. 19 It has distracted the jury. It's a In fact, it has They're The indictment is wholly dedicated to the defacement of 20 the L.A. Times website and begins with a story that's only 21 related to that. It has nothing to do with Cancer Man or 22 Skinner e-mails. There are no allegations in the indictment of 23 accessing an e-mail list and downloading it, obtaining or using 24 e-mail addresses from iPad users or anybody else from Fox 40. 25 THE COURT: All right. The motion is denied. It's KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 732 1 without prejudice. 2 jury. 3 I believe there's enough to send to the What your arguments have previewed is the challenge of 4 clarifying some jury instructions to tell the jury what its job 5 is. 6 each count, to send the case to the jury. 7 denied without prejudice. But I think there's enough, including circumstantially on 8 MR. SEGAL: Thank you, Your Honor. 9 THE COURT: All right. 10 MR. SEGAL: See you at 1:00. 11 (Lunch recess taken.) 12 But the motion is We'll see you at 1:00. ---o0o--- 13 14 15 16 17 18 19 20 21 22 23 24 25 KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 733 1 SACRAMENTO, CALIFORNIA 2 MONDAY, OCTOBER 5, 2015, 1:00 P.M. 3 ---o0o--- 4 (Jury not present.) 5 THE CLERK: 6 You may remain seated and come to order. Court is now back in session. 7 We're back on the record, Your Honor. 8 THE COURT: 9 All right. instructions workshop. 10 MR. HEMESATH: We're on the record for a jury Any update on exhibits? We met and conferred, Your Honor. We're 11 still confirming the last details. 12 agreement about how to submit the audio files and so forth, and 13 so we are very close. 14 THE COURT: 15 stipulations? 16 morning? All right. And we've come to an Do you want to record any Or do you want to wait and do that tomorrow 17 MR. LEIDERMAN: At the government's pleasure. 18 MR. HEMESATH: Let's do that tomorrow morning. 19 THE COURT: 20 21 All right. All right. Let's go through the proposed jury instructions. You have a working set that is 37 pages, unnumbered 22 instructions. So I'm going to refer to the page numbers, and 23 we'll just go page by page. 24 objectionable, but some will be the subject of intense 25 discussion. Some I assume are not KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 734 1 Any problem with page 2 as worded? 2 MR. SEGAL: No, Your Honor. 3 THE COURT: Mr. Leiderman or who's on point here? 4 MR. LEIDERMAN: 5 Actually Mr. Jaffe is going to be on point here, but I'll answer for both of us. 6 THE COURT: All right. 7 MR. JAFFE: No objections. 8 THE COURT: All right. 9 Page 3, Mr. Segal? So page 2? MR. SEGAL: No, Your Honor. 11 THE COURT: Mr. Jaffe? 12 MR. JAFFE: No objections. 13 THE COURT: All right. 14 Page 4. 15 MR. SEGAL: Nope. 16 THE COURT: Mr. Jaffe? 17 MR. JAFFE: No objections. 18 THE COURT: All right. 20 innocence. No. Mr. Jaffe? So that will be given as shown. 10 19 Mr. Segal? That will be given as shown. Mr. Segal? Page 5, general presumption of Reasonable doubt instruction. MR. SEGAL: Mr. Segal? Your Honor, what is the modification from 21 the pattern instruction in this one on reasonable doubt? 22 couldn't find it. 23 24 25 THE COURT: I I'm actually thinking that you had proposed a modification, and the Court deleted the modification. MR. LEIDERMAN: I had proposed a modification. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 735 1 THE COURT: 2 MR. LEIDERMAN: 3 THE COURT: 4 You did? Is the modification incorporated? MR. LEIDERMAN: 6 MR. SEGAL: 8 9 Can you remind me? 5 7 Yes. Can you go down a little bit further? I would ask that the Court give the pattern instruction on reasonable doubt. MR. LEIDERMAN: I think that's -- My proposed modification was between lines -- would have fell between lines 9 and 10, and I ask that 10 it be amended to say in partial consideration of all the 11 evidence, comma, a conflict in the evidence, comma -- a 12 conflict in the evidence or from lack of evidence. 13 asking for the clause "a conflict in the evidence," and I see 14 that the Court has left that out. 15 THE COURT: 16 MR. LEIDERMAN: 17 Right. THE COURT: 19 MR. LEIDERMAN: It's -- I took it from the state court instruction. THE COURT: 22 MR. LEIDERMAN: 23 THE COURT: 25 My authority for putting in the Correct. 21 24 And your authority for that? conflict of the evidence? 18 20 So I was California state court? California state court. All right. Any case law addressing the possibility of adding that language? MR. LEIDERMAN: I didn't pull Ninth Circuit case law on KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 736 1 it. 2 submitted rather late. 3 4 5 If the Court recalls, that was -- and I apologize -- THE COURT: So any comment based on the fact that language does appear in the state instruction, Mr. Segal? MR. SEGAL: We're in federal court. I don't think the 6 Court should be altering the definition of reasonable doubt. 7 All the evidence gives counsel the opportunity to argue 8 conflict in the evidence. 9 And in this case, we have -- and, furthermore, even if 10 we were in state court in a case where a defendant hasn't put a 11 case on, there's not -- there's a conflict of evidence anyway. 12 It's really -- 13 THE COURT: No comment on the last bit, but I'd give 14 the tried and true instruction. I don't think there's any 15 reason not to, not that the Court always does that. 16 instruction will be given, and we'll note that was not modified 17 in terms of what the Court gave the parties. 18 Ninth Circuit instruction 3.5. So the We will track 19 Page 6, right not to testify. Mr. Segal? 20 MR. SEGAL: No objection. 21 THE COURT: Mr. Jaffe? 22 MR. JAFFE: No objections. 23 THE COURT: Page 7, what the evidence is. 24 MR. SEGAL: No objection. 25 THE COURT: Mr. Jaffe? Mr. Segal? KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 737 1 MR. JAFFE: No objections. 2 THE COURT: Page 8, what is not evidence. 3 MR. SEGAL: No objection. 4 THE COURT: Mr. Jaffe? 5 MR. JAFFE: One moment, Your Honor. 6 No objections. 7 THE COURT: All right. 8 MR. SEGAL: No objection. 9 THE COURT: So this refers to the 1006 summary. 10 11 Page 9? Is that the only one really? MR. SEGAL: This doesn't refer to the 1006 summary. 12 This refers to the argumentative exhibit that Agent Cauthen 13 testified about and is not going back to the jury. 14 on our effort to admit that as a 1006 summary. 15 THE COURT: All right. You had continued to refer to 16 it, I thought, as a 1006 summary. 17 power point? 18 MR. SEGAL: We gave up We're talking about the Right, until the moment we gave up. So I 19 think this instruction is appropriate, and the next one is not 20 necessary. 21 22 THE COURT: All right. And is it correct to say charts and summary? 23 MR. SEGAL: Fair enough. 24 THE COURT: Mr. Jaffe? 25 MR. JAFFE: No objection to that language. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 738 1 2 THE COURT: All right. So page 9 will be given as provided to the parties, Ninth Circuit 4.15. 3 And 10, Mr. Jaffe, you agree that is not needed? 4 MR. JAFFE: 5 It's not necessary, Your Honor. The defense agrees. 6 THE COURT: 7 Page 11, standard direct and circumstantial evidence 8 9 10 instruction. All right. So 10 will not be given. Mr. Segal? MR. SEGAL: I agree with this, Your Honor. MR. LEIDERMAN: I had given the Court a proposed 11 instruction that was considerably lengthier that had both this 12 portion of the instruction and then the entirety of the state 13 instruction, which explains not only what evidence is, but how 14 you are to use it. 15 For example, the most salient point of it is that, if 16 circumstantial evidence has two possible interpretations, one 17 which points to guilt, the other which points to a lack of 18 guilt, then the interpretation which points to guilt has to be 19 rejected in favor of the interpretation which points to a lack 20 of guilt. 21 22 THE COURT: And the authority for that? I do recall reviewing that. 23 MR. LEIDERMAN: 24 THE COURT: 25 MR. LEIDERMAN: Right. Remind me of the authority. Your Honor, I have to apologize. I had KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 739 1 literally just, like, stepped off the plane from a very long 2 vacation in Greece, and I didn't -- I looked at what my 3 colleagues had done and got this filed late without doing the 4 research, just looking over what they were and putting in the 5 California instructions that I felt I needed, and it was just 6 the two of those. 7 So I didn't do -- 8 THE COURT: 9 instruction? 10 11 So this is also based on a California MR. LEIDERMAN: It is verbatim the California instruction on direct and circumstantial evidence. 12 And while I recognize we're not in state court, it's a 13 helpful instruction. 14 it doesn't just tell them what the evidence is, but it tells 15 them how to use the evidence, and that's different than, you 16 know, arguing a reasonable doubt instruction. 17 evidence is extremely helpful to them. 18 THE COURT: 19 sidewalk example. 20 explain. 21 22 It's a correct statement of the law. And How to use the The Court at times gives the water on the That's the most I've done to further Has that language from the California instruction been addressed by the Ninth Circuit; do you know, Mr. Leiderman? 23 MR. LEIDERMAN: I don't. 24 THE COURT: Mr. Segal, do you know? 25 MR. SEGAL: Your Honor, if the Court wants to give the KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 740 1 water on the sidewalk instruction or the guy with the umbrella 2 coming in, any of that is fine. 3 Mr. Leiderman wants this instruction is -- is not federal law. 4 The jury is supposed to be instructed in federal court that 5 there is no distinction between direct and circumstantial 6 evidence, and it's all for the jury to decide. 7 actually would be -- they have no case that entitles them to 8 the judge telling the jury that, if circumstantial evidence can 9 go either way, you know, tie goes to the defendant. 10 11 But the exact reason that And I think it That's not -- I've never seen that instruction given in federal court, and I think it's error. 12 THE COURT: Did you say there is case law saying that? 13 MR. SEGAL: No, I said they never -- 14 THE COURT: I understand that. 15 16 17 So it's not been addressed one way or the other. MR. SEGAL: Well, except that it is in direct contradiction to the federal pattern instruction. 18 THE COURT: 19 No Ninth Circuit case has discussed the Court's 20 I understand that argument. declining to give it -- 21 MR. SEGAL: I don't -- 22 THE COURT: -- in the face of a defense objection. 23 MR. LEIDERMAN: 24 25 Well, yeah, if I could just make a further record, please. There's a difference between talking about a KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 741 1 distinction between the weight to be given and how to use the 2 evidence. 3 much weight to give any evidence as opposed to telling them 4 that, if the evidence is equivocal, the government has stated 5 it correctly, tie goes to the defendant, which is the way the 6 evidence is to be used, not how much weight is to be given to 7 it. It's different to say it's for you to decide how That's one thing. 8 The other thing is, not hearing any prohibition on if 9 it's not given by the Court, I should be allowed to argue it. 10 THE COURT: Any argument on that point? Mr. Segal? 11 MR. SEGAL: I'm just thinking about my answer before -- 12 I think if counsel wants to argue that -- I mean, if counsel 13 makes a statement that is contrary to federal law, the Court is 14 supposed to correct him, and so it really depends what the 15 argument that gets made is. 16 I don't know exactly what is going to be said, but how 17 to weigh evidence is -- is the province of the jury. 18 be -- things can be suggested. 19 requires that evidence be weighed in a particular way is not 20 how federal civil or criminal trials work, except in very 21 limited exceptions, which are not so general as to single out a 22 particular kind of evidence like circumstantial evidence for 23 extra doubt. 24 25 They can But to say that the law That's not -- he can say this is circumstantial, and his voice can drip -- you know, counsel's voice can drip with KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 742 1 contempt when he uses the adjective "circumstantial." 2 say that the law requires it to be weighed differently from 3 direct is running some risks that, you know, he'll decide 4 whether to run based on, you know, how far he wants to go out 5 on that limb. 6 THE COURT: All right. But to Whatever I give you next will 7 show how I resolved the issue of the instruction, and the 8 defense can stay alert for objections from the government if it 9 argues in the absence of an instruction. 10 Page 12. 11 MR. LEIDERMAN: Well, hold on. Can I rebut that? 12 sorry, Your Honor, I don't mean to say hold on, but with 13 respect. 14 I'm not telling the jury what the law is. I'm I'm arguing 15 to them at this point, in the absence of an instruction, how 16 the evidence should be used. 17 THE COURT: I think I understand that. 18 MR. LEIDERMAN: 19 THE COURT: Okay. All I'm saying is I'm not -- without 20 hearing the argument, I don't know if it's going to draw an 21 objection. 22 language and just make a final decision after this session. 23 So, again, you will see how I resolved the issue in the next 24 packet of instructions. 25 I'm going to go look again at the California MR. LEIDERMAN: Oh, I see what you're saying. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 743 1 THE COURT: 2 MR. LEIDERMAN: 3 THE COURT: 4 MR. LEIDERMAN: 5 THE COURT: Page 12, any objection? 6 MR. SEGAL: No, Your Honor. 7 THE COURT: Mr. Jaffe? 8 MR. JAFFE: No objections. 9 THE COURT: Page 13. 10 MR. SEGAL: No Your Honor. 11 THE COURT: Mr. Jaffe? 12 13 That's what I'm saying. I'm sorry, Your Honor. I'm not resolving it at this time. Got it. Mr. Segal? Mr. Segal? (Defense counsel conferring.) MR. JAFFE: The concern -- again, this concern recently 14 occurred to the defense. 15 statement offered through Agent Cauthen and other statements 16 that have been attributed to Matthew Keys. 17 a -- so that there is a statement, and there are other 18 statements that have been attributed to Matthew Keys that may 19 or may not have been Matthew Keys based on whether or not the 20 government has satisfied that burden. 21 THE COURT: This doesn't distinguish between the And that there is So is that solved by simply changing 22 statement to statements, you have heard testimony that the 23 defendant made statements? 24 MR. JAFFE: May have made statements? 25 THE COURT: It is for you to decide whether the KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 744 1 defendant made the statements? 2 to them? If so, how much weight to give 3 MR. JAFFE: Yes. 4 MR. SEGAL: The testimony was that he did make 5 statements, but it remains for the jury to decide whether to 6 credit that testimony. 7 8 THE COURT: There are two categories of statements. There are two recorded statements -- 9 MR. JAFFE: Yes. 10 THE COURT: and there are written statements. 11 Is there a need to make that distinction in the 12 instruction? 13 MR. SEGAL: I don't think so, Your Honor. 14 MR. JAFFE: No, Your Honor. 15 THE COURT: All right. 16 MR. SEGAL: So we're just -- how are we revising it? 17 THE COURT: Just converting it so it's a plural. 18 MR. SEGAL: Okay. 19 THE COURT: So changes throughout to reflect that 20 21 statements should be plural. Page 14, here my question really is with respect to 22 the -- I think there are -- there is the Mercer recording, 23 which I think most closely invokes the need for this kind of 24 instruction. 25 the first sentence. And so "agent" probably isn't the right word in My question to the parties is, is that the KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 745 1 only bit of evidence that invokes the need for this 2 instruction? 3 Mr. Segal? MR. SEGAL: Your Honor, the recording of the defendant 4 in his interview in his apartment was also without the 5 defendant's knowledge. And so -- 6 THE COURT: Correct. 7 MR. SEGAL: And so for that reason, I submitted an 8 instruction you've heard testimony -- that is a modification 9 because there was no other -- you know, it's not like a 10 narcotics case where we sent somebody in to buy drugs or 11 something like that. 12 surreptitious recording. 13 jurors might come to court with a problem with that, and others 14 might not. 15 The only stuff in deception was Some people have a problem -- some So -- THE COURT: Do you agree with that, that that's the 16 only evidence implicated, the Mercer recording and Agent 17 Cauthen's recording? 18 MR. JAFFE: We did seek to introduce other evidence 19 regarding the Cauthen interview, but I think that was not -- it 20 did not come into play. 21 THE COURT: But, for example, just so -- there is no 22 evidence to allow a conclusion that there was an informant in 23 the IRC. 24 MR. SEGAL: Right. 25 THE COURT: All right. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 746 1 MR. SEGAL: So -- 2 THE COURT: Or an agent in the IRC. 3 MR. SEGAL: Right. 4 THE COURT: So this needs to be modified to apply to 5 both Mercer and Cauthen. 6 MR. SEGAL: May I suggest one, Your Honor? 7 THE COURT: And that's -- you already have submitted 8 that to the Court? 9 MR. SEGAL: Page 5 -- 10 THE COURT: All right. 11 MR. SEGAL: -- of the government's proposed. 12 THE COURT: Any objection to that proposal? 13 MR. JAFFE: We're looking for it. 14 THE COURT: Mr. Jaffe? 15 (Counsel conferring.) 16 MR. LEIDERMAN: 17 THE COURT: 18 MR. LEIDERMAN: 19 THE COURT: That's fine. That's fine with you? It's fine. All right. So we'll plan to give that 20 instruction. 21 wordsmithing from me, if not more. 22 23 I'll double-check. MR. LEIDERMAN: Yes, Your Honor. You may see at least So this one is out, and the government's proposed is in? 24 THE COURT: Subject to my final review. 25 MR. LEIDERMAN: Okay. The defense joins in the request KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 747 1 to have it made that way. 2 THE COURT: All right. 3 MR. SEGAL: We haven't offered any 404(b) evidence so I 4 Page 15, Mr. Segal? don't think this one is necessary. 5 THE COURT: Mr. Jaffe, you agree? 6 MR. JAFFE: The defense does not agree that 404(b) 7 evidence was not offered. 8 be admissible for, if anything, 403 purposes and are part of 9 the -- of what was in the superseding indictment or part of 10 We believe that much of it can only what was charged. 11 That being said, this instruction, we do not object. 12 THE COURT: 13 Just so I'm perfectly clear on what you believe would fall under the description of other acts. 14 MR. JAFFE: Everything related to Cancer Man, 15 everything related to Skinner, everything related to Fox 16 Mulder, everything related to Sam Cohen's username and 17 password, everything related to the alleged accessing of 18 e-mails from iPad users, none of which was alleged in the 19 superseding indictment, which only relates to acts involving 20 the alleged attack on the L.A. Times, and we don't believe to 21 be relevant to the counts against Mr. Keys. 22 23 THE COURT: So we may come back to this after we discuss the counts. 24 25 All right. So page 16 is introduction to the instruction on Count One. Any objection to this page, Mr. Segal? KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 748 1 MR. SEGAL: No. 2 THE COURT: All three counts, it identifies all three 3 4 counts as set forth in the indictment. MR. SEGAL: So there should just be -- conspiracy to 5 cause damage to a protected computer, we have gone back and 6 forth on what to call this, the substantive offense for short, 7 malicious code or damage to a protected computer. 8 to be consistent in my proposed ones. 9 we settled on in our jury instructions was that it might be 10 11 12 better to call it -- hang on. THE COURT: And I tried I think in the end what Sorry, Your Honor. What's wrong in this instruction with just tracking the -- 13 MR. SEGAL: I'm -- there's nothing -- 14 THE COURT: -- name is assigned to the count. 15 MR. SEGAL: There's nothing wrong with it 16 substantively. I think -- I would just ask that we revisit it 17 once we settle on all of the instructions to make sure that 18 what we call the offenses for short do not confuse the jury 19 once we've decided on the elements. 20 Am I making -- that's all I'm asking. 21 THE COURT: 22 23 Right. Any objection to this language, Mr. Jaffe, page 16? MR. JAFFE: The defense isn't clear on what the 24 government is requesting at this time. The language in this 25 instruction, as far as I can see, tracks the superseding KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 749 1 indictment, so no objections. 2 THE COURT: All right. Page 17 begins the Count One 3 instructions, which currently are appearing on pages 17 through 4 24. 5 6 7 So the first instruction, pages 17 to 18. MR. SEGAL: Mr. Segal? There are a few problems with this one, Your Honor. The first is on the first line. This is not -- there 8 are two kinds of 371 conspiracy, and we've only charged one; 9 that is, to commit an offense against the United States. We're 10 not invoking the defraud clause in this case. 11 defraud the United States" should be out, and it should just be 12 conspiracy to commit an offense against the United States. 13 14 THE COURT: All right. So "or to The Court accepts that. Any problem with that, Mr. Jaffe? 15 MR. JAFFE: No. We believe that's correct, Your Honor. 16 THE COURT: All right. 17 MR. SEGAL: Okay. And then the second is it's -- the 18 first paragraph after that misstates the object of the 19 conspiracy. 20 to the Los Angeles Times website without authorization. 21 what the indictment says was the object -- first, the L.A. 22 Times website is not a computer. 23 identified in the indictment and in the evidence was the 24 Tribune content management system. 25 As drafted now, it says intending to cause damage Right? And The computer that was If there is going to be a website specifically KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 750 1 identified that's come up in the evidence, that would be 2 tribuneinteractive.com. 3 in through. 4 the modifications. 5 That's the website that they all came That was the URL of the Assembler CMS used to make What the indictment itself says was the object of the 6 conspiracy is twofold, to make unauthorized changes to websites 7 that Tribune Company used to communicate news features to the 8 public, and to damage computer systems used by Tribune Company. 9 That's in paragraph 3 of the -- you know, it's the objects 10 clause of the conspiracy count. 11 THE COURT: All right. But -- 12 MR. SEGAL: So my concern is basically constructive 13 amendment to the indictment. 14 the computer, it should be identified as it was, which is 15 Tribune Company's CMS in the indictment and the evidence. 16 if we're going to refer to the objects clause of the 17 indictment, it should be verbatim, because this language is 18 likely to be confusing and I think an amendment of the 19 indictment. 20 21 22 23 24 25 THE COURT: The -- if we're going to identify All right. And I understand, and I'm prepared to make some modifications based on what I've heard. Should the word "computer" say protected computer? And do we need a definition of protected computer? MR. SEGAL: I think that in the substantive clause, in the instruction for the substantive count, it says a computer KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 751 1 used in interstate commerce, and that's what a protected 2 computer is. 3 So at Your Honor's page 25. 4 THE COURT: That's Count Two. 5 MR. SEGAL: Yes. 6 Let me just find that in the proposed -- yeah. And so the object of the offense is to commit the substantive -- I'm sorry. Let me back up. 7 THE COURT: We're not to Count Two yet. 8 MR. SEGAL: I know, but it's -- 9 THE COURT: But the same definition. 10 MR. SEGAL: Right. 11 THE COURT: All right. 12 MR. SEGAL: And if I may, the jurisdictional element of 13 the substantive offense is not part of the mens rea requirement 14 of the conspiracy. 15 to have known that it was a protected computer for the 16 conspiracy. So, for example -- and so they don't have 17 THE COURT: Do you agree with that, Mr. Jaffe? 18 MR. JAFFE: That is true. 19 Protected computer is not typically a contentious area or definition under this act. 20 The defense wants to add that it agrees that the 21 intended damage, according to the indictment and indeed 22 according to the law, is damage to the computer management 23 system. 24 should be modified accordingly so that it's intending to cause 25 damage to the computer management system. And the defense strongly agrees that the instruction KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 752 1 THE COURT: All right. Should we import the definition 2 of protected computer or not? Do we just say the parties agree 3 that this was a protected computer? Does it matter? 4 MR. JAFFE: It can be added. 5 MR. SEGAL: It doesn't -- 6 MR. JAFFE: Whether or not there needs to be an intent 7 or knowledge that this is a protected computer is not the same 8 as whether or not. It must be determined that this is a 9 protected computer. So the defense has no objection to 10 including that definition. 11 THE COURT: 12 13 Are you saying the jury doesn't have to find that, Mr. Segal? MR. SEGAL: Not to convict of conspiracy. But if you 14 want to add it, I mean, it just -- I'm not going to -- I'm not 15 going to have this academic debate when it doesn't matter here. 16 If you want to make that change, it would be -- you could do it 17 easily by saying information to a computer used in interstate 18 or foreign commerce. 19 20 21 THE COURT: All right. All right. Anything else on this instruction? MR. SEGAL: Just that either -- well, I think in order 22 to talk about other instructions, we need to know what the 23 Court intends with regard to putting the -- identifying the 24 computer to be damaged or putting the objects clause of the 25 conspiracy in. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 753 1 THE COURT: What's the defense's response to the object 2 clause, Paragraph 3 on page 3 of the indictment, top of the 3 page? 4 Any objection to adding -- 5 MR. JAFFE: Paragraph 3 that begins with -- 6 THE COURT: The conspiracy had the following object. 7 MR. JAFFE: The one that says third or the one that 8 9 says second? THE COURT: Objects, page 3, paragraph 3 at the top. 10 The conspiracy had the following objects, among others. 11 government is asking for that information. 12 MR. SEGAL: 13 fine with me, too. 14 MR. JAFFE: 15 The Or just the -- if they want the CMS, that's It was my understanding that that's what the government had proposed. 16 MR. LEIDERMAN: 17 THE COURT: 18 verbatim from paragraph 3. 19 MR. SEGAL: Yes. 20 THE COURT: I'm trying to clarify the defense response 21 Yeah. But I also heard a request for the language Correct, Mr. Segal? That is -- that I think -- to that request. 22 MR. JAFFE: That's acceptable, Your Honor. 23 THE COURT: All right. 24 25 Anything else on Count One, Mr. Segal? MR. SEGAL: If I may have just one moment. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 754 1 The rest of it looks like the form language; is that 2 right, Your Honor? 3 THE COURT: It should track the form language. 4 MR. SEGAL: Oh, is there a typo? 5 MR. JAFFE: Are you talking about -- 6 MR. SEGAL: There should be an offense on line 1. 7 THE COURT: All right. 8 MR. SEGAL: And that's all I have. 9 THE COURT: Mr. Jaffe, again, we're looking at pages 17 10 11 12 and 18. Hang on. Is there anything else? MR. JAFFE: Yes. I believe at least one more time there is the use of the term "defraud the United States." 13 MR. SEGAL: Oh. 14 MR. JAFFE: In the paragraph that begins for a 15 conspiracy to have existed. 16 MR. SEGAL: It's also at -- yeah, at line 21. 17 THE COURT: All right. 18 MR. SEGAL: Right, that should come out. 19 May I have a moment to read it for other defraud clause 20 reference? 21 THE COURT: You may. 22 MR. SEGAL: Okay. 23 THE COURT: All right. 24 just tracking the statute. 25 MR. SEGAL: We can also word search for that. Page 19, Mr. Segal? This is No objection, Your Honor. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 755 1 THE COURT: Mr. Jaffe? 2 MR. JAFFE: The defense requests the modification or 3 the addition to the instruction that was in the defense's 4 proposed jury instructions, which includes this language, and 5 then also includes language to the effect "if the data was 6 still available to the alleged victim either because it was 7 backed up or elsewhere, there is no damage under Section 230. 8 9 We cited numerous cases cited in the civil context, but also tracking the same language, where information was altered 10 but in a way that the alleged victim was able to retrieve it, 11 and there was not determined to be damage within Section 230 12 within the Computer Fraud and Abuse Act. 13 Now, the issue here isn't whether something was wrong 14 or whether something was accessed without authorization. 15 Indeed, that's a very different provision of the Computer Fraud 16 and Abuse Act, but a very specific definition of damage which 17 only applies when information is lost so that it's not able to 18 be retrieved. 19 20 21 THE COURT: What about the back door evidence? it's not just copying a username and password, but -MR. JAFFE: It's my understanding that the damage 22 alleged is not damage to the username and password. 23 be the information transmitted under the statute. 24 alleged is the damage to the content management system. 25 So if THE COURT: That would The damage Which goes beyond the information required KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 756 1 to display the Chippy article. 2 3 MR. JAFFE: THE COURT: MR. JAFFE: Perhaps the government can clarify what the government alleges has been damaged. 8 9 Well, the damage between the period alleged here, between December 8th and 15th. 6 7 Which goes beyond the information -- I don't understand the question, Your Honor. 4 5 Agreed? THE COURT: So there is obtaining control of at least one username and password combination. Share at least one 10 username and password that could be used to log in and make 11 changes. 12 and password -- To obtain control of at least one additional username 13 MR. JAFFE: Right. 14 THE COURT: -- without authorization. 15 MR. JAFFE: It's not the username and the password that 16 is damaged under Section 1030 of the CFAA. It's damage to the 17 system itself. 18 information, may be the command under Section 1030, but the 19 damage is to the protected computer. 20 language of 1030(a)(5)(A). 21 alleged is alleged to be damage to the username and password, 22 that doesn't track the statute at all. The username and password may be the And that tracks the So to the extent that the damage 23 THE COURT: Is the damage to the username and password? 24 MR. SEGAL: The damage is to the integrity of the 25 system, the construction of all of these back doors, damage to KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 757 1 the integrity of the system. 2 their -- they spent much of their time trying to find and 3 eliminate back doors that were constructed in furtherance of 4 the conspiracy by Keys and his co-conspirators. 5 6 THE COURT: It's how they spent most of So what's the evidence, just so I'm clear, that supports the creation of back doors? 7 MR. SEGAL: Sure. 8 THE COURT: And what dates? 9 MR. SEGAL: Dylan Kulesza -- I'll get you the dates 10 when my colleague hands them to me. But I'll remind the Court 11 that, for example, there was a line of code shown to Dylan 12 Kulesza -- he was the technically proficient giant who 13 testified -- and he just said unequivocally that's the 14 construction of a back door. 15 THE COURT: But the date is really what's key. 16 MR. SEGAL: Okay. 17 18 May I have a moment? (Government counsel conferring.) MR. SEGAL: Okay. It's Government Exhibit 303 on 19 December 8th. 20 from the Tribune logs, that's part of the conspiracy -- shall I 21 walk over? 22 23 24 25 The first thing that we show -- I think that's THE COURT: That's okay. was one of my hypotheses. MR. SEGAL: Yes. I've looked at that. That Anything else? In the chat logs themselves, Keys tells them that he's credentialing up different usernames with KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 758 1 the second -- 2 THE COURT: So again December 8th? 3 MR. SEGAL: I have to check. 4 Yeah, so that corresponds with AEScracked saying, when 5 Hang on, Your Honor. it says find user, type anon1234 and then click find. 6 And then later, Sabu says -- they verify that it's 7 legit, and Keys warns them that they'll identify super user 8 accounts. 9 And then they -- THE COURT: All right. So let me ask the defense. How 10 is not the alleged creation of fake usernames, using access -- 11 how is not the creation of fake names -- why isn't that 12 impairment to integrity at least potentially? 13 MR. JAFFE: In this case because everything operated 14 the way it was supposed to, so the system itself was not 15 damaged. 16 operating, that people were able to get access, people were 17 able to use it. 18 And no -- no information was lost that wasn't available 19 elsewhere on the same system. 20 And there was much testimony as to the system itself It was utilized exactly the way it was before. THE COURT: But the link is integrity to -- to at least 21 information, that is, the information available on the L.A. 22 Times website. 23 MR. JAFFE: That's more of an allegation that there was 24 access to a system without authorization. There is a provision 25 under the CFAA for that, but this is not it. This is damage to KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 759 1 the system. 2 And we're not arguing that -- 3 THE COURT: Just using the government's mode of 4 thinking about this, if the back door creates a hole in the 5 dike, that's not a hole in the dike? 6 new username that allows someone -- If there's an anonymous 7 MR. JAFFE: That's access into the system. 8 THE COURT: That's unauthorized access. 9 MR. JAFFE: That may be unauthorized access, which was 10 not charged. 11 12 THE COURT: you've cited to me on that point? 13 14 And what's your best case of the cases MR. JAFFE: Hold on just a moment. (Pause in proceedings.) 15 MR. JAFFE: There is the AtPac decision, AtPac versus 16 Aptitude Solutions, 730 F.Supp.2d 1174 in the Eastern District 17 of California. 18 Sprint Solutions, Inc. versus Pacific Cellupage, Inc., which is 19 available on Westlaw 2014 WL3715122, Central District of 20 California, 2014. 21 2014 WL2988271, Central District of California, 2014. 22 THE COURT: 23 arguments. 24 that. 25 From the Central District of California, the And New Show Studios, LLC versus Needle, All right. I understand the parties' I'm going to have to think a little bit more about Page 20. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 760 1 MR. SEGAL: May I -- we're not just saying that a 2 single unauthorized access itself is damage. What we're saying 3 is that access -- the construction -- it's not just one access, 4 it then multiplied -- 5 THE COURT: I understand that. 6 MR. SEGAL: Okay. 7 20? 8 THE COURT: Page 20. 9 MR. SEGAL: This looks like the form instruction. 10 have no objection. 11 THE COURT: 12 Any objection, Mr. Jaffe? 13 MR. JAFFE: No objections, Your Honor. 14 THE COURT: Page 21. 15 MR. SEGAL: This looks like just the ordinary aiding 16 Great. I'm moving on. We It should be. and abetting instruction, and we have no objection. 17 THE COURT: Mr. Jaffe? 18 MR. JAFFE: No objections. 19 THE COURT: Page 22. 20 MR. SEGAL: No objection. 21 THE COURT: Mr. Jaffe? 22 MR. JAFFE: No objection. 23 THE COURT: Page 23? 24 MR. SEGAL: This looks like what we submitted to try to 25 Mr. Segal? solve any Apprendi problem, Your Honor. Let me see. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 761 1 THE COURT: Mr. Jaffe? 2 MR. SEGAL: No objection from the government. 3 THE COURT: I've added the cross-reference to the loss 4 definition. I think that's what I added. 5 MR. SEGAL: Yeah. 6 THE COURT: Mr. Jaffe? 7 MR. LEIDERMAN: 8 9 If we can have one second. (Defense counsel conferring.) MR. JAFFE: The defense doesn't have an objection to 10 this language specifically. 11 concern that will arise and will need to take place somewhere 12 within these instructions, and this could be the place. 13 that's in regard to the evidence submitted in the form of an 14 e-mail by Brandon Mercer regarding his statement, Mercer's 15 statement that the FBI needs $5,000 in order to prosecute. 16 What we've been discussing is a And Now, I think it's apparent to everyone in this room and 17 probably to the jury why that e-mail has been introduced and 18 used by the defense. 19 that the FBI needs $5,000 to prosecute is not accurate. The concern is that the language itself 20 And somewhere, perhaps this is the place -- 21 MR. SEGAL: Wait. That's fine with us. If the Court 22 wants to give an instruction, I just -- just to shortcut it, I 23 think the Court should give an instruction that any claims 24 about the law in the evidence -- that the jury should get its 25 understanding of the elements of the offense and the law only KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 762 1 from the Court's instructions, and that nothing in the evidence 2 should be considered an accurate statement of the law. 3 We -- I agree, I think that's -- 4 THE COURT: 5 exhibit. What's the exhibit number? I remember the I just don't know the number. 6 MR. SEGAL: There's more than one -- 7 MR. JAFFE: Exhibits F and G. 8 MR. SEGAL: There's more than one, Your Honor, and I'd 9 like to -- we could either refer to them or give a general 10 instruction. If you want us to refer to them exhaustively, 11 we'll have to go back and look at them again. 12 THE COURT: I don't know that we need to do that. 13 MR. SEGAL: You stopped court at times and told the 14 jury essentially this. 15 THE COURT: No, I understand that. I understand the 16 point. My question is, would it facilitate finalizing these 17 instructions to provide a joint instruction on this question? 18 You think you could do that by the end of the day? 19 MR. JAFFE: Yes. 20 MR. SEGAL: Yes. 21 THE COURT: And I believe I would -- do you agree that 22 this is the place to insert it? 23 it after page 24. 24 25 MR. SEGAL: My thought would be to insert I think you should put at either duty to -- under duty to follow the law or what is evidence, in that area. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 763 1 2 3 4 But we can come up with something and propose it to Your Honor. THE COURT: All right. So why don't you not only propose exact language, but a location in the instructions. All right. Then on page 24, my question on this 5 instruction -- again, I'm tracking the statutory language in 6 defining loss. 7 by this case? 8 9 Is the last part of this instruction implicated MR. SEGAL: No, and that was in my notes to raise. have not -- for various reasons, we have not adduced evidence 10 of consequential damages. 11 comma before "and" can be made a period, and you can strike 12 everything that follows after that. 13 14 15 We THE COURT: So I think from the comma -- the All right. With that clarification that I will do that, Mr. Jaffe, any objection? MR. JAFFE: There are no objections to striking that 16 part of it. 17 was out of concern that cost unrelated to computer impairment 18 or computer damages had been introduced. 19 moderately and more conservatively than the defense had 20 expected based on representations, but there is still concern 21 of confusion related to statements made to subscribership, 22 viewership and effect on the station and effect on the L.A. 23 Times that is not related to the computer impairment. 24 25 What the defense had requested and sought for this In this case, more Loss not being defined in the CFAA, but generally understood to mean what it means there. So the defense had KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 764 1 requested an addition to this that says costs unrelated to 2 computer impairment or computer damages are not loss under 3 Section 1030. 4 THE COURT: Mr. Segal, any objection to adding that? 5 MR. SEGAL: I do have an objection because loss is 6 defined under the statute for any reasonable cost to any 7 victim, and reasonable is the classic thing that it's up to 8 juries to define. 9 In this case, as I indicated, and as I argued in the 10 Rule 29, the defendant is actually the one trying to get them 11 to burn time responding to e-mails, you know, sort of the 12 effect of rattling before he strikes and causing all these 13 viewers to call in. 14 to decide what is a reasonable cost. 15 16 17 That's all -- that should be for the jury All these witnesses testified to what they did and why they did it and why it was important. THE COURT: So -- You're talking about the case as a whole. 18 This count is December 8th through 15th. 19 clear about that. 20 MR. SEGAL: Yes. Just so we're being But, still, I don't think -- I think 21 you're going to walk the jury into a lot of confusion if you 22 try to distinguish among loss for different counts. 23 24 25 THE COURT: information. I'm not talking about providing pinpoint I'm just looking at the counts as charged. MR. SEGAL: Right. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 765 1 2 THE COURT: And I'm really -- this is really leading towards the Pinkerton charge, which I have big questions about. 3 So I understand the defense objection. I'll go back 4 and look at your language. 5 again, you'll see how I resolve it in the next set of 6 instructions you get from me. 7 8 I'm inclined not to give it, but, Pages 25 and 26 are the Count Two instructions. Any objection to page 25, Mr. Segal? 9 MR. SEGAL: No. 10 MR. JAFFE: No objection, Your Honor. 11 THE COURT: Do we need to include the date range here, 12 Thank you. October 28th -- 13 MR. JAFFE: There is a general concern, and if it 14 arises here or somewhere else we're not certain, that so much 15 of the facts and information and evidence that was introduced 16 is unrelated to what was expected out of Count Two under the 17 superseding indictment; that nothing in the superseding 18 indictment begins on October 28th and nothing happens after 19 September 15th -- or December 14th, December 15th of that time 20 period. 21 And yet the jury was introduced with just a blitz of 22 information regarding Cancer Man and Skinner e-mails, yet the 23 alleged access of e-mail addresses from the iPad and other -- 24 Sam Cohen's account, none of which relates to the alleged 25 defacement of the L.A. Times website, all of which is KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 766 1 completely separate and wholly different activity and would 2 only seek to confuse the jury. 3 And I think it would be inevitable at this point that 4 the jury would be confused. 5 exactly understand what it's asked to decide here. 6 of that, none of those facts, nothing regarding Cancer Man and 7 Skinner e-mails, nothing that took place before December 8th, 8 nothing regarding e-mail addresses attributed to iPad users 9 were included in the superseding indictment. 10 11 12 THE COURT: I don't see how the jury would What about the CMS? And on top You've already said that reference to damage to the CMS system is what's alleged. I think the only thing that could give the defense 13 notice that the government was going after the Fox e-mail, the 14 accessing and using of Fox e-mails to send a notice to viewers 15 is that date, October 28th, 2010. Agreed? 16 MR. SEGAL: Was that the only thing? 17 So here's -- 18 THE COURT: 19 I'm having with Count Two. 20 in the allegations from paragraphs 1 and 3 through 15. I understand -- here's the other problem I understand that you're sweeping 21 MR. SEGAL: Yes. 22 THE COURT: The substantive count set forth in Count 23 24 25 Two is set forth fully in paragraph 2. MR. SEGAL: Right. So that's the thing, and that's what I think -- KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 767 1 THE COURT: So why do you need paragraph 1 in Count 3 MR. SEGAL: It's surplusage. 4 THE COURT: Conceded. 5 MR. SEGAL: It's surplusage, but here's the thing. 2 Two? All right. I 6 mean, it's not a concession. It's -- the only thing that we 7 need that -- what makes this indictment, this count sufficient 8 to charge any transmission of any code or command to the 9 Tribune server in that date period is paragraph 2. Right? 10 THE COURT: Of Count Two. 11 MR. SEGAL: Of Count Two, right. 12 And so you know that the defense, this defense attempt 13 to limit Count Two to just the L.A. Times defacement is wrong 14 when they say, oh, but, Your Honor, the only things that 15 happened outside that date range are, you know, the 16 exfiltration of Cancer Man, you know, the get command for the 17 e-mail, the construction of the back doors, Samantha Cohen's 18 e-mail. 19 no other allegations in this indictment, all of that evidence 20 would have been admissible to charge -- to prove just the bare 21 statutory language charged in paragraph 2 of Count Two because 22 all of those things were commands, information, whatever, sent 23 to the Tribune CMS between October 28th, 2010 and January 5th, 24 2011. 25 If we had come to court just with Count Two and with And so we showed -- I know we have a command on KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 768 1 November 3rd. 2 between the 28th and the 3rd. 3 testified about showing specific entries in the CMS log with 4 Keys trying to get into the CMS as late as January 2nd of 2011. 5 All of that was admissible. 6 paragraph 2 of Count Two. 7 paragraph 2 says is he did all these things to cause damage to 8 Tribune Company. 9 I'm not -- I don't recall if we have them And I know that Agent Cauthen It was properly admitted to prove And the only thing that it's -- that You know, it's well settled that an indictment does not 10 have to describe the government's evidence, plead evidentiary 11 detail or identify all the facts supporting the allegations. 12 And that goes as far back as, you know, Wong Tai versus United 13 States 273 U.S. 77. 14 THE COURT: But the issue is the damage. 15 MR. SEGAL: Uh-huh. 16 THE COURT: The damage is different -- even if I accept 17 the government's argument, the damage is different with respect 18 to the CMS and targeting of Fox 40 information and, 19 alternately, the L.A. Times website. 20 MR. SEGAL: 21 even. 22 Right? I don't -- I don't understand that argument The damage is just -- is generally pled as damage. So that sweeps in everything that is damage -- 23 THE COURT: Allowed by the statute. 24 MR. SEGAL: Right. 25 And so that is -- and so, now to go to the statute, that includes not just the integrity of the KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 769 1 system and the -- 2 THE COURT: I've read the statute over and over again. 3 MR. SEGAL: Okay. 4 THE COURT: So just back to Count Two, just so I'm 5 clear, are the parties agreeing that no date range should be 6 mentioned? 7 MR. SEGAL: We're fine with a date range, if you want 8 to put in that date range. 9 THE COURT: But you don't believe it's necessary? 10 could it not be necessary? 11 that? 12 MR. SEGAL: How And what's the defense position on It's not -- there's no danger of a variance 13 because all of the evidence that we put in fell within that 14 date range. 15 code or command transmitted outside of that period. So there's no risk of the jury convicting based on 16 But at the same time -- 17 THE COURT: You agree with that, Mr. Jaffe? 18 MR. JAFFE: Well, the defense is concerned about the 19 nature of the charge. However, it was our understanding up 20 until this point that the damage to the protected computer was 21 the damage to the content management system. 22 ago, I heard damage to the Tribune Company itself. Just a moment 23 The concern -- 24 THE COURT: But the CMS includes -- the CMS is -- 25 MR. JAFFE: Is the protected computer. And our KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 770 1 understanding to this point is that that was the L.A. Times. 2 And the L.A. Times defacement -- 3 4 THE COURT: But CMS was defined more broadly during trial, correct? 5 MR. JAFFE: It was defined so broadly so as to be 6 confusing and inconsistent, and really there are two different 7 possibly acts alleged that are being merged together. 8 there may even be multiple conspiracies. 9 In fact, But one is a conspiracy to deface -- one, in this case, 10 is the L.A. Times website and entering into the L.A. Times 11 website, which begins on December 8th. 12 series of information regarding iPad addresses and nasty 13 e-mails, which are wholly unrelated. 14 clear from this instruction at all what the jury is being asked 15 to do. 16 THE COURT: And the other is a And I don't think it's Do you agree that Count Two at least is 17 charging something completely separate from what's in Count 18 One, Mr. Segal? 19 MR. SEGAL: I'm thinking about that answer. 20 So it's complete -- it is overlapping but different, 21 and let me explain why. 22 substantively. 23 the inchoate offense of conspiracy to commit a substantive 24 crime and a substantive crime. 25 Right? First of all, it's different Like many indictments, this one charges Right? The other way that it's different, though, is in the KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 771 1 date range. 2 saying, you know, go do these things to the Tribune Company 3 CMS. 4 5 6 Because the conspiracy is Keys going out and THE COURT: Starting in December, the earliest possible December 8th. MR. SEGAL: Right, exactly. But Count Two is a 7 different kind of continuing offense. 8 right that Count Two is a continuing offense, but it continues 9 from different dates, and it's a substantive count that's 10 11 Right? My friend is alleged against a particular person, Matthew Keys. So, if I may, he's doing this substantive offense, 12 which is a continuing offense, all the way from October 28th to 13 January 5th. 14 in that period of time up to $5,000 in order to convict him of 15 Count Two. And we get to aggregate all the loss that occurs 16 In the middle -- I'm sorry. 17 In the middle of that conduct, he has friends or 18 co-conspirators who are doing this reconnoitering and back-door 19 construction and web defacement. 20 captures everything that Keys did to the CMS and aiding and 21 abetting in that period. 22 conspiracy is that, for Count Two, we actually have to prove 23 loss in order to convict him, not that it was within the scope 24 of an agreement or reasonably foreseeable. 25 on, and we did, people who, you know, burned time and whatever. But that -- but Count Two The difference between it and the We've got to put KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 772 1 Does that -- am I -- 2 THE COURT: I understand what you're saying. 3 MR. SEGAL: Okay. 4 THE COURT: And if the instruction is given as 5 proposed -- 6 MR. SEGAL: I think this is fine. 7 THE COURT: -- does it avoid any double jeopardy issue? 8 MR. SEGAL: No, absolutely not. 9 10 11 12 So there's no double jeopardy issue, and actually that's the core of why -THE COURT: That's why I said, does it avoid double jeopardy? MR. SEGAL: There can't be double jeopardy -- there's 13 no double jeopardy problem ever between a substantive count and 14 a conspiracy count. 15 a substantive offense and a substantive offense itself. You can always charge conspiracy to commit 16 And the reason is that under -- 17 THE COURT: 18 I'm talking about in terms of any future charges -- 19 MR. SEGAL: Oh, okay. 20 THE COURT: -- that Mr. Keys might face. 21 MR. SEGAL: Perfect. 22 So if this is charged this way, and we have proven this 23 through other accesses to the Tribune CMS, including the Cancer 24 Man e-mail, then -- you know, if we were disappointed in the 25 verdict in this trial and came back and charged him with, you Thank you. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 773 1 know, the Fox Mulder episode, you would dismiss it for double 2 jeopardy. 3 And that's why that conduct is captured by Count Two. 4 It is within that course of conduct. 5 this count, he will either be convicted of the Fox Mulder 6 conduct, or he will be able to plead a double jeopardy bar to 7 re-prosecution for that conduct. 8 9 10 11 12 13 14 THE COURT: All right. And by standing trial on Anything else, Mr. Jaffe? believe I understand the parties' differing positions. I But anything you want to say in response to what you've just heard? MR. JAFFE: Not to those most recent statements, no, Your Honor. THE COURT: All right. Then on page 26, any problem with that language, Mr. Segal? 15 MR. SEGAL: No. 16 THE COURT: Mr. Jaffe? 17 MR. JAFFE: No, Your Honor. 18 THE COURT: Page 27, Count Three, the attempt charge. 19 Thank you. Mr. Segal? 20 MR. SEGAL: No objection, Your Honor. 21 THE COURT: Should December 15th be noted? 22 MR. SEGAL: That's fine. 23 THE COURT: Mr. Jaffe -- 24 MR. JAFFE: Yes, Your Honor. 25 THE COURT: -- assuming the date is added? Yes. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 774 1 2 MR. JAFFE: It just occurred to the defense, going -- if we haven't lost the opportunity to discuss page 26. 3 THE COURT: All right. 4 MR. JAFFE: That loss is -- loss is as previously 5 defined? Or does that come up? 6 THE COURT: We can reference back -- 7 MR. JAFFE: Okay. 8 THE COURT: -- loss as previously defined. 9 Agreed, Mr. Segal? 10 11 MR. SEGAL: 25 or not? Yes. And are we putting the dates in page It's fine with us if that's -- 12 THE COURT: I'm inclined to do that. 13 MR. SEGAL: Great. 14 THE COURT: It's what's alleged. 15 MR. SEGAL: Please, Your Honor, that's fine. 16 THE COURT: I'm thinking more about whether or not 17 these are completely separate. And -- I mean, what's your -- I 18 understand your consistent position from the defense that you 19 really haven't been on notice, that you've construed the 20 indictment as going after the L.A. Times hack. 21 MR. JAFFE: Yes, Your Honor. 22 THE COURT: But do you dispute the government's 23 characterization that they can proceed on general allegations? 24 MR. JAFFE: In this case -- 25 THE COURT: That that's enough? KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 775 1 MR. JAFFE: It's not so much the general allegations, 2 it's what the superseding indictment created the impression of 3 what the indictment is based on. 4 5 THE COURT: Just based on the contents of the superseding indictment itself? 6 MR. JAFFE: The superseding indictment, as you said, 7 incorporated in Count Two the allegations specifically 8 regarding to the L.A. Times hack, as the Court mentioned now. 9 And only those, and the only facts alleged that would suggest 10 otherwise, are dates which on the superseding indictment do not 11 appear to be consistent with anything alleged specific for that 12 count. 13 the damage and what had particularly been alleged in Count Two. 14 And up until this point, it had not been clear what -- THE COURT: So what about that, that you have just 15 conceded the incorporation of the conspiracy allegations as 16 surplusage? 17 MR. SEGAL: So. 18 THE COURT: Well, the defense is saying that, even if 19 you've done that now, previously they relied on the 20 incorporation of those allegations to think Count Two was about 21 the L.A. Times website hack. 22 MR. SEGAL: So here's the thing. I mean, surplusage 23 just means something that is outside the count -- I'm sorry -- 24 that's outside the statutory language. 25 it's just not true that they're surprised that the But, look, you know, KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 776 1 government -- that they're surprised by this today. 2 This has been the subject of pre-trial litigation. The 3 Cancer Man e-mails were among the first things that went out in 4 discovery. 5 procedural vehicle to force the government to be more specific 6 in charging language, and it's called a bill of particulars, 7 and they never moved for one. 8 9 If they -- there is a vehicle to force, a Right? And so we proceeded with this indictment that says, among other things, that even before the conspiracy started -- 10 this is a paragraph that is charged in Count One and 11 re-incorporated in Count Two also. 12 employment was terminated, Matthew Keys kept and used for 13 malicious purposes log-in credentials to the Tribune Company's 14 CMS. 15 sub-paragraph H. 16 know -- it was in the discovery. 17 have been entitled to a bill of particulars. 18 thought -- but that was a procedural vehicle always available 19 to them. 20 21 22 It says that after his That's at page 2 of the indictment, paragraph 1, If they wanted more flesh on that bone, you They probably wouldn't even But if they May I have one moment, Your Honor? (Government counsel conferring.) MR. SEGAL: I mean, it's just -- there's nothing in 23 here that says -- for example, even among the objects of the 24 conspiracy, they're on notice at paragraph 3 that the 25 conspiracy had the following objects among others. Among the KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 777 1 manner and means, it said the conspiracy used several means to 2 accomplish the objects of the conspiracy, including the 3 following. 4 5 THE COURT: I understand all that. I've read and reread the indictment. 6 MR. SEGAL: Okay. 7 THE COURT: We also discussed this at motions in 9 MR. SEGAL: Right. 10 THE COURT: We now have the benefit of the evidence 8 11 12 So -- limine. that's come in. So, on Court Three -- I'll consider what you're saying, 13 and you'll see how I resolve that in the next set of 14 instructions. 15 Count Three? 16 MR. LEIDERMAN: 17 Your Honor, may I ask a question about Count Two? 18 Depending upon how the Court resolves it, presuming the 19 Court resolves it in favor of the government, would we still -- 20 would we be in a dangerous area if we argued that, as to Count 21 Two, the conspiracy is the -- I suppose the second conspiracy, 22 the one that Mr. Segal just described as dealing with Mr. Keys' 23 friends, we argued -- to use surplusage a different way -- that 24 all the Cancer Man matters were surplusage, argue this to the 25 jury as our theory of it? KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 778 1 Because I don't want to -- I don't want to create an 2 argument for closing and end up having that argument sort of, 3 you know, swatted back on me. 4 the Court rules in favor of the government on this, am I going 5 to be precluded from making that argument? 6 THE COURT: 7 charge? 8 here. So I guess I have to know, if Well, does this link to the Pinkerton I'm not thinking that a Pinkerton charge is warranted 9 MR. SEGAL: I want to think -- 10 THE COURT: I've seen one conspiracy, one conspiracy 11 and two substantive counts. 12 MR. SEGAL: Well, it's a conspiracy, a substantive 13 count and an attempt. 14 there may be a variance argument. 15 16 17 THE COURT: question. Attempt is another -- but all of this -That's something -- I understand that, so answer my Pinkerton Why do you need a Pinkerton instruction? MR. SEGAL: So Keys can be guilty of the substantive 18 offense in Count Two because of the conduct of his 19 co-conspirator. 20 THE COURT: Sharpie. 21 MR. SEGAL: Right. So Count Two asks you -- because 22 it's a continuing offense that asks for the aggregation of 23 loss, that is adding up all of the loss that he -- for the -- 24 25 THE COURT: But there's no backward looking conspiracy, so loss can't be counted before December 8th. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 779 1 MR. SEGAL: Loss is not being counted before December 2 8th. For the only count -- for the only count where actual 3 loss has to be counted, the time scope is October 28th to 4 January 5th. 5 asking what loss was reasonably foreseeable or within the scope 6 of the agreement. 7 Right? For the conspiracy count, we're only This is -- you don't need to worry about this now 8 actually because the argument that the defense is making that 9 somehow they were head-faked into thinking they didn't have to 10 worry about the Fox Mulder e-mails, that's actually not a jury 11 instructions argument. 12 variance, and it's the basis for a motion to dismiss the count 13 for variance. 14 It's an argument about prejudicial Right? It's not addressed to the jury based on a jury 15 instruction. 16 decide that. 17 It should be addressed to Your Honor, and you can THE COURT: All right. 19 MR. SEGAL: I want to -- well -- 20 THE COURT: That's your position? 21 MR. SEGAL: Hang on. 18 22 So you do need the Pinkerton charge? Let me find -- what page is the Pinkerton charge? 23 THE COURT: 24 I included it because I think you included it. 25 modified it. Page 29. I I don't -- I'm not inclined to give the Pinkerton KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 780 1 charge. 2 3 So, Mr. Leiderman, while they're thinking about that, you have been proceeding as if there were two conspiracies? 4 MR. LEIDERMAN: Meaning one starting on October 28th 5 lasting through January 11th or whatever the charge date is 6 and -- 7 THE COURT: You think something started on -- does the 8 evidence support the conclusion that there was a conspiracy 9 starting as early as October 28th? 10 MR. LEIDERMAN: 11 THE COURT: 12 MR. LEIDERMAN: 13 THE COURT: No. All right. No. Do you agree December 8th is the earliest 14 the evidence would support a conclusion there was any 15 conspiracy? 16 MR. LEIDERMAN: 17 THE COURT: 18 MR. LEIDERMAN: I do. All right. Yeah, I do agree to that. I do agree 19 to that. 20 like, for example, the creation of credentials -- and making 21 that part of the conspiracy. 22 December 2nd. 23 Although, they're taking the facts from outside -- And that was December 1st, So, no, I don't agree with December 8th. Because now 24 they're saying -- or from the arguments I've been hearing, I 25 think they're saying that the conspiracy in fact started on KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 781 1 December 1st when Mr. Keys made the credentials in the first 2 place. 3 MR. SEGAL: No, we're not arguing Keys -- December 1st 4 is background evidence for the conspiracy, but it's not -- they 5 start -- they are messing with credentials on December 8th, 6 that's our evidence, and that is something they do in 7 furtherance. 8 9 10 We showed you the exhibit. THE COURT: All right. So tell me, again, on Count Two, what are you asking to argue? MR. LEIDERMAN: That the -- we want to argue with 11 respect to Count Two that the -- that the October 28th through 12 January 11th date range isn't the date range at issue in Count 13 Two, that the date range at issue is the December 8th through 14 December 15th date range, and that the rest of the evidence 15 should be disregarded. 16 jury, if I can. 17 18 19 THE COURT: That's what I want to argue to the I think that would be a variance based on the allegations. MR. LEIDERMAN: Then I suppose we are arguing to the 20 Court that it's a variance. 21 we'll make that argument now or make that motion to dismiss 22 thereon now, or at whatever time the Court deems proper. 23 24 25 THE COURT: And we'll make that -- you know, All right. I understand that position. I don't think you're going to be able to argue that. So Count Three, in addition to adding the date, KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 782 1 anything else, Mr. Segal? 2 instruction? 3 4 MR. SEGAL: we're on? You said you were fine with that Now I'm lost. Can you tell me what page I'm sorry. 5 THE COURT: Page 27. 6 MR. SEGAL: 27. 7 THE COURT: Mr. Jaffe? 8 MR. JAFFE: No objections to this instruction. 9 THE COURT: All right. 10 No, we're good. Thank you. Page 28, again, the loss issue. And I would add cross-referencing the prior definition of loss. 11 MR. JAFFE: Yes, Your Honor. 12 THE COURT: With that clarification, any objection, 13 Mr. Segal? 14 MR. SEGAL: No, Your Honor. 15 MR. JAFFE: With that addition, the defense agrees, 16 17 18 19 Your Honor. THE COURT: Page 29, Pinkerton. So where are you on this, Mr. Segal? MR. SEGAL: I have no doubt that we're entitled to a 20 Pinkerton instruction based on proof of a conspiracy, and the 21 defendant should get vicarious criminal liability. 22 THE COURT: What's the error in not giving it? 23 MR. SEGAL: Well, it's error not to inform the jury of 24 25 the basis for criminal responsibility. I don't know -- I want to think about this. I might KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 783 1 withdraw this. 2 maybe it would be confusing to them. 3 4 We have an aiding and abetting instruction, and THE COURT: confusing. That's my -- my position is I think it is What's the defense position? 5 MR. JAFFE: 6 MR. LEIDERMAN: 7 MR. JAFFE: 8 9 10 11 12 The defense accepts -Yeah. The defense agrees, Your Honor, with the instruction. THE COURT: So you want the instruction given? MR. LEIDERMAN: No. The defense is in accord with the Court, we do not want the instruction given. THE COURT: All right. I don't plan to give it. If 13 the government wants to make a further argument, it can submit 14 something in writing by the end of the day. 15 MR. SEGAL: No, my colleagues have stopped me. 16 THE COURT: All right. 17 MR. SEGAL: Thank you. 18 THE COURT: All right. 19 sailing, I think. Page 30, back to smooth Any objection? 20 MR. SEGAL: No. 21 MR. LEIDERMAN: 22 MR. SEGAL: No, Your Honor. 23 THE COURT: All right. That's fine. 24 standard instructions. 25 instructions, pages 31 to 37? Page 31 through the end are the Any objection to any of those KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 784 1 MR. LEIDERMAN: 2 No objection by the defense. 3 THE COURT: Mr. Segal, you're fine with those? 4 MR. SEGAL: Yes, Your Honor. 5 THE COURT: All right. 6 MR. SEGAL: For some reason, I don't have the verdict 7 8 9 10 form. Just one second, please. Thank you. Then on the verdict form. I thought I printed it, Your Honor. THE COURT: proposed. I'm sorry. I believe it tracks what the government had I didn't see any objection from the defense. MR. SEGAL: They shouldn't -- it basically allows 11 conviction on the lesser included, so I imagine that they would 12 be happy with it. 13 MR. LEIDERMAN: I'm sorry. 14 THE COURT: Any objection to the verdict form? 15 MR. JAFFE: This is acceptable subject to we discussed 16 your giving an instruction with regard to the Mercer e-mail and 17 the FBI prosecution. So long as that is clear to the jury -- 18 THE COURT: What prosecution? 19 MR. JAFFE: The e-mail where -- 20 THE COURT: No, I understand that. 21 part of what you said? 22 MR. LEIDERMAN: 23 THE COURT: 24 MR. LEIDERMAN: 25 THE COURT: What was the last Where Mercer said you need $5,000 -- Oh, right. -- to get a prosecution. I will add that. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 785 1 2 And you're going to give me by the close of business, can we say by 4:30, a proposed instruction to clarify that. 3 MR. SEGAL: 4 MR. LEIDERMAN: 5 THE COURT: 6 Yes. Yes, Your Honor. And a proposed location in the set of instructions you currently have. 7 So the verdict form I'll plan on using. You will get 8 from me, before too late this evening, a final set of 9 instructions and the verdict form, and you may use those in 10 closing. 11 MR. SEGAL: Okay. 12 THE COURT: We will meet at 8:30 so you can record any 13 final objections to the final instructions. 14 exhibits if we need to. We'll talk about 15 Is there anything else we need to talk about today? 16 MR. LEIDERMAN: 17 I think just a matter of housekeeping, which is this. 18 I understand now what I'm not -- what either I'm going 19 to be allowed to argue or, if I argue it, I'm going to have an 20 objection sustained and be very embarrassed about. 21 think the Court impliedly ruled on the motion to dismiss based 22 on the variance, but I don't think the Court actually ruled on 23 it. 24 THE COURT: 25 MR. LEIDERMAN: However, I Based on the variance? Yes. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 786 1 THE COURT: 2 MR. LEIDERMAN: 3 THE COURT: 4 I'm going to think about that some more. So you can -- let's revisit that in the morning as well. 5 MR. LEIDERMAN: 6 MR. SEGAL: 7 Oh, okay. Okay. You can hold that until after trial, too. You can hold that until after the verdict as well. 8 THE COURT: Well -- 9 MR. LEIDERMAN: But I'd like -- 10 THE COURT: 11 then revisit the question. 12 13 MR. LEIDERMAN: I'd like to put on a clean closing, so I want to know what's -- 14 15 You can always make more of a record and THE COURT: The jury instructions will essentially tell you what you can do with that. 16 MR. SEGAL: Well, if the Court is thinking of 17 dismissing based on variance and -- the problem is that I want 18 to submit e-mail correspondence that goes back maybe six months 19 or a year where this issue has been discussed. 20 an -- There's not 21 THE COURT: I'm thinking about that. 22 MR. SEGAL: All right. Thank you. 23 THE COURT: All right. Anything else today? 24 MR. HEMESATH: 25 we're very close on exhibits. Merely that, as I mentioned earlier, And the only change that we're KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 787 1 contemplating so far is based on a discussion that we had about 2 Exhibit 604, that is largely similar to one of the other 3 exhibits. 4 MR. JAFFE: 5 MR. HEMESATH: 6 7 8 9 10 611 and 112. THE COURT: I show that 611 is in, but 604 was not admitted. MR. HEMESATH: 12 MR. HEMESATH: 15 16 17 18 Well, that's corrected. I believe that the defense -MR. JAFFE: 14 And we're discussing still the redaction of one of the exhibits. 11 13 604 and 611. I think the government wants to swap them. I think we want them both in, but if choosing between them, we would prefer 604. MR. LEIDERMAN: I think two of them is duplicative, but you can put in 604 instead of 611. THE COURT: Just let me know in the morning how you work that out. MR. HEMESATH: And then the other thing, and this is 19 important to resolve between then and now so we'll have time to 20 do it, is that what the defense intends with regard to the 21 individual snippets of the interview is to decide for certain 22 which of those were admitted and burn a disk that has all of 23 those conversations labeled by exhibit number on the file name 24 and submitting one single disk that has the -- 25 THE COURT: That's the government's plan? KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 788 1 MR. HEMESATH: Well, yes. 2 MR. LEIDERMAN: That's -- 3 THE COURT: 4 MR. LEIDERMAN: 5 THE COURT: 6 Unless -- That's the defense plan? I think that's the joint plan. All right. As long as you work together, and you have an unobjected-to exhibit. 7 Which exhibit are you talking about? 8 MR. HEMESATH: 9 THE COURT: Well, it's a series of exhibits. The series -- 10 MR. HEMESATH: It's the audio clips. 11 THE COURT: 12 MR. HEMESATH: 13 MR. SEGAL: You don't need to worry about this now. 14 THE COURT: That's what I'm saying. The 200 series? Yes. I mean, if you 15 represent that it is what has been admitted, and you both agree 16 and you've had a chance to fully review it, then I'm prepared 17 to accept that. 18 If there's a dispute, though, about the content not 19 reflecting what was admitted -- are you talking about excerpts 20 of what was admitted? 21 MR. HEMESATH: 22 MR. SEGAL: No. 23 THE COURT: All right. 24 of what has been admitted? 25 MR. HEMESATH: No. Just creating a usable format Yes. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 789 1 2 MR. LEIDERMAN: about. 3 MR. HEMESATH: 4 THE COURT: 5 That's what I thought we were talking Yes, that's correct. Again, no exhibit that is disputed will go to the jury until I've resolved any dispute. 6 MR. HEMESATH: 7 MR. SEGAL: Absolutely. Well, the audio recordings don't go back 8 anyway. That's why you don't have to worry now. 9 what form they're going to be preserved. It's just in But the jury should 10 not be allowed -- it would be error for the jury to listen to 11 these unsupervised. 12 13 THE COURT: stipulation to the contrary. 14 15 Well, unsupervised unless there's a MR. LEIDERMAN: Are you asking me if I agree that the jury can listen to the snippets -- 16 THE COURT: 17 MR. LEIDERMAN: 18 THE COURT: 19 That's agreed? Will not listen. Will not listen unsupervised. Is that understood? Do you agree with what -- 20 MR. LEIDERMAN: No, I agree with that. 21 THE COURT: 22 MR. LEIDERMAN: 23 THE COURT: 24 bridge when we come to it. 25 what it is they're asking and what we do with that. Right. Yes. All right. I mean, we can cross that If they ask to listen, we consider KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 790 1 All right. 2 MR. SEGAL: Thank you, Your Honor. 3 THE COURT: See you tomorrow morning at 8:30. 4 (Proceedings were adjourned at 2:24 p.m.) 5 ---o0o--- 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 1 2 I certify that the foregoing is a correct transcript from the record of proceedings in the above-entitled matter. 3 4 5 /s/ Kathy L. Swinhart KATHY L. SWINHART, CSR #10150 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347