IN THE UNITED STATES DISTRICT COURT FOR THE EASTERN DISTRICT OF CALIFORNIA BEFORE THE HONORABLE KIMBERLY J. MUELLER, JUDGE ---o0o--UNITED STATES OF AMERICA, Plaintiff, vs. No. 2:13-CR-00082 MATTHEW KEYS, Volume 7 Pages 791 through 927 Defendant. / ---o0o--REPORTER'S TRANSCRIPT OF PROCEEDINGS JURY TRIAL VOLUME 7 TUESDAY, OCTOBER 6, 2015, 8:30 A.M. ---o0o--- For the Government: BENJAMIN B. WAGNER, U.S. ATTORNEY 501 I Street, Suite 10-100 Sacramento, California 95814 BY: MATTHEW DEAN SEGAL and PAUL ANDREW HEMESATH Assistant United States Attorneys (Appearances continued next page...) Reported by: KATHY L. SWINHART, CSR #10150 Official Court Reporter, 916-446-1347 501 I Street, Room 4-200 Sacramento, California 95814 Proceedings reported by mechanical stenography, transcript produced by computer-aided transcription. 1 APPEARANCES (Continued) 2 For the Government: UNITED STATES DEPARTMENT OF JUSTICE Computer Crime and Intellectual Property Section 1301 New York Avenue NW, Suite 600 Washington, D.C. 20530 BY: JAMES ANTHONY SILVER Deputy Chief For the Defendant: LAW OFFICES OF JAY LEIDERMAN 5740 Ralston Street, Suite 300 Ventura, California 93003 BY: JASON SCOTT LEIDERMAN 3 4 5 6 7 8 9 10 11 TOR EKELAND, P.C. 195 Plymouth Street, Fifth Floor Brooklyn, New York 11201 BY: MARK H. JAFFE 12 13 14 15 16 17 18 19 20 21 22 23 24 25 KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 1 INDEX 2 PAGE: 3 4 5 CLOSING ARGUMENT BY MR. HEMESATH CLOSING ARGUMENT BY MR. LEIDERMAN REBUTTAL CLOSING ARGUMENT BY MR. SEGAL JURY INSTRUCTIONS 809 835 881 906 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 791 1 SACRAMENTO, CALIFORNIA 2 TUESDAY, OCTOBER 6, 2015, 8:33 A.M. 3 ---o0o--- 4 (Jury not present.) 5 THE CLERK: 6 States versus Matthew Keys. 7 Your Honor. Calling criminal matter 13-82, the United This is jury trial, day seven, 8 THE COURT: All right. 9 MR. SEGAL: Good morning, Your Honor. 10 THE COURT: All counsel are present. 11 Good morning. Mr. Keys is present. 12 This is our final session on jury instructions. You 13 have the final verdict form that just tracks the language of 14 the indictment using the between on or about, not beginning and 15 ending in terms of the time frame. 16 17 In terms of the final jury instructions, let me share one thing with you, and then I would take objections. 18 We will, while you are giving closings, prepare a 19 sanitized version. 20 instructions in your closing, please don't reference the 21 authorities at the bottom of the page. 22 working packets. 23 the Elmo, just make certain the bottom of the page does not 24 show. 25 But to the extent you're using any of the What you have is my So if you're going to show an instruction on Understood? KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 792 1 MR. LEIDERMAN: 2 THE COURT: Yeah, not an issue for the defense. All right. So the main issue I've caught, 3 I don't think aiding and abetting belongs in the conspiracy 4 instruction. 5 substantive charges, but I think the authority is pretty clear. 6 And I know you did highlight that yesterday, Mr. Segal, and 7 link that to the Pinkerton charge. 8 9 Aiding and abetting is incorporated into So my plan would be to delete what is shown on page 20, currently instruction No. 18, and re-number the subsequent. 10 MR. SEGAL: Your Honor, this is embarrassing, but I 11 don't actually have a printed copy in my hands right now of 12 the -- I'm sorry. 13 14 THE COURT: I think it was the government that proposed this with respect to Count One. 15 So any disagreement on the law? 16 MR. SEGAL: You can aid and abet a conspiracy. 18 THE COURT: What is your authority for that? 19 MR. SEGAL: There's a Ninth -- so I haven't reached 17 20 21 is -- this in a long time, but I'm sure -THE COURT: The research I've done confirmed my sense 22 that that's not case. 23 otherwise -- 24 25 That MR. SEGAL: But if you have a case that says There's a Ninth Circuit case that 1950s or 1960s, and if you give me 20 minutes or less, I could find it. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 793 1 Essentially -- I don't know if we need this 2 instruction, but I am familiar with this concept from my days 3 in the anti-trust division, where basically if there's a 4 general contractor that arranges a bid-rigging conspiracy among 5 his subs in order to pass along their charges in a cost-plus 6 contract, that is actually aiding and abetting a Sherman Act 7 conspiracy. You can aid and abet any offense. 8 But this may be academic. 9 THE COURT: I don't know if I need this. That's the first question. 10 Anything to say on this point? 11 MR. JAFFE: 12 13 14 No. The defense agrees, Your Honor, that it's not necessary or applicable to this charge. MR. SEGAL: Can I just find where we're talking about so I can -- 15 THE COURT: It's page 20, instruction 18. 16 And the Court's proposal -- I mean, I'm the one 17 responsible for these instructions, I know. 18 delete 18 and re-number the subsequent instructions and any 19 cross-references. 20 21 22 23 MR. SEGAL: My proposal is to You mean cut out an aiding and abetting instruction completely? THE COURT: Yes, with respect to Count One, and that's the only place it's been proposed and appeared. 24 MR. LEIDERMAN: 25 MR. SEGAL: Well, it appears in Count -- No, this is for the substantive count. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 794 1 2 THE COURT: Well, it's embedded right now in the conspiracy instructions. 3 MR. SEGAL: Is it also -- We need a vicarious criminal liability 4 instruction. 5 knew we were getting aiding and abetting. 6 7 8 9 The reason I dropped my issue with Pinkerton is I THE COURT: No, I know you said that. That's why MR. SEGAL: We absolutely need a vicarious criminal I'm -- liability instruction so we can argue that Matthew Keys is 10 personally accountable for the conduct that Sharpie engaged in 11 that he assisted in. 12 THE COURT: So is that Count One or Count Three? 13 MR. SEGAL: That is Counts Two and Three. 14 THE COURT: And aiding and abetting is incorporated 15 into the substantive offenses. 16 MR. LEIDERMAN: 17 THE COURT: 18 That's what I was saying. So any problem with moving aiding and abetting to the Count Two and Three sets of instructions? 19 MR. SEGAL: No, but I don't know -- hang on. 20 THE COURT: If that's the request, and there's no 21 objection or reason not to -- 22 MR. SEGAL: No, I don't care. I'm not -- but let me -- 23 THE COURT: It doesn't belong -- at this point, my view 24 is it doesn't belong in the conspiracy set of instructions, 25 which is where it shows now. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 795 1 2 3 4 5 6 7 MR. SEGAL: The Court is just talking about moving the instruction? THE COURT: Based on what I've heard in the last two minutes, that's my proposal. MR. SEGAL: Without adding or subtracting to its language? THE COURT: Yes. Because it's the general instruction, 8 so it would be moved from page 20 -- so the language at the 9 top, the introductory language identifying the crime charged 10 11 would be modified to track Counts Two and Three. MR. SEGAL: That's fine with us in this case. There 12 may be another day when I'll come to you and care about the 13 principle that you can aid and abet a conspiracy, but that's 14 not today. 15 THE COURT: All right. So what's currently showing on 16 page 20, instruction No. 18, would be moved to two locations, 17 one at the end of the Count Two instructions, so between what's 18 currently 25 and 26, and to the end of the Count Three -- 19 MR. SEGAL: I would say -- my own view is you only need 20 to give this instruction once. 21 and Three, that is probably the most -- 22 THE COURT: All right. If it just refers to Count Two So before page 28, would you 23 agree with that, Mr. Leiderman, that specifically reference 24 Counts Two and Three? 25 MR. LEIDERMAN: We're looking, if we may. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 796 1 MR. JAFFE: So this is the instruction that begins -- 2 we're looking at the previously submitted instructions, Your 3 Honor, the one that begins with a member of conspiracy commits 4 an act? Oh, no, that's the one -- 5 THE COURT: No, this is the aiding and abetting. 6 MR. JAFFE: Okay. 7 THE COURT: So the first paragraph references aiding 8 and abetting twice. 9 So a defendant may be found guilty of -- MR. LEIDERMAN: Your Honor, I'll save the Court some 10 trouble. I don't like it obviously because it's harmful to us, 11 but it's a correct statement of the law. 12 THE COURT: 13 MR. LEIDERMAN: 14 15 only. With respect to Counts Two and Three. With respect to Counts Two and Three I'm not aware of -THE COURT: Well, then structurally I'm going to accept 16 the government's suggestion and move what's currently numbered 17 18 to follow the Counts Two and Three sets of instructions. 18 And so it will be a new -- it will show between pages 27 and 28 19 with re-numbering. 20 MR. LEIDERMAN: 21 THE COURT: 22 23 24 25 Yeah, it's -- And the introduction will be modified to reflect that it's talking only about Counts Two and Three. MR. LEIDERMAN: It's difficult to credibly object to such a move. THE COURT: All right. So that's the only substantive KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 797 1 change I plan to make. 2 MR. HEMESATH: So, Your Honor, from my presentation's 3 perspective, this is my current slide. 4 now the reference to instruction 18 at the top, but you seem to 5 be suggesting that the introduction will be changing as well? 6 THE COURT: I did delete just right A defendant may be found guilty of the 7 crimes charged in Counts Two and Three, even if the defendant 8 personally did not commit the act or acts constituting the 9 crimes, but aided and abetted in their commission. 10 MR. SEGAL: Obviously if we put this up, the defendant 11 can't prejudiced because this one only refers actually to Count 12 One as it is now. 13 MR. HEMESATH: It doesn't refer to any crime actually. 14 MR. SEGAL: The crime of transmitting a program -- 15 THE COURT: But it's only -- my conclusion, without 16 your bringing in your case from the 1950s, if you reference it 17 with respect to Count One -- 18 MR. HEMESATH: 19 THE COURT: 20 MR. HEMESATH: 21 MR. SEGAL: We're not going to do that. 22 THE COURT: It's only applicable to Counts Two and MR. SEGAL: While waiting on the jury, I'm going to 23 24 25 Oh, yeah. -- I would sustain an objection. Yes. Three. find that case for you just for kicks. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 798 1 THE COURT: All right. 2 MR. SEGAL: But we're not arguing it. 3 THE COURT: All right. 4 other objections to the instructions. 5 6 So I'm prepared to take any MR. SEGAL: Mr. Segal? None other than what we discussed yesterday, Your Honor. As long as -- 7 THE COURT: That created your record. 8 MR. SEGAL: This is everything that -- I'm sorry. 9 10 Except for the modification that the Court explained, these are the same as what went out in the e-mail last night? 11 THE COURT: Except for the moving of the aiding and 12 abetting to follow Counts Two and Three and specifically 13 reference them -- 14 MR. SEGAL: Yeah, I have nothing to add, Your Honor. 15 THE COURT: All right. 16 The other modification to aiding and abetting would be Let me just check. 17 on lines 7 and 8 just to reference the crimes in Counts Two and 18 Three. 19 MR. SEGAL: There is one problem. 20 15, Your Honor. 21 going to have trouble with this. 22 23 May I approach? It's in instruction I don't think the defense is There are a couple of words left from the defraud clause. I'm looking at instruction 15. 24 THE COURT: All right. 25 MR. SEGAL: And at line 22, the words "or agency KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 799 1 thereof" should be deleted. 2 THE COURT: 3 MR. LEIDERMAN: 4 THE COURT: 5 All right. Agreed, Mr. Leiderman? That's agreed. All right. So it will go "against the United States in any manner or for any purpose"? 6 MR. HEMESATH: What line is that? 7 MR. SEGAL: 22. 8 THE COURT: All right. 9 And you got that further modification to the aiding and Anything else, Mr. Segal? 10 abetting, Mr. Hemesath? 11 line 7 as it now appears would read first the crimes charged in 12 Counts Two and Three were committed by someone. 13 14 15 16 17 18 19 20 MR. HEMESATH: That is so the first element, page 20, If I may, I just want to make sure that my presentation tracks. THE COURT: Currently page 7 and 8 tracks the language of Count One. MR. HEMESATH: abetting. So this is what I have for aiding and If -- yeah. THE COURT: So the second paragraph beginning with the word "first." 21 MR. HEMESATH: 22 THE COURT: Is this a substantive -- What my instruction is going to read, "A 23 defendant may be found guilty of the crimes charge in Counts 24 Two and Three." 25 MR. HEMESATH: Okay. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 800 1 2 THE COURT: So your language is tracking the charge in Count One. 3 MR. HEMESATH: 4 THE COURT: So you need to generalize. 5 MR. SEGAL: For the aiding and abetting? 6 MR. HEMESATH: 7 MR. SEGAL: Transmission is Count Two. 8 THE COURT: Is it tracking exactly the language of 9 10 I see. No, no, in the first. Count Two, knowingly causing? MR. SEGAL: Right. We were going to -- we will use the 11 short explanation of the crime, but it's not telling them to 12 convict of conspiracy, which is the only problem that the Court 13 has pointed out. 14 15 16 THE COURT: All right. You agree with that, Mr. Leiderman, it's all right to leave that language as is? MR. SEGAL: 17 Court identified it. 18 conspiracy -- The instruction goes back and it's as the But we're not going to say to convict on 19 THE COURT: All right. 20 You agree with that, Mr. Leiderman? 21 MR. LEIDERMAN: 22 THE COURT: Okay. All right. I think that's fine. Yes. All right. We'll change 23 instruction 15. 24 government is prepared to rest on its record made yesterday. 25 No other objections from the government. The Mr. Leiderman, objections to the instructions in this KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 801 1 set? 2 MR. LEIDERMAN: No. We're prepared -- we made, I 3 think, quite a record yesterday. 4 that. 5 THE COURT: All right. We're prepared to stand on Just so it's clear as to the 6 Court's resolution, in looking back at the cases cited by the 7 defense, looking back at the NetApps case I had cited on the 8 first day, and having considered the evidence that is now in, I 9 do believe there is sufficient evidence before the jury that 10 the government could prove by circumstantial evidence, with 11 respect to the 10(a)(5) -- I'm sorry -- 1030(a)(5) charges, 12 damage. 13 government has presented sufficient evidence to support a 14 conclusion that a reasonable juror could conclude beyond a 15 reasonable doubt supports more than just mere misappropriation; 16 that this is not just taking information, it's taking usernames 17 and passwords, and so it's taking information plus. 18 NetApps case towards the end does discuss the risk of taking 19 usernames and passwords alone. 20 And that is because this is not -- I think the And the But here, if the jury believes the back door evidence 21 that the government has presented, I think it would support the 22 charges in this indictment. 23 beginning of the case based on the evidence that has come in. So my view has shifted since the 24 MR. SEGAL: May I -- 25 THE COURT: It doesn't mean I'm deciding who is right KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 802 1 or wrong here. 2 jury. 3 4 I'm just allowing those charges to go to the MR. SEGAL: Your Honor, there is one more thing with the jury instructions. 5 THE COURT: Yes. 6 MR. SEGAL: Looking at instruction 22, which is the 7 instruction for the substantive count, it says -- the word 8 "protected" has been added to the second element. 9 way -- but there's no definition of protected computer in the 10 11 And the jury instructions. I think that the way that the Ninth Circuit pattern 12 instruction operates is the person intentionally damaged a 13 computer and, third, the computer was used in or affected 14 interstate or foreign commerce. 15 THE COURT: 16 protected. 17 charged offenses. And -- I decided not to add a definition of Protected does appear in the description of the 18 MR. SEGAL: Yes. 19 THE COURT: But based on the representation of the 20 parties that there was no material dispute that the computer at 21 issue here was a protected computer, I can delete the word 22 "protected" in what's currently numbered instruction No. 22, 23 will become instruction No. 21, to delete the word "protected" 24 on line 10. 25 Any problem with that, Mr. Leiderman? KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 803 1 2 MR. LEIDERMAN: No. It's conceded that this is a protected computer. 3 THE COURT: All right. Anything else, Mr. Segal? 4 MR. SEGAL: I'm just checking for the attempt 5 instruction to see if there's anything that related to that in 6 the attempt instruction. 7 No, Your Honor. 8 THE COURT: 9 Thank you. All right. before we take a short break? All right. Anything else Ms. Streeter will check with the 10 jury to see if they have a schedule for us so we'll know that 11 before you begin closings hopefully. 12 13 Are you currently thinking a total of two hours, Mr. Hemesath? 14 MR. HEMESATH: 15 THE COURT: 16 MR. HEMESATH: 17 THE COURT: MR. HEMESATH: If you could tell me when I maybe hit an hour. THE COURT: 23 MR. HEMESATH: 25 I would like to Do you want a warning notice when you reach 22 24 Yes, Your Honor. a certain time? 20 21 Did you want to reserve time? reserve any remaining time that I have for rebuttal. 18 19 Yes, Your Honor. All right. And then for sure a half an hour after that. THE COURT: All right. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 804 1 MR. HEMESATH: 2 THE COURT: 3 All right. And, Mr. Leiderman, are you thinking two hours? 4 5 That would be great. MR. LEIDERMAN: minutes. I'm thinking and I'm targeting 90 So if I -- 6 THE COURT: Do you want a 15-minute warning? 7 MR. LEIDERMAN: No, I'd actually love a half an hour 8 warning. If I find myself on a slide -- you know, on a slide 9 too far away from my last slide, I know I better pick it up. 10 But I -- 11 THE COURT: All right. 12 I'll let you know at one hour. 13 MR. LEIDERMAN: You would have equal time, but Yeah, I just want -- to Court and 14 counsel, my plan is for 90 minutes. 15 case I don't hit that target. 16 17 THE COURT: All right. So I think we can get through closings if your estimates are correct. 18 19 All right. I want two hours just in I'm going to cut you off, Mr. Hemesath, at two hours, just so you know. 20 MR. SEGAL: I'll cut him off at one. 21 THE COURT: All right. And so the case would go to the 22 the jury by the 1:30 adjournment time, and the only question is 23 will they work the rest of the day. 24 soon. 25 All right. And I think we'll know We'll take a short break. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 805 1 (Off-the-record discussion with Courtroom Deputy.) 2 THE COURT: 3 question. Have you finalized the exhibits? Ms. Streeter is asking. 4 MR. LEIDERMAN: 5 THE COURT: 6 Good No. Are there any disputes for me to resolve is really the question. 7 MR. LEIDERMAN: There are no disputes to resolve. 8 There are proper copies for us to locate and make sure to make 9 it back. 10 THE COURT: All right. What I tell the jury, as they 11 are excused to deliberate, is they will have the exhibits 12 shortly. 13 14 MR. HEMESATH: And for the record, I think we discussed yesterday is that we're adding 604 to the admitted list. 15 THE COURT: Is that the final resolution? 16 MR. LEIDERMAN: Is it adding 604 and withdrawing 611? 17 I thought that's what it was. 18 MR. HEMESATH: No. I thought about that, and the thing 19 is is that I believe that the government at various points did 20 refer to 611 as well. 21 confusing to keep 611 -- or to reject 611 in favor of 604. 22 they are 80 percent the same. 23 24 25 THE COURT: clarify. So I think would be a little too But Well, the Court can give an instruction to Why don't you meet and confer and tell me -MR. LEIDERMAN: I'm not offended by it, Your Honor. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 806 1 They're both the same thing. 2 It's in basically like a Word document type format, so it's 3 easier to read. 4 or superfluous -- not superfluous, but extra verbiage. And it has some extra language, some different 5 THE COURT: 6 MR. LEIDERMAN: 7 THE COURT: 8 9 604 is in a different format. So 604 will come in I can live with it. All right. Is that the only change to the list? MR. LEIDERMAN: 112 is going to have a redaction. 10 Mr. Jaffe is working with Mr. Hemesath on that. 11 said, we're still looking for the correct defense F. 12 MR. SEGAL: May I have a moment? 13 THE COURT: Okay. 14 disputes to resolve. MR. LEIDERMAN: 16 THE COURT: 19 THE COURT: If Okay. All right. 20 (Recess taken.) 21 (Jury not present.) 22 THE CLERK: 25 112 will be redacted. there's any other dispute, you can let me know. MR. LEIDERMAN: 24 604 can come in. All right. 18 23 You let me know if there are I will note that 604 is coming in. 15 17 And like I We'll just take a break. Please remain seated and come to order. Court is now back in session. THE COURT: All right. We were waiting on a juror who was late because of child care issues. If you haven't heard, KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 807 1 the jury is saying they would like to leave at 1:30 today, but 2 they will report tomorrow morning at either 8:30 or 9:00 and 3 then work all day tomorrow. 4 What they've said to Ms. Streeter, as I understand it, 5 is they just want to get it done tomorrow. 6 for them that they need to take as long as they need, and they 7 can't count on finishing tomorrow even if that's their goal. 8 don't want a verdict driven by their own sense of a limited 9 schedule. 10 I will emphasize I And the Court will remain available if needed Thursday and Friday. 11 Ms. Streeter is going to e-mail you the final 12 instructions, still unsanitized but the final instructions with 13 the edits we just talked about. 14 by the time I instruct. 15 jurors can follow along if they wish. 16 the breaks we'll load those into the binders. 17 MR. SEGAL: We'll have sanitized versions Those will go into binders, and the So just during one of Your Honor, would it be possible to get 18 printed copies of the final instructions? I may want to put 19 them up on the Elmo during my rebuttal with the bottom folded 20 over. 21 THE COURT: So you're splitting the closing? 22 MR. SEGAL: Oh, yes. 23 THE COURT: Oh, I had not understood that. 24 25 Typically it's the same attorney. Any objection to the splitting of the argument? KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 808 1 MR. LEIDERMAN: 2 THE COURT: 3 MR. LEIDERMAN: 4 THE COURT: No. All right. All right. No. You have, again, the unsanitized version. 5 If they're ready, if the sanitized versions are ready before 6 your rebuttal, we'll provide you a copy. 7 MR. SEGAL: Thank you, Your Honor. 8 THE COURT: All right. 9 Let's bring the jury in. (Jury present.) 10 THE COURT: 11 Welcome back, Ladies and Gentlemen. 12 good evening. 13 argument. 14 You may be seated. We hope you had a We are ready, as I told you, for closing Let me tell you how the schedule will work today given 15 what you've shared with us. 16 between the prosecution and the defense of about three and a 17 half hours of closing. 18 The defense believes up to an hour and a half. 19 breaks along the way according to our -- as close as possible 20 to our normal schedule without interrupting the flow of 21 argument. 22 I understand that there is a total The government may go up to two hours. We'll take Then I will instruct you. That may get us close to our 1:30 closing time, and I 23 understand you do want to adjourn today at 1:30. You want to 24 begin tomorrow morning at 8:30 or 9:00 and then work all day 25 tomorrow. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 809 1 As I'll instruct you, it's very important you not put 2 an artificial end time on your negotiations -- on your 3 deliberations. 4 Court and counsel of course will be available. 5 take as long as you need to do your job. 6 instructions on that when I instruct you. 7 8 9 10 So if you need more time than tomorrow, the So that's our schedule. You need to I'll give you full We'll begin with Mr. Hemesath, the government's closing. MR. HEMESATH: Members of the jury, good morning. You have now heard a story about online, anonymous 11 revenge, a self-described angry employee who began a campaign 12 to impose what he called consequences against his former 13 employer using illicitly obtained passwords and usernames. 14 But that wasn't enough. When Cancer Man and Fox Mulder 15 no longer seemed sufficient, the defendant then turned to the 16 Internet, and specifically to members of online chat rooms who 17 were ready and willing to agree with him to impose even greater 18 damage on the Tribune Company. 19 Members of the jury, you've now heard and seen the 20 evidence in this case. 21 that you've seen with the charges alleged by the United States. 22 And the United States submits to you that the evidence proves 23 beyond a reasonable doubt that Matthew Keys is guilty of three 24 charges in the indictment. 25 Now is the time to apply the evidence Now, the purpose of this closing statement is to KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 810 1 present to you an organized structure and to show you that the 2 evidence applies to each of the elements that the government is 3 required to prove, and that is why I began today by showing you 4 the charges in this case. 5 conspiracy. 6 7 Now, Judge Mueller will instruct you specifically with regard to the application of this count as follows: 8 9 And we began with Count One, the The defendant is charged in Count One with a conspiracy to commit an offense against the United States, namely, to 10 cause damage to a protected computer in violation of Section 11 371. 12 I'm skipping ahead. In order for the defendant to be found guilty of that 13 charge, the government must prove each of the following 14 elements beyond a reasonable doubt: 15 On a timeline that there was an agreement between 16 December 8th, 2010 and December 15th, 2010, between two or more 17 people to transmit a program, code, command or information to a 18 computer. 19 defendant became a member of the conspiracy knowing at least 20 one of its objects and intending to help accomplish it. 21 third, that one of the members of the conspiracy performed at 22 least one overt act on or after December 8th, 2010 for the 23 purpose of carrying out the conspiracy. 24 25 We'll talk about this. The second element, that the And, Now, you will see this date range here seems relatively narrow, for comparison, to the date range in Count Two. That's KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 811 1 the campaign. 2 instructions from Judge Mueller: 3 Again, you will receive the following The defendant is charged in Count Two specifically with 4 knowingly causing the transmission of a program, information, 5 code or command and, as a result of such conduct, intentionally 6 causing damage without authorization to a protected computer. 7 The elements to that charge are as follows: 8 First, the person knowingly caused the transmission of 9 at least one program, code, command or information to a 10 computer; second, as a result of that transmission, the person 11 intentionally damaged a protected computer; and, third, the 12 computer was used or affected interstate commerce. 13 Again, this is the range of the two counts that we've 14 spoken about so far. 15 attempt. 16 That brings us to Count Three, the The defendant is charged in Count Three specifically 17 with knowingly attempting to cause the transmission of a 18 program, information, code or command and causing intentionally 19 damage to a protected computer on December 15th. 20 The elements here: 21 That the defendant intended to transmit a program, 22 command, code, information to a computer and cause damage 23 without authorization; and, second, that the defendant did 24 something that was a substantial step toward committing the 25 crime. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 812 1 2 Now, note the relationship datewise of these three counts. 3 Now, to help you, the jurors, conduct a searching 4 analysis of these topics, the government submits to you a 5 chronology of events. 6 any particular order, and so a chronological summary may be of 7 use to you in your deliberations. 8 9 The witnesses here did not testify in Note a couple of details before I begin. or show you on the screen is evidence. Nothing I say I may refer to 10 something in evidence, but nothing I say independent of that is 11 evidence, only my words, only argument. 12 Secondly, you will not be permitted to take this 13 presentation back to the jury room for your own study. 14 see something that you remember and that you want to remember 15 to discuss back in the jury room, please take a note of it, 16 particularly the exhibit numbers that you will see flashing by. 17 If you So you heard evidence that this story began on October 18 28th, 2010 when Matthew Keys left Fox 40 under heated 19 circumstances. 20 with Brandon Mercer, he was terminated and left voluntarily, 21 probably both. 22 Witnesses testified that, after an argument That was October 28th, 2010. Not long after that, the evidence shows, someone -- and 23 John Cauthen showed you the analysis of why he believed it to 24 be Matthew Keys, but someone operating behind the cover of a 25 virtual private network, downloaded an e-mail file from the KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 813 1 CMS. You heard evidence from both Dylan Kulesza and John 2 Cauthen explaining these entries showed that someone downloaded 3 an e-mail list. 4 That's Exhibit 303, page 4. Not long after that, someone else downloaded another 5 e-mail list, or the same e-mail list perhaps, using user 6 test5678. 7 a VPN and using an IP address that ultimately resolved to 8 Matthew Keys. 9 Again, the evidence shows that it was someone using Then, on December 1st, 2010 at 3:36 in the afternoon, 10 Matthew Keys, using the moniker Fox Mulder 4099, sent his first 11 e-mail to Brandon Mercer referencing the breach of the CMS. 12 Now, note the importance of the reference to the CMS, the 13 content management system. 14 e-mail. 15 small A -- referencing not only a complaint, but suggesting a 16 breach to the content management system. This was not just a scolding This was an e-mail anonymously sent -- anonymous, 17 This is important because Fox Mulder claimed a breach 18 of the security system, and he provided evidence to back that 19 up. 20 shouldn't have had access. He suggested that someone had access to the system that 21 Not long after that, a second e-mail referencing a 22 breach of the CMS, Exhibit 101 again. Specifically we already 23 sent you five e-mail addresses to show that these addresses 24 were legit. 25 system. You can find them in your content management KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 814 1 Another e-mail the same day. Your viewers can decide 2 for themselves when we e-mail them with the e-mail addresses 3 provided upon registration. 4 This was not some mass e-mail to someone that Fox 5 Mulder thought was a viewer of Fox 40. 6 addresses provided on registration. These were e-mail 7 Now, you may be asking yourselves at this point, how do 8 we know that Matthew Keys was Fox Mulder or, as you'll see in a 9 moment, Cancer Man. Well, you heard John Cauthen's analysis of 10 the logs, his use of the Overplay VPN and how ultimately, 11 despite the fact that the IP addresses looked like they came 12 from Ireland or Switzerland or France, they were actually 13 originating from Matthew Keys' Internet connection. 14 15 16 But more telling than that, his own words. (Audio recording played, not reported.) MR. HEMESATH: So not only admitting Overplay, not only 17 admitting that he knew that he was appearing as a different IP 18 address, Matthew Keys admits that he downloaded e-mail -- that 19 he had access to e-mail addresses. 20 21 22 (Audio recording played, not reported.) MR. HEMESATH: And if that's not enough, he wrote a written confession to the same thing. 23 In December 2012, I gained access to a list of e-mail 24 addresses from the Tribune Company content management system. 25 I used these e-mail addresses to send correspondence to people KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 815 1 I have reason to believe were viewers of my former employer, 2 KTXL, a part of Tribune Company. 3 Ladies and Gentlemen, the government submits that there 4 is no doubt who was sending these e-mails to viewers and who 5 was threatening Tribune Company and, beyond that, who had 6 accessed the e-mail system from the content management system. 7 Now, at this point, Tribune employees don't know who is 8 sending these e-mails, and they don't know who is suggesting 9 that the security of the CMS has been breached. 10 11 They just continue to get e-mails. Once again, we have decided to begin sending the 12 e-mails to the first group of people tomorrow morning to people 13 who have registered on fox40.com. 14 Now, certain e-mails suggested that the identification 15 of the intruders was an important task. 16 from multiple IT workers that identifying the intruder was 17 important for system security. 18 In fact, you heard The other thing that the e-mails suggested, and this is 19 an e-mail on December 2nd, that the identification process 20 would be a long and painstaking process. 21 that he was operating behind a foreign IP address with a 22 virtual private network, and that was for his protection, a 23 cloak of anonymity. 24 and the fact that it was a long and painstaking process to 25 identify him and plug the holes. Matthew Keys knew Those same IT workers confirmed that fact, KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 816 1 And by the way, we know that e-mails were actually sent 2 to the viewers because some of those viewers actually 3 complained to Fox 40, as you can see in Exhibit 105. 4 On December 3rd, yet another e-mail from Cancer Man 5 specifically referencing damage to the integrity of the content 6 management system. 7 8 You Fox people make it incredibly easy to gain access your subscriber list. 9 On December 3rd, later that day -- or on December 5th, 10 the e-mails continue to roll in, suggesting more and more that 11 it was the security of the system that was at stake in the most 12 important detail. 13 There is a new urgency to addressing information 14 security. 15 databases and internal websites that are thought to be locked 16 to the outside world. 17 18 19 20 At risk are company secrets, e-mails, documents, Why was Cancer Man doing this? Now, later we would hear directly from him. (Audio recording played, not reported.) MR. HEMESATH: Was he really saying to viewers what was 21 going on? 22 about security to the system, backed up by proof in the form of 23 stolen e-mail addresses? 24 25 Or was he instigating a series of persistent threats Now at a certain point, December 5th, not even references to information security were enough. There's the KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 817 1 extraordinarily direct, first, your database is not secure. 2 Now, on December 6th, we learn that the evidence shows 3 that Matthew Keys' tactics went beyond merely sending messages 4 to Brandon Mercer and to viewers using stolen e-mail addresses 5 from the CMS. 6 expenses and headaches, he uses credentials to antagonize his 7 successor Samantha Cohen, then Samantha Scholbrock. Instead of using the system just to create IT 8 You heard Agent Cauthen, in Exhibit 303, explain what 9 was going on with this Assembler log entry, that somebody had 10 changed Samantha Scholbrock's credentials. 11 credentials, you heard Samantha Cohen say she was initially not 12 able to work, so she got a new password. 13 8th, 2010, her password was changed again. 14 occasion, both her passwords to S. Scholbrock and S. Scholbrock 15 2 why changed at once. 16 to do her job, which was to post content to the CMS, for a 17 week. 18 And without her But then on December And then on a later You will recall that she was not able Now, at this point I'm going to ask you to 19 simultaneously think about Count Two, which was the campaign, 20 Keys' campaign to cause damage, and also think about Count One, 21 conspiracy, because we are now at December 8th. 22 December 8th that Keys decided to take efforts from his own 23 solo work, obtaining e-mail lists, sending e-mails on his own, 24 to the big time, specifically to the IRC, the Internet relay 25 chat room, where he begins advertising his desire to attack his And it is on KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 818 1 former employer. 2 3 Specifically, if you want to attack Fox News, PM me. have a user password to their CMS. 4 I That's on December 8th. Now you can see right here that the reference is to 5 AEScracked. 6 within brackets like that, the greater/less than symbols, that 7 that means in an Internet chat room that that is the person 8 talking. 9 10 11 You heard testimony that when there is a term But how do we know that AEScracked is Matthew Keys? He tells us in his own words. (Audio recording played, not reported.) 12 MR. HEMESATH: So now we know AEScracked is Matthew 13 Keys. 14 took you through in his presentation showing that IP addresses 15 associated with AEScracked resolved back to Matthew Keys. 16 Not to mention all of the analysis that John Cauthen So what is AEScracked saying on December 8th? Well, 17 here it appears that he is giving away the subject of this very 18 case. 19 system. 20 21 22 23 24 25 He is giving away passwords to the content management You can publish content, change user settings, all sorts of shit. Further on down the page: Is this where I put the super user username and pass code? And then a little further down: common two. User anon1234, pass, And, notably, go fuck some shit up. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 819 1 2 This is confirmed by Keys' later statement. (Audio recording played, not reported.) 3 MR. HEMESATH: Let's continue to look at the highlights 4 from December 8th and note that what's coming back to you in 5 the jury room is a complete version unhighlighted of these 6 chats. 7 Notably on this page, you can see that Sharpie is 8 indicating that they have access, they are successful now in 9 entering the the CMS. 10 11 But that's not enough. Matthew Keys offers the following advice. If you want the largest impact, target the Chicago 12 Tribune, the Los Angeles Times, WPIX, KTLA, KCPQ, KTLX, WGN-TV, 13 Antenna TV. 14 Also Tribune wises up. They deleted a super user 15 account of mine two weeks ago after it was created. 16 not the fastest bunch, but they're close. 17 More stations. And what are those stations? 18 Tribune's bread-and-butter assets. 19 again, Chicago Tribune, L.A. Times. 20 21 They're They are The ones to target, once (Audio recording played, not reported.) MR. HEMESATH: 22 says we're in. 23 credentials worked? At this point right here, where Sharpie Is there any doubt about whether these 24 The advice and the exhortation goes on. 25 A question, So these log-ins will be for everything? KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 820 1 AEScracked, yes, absolutely. And then a Wikipedia 2 entry for Tribune Broadcasting to further explain the reach of 3 what has been breached in this case. 4 Here a chat member presents a problem that anon1234 5 stands out like a sore thumb. Keys offers advice in response. 6 Create a fictitious name, essentially blend in. 7 The advice goes on, how to fool the system to stay in. 8 And another chat room member can't believe that this 9 was quote, legit. 10 He's glad he stayed up to witness this. And after that, yet more advice. Make your move soon 11 because they will wise up. 12 note the use of the term -- another super user account. 13 Remember that a super user is a user that can create other 14 users. 15 16 But if they do, I can create -- and At the same time, another chat room member tells him, I'm looking for a way to do even more damage. 17 The reaction to that, I did not give you those 18 passwords for, quote, research. 19 up. 20 I want you to fuck some shit And more advice beyond that. In the event Tribune 21 removes the super user account, how do I gain access to this 22 chat when I create another one? 23 This foretells the difficulty that Tribune IT staff 24 will have. It's not just about plugging one hole, it's about 25 stopping an attack in which there may be dozens or hundreds of KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 821 1 2 3 super users created by super users created by super users. And then he asks for feedback. some more information. Did I help? Here is Yet another URL. 4 And by the way, I can tell you who I am, I am the man. 5 So what happened after that? 6 7 8 9 What happened after December 8th? On December 9th, he offers to peddle his wares again. I've already given ops, the user/pass to several Fox websites. Later that day on the 9th, he argues that the L.A. 10 Times should be demolished, citing around article that might be 11 unpopular with some in the chat room. 12 On December 10th, he tries again. 13 He supports his argument on December 10th by calling 14 15 Target Fox News. Fox News infotainment for inbreds, target them. Now continuing with the chronology, Assembler logs show 16 a user logging in as N. Garcia on December 11th. You may 17 recall that N. Garcia ultimately was the username that 18 officially accessed the CMS to change the defacement -- to 19 change the story that was the defacement that we will be 20 talking about. Here's the log entry for that. 21 But the next day, you may recall, December 12th, 2010, 22 Brandon Keys called Matthew Keys specifically about the Cancer 23 Man e-mails. 24 he was Fox Mulder. 25 attack while claiming to be a journalist covering the Keys denied that he was Cancer Man, denied that And he audaciously predicted the L.A. Times KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 822 1 Anonymous, big A, movement. 2 Among other things Keys says in the recorded call: 3 I haven't sent any e-mails about your contests or your 4 website or your e-mail addresses. 5 talking about. 6 I don't know what you're At no point was I involved in advising on any of their, 7 ah, operations, and at no point did I volunteer any of my 8 services as a former or current journalist to help get their 9 message out. 10 Now, with regard to potential cost and whether Keys 11 knew about the cost, he said specifically, attempting to advise 12 Brandon Mercer: 13 Get a computer forensics team involved in it. Cal 14 Forensics I hear is a really good company. 15 had access my e-mail and my Facebook and my -- you know, my 16 usernames and passwords that are computer forensics experts. 17 It really sucked, umm, but I knew I hadn't done anything. 18 you know, they wound up charging my ex a bunch of money to do a 19 bunch of bullshit investigative work. 20 anything. 21 Private eyes that So, It didn't pan out into This is the point where we know that Matthew Keys knows 22 that this is an expensive and an intensive investigation. 23 he knows, by the way, that he's using a VPN. And 24 Even though they are criminals, referencing his use of 25 the word "criminals" in the previous sentence, 'cause they are KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 823 1 clearly doing do a lot of illegal shit, but I don't know what 2 they're planning on doing with the Times, and that's why I 3 didn't say anything. 4 That was on December 12th. But on December 14th, the 5 campaign continues. 6 Times? 7 room participants attacked L.A. Times on December 14th, 2010. 8 9 Anyone interested in defacing Fox, L.A. And finally what Matthew Keys was waiting for, the chat Now, how do we know about this conversation between Matthew Keys and a member of the chat room? Here we don't have 10 to rely on IRC chats taken from some other computer. We can 11 find evidence of this on Matthew Keys' own computer in the form 12 of a screenshot. Here it is specifically. 13 Sharpie, I taught myself the system using N. Garcia. 14 AEScracked responding to the fact that Sharpie was cut 15 16 off. I can grant you access again. Notably, Sharpie, And I see that you can do a bunch of 17 different layouts on different papers and have them all go live 18 at the same time. 19 Remember that. 20 The next screenshot. 21 22 23 24 25 Let me see if I can find other users/pass I created while there. Again, I encourage you to read this in total in the jury room. In response at the bottom, I could have done so much more if I'd known their interface at the start. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 824 1 And, of course, here is the result from the web page, 2 from the mobile version. That was up for a day you heard 3 testimony about. 4 accounts not been locked out, you can easily for see what would 5 have happened. Had he not been locked out or had Keys' other That is a chronology. 6 Now let's move on to what will be important to your 7 analysis in the jury room, and that is a loss analysis with 8 regard to each count. 9 loss on all three of the counts, and the analysis is slightly 10 11 You will have to answer the question of different with regard to each of the counts. With regard to Count One, you recall, the conspiracy, 12 the range of the conspiracy is limited to December 8th through 13 December 15th. 14 if you find beyond a reasonable doubt that the defendant 15 committed the offense charged in Count One, you must then 16 decide whether the government has proved beyond a reasonable 17 doubt either that the defendant could reasonably foresee that 18 the conspiracy could cause $5,000 or more in loss to the 19 Tribune Company; or, two, causing $5,000 or more in loss to the 20 Tribune Company fell within the scope of the defendant's 21 particular agreement with his co-conspirators. 22 23 24 25 The judge's instruction, you will find, is that We'll get to the definition of loss in just a moment, but it goes on. Note that for Court One, the government is not required to prove that any loss actually occurred. And this is the KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 825 1 nature of conspiracy. 2 And how can you calculate, how could you possibly 3 calculate what the defendant could reasonably foreseen with 4 regard to the conspiracy costing $5,000 or more? 5 do we have of that? 6 though, let's talk about what loss is. 7 What evidence And before we get to that evidence, A loss is any reasonable cost to any victim, including 8 the cost of responding to an offense, conducting a damage 9 assessment and restoring the data, program, system or 10 information to its condition prior to the offense. 11 And I note that a jury instruction changed. 12 THE COURT: 13 MR. HEMESATH: 14 THE COURT: Well, are you going to clarify that? Yes. Again, you will be told that what the Court 15 instructs is what the instructions are. 16 included in this that is not part of any instruction that the 17 Court is going to give. 18 19 20 MR. HEMESATH: There is language Some instructions changed very recently and -THE COURT: Well, the Court's instructions are the 21 Court's instructions. 22 MR. HEMESATH: 23 With regard to these instructions, you will see that Yes, that is absolutely correct. 24 this last section here, and any revenue lost was not argued 25 and, therefore, there will be no reference to that. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 826 1 2 THE COURT: So you are to disregard that part of that slide, just so it's perfectly clear. 3 MR. HEMESATH: How do we know that? How do we know 4 what the defendant could have foreseen? Ladies and Gentlemen, 5 I submit to you that you have seen exactly what the defendant 6 intended through his own words on the IRC chat channel. 7 He wanted to, quote, fuck some shit up. He knew -- he 8 told Brandon Mercer that he knew about the skill that these 9 chat room members had. 10 11 to go. He exhorted them. He gave them the password. He told them where He told them what to do. Now, with regard to the second part, causing $5,000 or 12 more in loss to the Tribune Company, whether that fell within 13 the scope of the defendant's particular agreement with the 14 co-conspirators, this is a little different than the first one. 15 It may not be what the defendant personally foresaw. 16 regard to the scope of what was agreed upon in the conspiracy, 17 what were the stakes? 18 19 20 But, with (Audio recording played, not reported.) MR. HEMESATH: Matthew Keys admits the stakes. He knows what a hacking attack would mean to the Tribune Company. 21 Beyond that, once again, we go back to the chat. 22 Yet another reason why the Times must be demolished. 23 did not give you those passwords for research. 24 fuck some shit up. 25 Is this where I put the password? I I want you to Here are the assets that they can target. Go fuck some shit up. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 827 1 Ladies and Gentlemen, that, under Count One, is how you 2 will determine whether the stakes or the foreseeability, either 3 one, meet the $5,000 threshold. 4 will say that an actual loss is not required for you to find a 5 $5,000 loss on that point. 6 under option one or two is sufficient. 7 for the government to be able to provide -- to prove guilt on 8 this element. 9 You note that the instructions And either one under count -- or Only one is required Now, with regard to Count Two, you may recall the 10 timeline, that the range is different than under Count One. 11 That's October 28th to January 5th, 2011. 12 This is the correct loss statement. Again, the loss is 13 any reasonable cost to any victim, including the cost of 14 responding to an offense, conducting a damage assessment and 15 restoring the data, program, system or information to its 16 condition prior to the offense. 17 18 Now, how do we count that? Well, we've got to go back to our witnesses. 19 We start out with Brandon Mercer, Matthew Keys' 20 supervisor and recipient of the Cancer Man e-mails. 21 know we followed the standard formula to determine the hourly 22 rate. 23 hours in a year; that's 2,080. 24 the figures may not be exact. 25 So you That's the total salary divided by the number of working There may be some rounding so Dan Gaines, the veteran reporter, who found the story. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 828 1 2 Tom Comings, the engineer who identified N. Garcia as the account that made the change. 3 Brian Hanrahan, who fixed the story the best he could. 4 Armando Caro, who led the IT team in the security 5 6 7 8 9 10 response. Dylan Kulesza, who identified Chippy leet and the IRC chat room. Tim Rodriguez and another IT professional who spent 50 hours on the response. And you may recall, Ladies and Gentlemen, throughout 11 the testimony there was a differentiation between what was 12 spent in response and what was spent on upgrades. 13 controls, but the government submits that these figures only 14 count the response, only count the identification. 15 the money that was spent and the man-hours expended, are not 16 included in this chart. 17 to the CMS, which was her job. 19 to post to the CMS. In her words, that was my job Jason Jedlinski, who organized the security response on 21 both of the incidents, Cancer Man and the L.A. Times 22 defacement. 23 The rest, Samantha Cohen, who lost a week of being able to post 18 20 Your memory Finally Jerry Del Core, station manager at Fox 40, 24 spent hours in meetings and on the phone in direct incident 25 response. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 829 1 Note that we listed the high and the low estimates of 2 these witnesses. 3 conservative estimates by any measure, and they exceed $5,000 4 even in the poorest case scenario. 5 We didn't count benefits. These are Now as to Count Three, attempt, the instruction here 6 with regard to loss is that, if the offense had been completed, 7 would it have caused loss adding up to at least $5,000 to the 8 Tribune Company? 9 chats, and specifically in this case to the chat that occurred 10 To answer this, once again we go back to the on the date that the attempt was perpetrated, December 15th. 11 And I see that you can do a bunch of different layouts 12 on different papers and have them all go live at the same time. 13 If the damage from one story exists in the way that the 14 government suggests that it does, what would the damage have 15 been from all of the layouts on the front page at the same 16 time? 17 18 19 He could have done so much more. So, with that, briefly let me circle around and give a brief review of all of the elements for all of the counts. Once again, Count One, the conspiracy. You will ask 20 yourselves, was there an agreement? 21 of the conspiracy knowing of least one of its objects? 22 of the members performing at least one overt act? 23 24 25 Was Matthew Keys a member Was one Well, the chat logs sure seem to prove every single one of the points, all of the assets that they could target. Now did Keys, with regard to Count Two, know of the KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 830 1 object of the conspiracy and intend to help accomplish it? 2 do we know that? 3 4 5 How Once again, let's go back to the chat rooms. Is this where I put the super user username and pass code? (Audio recording played, not reported.) 6 MR. HEMESATH: He incited it. He knew it. 7 Finally, did one of the members perform at least one 8 overt act after December 8th? 9 there were quite a few, but one sticks out, and only one is 10 necessary. 11 Now the evidence shows that They defaced the L.A. Times website. Ultimately this is the form that you will fill out. 12 This is Count One, and this what you will have to decide in the 13 jury room. 14 With regard to Count Two, the campaign, this is the 15 course of conduct between October 28th, 2010, and January 5th, 16 2011. 17 the individuals in the chat room. 18 elements. 19 That includes everything that Keys did, including with Knowingly. And, again, here are the We know that Keys knowingly caused the 20 transmission of at least a command. 21 and his IP address analysis, he transmitted many, many codes 22 and commands to download e-mail lists, to harass Samantha 23 Scholbrock, and then to aid and abet Sharpie sending a code. 24 25 According to Agent Cauthen Now note that as to another instruction that you will be getting. And, again, the copy that the judge provides you KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 831 1 with in the jury instructions is what will control. 2 These instructions will tell you that aiding and 3 abetting someone following these elements counts just the same 4 as having done it yourself. 5 incited the conduct does not absolve him of the responsibility. 6 The fact that Matthew Keys merely Did he intentionally damage or aid or abet someone 7 damaging a protected computer? 8 passed along a password, and then he told them what to do with 9 it. 10 Once again, the chat logs. Finally, was this computer used in or affecting 11 interstate commerce? 12 located, administered throughout the the United States, 13 California, Texas, Chicago. 14 conservative estimates exceed $5,000. 15 16 He You heard that the system was used, And you know that these Members of the jury, this is Count Two. Here's the form that you will fill out in the jury room. 17 And then Count Three, the attempt, on December 15th, 18 2015. 19 defendant intended to transmit a code that could cause damage 20 to a computer. 21 works here for those that would assist or aid or abet the 22 transmitter of that code. 23 Here the required elements are that: First, the And that same aided and abetted instruction Second, the substantial step. Here the step is located 24 on the screenshots found on the computer. They tried. 25 tried to get in again and again, and they failed. They Not only is KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 832 1 the evidence there on the screenshots, but Agent Cauthen told 2 you that, in Exhibit 307, the Assembler logs reflect an 3 attempted entry on the system at about that time. 4 You will also learn from the instructions that mere 5 preparation is not a substantial step for the purposes of these 6 elements. 7 or actions must demonstrate that the crime will take place 8 unless interrupted by independent circumstances. 9 To constitute a substantial step, a defendant's acts Let's look at the screenshot again. 10 independent circumstance? 11 was that the system admins were that good. 12 13 What was the It was that he was locked out. This is Count Three, and here is the form that you will fill out in the jury room. 14 And so went this bitter, expensive, exhausting tale of 15 online anonymous revenge against a media organization. 16 will now hear from the defense. 17 your job is not to be taken lightly. 18 Matthew Keys' own words when interviewed by John Cauthen. 19 It You Please listen carefully. And I ask you to recall (Audio recording played, not reported.) 20 MR. HEMESATH: 21 Consider also the reasons that Matthew Keys offered for 22 23 doing it. (Audio recording played, not reported.) 24 25 He did it. MR. HEMESATH: Members of the jury, thank you for your service. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 833 1 THE COURT: All right. Ladies and Gentlemen, that 2 concludes the government's closing argument. 3 time for rebuttal, so you will hear from the government again. 4 5 It has reserved My question is, do you expect your closing to go an hour and a half? 6 MR. LEIDERMAN: 7 THE COURT: Yes. Let's go ahead and take a break now so we 8 can come back and hear the defense closing in one piece. 9 During that break, all my admonitions remain in place. 10 discuss the case. 11 No research of any kind. 12 Do not Don't think about its ultimate conclusion. Let's take a 15-minute break, and then we'll come back 13 and hear from Mr. Leiderman. 14 (Jury not present.) 15 THE COURT: 16 Just two things. All right. 15-minute break. There was a slip of the tongue. 17 said Count Two when you meant element two with respect to 18 conspiracy. 19 You I think it's clear in context. But you also showed transcript excerpts of the Mercer 20 recording, and the evidence did not come in in that form. 21 didn't hear an objection, so I'm assuming there's no dispute 22 but that those transcript excerpts properly reported what was 23 said. 24 25 MR. LEIDERMAN: I There were a number of things that I thought were objectionable that I let go, you know, in KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 834 1 deference to counsel, and that was one of them. 2 and listened, and it appeared to -- it appeared to reflect what 3 was being said. 4 that it appeared to reflect. 5 hopes that, you know, it's reciprocal. 6 I looked at it That's the best I can give you, Your Honor, is THE COURT: I afford counsel leeway in the All right. Well, I'm not going to give any 7 special advisement, but specifically the evidence did not come 8 in in that form. 9 10 MR. HEMESATH: MR. SEGAL: That's correct. But just as much -- that's right, but as 11 long -- it's argument. 12 he could say this is what he said and read it back to the jury, 13 he could put it up on a power point. 14 And he played that tape, and so much as I mean, that was not Mr. Hemesath's decision. My own 15 view was that that was perfectly fine, I saw the slides, so 16 it's on me. 17 THE COURT: I've raised the issue. 18 anything at this point. 19 something. I'm not going to do The more you talk, the more I might do 20 MR. SEGAL: 21 MR. LEIDERMAN: 22 It is argument, and I think people are entitled more 23 See you after the break, Your Honor. Well, hold on, just to settle that. leeway in argument. 24 I just wanted to get that out -- 25 THE COURT: And I will clarify -- KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 835 1 MR. LEIDERMAN: 2 THE COURT: 3 At this point, 10 minutes. All right. 4 (Recess taken.) 5 (Jury not present.) 6 THE CLERK: 7 -- because I'm about to argue. I understand. You may remain seated and come to order. Court is now back in session. 8 THE COURT: All right. Let's bring the jury in. 9 Mr. Hemesath ran for 52 minute and 12 seconds. 10 MR. SEGAL: 52? 11 THE COURT: 52 minutes, 12 seconds. 12 MR. SEGAL: That's precision. 13 (Jury present.) 14 15 THE COURT: You may be seated. Welcome one more time, Ladies and Gentlemen. 16 We'll move now to the defense closing argument. 17 heard me say before this is argument, not evidence. 18 Mr. Leiderman informs the Court that he may take up to 90 19 minutes. You And 20 So you may proceed. 21 MR. LEIDERMAN: 22 If it pleases the Court and counsel, on behalf of Thank you, Your Honor. 23 Matthew Keys, we will deliver our closing statement at this 24 point. 25 The first thing I want to tell you is that I think it's KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 836 1 important that we start with this before we go into any of my 2 slides. 3 argument. 4 after we finish. 5 is the law in this case. 6 to make clear that because I have a lot of mixed in slides of 7 argument and actual jury instructions. 8 9 My words are not jury instructions. They are You're going to get a pack of jury instructions The government has chance for rebuttal. What I'm saying is argument. That I want So, having said that, there is no dispute that this is a protected computer. Just about any computer these days is a 10 protected computer. 11 have a happy computer there, and he's happy because it wasn't 12 damaged. 13 This is an unauthorized damage case. You You're not being asked to decide in this case if 14 Mr. Keys gained unauthorized access to a protected computer. 15 You're being asked to decide if he caused unauthorized damage. 16 And as the Court will instruct you, damage means a very 17 specific thing under the Computer Fraud and Abuse Act, or CFAA, 18 which is the statute at issue. 19 may use that term. 20 want you to understand what I'm saying if I happen to say CFAA 21 instead of Count One, Two or Three. 22 there's a specific definition of damage, and you'll get that. 23 Okay. And I tell you that because I Just because it's what sticks in my mind, I But under the CFAA, The first thing is this. The Cancer Man and the 24 X Files e-mails, these are, we assert, irrelevant. They were 25 brought out solely for prejudice, to have you not like KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 837 1 Mr. Keys. 2 not have the knowledge he needed to have regarding whether 3 Sharpie could do any computer damage, had the skills, was, as 4 the testimony came in, leet or elite. 5 We believe the evidence has shown that Mr. Keys did The government wants to make you believe that Matthew 6 Keys is a vengeful, horrible person. 7 confusing. 8 take it, and you should crumble it up into a little ball, and 9 you should throw that evidence into the garbage. 10 It's irrelevant. It's distracting. It's unimportant. It's You should That's what you should do with that evidence. 11 The last thing you see on this slide is the X Files 12 movie. 13 the movie or something like that. 14 you believe these things, that Matthew Keys is this horrible 15 person who did these horrible things. 16 in all of this, what we assert is irrelevant, prejudicial 17 evidence for no reason other than to make you think that 18 Matthew Keys is horrible. 19 tapes that he's not horrible. 20 It's I Want to Believe, I think that was the name of The government wants to make And by that, they threw And I think it comes out in the What then is this case about? It's really about this 21 edit to the L.A. Times. 22 came in except for the prejudicial, irrelevant evidence. 23 this Chippy 1337, that's what we're gathered here for, or 24 Chippy leet. 25 That's the bulk of everything that It's There is a computer language that is spoken by these KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 838 1 people, and it really didn't come out so much in these logs, 2 and the language wasn't quite as coarse as some of the -- some 3 of the traditional logs of this type have. 4 ugly in there. 5 cleaner logs for you. 6 1337, an edit for 40 minutes. 7 It can get really The government, to their credit, put in sort of But that's what this is about, Chippy And we'll talk more about that. This is the story as corrected by Mr. Hanrahan. As he 8 testified, it's the story that is still online if you go after 9 this case is over -- because you can't do any independent 10 research. 11 story will come up, you know, if you can remember pressure 12 builds in house to pass tax cut package. 13 If you go after this case is over, you can see this So, as I said, we'll talk more about it. This story 14 was up on December 14th from 3:49 p.m. to 4:29 p.m. Pacific 15 standard time. 16 someone else testified that it was central standard time. 17 any event, 40 minutes is 40 minutes. 18 the L.A. Times. 19 Hanrahan, an L.A. Times editor. 20 That is actually a fact in dispute because In And that's according to And as I said, it was discovered by Brian This is not exactly the most unforgettable act of 21 hacktivism ever there was, but here we're in a federal case. 22 And I don't know if you know the expression, don't make a 23 federal case out of it. 24 me, and now I say it. 25 this, out of a 40-minute deface to a story that probably no one My grandpa always used to say that to They have made a federal case out of KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 839 1 saw. This is not a front page story. 2 that -- that probably wouldn't have made the print edition, 3 although I think the testimony might have been that they were 4 looking at it for the print edition. 5 This is something The other thing they talked about was the Wayback 6 Machine and the mobile site. There were worries about both of 7 these things. 8 but inferentially, I think perhaps you can conclude that this 9 is not in the Wayback Machine, that you can't find this story I'll talk about circumstantial evidence later, 10 or this Chippy 1337 story anywhere except for in articles about 11 this case. 12 There's no proof that it was ever in the Internet archive. 13 There is some testimony to the contrary. 14 There's no proof that it's on the Wayback Machine. We don't know what the mobile site feed had originally 15 regarding the Chippy story. 16 appeared. 17 something called RSS feeds, it was on the next day. 18 you don't know when it came out, you also don't know when it 19 came on. 20 That's the issue. We don't know when it first Because they talked about So because And, of course, this didn't do any lasting damage to 21 the brand. That was just discussed by Mr. Hemesath, this 22 lasting damage to the brand. 23 damaged correlated with loss to the brand, and that's not 24 something you should be considering in terms of damage and loss 25 in this case. There was no testimony about how And, again, this case is about damage and loss. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 840 1 So we go to Anonymous. 2 we had in opening, right? 3 who is Anonymous? 4 And we have the same questions Who is Sharpie? Who is Sabu? And I think the question what is Anonymous has been 5 answered. 6 credentials passed to him and seemed to be quarter-backing at 7 least the beginning of this -- of the incidents in the Internet 8 Feds chat room. 9 Sabu in this case is someone that passed -- had Sharpie, on the other hand, astoundingly we really 10 heard very little about. 11 know what his capabilities were at any time. 12 he came out in any indictment. 13 relation to this case. 14 about Sharpie. 15 You don't know who he is. You don't You don't know if You don't know where he is in There are all kinds of open questions So some of the most important open questions are, did 16 Matthew Keys know, truly know that Sharpie and Sabu were 17 actually hackers? 18 this trial, what they specifically were. 19 the most important questions of the trial, and it didn't get 20 answered. 21 You don't know that, that didn't come out in And that was one of Like I said, Sharpie was hardly even discussed. 22 knows who he is. 23 this case about Sharpie. No one There was no evidence that was relevant to 24 Pardon me. 25 He's the second biggest part of this case, and he's KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 841 1 nobody. 2 to fill this case with reasonable doubt. 3 He's literally nowhere. Sharpie is a hole big enough The next question unanswered, who is N. Garcia? Is 4 there any connection between Matthew Keys and someone logging 5 in as N. Garcia? 6 to you beyond a reasonable doubt. 7 If there is, the government needs to prove it They haven't done that. We'll talk about what a reasonable doubt means later, 8 but I want you to obviously keep that phrase in mind because 9 that's what this case is about. This case is about reasonable 10 doubt. 11 but ultimately this is a reasonable doubt case. 12 government prove their case to you beyond a reasonable doubt? 13 And, of course, they didn't. 14 I'll discuss, you know, some other points very briefly, Did the In terms of N. Garcia, there's no N. Garcia in the IRC 15 logs. 16 information or sent any information to or from an N. Garcia. 17 And there's no evidence that anyone at all gave access to an N. 18 Garcia. 19 20 There's no allegation that AEScracked gave any And then there's anon1234 and N. Garcia, and the government never made the connection between the two. 21 I apologize for reading these slides to you, but there 22 is a record going, and the argument needs to be in the record. 23 Some slides I won't, but I understand that you guys can read. 24 25 Old usernames. Jedlinski testified that when they finally took a close look at their system, they discovered that KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 842 1 there were many valid usernames and passwords that belonged to 2 people that no longer were with Tribune Company. 3 blaming the victim, but this was not a secure site at the 4 outset. 5 of time cleaning up the system, cleaning up the system from 6 their old usernames. 7 because they had work to do that they had never done. 8 cleaning up the system, we assert, is not loss or damage within 9 the meaning of the CFAA, within the meaning of this case. 10 Old usernames. I'm not Jedlinski testified they spent a lot Not in response to the attack, but Time Before I get into jury instructions, I wanted to tell 11 you, something else. Take your time with this case. 12 wasn't an easy case. It involves a lot of technical issues. 13 It wasn't easy for the lawyers. 14 you, I would think. 15 This It can't possibly be easy for Sometimes I tell a jury don't be a Friday 4:30 jury. 16 And, you know, it's Tuesday morning. 17 what happens a lot of times is Friday at about 4:30 a jury will 18 come back with a verdict because they don't want to come back 19 on Monday, which, when you think about it being jurors, is kind 20 of a natural thing. 21 the defendant of your full consideration of the case. 22 You're not going to be -- But it deprives both the government and I would think this case is important to the government, 23 but I can assure you of one thing, there's nothing more 24 important in Matthew Keys' life than this case. 25 expect you to come back Friday at 4:30 from Tuesday morning, And I don't KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 843 1 but I do hope that you will take all the time that is necessary 2 in this case. 3 was six days of testimony. 4 verdict either way. 5 There was a lot of evidence introduced. There I don't think this is an easy Of course, I think it's a not guilty verdict on all 6 three counts, but I don't think it's an easy -- I don't think 7 it's an easy you're going to walk back there and come back in 8 15 minutes. 9 10 So let me start talking about some of the jury instructions we have. 11 The first is just because a witness or document in 12 evidence says something about the law doesn't mean it's an 13 accurate statement. 14 upon the jury instructions. 15 To determine what the law is, you may rely The judge is going to give you copies of all the law 16 that applies to this case. 17 that you have to decide this case upon. 18 jury instructions. 19 what I mean by this. 20 That is the universe of materials Don't go outside the And I'm going to show you an example of This is the e-mail from Brandon Mercer to a number of 21 different people. 22 the one to Cecilia Osborne. 23 this case unless there's $5,000 or more of actual damages 24 caused by this. 25 No? This is the other one. This is just It says the FBI cannot prosecute Your time and hourly rate counts as damages. That's an incorrect statement of the law. In fact, if KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 844 1 this statement even matters, you've already found Mr. Keys 2 guilty. 3 verdict forms, it says, do you find him guilty or not guilty? 4 And then if you found him guilty, then it comes into play 5 whether or not $5,000 is at issue. 6 completely different to do with this case than whether he's 7 innocent or -- I'm sorry -- whether he's not guilty or guilty. 8 And there's a difference between innocent and not guilty, a big 9 difference. 10 And what I mean is, when Mr. Hemesath put up the jury $5,000 has something Not guilty can mean the case wasn't proved, and that's 11 what we're asserting in this instance. 12 anything, had nothing to do with this, and we'll talk about 13 that a little bit later. 14 Innocent, didn't do But don't speculate about what this $5,000 line has to 15 do with -- you're not to consider punishment. 16 the instructions. 17 determine that beyond a reasonable doubt. 18 That will be in And even a loss of $5,000 or more, you must And, of course, I want you to call into question their 19 entire accounting process, and we're going to go over this in 20 detail why it's flawed. 21 However, it's important that Brandon Mercer thought 22 this was true, because this is the inception. This is December 23 2nd before the December 8th conspiracy dates. Brandon Mercer 24 thought this was true, and I'm going to come back to that also 25 in a little bit. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 845 1 Okay. Here's the cookie, the elements of the crime. 2 Right? 3 your ingredients. 4 However, I recognize that cookie dough is made out of certain 5 things, milk, eggs, sugar, chocolate chips. 6 build a case. 7 of the crime. 8 9 You can't have a chocolate chip cookie unless you have In my case, it's typically cookie dough. That's how you There has to be -- you have to meet the elements And the first is, in a conspiracy, there has to be an agreement between two or more persons in this case to either 10 transmit a code, transmit a program, transmit a command or 11 transmit information, and you see in even smaller print to a 12 protected computer, and I'll tell you again it's a protected 13 computer, we concede it, with the intent to cause damage to the 14 L.A. Times website. 15 So damage is the most critical question to answer in 16 this case. 17 again. 18 highlights. 19 Let's look at it. Here's the Chippy 1337 article And the yellow highlights are, of course, my There was a back-up of the data. As everyone 20 testified, it could have been -- they could go into the system, 21 click a button, and restore it. 22 did. 23 of the words weren't even changed. That's not what Mr. Hanrahan He did it from memory and also from the fact that a lot 24 However, the question is, is this damage? Did it hurt 25 this computer system in any way such that it was unlawful? KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 846 1 There was a back-up right there. Bless you. 2 It's not the question of the 40 minutes that it was up. 3 It's the question of within a few minutes of Mr. Hanrahan 4 seeing this, it was restored. 5 There is no damage. So let's talk about what damage is, and I think this is 6 from the actual jury instruction. 7 wrong. 8 data, program, system or information. 9 It's any impairment to the integrity or availability of The system wasn't hurt. 10 There was a back-up. 11 wasn't hurt. 12 I'll be corrected if I'm The information wasn't hurt. The integrity or the availability of data As I said, data was backed up and available to the L.A. 13 Times at all relevant -- all relevant times herein. 14 clearly just lawyer babble. 15 what I mean, there was a back-up. 16 There was no damage. 17 Sorry. That is During this 40 minutes is There was a button to click. This is our argument on damage. If the data was still 18 available to the complaining witness -- and by that, we mean 19 several different things. 20 Company, to what is now Tribune Publishing. 21 don't think the term "victim" applies in this case. 22 Complaining witness, they're the ones who complained about the 23 issue and got the FBI response. 24 25 To the L.A. Times, to Tribune It's hard -- I If it was still available to the complaining witness either because it was backed up or elsewhere, there is not KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 847 1 damage within the meaning of this case. 2 3 Using a username and password to download data, we assert, is not damage. 4 It's not harming a computer. And now we're talking about damage and loss together. 5 There is no loss without damage. 6 these numbers of loss based upon these hours. 7 going to go over the hours. 8 upon that. 9 there. 10 They want you to find all Again, we're They want you to find loss based There is no loss without damage. You don't get And as I said, we'll talk about loss in a minute. So here's the conspiracy, Count One. Matthew Keys had 11 to have joined the conspiracy knowing what the object of the 12 conspiracy was. 13 fuck some shit up meant Sabu and Sharpie go deface the L.A. 14 Times or do some specific illegal act. 15 So you have to decide if, quote/unquote, go In other words, Matthew had to know and agree that 16 certain people with whom he conspired -- that's from the jury 17 instruction, with whom he conspired -- were about to do certain 18 things, and he had to help them accomplish these goals. 19 Conspiracy still, conspiracy is a criminal partnership. 20 Matthew entered into a partnership with these people? 21 existence of a partnership must be to do something unlawful. 22 Did he know they were going to do something unlawful? 23 The Plus you must find that there was a plan to harm the 24 victim. Matthew didn't know what they were going to do with 25 the keys to the -- or the credentials to the Tribune. And, KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 848 1 further, it didn't appear that he cared. 2 willfulness to this, a willfulness to the act. 3 what they did. 4 conspiracy. 5 There has to be a He has to care And he didn't have the intent to further this So we go to damaging a computer, the conspiracy 6 elements of it. 7 information to a computer intending to cause damage or the 8 attempt to commit such crime was committed by someone in this 9 case, they're asserting Matthew Keys, or in conjunction or in 10 11 The crime of transmission of a command or conspiracy with Sharpie -- well, it would be Sharpie. Mr. Keys must have intentionally aided, counseled, 12 commanded, induced or procured that person to commit each 13 element of the crime, which must be proved beyond a reasonable 14 doubt, each element. 15 conspiracy charge, there still must be a plan to create damage, 16 and it's in the name of the crime, damaging the computer, the 17 conspiracy to damage a computer. We're on damaging the 18 computer, the conspiracy count. This is Count One still. 19 So while no loss has to occur in a Mr. Keys had to have acted before the crime was 20 completed. 21 doubt that Mr. Keys acted with the knowledge and intention of 22 helping someone else commit this crime. 23 Now let's turn to loss. 24 25 And the evidence must show beyond a reasonable I believe this is the jury instruction on it that you'll get. Any reasonable cost to any victim, including the cost KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 849 1 of responding to the offense -- you can read this one. 2 the heart of the case after damage. 3 decide if the computer was damaged, and then you have to decide 4 if there was loss to it. Right? First you have to 5 Look at where it says restoring the data. 6 three minutes to restore the data, three minutes. 7 This is It took They're entitled to conduct a damage assessment. We're 8 going to talk about whether that was reasonable. 9 have to be reasonable and reasonably related to the actions at 10 11 These costs hand. This is our argument, that costs unrelated to computer 12 impairment or computer damages, such as subsequent economic 13 losses unrelated to the alleged damage, are not loss within the 14 meaning of this crime. 15 from, directly flow from the Chippy 1337, it's not loss. 16 In other words, if it doesn't flow In this instance, we argue the only impairment that the 17 government has alleged is the edit to the L.A. Times website. 18 Our, again, take on this is that all of this Fox Mulder stuff 19 is nothing but a red herring. 20 isn't damage, isn't loss within the meaning of the CFAA, within 21 the meaning of this case, within the meaning of the law, within 22 the meaning of conspiracy, the completed crime of damaging a 23 protected computer or the attempt to damage a protected 24 computer, Counts One two and three. 25 It's not nothing but prejudice, So, as I said, the Cancer Man e-mails and all the time KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 850 1 spent on them cannot be counted as loss because there was no 2 impairment to this e-mail address list. 3 about an e-mail address list, but you've never seen it. 4 not been introduced into evidence. 5 it's just kind of floating out there and wasn't tied up in this 6 case. 7 They kept talking It's It's just like Sharpie, Nor was there any impairment to the content management 8 system or CMS caused by the Cancer Man e-mails. If they -- 9 there's -- there were different crimes that could have been 10 charged that were not. 11 of you. 12 intrusion case. 13 wildly different things especially under the evidence here. 14 You're not asked to decide about a trespass. 15 You're asked to decide what's in front This is not a trespass, computer trespass, computer This is a computer damage case. Those two are Misappropriation and misuse of data, we assert, aren't 16 damage or loss within the meaning of this case. 17 isn't a burglary isn't a grand theft isn't a petty theft isn't 18 receiving stolen property isn't shoplift. 19 different things, and they have different statutes. 20 in this case. 21 A robbery They are all Likewise Moreover, all of the e-mails and investigation into the 22 e-mails occurred before the intrusion into the L.A. Times 23 website. 24 25 Do not count the cost of upgrading a security system as loss in this case. It is not. Upgrading a security system is KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 851 1 not loss. 2 is loss. 3 To the government's credit, they're not asserting it However, I want to make this crystal clear. They used the house analogy. There's the keys, and 4 there's a front door, and there's perhaps a window left open, 5 which is a back door. 6 building a new house, which is what they did. 7 time related to any part of building a new house is not loss in 8 this case. 9 And then I asked Mr. Kulesza about Any portion of So let's talk again more about loss as it relates 10 specifically. 11 functionality was not impaired; it worked just fine. 12 40 website never went down. 13 down. 14 There is no interruption of services. The CMS's The Fox The L.A. Times website never went Mr. Hemesath discussed damage to the brand or its 15 integrity. 16 quantifiable number was never placed upon brand loss. 17 heard from no expert. 18 into this case. 19 That's not loss, number one. And, number two, a You There was no goodwill number introduced It's not loss. So the evidence of loss is muddled and imprecise and 20 has caused a reasonable doubt as it relates to the loss figure 21 at which the government has arrived. 22 When the witnesses logged their time as a normal part 23 of their job, did they include that as part of their hours? 24 don't know. 25 time? I And if so, how long did it take them to log their These are questions to be asked because that's the heart KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 852 1 of the people's damage. 2 numbers, which are interesting, and I'll go into that in a 3 little bit. 4 their loss calculations, but what went into that? 5 They put these inside and outside They put these inside and outside numbers into We'll talk about this again, but I want to -- when I 6 say I'm going to talk about this again, I'm mentioning things 7 twice because they're important to me, and I want to make them 8 important to you. 9 But note that all of the witnesses recorded their time 10 in these very tidy hour, half-hour increments. 11 I spent, you know, 22 minutes on this, 16 minutes on this. 12 It's all, you know, I spent 15 hours. 13 And you don't know where these things are coming from. 14 Nothing is like It was 20 hours total. To find Mr. Keys guilty, you must find that Mr. Keys 15 knowingly caused the transmission of at least one program, 16 code, command or information to a computer. 17 This is what we call the full offense. 18 conspiracy. 19 This is Count Two. This is no longer This is him damaging a computer. And then you have Count Three, attempt to damage a 20 protected computer. 21 Mr. Keys intended to transmit at least one program, code, 22 command or information to a computer. 23 must have done something that was a, quote/unquote, substantial 24 step toward committing the crime. 25 And to find Mr. Keys guilty, you must find Additionally, Mr. Keys So for Count Three, substantial step, this is the most KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 853 1 important thing. 2 count that relates to the deface of the whole front page of the 3 Chicago Tribune. 4 nonetheless it comprises one of the three counts, one-third of 5 this entire case, even though you barely heard about it. 6 This is the count -- this Count Three is the You barely heard about this during trial, but Here there was no substantial step that Matthew Keys 7 took toward helping Sharpie deface the Tribune. 8 of his own on this count. 9 Sharpie says I have this great plan. He did no act In fact, they meet up later on, and And Matthew says, oh, 10 wonderful. 11 says, if I only had known, you know, what could have been, and 12 they're locked out. 13 commission of this crime. 14 to complete this crime. 15 because they didn't actually make the try. 16 But they're locked out at that point. There's no substantial step toward the They were blocked. There was no way And it wasn't an attempt to do it Sharpie said, I could have done so much more if I knew 17 the interface at the start. 18 substantial step. 19 anything before he was locked out. 20 out by the time that Count Three came into play. 21 There was no ability for a He didn't know the interface. These are keys to the front door. 23 Mr. Keys' name. 25 He didn't do And he was in fact locked Again, these crimes were not committed in this case. 22 24 Sharpie This is not a pun on I recognize they're the same. Taking an analogy, you could have been kicked out of your office and still had the keys. You give someone your KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 854 1 keys, and they go into your old office and move desks around. 2 You're charged with robbery. 3 Are you guilty of robbery? No. That does not mean you're guilty of some other lesser 4 crime. You're not being asked to decide that. 5 asked to decide three specific crimes. 6 You're being There is no substantial step with respect to Count 7 Three. There's no damage, there's no loss, and there is no 8 conspiracy to commit specific damage or loss. 9 So we go back to -- you've seen this slide before in 10 opening -- hacking or vandalism, and what's the difference? 11 what did Sharpie do? 12 deface vandalism? 13 Is this computer hacking or is this Well, Special Agent Cauthen says, no, I consider this a 14 hack, but everyone else says this a deface. 15 difference? 16 another. 17 essentially the heart of the legal dispute in this case, but 18 think about this. 19 So what's the You know, vandalism is one thing, and hacking is And do they fit the elements for Mr. Keys? This is In terms of vandalism, someone spray-paints on the wall 20 like the picture there. 21 that says revert to back-up and put it right back the way it 22 was. 23 repainting a wall. 24 25 So Okay. You cannot click a button on your wall That's part of building a new house when you are This was a case of click and revert to back-up. Or in Mr. Hanrahan's case, he decided within three minutes to just KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 855 1 rewrite the headline, and it was back up. 2 he noticed it till when it went back up. 3 Three minutes since So, again, one thing is indisputable in this case, and 4 that's Mr. Keys is a journalist. 5 resigning -- well, I think the evidence was after resigning and 6 being fired from Fox 40, he gained access to a chat room of 7 hackers that sat around all day talking about hacktivism and, 8 you know, these ops, as they call them, that they were doing, 9 ops. 10 In late November 2010, after Matthew was writing a story about them, and he was 11 welcomed into the room for that purpose. 12 was to find out who Sabu, Sharpie and others were and what, if 13 any, capabilities that they had. 14 His personal purpose In terms of an intent to cause damage, the evidence did 15 show that two of Keys' goals as a journalist were to catch a 16 headline-grabbing story and understand Anonymous, something no 17 one had done yet. 18 only on own computer, but published in the media and given to a 19 journalist who was writing a book, were these screen grabs. 20 is are hardly the actions of a person who is guilty to take 21 their own work capturing their guilt and give it over to the 22 media for publication. 23 Screen grabs on his own computer -- and not This is a journalist trying to get a story. 24 heard that he gave logs to -- for the book. 25 someone named Adrian Chen and Gawker. It And we've He gave logs to I don't think the KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 856 1 evidence came in quite cleanly about whether he wrote his own 2 story. 3 that. 4 I think there is some conflict in the evidence about Moreover, he made a complete statement. We'll talk a 5 little bit about the statement somewhat later, but he made a 6 complete statement in this case. 7 So he purposely documents these actions, and I think 8 the evidence of Twitter kind of came in a little bit light. 9 personally documents these actions because in 2010 Twitter is 10 unreliable. 11 this or I'm signing this bill or, you know, I'll be at this 12 town hall meeting in 2010. 13 became what it is today. 14 this point. 15 You don't have Barack Obama tweeting I'm doing It was only later that Twitter Remember, this is five years ago at In fact, it's almost exactly five years ago. Because there must be proof that Anonymous exists, not 16 simply braggadocio and innuendo. 17 Twitter? 18 be whatever they want in an IRC and on Twitter. 19 journalist to get to the truth, and that's what Matthew was 20 trying to do. 21 Anyone can lie, anyone can It takes a The charge in this case really is intent to commit journalism. 23 journalism. 25 Who were these people on Who were these nicknames? 22 24 He That's what we're here for, intent to commit Once again, none of the loss at Fox 40 had anything to do with the L.A. Times, so where do the numbers come from? KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 857 1 Let's talk about that a little bit, loss. 2 Here's Brandon Mercer's improvident e-mail that you 3 should bill a thousand dollars an hour. 4 spent talking to Tribune general counsel, Charles Sennet and 5 company. 6 the e-mail. 7 we have a bunch of people on it. 8 9 Legal costs aka time Mr. Sennet's e-mail or name is on the "to" line in Sennet responded, as you'll recall, don't worry, They don't count as CFAA loss. They don't count as loss within the meaning of Counts One, Two and Three. And, 10 again to the government's credit, they don't assert they do. 11 They're clearly not reasonable. 12 Loss, take a look at that "to" box. So the first thing 13 is to KTXL news managers, all of them. 14 number of other people, including Jason Jedlinski, Sam Cohen, 15 Jerry Del Core, and Charles Sennet cc'd to this e-mail. 16 And then you have a It says maintain very accurate logs. Were very 17 accurate logs maintained in this case? If you spend two 18 minutes on something, do you get to put down an hour? 19 seems to be what they were doing. 20 He gives them an example. 21 11/30, 4:00 to 6:00 p.m., e-mailing back, coordinating That Let's look at this example. 22 with Chuck, Troy, Andy, Jason and Sam. 23 hours for that. 24 coordinating with the newsroom. 25 mean? He gives himself two An hour and 45 minutes, e-mailing back and First of all, what does that Second of all, is it reasonable? Third, how long does KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 858 1 it take to send an e-mail? What was this e-mail? 2 giant, long e-mail that looks like it would have taken over an 3 hour to write? Do you know? Was this a Did you see the e-mail? No. 4 And then, of course, you have the truth of the matter, 5 which is that, by his inflated numbers, the loss to Fox 40 was 6 $3,583.91. 7 a regular part of the Fox 40 employees' jobs to log time as it 8 relates to responding to someone's e-mails. 9 these numbers are rapidly expanding. 10 They're running up numbers in this case. As you can see, What's the best -- well, what's the second best example 11 of this? 12 the last witness, hopefully fresh in your mind. 13 It's not Yesterday. Oh, sorry. Yesterday. Jerry Del Core, He testified that his hours were somewhere between 15 14 and 20 responding to this incident. 15 government a week ago. 16 redirect they steered him to what he only discussed a week ago, 17 which was on the inside what are your reasonable hours? 18 He had met with the Again, to the government's credit, in Seven. If government wasn't honest about this, what you would 19 have had for evidence was 15 to 20 hours at Jerry Del Core's 20 $275,000 salary. 21 to ask if Jerry Del Core, with his inflated numbers, is the 22 typical witness in this case. 23 hours this way? 24 25 Quite a difference, isn't it? And did everyone keep their I understand the make-up of my jury. pick on Sam Cohen. And you have I do not seek to I recognize that she made half what anyone KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 859 1 else, even the lowest salaried of the men called in this case 2 made. 3 precise data to show you the discrepancies between reported 4 time and actual time. However, she is the only witness for which we have 5 So, first things first, even before we get to that, Sam 6 Cohen, while she was in her down time, could have done other 7 duties, could have used other users' accounts. 8 back. 9 gave no reason why she couldn't do that. 10 Other duties, updating the Facebook and Twitter, she Those credentials are totally separate from the CMS. 11 She could have used other people's access. 12 testified she didn't want to do that. 13 loss grossly. 14 She And she overstated her Her computer was down for a few hours total. Now, believe me, I'm not trying to pick on her as 15 opposed to anyone else. 16 evidence on Ms. Cohen. 17 going to come back to the jury room with you. 18 e-mails. 19 Well, let's go However, I'm going to go into the hard You have it. It's in evidence. She testified to 40 hours of loss. It's These are On December 6th, 20 she was down from 10:05 to 11:09, including a period where she 21 had access from 10:15 to 10:50. 22 from 11:19 a.m. to 1:28 p.m. 23 down from 11:05 to 11:18. 24 Even with that time on day one, including the 10:15 to 10:50, 25 35 minutes, your total is two hours and 51 minutes. December 8th, she was down And on December 14th, she was She testified to 40 hours of loss. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 860 1 This is why you should find Mr. Keys not guilty. This 2 isn't an issue of $5,000. 3 reasonable doubt. 4 evidence, and this is evidence that is unreliable to the point 5 it should be disregarded. 6 two hours and 51 minutes is stunning. 7 This is an issue of proof beyond a This is sloppy. This is not proper The difference between 40 hours and And even at her salary of $50,000 a year, it works out 8 to $72.09. She testified to a full workweek. 9 $50,000 is close to a thousand dollars. 52 weeks a year, It's nine hundred 10 something dollars. 11 something dollars and $72.09 in this case is staggering. 12 it doesn't go to loss. 13 Pardon me. 14 Okay. The difference between nine hundred and And It goes to reasonable doubt. I'm going to argue some different things to you, 15 and it starts out with not so important, but -- and it really 16 isn't that important to us, but I think I'd be remiss if I 17 didn't bring up these points. 18 There are a number of things that we could have argued, 19 that we could have really gone into in this case that would 20 make Matthew Keys the person who didn't do the alleged acts at 21 all. 22 doubt case. 23 We didn't really go there because this is a reasonable It isn't a whodunit. While we're not relying on this, we do want to point 24 certain things out. As I said before, we're relying on the 25 fact that the government failed to prove its case beyond a KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 861 1 reasonable doubt to you. 2 We're going to come back to the other witnesses in just 3 a second. 4 Sam Cohen, but I felt this was a good time to talk about other 5 things. 6 raise these issues just because they were hanging out there. 7 8 9 I'm not only going to talk about Jerry Del Core and So is it important for you to decide? Again, did Matthew do this? there was no loss or damage. I wanted to It doesn't matter because They didn't prove their case. For example, I asked both Mr. Kulesza and Agent 10 Cauthen, can you lock a nickname or reserve a nickname such 11 that other users couldn't have used it? 12 No one knew in that chat room whether you couldn't do it. 13 The answer was yes. Multiple pieces of traffic came through the same 14 Internet protocol or IP address on that VPN. 15 number of people through it, not just Mr. Keys, but Agent 16 Cauthen was strident that it was Mr. Keys. 17 They routed a Special Agent Cauthen admitted to editing a chat log. 18 These could have been edited. 19 think he'd do that, but these came from a computer in Ohio by 20 some guy named Owen. 21 Not necessarily by him, I don't Who knows what Owen did. RAT, computer type rat, a remote access trojan. It's a 22 piece of software that goes on your computer where someone can 23 remotely access it and execute commands. 24 or had it -- had it occur to you. 25 know, Microsoft, and you just bought their office suite or Maybe you've seen it You have a problem with, you KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 862 1 something like that. 2 and there's a little program -- 3 4 MR. SEGAL: now, Your Honor. You can call up for technical support, Objection, this is outside the evidence I've been -- 5 THE COURT: 6 MR. LEIDERMAN: 7 There's a way to get into desktops. There's also an issue of stolen Wi-Fi, which we discussed. 10 You can say that the remote access trojan doesn't 11 matter because there's a statement in this case. 12 go into the statement, the written statement. 13 Well, let's Agent Cauthen, I didn't tell him what to write exactly, 14 meaning he did suggest what to write in part. 15 want to hear. 16 Tell me what I Agent Cauthen said when he felt that Mr. Keys was not 17 on track, he would, quote/unquote, stop and put him back on 18 track. 19 the story out of Matthew that he wanted, not the one that 20 Matthew wanted to tell. 21 22 23 Or there's a way to get into computers. 8 9 Sustained. He said this because he wanted to make sure that he got Cauthen testified that the whole statement was two hours, and you only heard snippets, maybe 20 minutes total. And there's a timeline. In March 2012, some Anonymous 24 indictments were unsealed. It was only after March 2012 that 25 it was known the true capabilities of some of the people in the KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 863 1 Internet Feds chat room. 2 evidence, but it wasn't by the government. 3 don't know what Sharpie's capabilities were. 4 what Sabu's capabilities were. 5 people that Mr. Keys interacted with. 6 Now this could have been brought into And, again, we We don't know And those were the only two And, of course, Matthew's statement happened after 7 March 2012; it was in October 2012. So he had, by the time of 8 the statement, the benefit of the knowledge of what everyone 9 had done, who everyone was, what their real names were, what 10 their real jobs were, things like that. 11 evidence showed that Mr. Keys did not have the knowledge that 12 he needed to have regarding whether Sharpie could do any 13 computer damage, and it wasn't proven to you. 14 So we believe the And then there's mental state, and this was the quote 15 from Mr. Keys regarding whether he would write a statement 16 for -- the written statement for Agent Cauthen. 17 I don't know that right now I'm in the state of mind 18 where I can -- and it's not because I don't want to, it's 19 because I want to be cognizant of any event. 20 21 And the evidence was somewhat peripheral about what medication he was on, but there was some medication -- 22 23 MR. SEGAL: again. Your Honor, this is outside of the evidence The agent didn't -- 24 THE COURT: Overruled. 25 MR. LEIDERMAN: Again, we're not relying on this, but I KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 864 1 do want to point out that there is more to this case than just 2 reasonable doubt that the government failed to meet its burden. 3 Then there's the IP address, and I think this is more 4 important than the other stuff because the government is 5 relying heavily upon this. 6 An IP is a numerical string that identifies the origin 7 of a computer connection. The IP address 75.53.168.11, or what 8 they called the 75.11 address, was said to have connected to 9 the proxy when the username and password was handed over in the 10 IRC. 11 well, who the 75.11 IP belonged to. 12 The government did not prove that the IP 75 point -- The evidence shows an IP is like a phone number, it 13 helps identify a computer connected to the Internet. 14 government says 75.11 was connected to a proxy server that was 15 identified as Internet Feds on December 8th, 2010, and was the 16 IP address of a user who passed a username and password in the 17 Internet Feds chat room. 18 The He testified that the IP address geolocated to 19 Sacramento, and so there was enough to make a connection to 20 Matthew Keys. 21 of thousands of Internet users in Sacramento, and that IP 22 address can belong to any of them. 23 acknowledged getting IP addresses from AT&T showing Matthew 24 Keys' home address, that record was not for the 75.11. 25 But there are tens of thousands, if not hundreds And while John Cauthen Cauthen testified that he was unable to get any record KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 865 1 from AT&T on 75.11, and so why is that important? 2 the date range. 3 until December 12th, after the credentials are passed. 4 75.11 does not match up, in fact, to the passing of credentials 5 at Matthew Keys' address. 6 Well, it's The next IP address doesn't come into play So the Another thing on IP addresses, there is no way to link 7 Matthew Keys to the 75.11, which is the IP the government 8 associates with the Tribune Company system intrusion. 9 line, you can't link Matthew Keys to that IP address. Bottom 10 Remember, he had a static IP address, one that didn't change. 11 And Cauthen didn't go get those logs, didn't go get those -- 12 didn't go get that from AT&T. 13 So, again, is any of this important? It's not so 14 important to us if you think he did this or didn't do it. 15 isn't that type of case. 16 of proof case, so let's get back to that. 17 18 THE COURT: know. It isn't a whodunit. It It's a failure You're coming up on one hour, just so you You asked to be advised. 19 MR. LEIDERMAN: Thank you. 20 THE COURT: 21 MR. LEIDERMAN: 22 Armando Caro, he testified to 40 hours responding to You're almost 59 minutes. Okay. Thank you. 23 the breach and then, quote/unquote, 20 more hours. He didn't 24 specify it, just, quote/unquote, 20 more hours. 25 this was, as they use in the house analogy, locking the door How much of KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 866 1 and how much of it was building a new house? 2 Notice how round the numbers are? It's like he broke 3 his time into full workweeks and half work weeks, and there was 4 nothing more. 5 Sam Cohen. 6 reasonable doubt. 7 This is just like Del Core. This is unreliable. This is the essence of Moreover, this door versus rebuilding the house analogy 8 was undifferentiated at trial. 9 Mr. Caro was relocking the door? 10 This is just like portions of a new house? 11 How much of this with regard to How much of this was building You don't know. Remember, Dylan Kulesza testified that they did in fact 12 build a new house. 13 upper management to agree that we needed these upgrades, and 14 they started making the upgrades. 15 these hours happened over months, which is consistent when the 16 upgrades were -- were put in. 17 do you trust this estimation of hours in light of Del Core and 18 Cohen? 19 Finally -- I think he said finally we got And Caro testified that So ask yourself this, how much Dylan Kulesza -- and I added up all his hours -- said 20 he spent 32 to 58 hours on the response. 21 than the response. 22 reliable? 23 Actually he said more His salary is a hundred and five. Is this Is it reasonable? Jason Jedlinski, he testified -- and this is the Del 24 Core again -- 15 hours. It's like this arbitrary figure yanked 25 out of thin air, 15 hours responding to Chippy 1337 or Chippy KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 867 1 leet, at a salary of $170,000 annually. 2 Tim Rodriguez testified to 50 hours at a salary of 105. 3 Here's what is interesting about Mr. Rodriguez. 4 that he finished the analysis on January 25th, 2011. 5 have to ask was a full month investigation reasonable, 6 reasonably related for an edited title that stood on the 7 Internet for 40 minutes? 8 it reasonable? 9 He testified So you It was fixed in three minutes. Was Was any of this reasonable? This is the meal the government has served you in this 10 case, and the question is, do you want to eat this meal, eat 11 this meal being find beyond a reasonable doubt he's guilty. 12 Would you eat this meal, should you eat this meal, was this 13 meal fit for human consumption? 14 proper for the government to put on this evidence and get a 15 guilty verdict? 16 case? Then, again, is this right and Would you eat it? Would you convict in this That's the real question. 17 This evidence has a truckload of holes in it, and this 18 is all the government has served you. 19 kitchen. 20 to eat, that's the universe of materials for you. 21 heard at trial is all you get. 22 you've heard, that's it. 23 They put it all out for you. That's the whole That's -- that's what What you What's in the exhibits, what There are too many open parts of this case to convict 24 Matthew Keys beyond a reasonable doubt. 25 This -- it's absolutely inedible. And would you eat it? It's full of reasonable KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 868 1 2 doubt. One of the other things to consider, there is no expert 3 put on in this case. 4 expert witness on loss and damage to prove their case to you. 5 They could have gone through logs. 6 he go through Tribune Company salary logs, tax returns, 7 anything like that, where it would actually prove salaries that 8 people are trying to remember from five years ago, that it 9 would actually prove hours worked from Tribune Company. 10 The government could have brought in an I asked Agent Cauthen did You remember they went over every log with respect to 11 Matthew Keys, but they didn't go over any logs with respect to 12 what Dylan Kulesza was doing, with respect to what Armando Caro 13 was doing, Armando Caro, who broke his time to into week and 14 half week increments. 15 And when you look at Sam Cohen's actual hours compared 16 to the week that she estimated, it calls into question 17 everything. 18 hours, calls everything into question. 19 they needed an expert to prove loss to you in this case. 20 Del Core, the 15 to 20 hours versus the seven Damage and loss. We submit to you that Is it reasonably foreseeable to 21 expect someone to restore the article quickly and maybe do some 22 checking to make sure that the door lock is functioning 23 properly? 24 25 Yes, of course it is. That was Mr. Hanrahan. It's not reasonably foreseeable that the Tribune Company would have to clean up their entire system because it KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 869 1 was a mess and to charge that tab to Mr. Keys. 2 differentiation between response times and upgrade times in the 3 testimony. 4 There was no This is in and of itself reasonable doubt. Mr. Keys didn't testify. He has the absolute 5 constitutional rights not to testify. And as we said, this is 6 a reasonable doubt case. 7 government's case when choosing not to testify. 8 to testify. 9 loss and damage in this case. He relied on the state of the He didn't need The government didn't prove to you that there was They didn't prove to you that he 10 took a direct and substantial step toward the completion of an 11 attempt. 12 willfully engaged in a conspiracy with these people. 13 They didn't prove to you that he knowingly and Circumstantial evidence. Evidence may be direct or 14 circumstantial. 15 as testimony by a witness about what they saw or heard or did. 16 Testimony by Mr. Mercer that he and Mr. Keys had an argument in 17 the newsroom is direct testimony. 18 that she was locked out of her account was direct testimony. 19 Direct evidence is direct proof of a fact such Ah, testimony by Sam Cohen Circumstantial evidence is indirect evidence. It's 20 proof of one or more facts from which you may find another 21 fact. 22 prove another to prove another is circumstantial evidence. 23 What Agent Cauthen did with relying on one thing to What do you do with circumstantial evidence that has 24 two reasonable interpretations, one pointing to guilt and one 25 pointing to innocence? Here's the animation of that. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 870 1 So one points to guilt, and one points to innocence. 2 We suggest the way to use circumstantial evidence, the way to 3 use circumstantial evidence is you reject that interpretation 4 which points to guilt, and you adopt that interpretation which 5 points to a lack of guilt, not guilty, not necessarily 6 innocent. 7 don't think that matters. 8 9 Again, I don't think it's an innocence case. I But when there are two reasonable interpretations of circumstantial evidence, he is entitled to a reasonable doubt 10 on circumstantial evidence. 11 entitlement to a reasonable doubt that which points to guilt 12 and adopt that which points to a lack of guilt. 13 Burden of proof. You reject, then, based on the The government bears the burden of 14 proving every part and subpart of the crime, including the two 15 parts I just mentioned over and over and over again, damage and 16 loss. 17 It's not our job to prove anything to you in this case, and the 18 judge will affirm that. 19 You can't have loss without damage. Remember that. Hold the government to their burden of proof. They 20 have to show you that Mr. Keys took a substantial step with 21 respect to a deface of the entire Chicago Tribune front page. 22 Mr. Keys didn't even know about it. 23 Sharpie tells him after he couldn't do it. Oh, well, 24 you know, I wish I knew the CMS system, I would have done this. 25 That's not a direct substantial step toward the completion of KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 871 1 2 that crime. That's not guilty on Count Three. There's no damage related to the X Files e-mails, the 3 Fox Mulder, the Cancer Man. 4 And it's the wrong charge. 5 damaging a protected computer. 6 Reasonable doubt. 7 Okay. There's no damage related to that. That's a trespass. It's not Pardon me. This is -- again, I cut a line or two out, but 8 this is the instruction that you're going to have back there. 9 I cut a line or two out to make sure that you pay attention to 10 the instruction that the judge gave you and not specifically 11 what's up on the screen. 12 complete, but make sure you get the one that is 100-percent 13 complete. 14 Most -- this is, I think, 98 percent Proof beyond a reasonable doubt is proof that leaves 15 you firmly convinced the defendant is guilty. Let's talk about 16 that, firmly convinced. It's a kind of 17 nebulous concept, firmly convinced. 18 things, but it's the highest burden, it's the highest standard 19 we have in law. 20 What does that mean? It can mean a lot of They use proof beyond a reasonable doubt in a death 21 penalty case, to kill someone. Proof beyond a reasonable doubt 22 is not -- I believe some of you have served on civil juries. 23 It's not this 51-percent standard where it's just a little more 24 than not. 25 convincing which they consider about three-quarters proof. There's a standard in law called clear and KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 872 1 What is beyond a reasonable doubt? It can't be 2 quantified, I mean, is it 98 percent, is it 99 percent sure? 3 It can't be quantified. 4 you can wake up 10 years from now, 20 years from now, 30 years 5 from now knowing you did the right thing in this case. 6 But you need to be sure, so sure that Computers are changing overnight. The new iPhone just 7 came out. 8 sure Samsung is going to doing something to counter the new 9 iPhone, and there you go, and we have this wonderful digital 10 11 There will be another new one next year, and I'm revolution going on right now. This case is five years old. 12 excuse me. 13 losing my voice. 14 The events that have -- I guess it's that point in the trial where I'm Pardon me for that. Things are changing so rapidly that this case is 15 fraught with peril. 16 necessarily translate to today, so you have to look at this 17 evidence through the eyes of five years ago. 18 Something from five years ago doesn't What was known in this chat room? 19 question, what, five times now? 20 It could have been answered in this case. 21 We didn't put on a case. I've asked you that It's because it's unanswered. It wasn't. We stood on our evidence 22 because there is reasonable doubt. We didn't -- we didn't put 23 on a case. 24 case because the government didn't prove to you what they 25 needed to prove to you. Don't hold that against us. We didn't put on a They didn't bake you a chocolate chip KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 873 1 cookie. 2 They didn't have all of the elements. 3 They did something that fell short of the cookie. And that's why I think this case is going to take you a 4 little while. These jury instructions, not constructions, jury 5 instructions are -- they're thick, they're dense. 6 evidence was -- there was a lot of it, and a lot of it was very 7 technical. Everyone did a really good job staying awake the 8 whole time. There was a lot -- it was -- it was difficult 9 going through all of those logs. And the It was difficult for us. 10 can't imagine how difficult it was for you. 11 through those logs in painstaking detail. 12 they even matter when someone logged in, when someone logged 13 out? 14 I But they went And, I mean, did You're talking about e-mails from Cancer Man that are 15 irrelevant in the nth degree. You're talking about a deface to 16 a website that took three minutes to correct. 17 about a company that had to go back and clean out all of the 18 old usernames and passwords that were still live for employees 19 that had long since been gone. 20 these things. 21 doubt. You're talking You're talking about all of Those things, when put together, are reasonable 22 Take a look at the instructions. Take a look at the 23 instructions for the substantive crimes. 24 crimes, I mean Count One, the conspiracy, Count Two, the 25 damaging a protected computer, and Count Three, the attempt. By substantive KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 874 1 Did Mr. Keys conspire to do something? Did he tell 2 Sharpie, you know, go hit this article? 3 it's reliable, he said -- I hate to keep repeating it, but he 4 said go fuck some shit up. 5 specific thing? 6 decide. 7 The evidence is, if Is that a specific plan to do a Is that a conspiracy? That's for you to I talked a number of times about a substantial step, 8 and I can't talk about it enough. Even if it's driving you 9 nuts, I can't talk about it enough because there was no 10 substantial step taken in the attempt. They were locked out by 11 the time that Sharpie talked to Mr. Keys about, oh, I was going 12 to do this deface of the Chicago Tribune and, you know, I 13 couldn't. 14 Chicago Tribune. I was going to put the Anonymous flag up on the 15 The second part of this is, it's not required that the 16 government prove guilt beyond all possible or imaginary doubt. 17 I think I talked to you a little bit about this in opening. 18 Martians did it. 19 nothing can be proved to a scientific certainty because even 20 that is subject to some kind of doubt. 21 be reasonable. 22 and what is not reasonable in this case. 23 You know, magic happened. I'll stipulate The doubt just needs to It's for you to determine what is reasonable But reasonable, look at all the things I've pointed 24 out. There is so much doubt in this case on an article that 25 was fixed in three minutes. They're asserting $20,000 worth of KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 875 1 2 damage -- or worth of loss? They're asserting damage? Again, it's not spray-paint all over the wall of the 3 house such that you need to build a new wall. 4 have restored this. 5 it was quicker, based on what was going on in the newsroom, to 6 just rewrite the title. 7 That's the testimony. Three minutes. More on reasonable doubt. One click would Mr. Hanrahan felt Up for 40 minutes. Reasonable doubt is doubt 8 based on reason and common sense and is not based purely on 9 speculation. 10 11 It may arise from a careful and impartial consideration of all the evidence or from lack of evidence. Well, that's what we have been talking about this whole 12 time, consideration of the evidence. 13 with the evidence, and all of the lack of evidence in this 14 case, the thing that wasn't -- who is Sharpie? 15 matter, who is Chippy? 16 All the problems For that I mean, front and center in this case is Chippy 1337 is 17 elected house leader. 18 answer that question for you. 19 at the heart of the case. 20 What do they mean? 21 Right? Who is Chippy? They couldn't even No one could, and that's right Who is Chippy? Who is Sharpie? What are their capabilities? And keep in mind that this doubt based on reason and 22 common sense, it goes to each and every portion of the 23 instructions. 24 different parts that you need to find to find a conspiracy. 25 will tell you -- or to find damaging a protected computer. So, for example, I think there are three It It KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 876 1 will tell you, you know, one, two, three. 2 these three things. 3 chocolate chips, eggs, flour and milk to get a cookie. 4 5 6 You have to find Those are the elements, those are the Obviously I don't know how to bake a cookie. I hope I'm right on the ingredients. Every piece has to be proof to you. If you find that 7 part one is true and part -- or part one was proof beyond a 8 reasonable doubt and part two was proof beyond a reasonable 9 doubt, but instruction part three you have a reasonable doubt 10 11 about, that means not guilty. That's what that means. And finally, the last part of the reasonable doubt 12 instruction, if after a careful and impartial consideration of 13 the evidence, you are not convinced beyond a reasonable doubt 14 the defendant is guilty, it is your duty to find the defendant 15 not guilty. 16 as he sits there right now, before you've had a chance to 17 deliberate, he's entitled to a not guilty verdict. It's your duty. He is entitled to it. In fact, 18 Everyone comes before you not guilty. It is unless and 19 until the government proves their case to you beyond a 20 reasonable doubt that you can check that box of guilty and then 21 move on to whether this was $5,000 worth of loss, which, again, 22 you have to find beyond a reasonable doubt. No matter how they 23 got here, they stand before you not guilty. It's only through 24 proof beyond a reasonable doubt that they can become guilty, 25 and that's not present here. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 877 1 Don't speculate on what Mr. Keys is doing in that seat. 2 Don't think that there must be some reason he's there; 3 therefore, I'm going to vote guilty. 4 This is a federal case. 5 Otherwise the government wouldn't, you know, have a table of 6 five or six people trying this case. 7 know, three or four people over at defense counsel defending 8 this case. 9 Well, he's in court. He must have done something illegal. There wouldn't be, you In other words, Mr. Keys is entitled to a not guilty 10 verdict unless and until the prosecution satisfies every 11 element beyond a reasonable doubt. 12 only through proof beyond that very lofty burden, that very 13 lofty standard beyond a reasonable doubt, that he can leave 14 here any different than he came here, not guilty. 15 Let's look at this. 16 hope everyone can see it all right. 17 He's not guilty, and it's This is kind of an escalator. I Just take a look. Not guilty, that's at the bottom. Right? You have 18 other things that should go into your mind in terms of -- in 19 terms of what is proof beyond a reasonable doubt, and this is 20 just some help for you to do that. 21 So not guilty. It's unlikely that he's guilty. That's not guilty. 22 is likely that he is guilty. That's not guilty. 23 guilty. Possibly he is guilty. 24 not guilty verdict. 25 guilty verdict. That is not guilty. Probably he is guilty. It Maybe he is That's a That is a not KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 878 1 Probably is not proof beyond a reasonable doubt. It is 2 only proven beyond a reasonable doubt, you don't have any 3 doubts. 4 probably -- probably is probably -- probably is probably the 5 biggest challenge for the defense because a lot of juries think 6 that probably is good enough. 7 distinguish between probably and beyond a reasonable doubt 8 because probably means I think there's a lot there. 9 I'm pretty sure that he did this. 10 Probably is still some doubt, and probably is And this is -- it's so hard to I mean, But pretty sure isn't beyond a reasonable doubt. 11 If there is any sort of doubt in your mind, besides 12 like the Martians did it, this was magic, this was, you know, 13 something not permissible, if there is any doubt in your mind, 14 even probably, even likely, evenly highly likely, that's 15 reasonable doubt. 16 That's reasonable doubt. You have to be firmly convinced. Firmly convinced is 17 your operative phrase, and I'm going to skip this slide. 18 Again, what does firmly convinced mean? That's for you 19 to decide. Sometimes reasonable doubt is a feeling. It's a 20 feeling that they just haven't proved their case. 21 isn't enough evidence. 22 a doubt because I'm missing this piece of evidence, I'm missing 23 that piece of evidence. 24 quite what it was supposed to do. 25 case. There just They're just missing something. I have This piece of evidence doesn't do That's what we have in this KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 879 1 I'm not sure if this is an instruction that you're 2 getting now, but this is an instruction that you got at the 3 beginning of the case. 4 are to be treated as equals. 5 entitled to a verdict of not guilty until and unless they're 6 proven guilty beyond a reasonable doubt. 7 nation stand before you not guilty. 8 speculation that a charge or an investigation or an arrest 9 makes someone guilty. 10 All persons stand before the law and proven reasonable doubt. 12 already? 13 that's the sum of this case. 15 16 17 18 19 20 All humans in this There is to be no Matthew is entitled to acquittal unless you find guilt 11 14 That means that all persons are I've said that, what, 20 times That is what this case is about. That's the whole -- The chocolate chip cookie was never baked in this case. We don't even know who Chippy is. Thank you for your time. I ask you to please find Matthew Keys not guilty. THE COURT: All right. Ladies and Gentlemen, that concludes the defense closing argument. We'll take another break now. I believe when we come 21 back you'll hear rebuttal from the government and then my 22 instructions. 23 concluding time. 24 25 And we'll be close, if not there, to our So, during this break, remember all of my admonitions. Have a good break. We'll start up again in 15 minutes. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 880 1 (Jury not present.) 2 THE COURT: 3 seconds, just so you know. All right. That was 91 minutes and nine 4 How much time do you estimate on rebuttal, Mr. Segal? 5 MR. SEGAL: I'll probably use what we have left, Your 7 THE COURT: The entirety of it? 8 MR. SEGAL: I mean, I'm not sure -- 9 THE COURT: If that's the case, I'm just not certain we 6 10 Honor. have time then for the instructions today. 11 MR. SEGAL: Oh. 12 THE COURT: So you're clear. 13 MR. SEGAL: Well, I'll bear that risk. 14 I'll do my best, Your Honor. 15 THE COURT: All right. If we don't get to instructions 16 today, then we'll have to figure out timing in the morning. 17 they don't want to come in until 9:00, I have criminal calendar 18 at 9:00. 19 20 MR. SEGAL: If How long will it take to instruct them do you think? 21 THE COURT: 20, 30 minutes. 22 MR. SEGAL: Well, I'll see if -- 23 THE COURT: Think about that. 24 MR. SEGAL: I'll try to wrap up before -- I'll try to 25 wrap up as fast as I can. I'd like to instruct them also. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 881 1 2 3 4 5 6 7 8 9 10 THE COURT: If I could start by 1:00, that would be All right. 15 minutes. ideal. (Recess taken.) THE CLERK: Please remain seated and come to order. Court is now back in session. THE COURT: All right. Let's bring the jury in. (Jury present.) THE COURT: You may be seated. Welcome back, Ladies and Gentlemen. We'll now move to 11 the government's rebuttal. It has the right to a rebuttal and 12 has some time reserved for that, and so Mr. Segal is going to 13 handle that portion of the government's closing. 14 Mr. Segal. 15 MR. SEGAL: 16 Good afternoon. 17 So the function of this jury address is just as it Thank you, Your Honor. 18 sounds, it's rebuttal. 19 were said in the defense closing claiming that we have not met 20 our burden of proof. 21 And so what I'm going to focus on a lot are -- excuse me -- two 22 things, the evidence that we've shown and the actual elements 23 of the offense. 24 25 It's to address some of the things that And so -- on the elements of the offense. And I urge you -- I'll come to this later -- when you think about the elements of the offense, look at the jury KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 882 1 instructions. 2 side put up. 3 at the jury instructions, it's possible that the defense has 4 asked you to return a not guilty verdict based on some things 5 that aren't on the slides, and so I want to show you that. 6 Don't try to remember the slides that either Because, as I'll show you, once you actually look First, it was asked -- it was asserted in the defense 7 closing that it wasn't known what was in the chat room. 8 knew what was going on in there. 9 10 Nobody Matthew Keys knew. Let's play Government Exhibit 211, please, and start at 25 minutes and 7 seconds. 11 (Audio recording played, not reported.) 12 MR. SEGAL: So he knew. 13 guys were about. 14 most damage. 15 and the magnitude of the scale. 16 Matthew Keys knew what these They could -- they were the people doing the They had no regard for any kind of consequences And so what did he do? He gave them log-in credentials 17 to the L.A. Times -- excuse me -- to the entire Tribune 18 Company's content management system and gave them instructions 19 to go mess stuff up. 20 That's what he did. Then after, after Sharpie says in the chat log, we're 21 in. Right? And you'll see that in Government 611. 22 ahead and gives him tech support. 23 where in the Assembler log you can edit usernames, you can 24 change content, scroll down here. 25 He talks not just about using the anonymous -- the anon1234 Right? He goes He says this is And tells them to do what? KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 883 1 password, but he talks about building back doors. 2 You heard Dylan Kulesza, the gigantically tall guy, 3 testify about an actual line of code that he recognized. 4 says that is building a back door. 5 to the integrity of the system. 6 that is what is obvious. 7 Right? He And that is damage This is what they said, and Right? If a guy break into your house, say keys into your 8 house and then cuts a bunch of, you know, extra doors in the 9 house, that's damage. 10 That's damage. The integrity of the system is compromised. 11 And almost all of the incident response that you heard 12 about -- this house metaphor didn't come out of nowhere. 13 came from Matthew Keys. 14 15 It Right? Let's play Government Exhibit 212, please. (Audio recording played, not reported.) 16 MR. SEGAL: And there's another metaphor that he gave 17 the agent where he says it is as if I'd been the night manager 18 of a warehouse, and I was supposed to lock up, but they never 19 took the keys from me. 20 gang and gives them the keys and says go jack stuff up. 21 People he knew were malicious, knew were interested in doing 22 other things, knew could cut back doors. 23 them how to cut back doors, and he wants to say that's not 24 damage, and he wants to say that he didn't know what he was 25 doing? So then he finds this basically street Right? In fact, he tells KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 884 1 I mean, this is an extraordinary case, Ladies and 2 Gentlemen, because not only can you see the conspiracy from the 3 concert of action from everybody doing -- everybody acting 4 together towards a common goal, but you actually have -- it's 5 almost like having a tape recording right there in the 6 conspiratorial meeting because they were doing it over IRC, and 7 somebody who wasn't criminally sophisticated enough logged it, 8 and we can see it. 9 they are agreeing. 10 Right? You can see the actual words while And read that instruction, it's not -- it's not yes -- 11 the word "agree" doesn't have to be used. 12 can see this in the concert of action, we're in. 13 mess stuff up. 14 conspiracy. 15 We're in. You know, but you Here's more help. You know, go That's a Now I want to address right now something that, again, 16 was said with reference to a power point slide, but not the 17 jury instructions. 18 the attempt. 19 substantial step, you haven't seen any evidence of a 20 substantial step. Think about Count Three. Count Three is Now it's been argued that there wasn't a That's just not true. 21 Let's look at Government Exhibit 507, please. 22 507 is a screenshot taken from Matthew Keys' electronic 23 media. Right? Where he's saying -- they've told him what 24 they've done, and he's looking for other users and passwords he 25 created while he's there. Let me see if there's still another KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 885 1 good back door. 2 3 Let's go -- let's go to the next one, next page, please. 4 And he's locked out for good. Right? And all the 5 while, this man, who says that he was acting as a journalist, 6 is trying to help some anonymous, you know, hacker, whose 7 street name -- who only goes by his street name, not by a real 8 name -- that's not evidence that is good for the defense, 9 that's evidence that's good for the government -- he's trying 10 to help him get back into the CMS. 11 page layouts all across Tribune properties. 12 what they're talking about. 13 To do what? Put up front Okay. So that's And so you have, was there a substantial step taken? 14 Are they doing -- is Keys really taking that substantial step 15 to get him, to get Sharpie back in? 16 about. 17 That's what he's talking And, in fact, yes. Let's look at Government Exhibit 307. This was 18 testified about by Special Agent Cauthen. 19 to read there, but you'll see the command -- here are the 20 commands coming in from Overplay at -- and I think this one, 21 the times are even correct without an offset by hours. 22 That's what is happening during that chat log 23 conversation. 24 to IPs that he's using right then. 25 And it's too small He's transmitting those commands that trace back Now, the defense makes -- wants you to think, well, KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 886 1 nothing could have happened and, therefore, it wasn't a 2 substantial step. 3 Right? 4 required success, the charge wouldn't be attempt, it would be a 5 charge of a completed crime. 6 did. 7 But that's not what substantial step means. A substantial step does not require success. He did something. If it That's what he It says mere preparation is not a substantial step. To 8 constitute a substantial step, his act or actions must 9 demonstrate that the crime would take place unless interrupted 10 by independent circumstances. 11 were too good. 12 back in, you know that would have happened because they -- 13 because they had already done it once already but to less 14 severe consequences. 15 Well, the system administrators If Keys had been successful in getting Sharpie And just as long as we're on Count Three, we'll talk 16 about the loss in Count Three. 17 instruction, it says would the loss have been $5,000 or more if 18 the crime had been completed? 19 figure out how much it's worth except what the witnesses from 20 the paper said. 21 You know, when you see the loss You know, it's a little hard to You know what the loss would have been? More. More. 22 More. I mean, if you put up entire front page layouts for all 23 the Tribune properties, that is a greater harm than what the 24 defense has sought to minimize by saying, oh, it was just a 25 single edit to a single story that nobody saw. That would have KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 887 1 2 been an even bigger deal. Now, the defense kind of makes a sleight, though, at 3 contesting identity. 4 access trojan. 5 such things exist, and I think he said, well, anything is 6 possible. 7 They say, oh, it could have been a remote Because you heard testimony from the agent that You know, reasonable doubt is not -- you'll get an 8 instruction on it. 9 speculation. It's not supposed to be based on pure And I will argue to you, Ladies and Gentlemen, 10 that if this were a remote access trojan, it really would have 11 to be the most cunningly written, magical remote access trojan 12 ever invented known to man or woman. 13 Because it not only had to execute the e-mail campaign 14 prior to meeting Anonymous, it not only had to choose Samantha 15 Cohen as his replacement as the person to target for changing 16 her password, it also had to have the same -- nobody else had 17 the same motive for the attack. 18 these events, save it on his removable hard drive. 19 It had to take screenshots of And then it wasn't really like a remote access trojan, 20 it was more like those worms that they put in the guy's ears in 21 Star Trek 2, because then what it did is it made him confess. 22 It made him say, yeah, I was AEScracked. 23 did this because I was angry and hurt, and they need 24 consequences. 25 it would have to write his confession for him, too, which is I used Overplay. And then -- well, you've seen it before. I Then KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 888 1 Exhibit 204. 2 software, and that's not what happened. 3 So that would be a really cunning piece of The next thing I'd say to you, Ladies and Gentlemen, as 4 you going through the evidence, is look at the jury 5 instructions. 6 something up on the screen as power point slide to think, oh, 7 yeah, that's the law. 8 because that is the only thing -- that is the law. 9 Right? I mean, it's tempting when you see You gotta look at the jury instructions So, for example, it's been argued to you that the 10 conspiracy was to damage the Los Angeles Times website, and 11 that's why this whole Fox Mulder narrative and carving out all 12 of the back doors is irrelevant. 13 not it. 14 15 jury instruction No. 15 that tells you what the conspiracy is. These are the dates of the conspiracy. THE COURT: Is there anything on the screen? If you mean something to be on the screen -- 20 MR. SEGAL: I do. 21 THE COURT: All right. 22 MR. SEGAL: Thank you, Your Honor. 23 There was an agreement -- 18 19 That's just Let's look at government -- I'm sorry -- at the Court's 16 17 That's not true. Can you jury see it now? 24 UNIDENTIFIED JUROR: 25 MR. SEGAL: Yes. Okay. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 889 1 Here's what they the agreement was to do, to make 2 unauthorized changes to websites that Tribune Company used to 3 communicate news and features to the public; and to damage the 4 computer management systems used by the Tribune Company. 5 Okay? So it's not just a web defacement, and that's where -- 6 and that's why this crime was so serious. 7 carve out all these back doors to compromise the integrity of 8 the system, which they needed to do in order to get back in 9 when they wanted to do other dirt. 10 Right? It's also to Now, the defense argues to you, well, there can be -- 11 legally, Ladies and Gentlemen, there can be no damage if there 12 was a back-up copy of the news story. 13 as if it were a jury instruction, but it's not true. 14 in the jury instructions. 15 And that's up on a slide It's not Damage is defined. Damage means any impairment to the integrity or 16 availability of data, a program, a system or information. Any 17 impairment. 18 access that the system integrity was damaged. 19 they want to say, oh, if you tried to post a story, it would go 20 up on the site. 21 Because the content management system didn't only work for Fox 22 40 and the L.A. Times and everybody else, but it also would 23 work for these clowns at Anonymous who want to put nonsense up. 24 That's not how it's supposed to work. 25 the integrity of the system. So we know that because of all the back-door Right? Yeah, that's the whole problem. I mean, Right? That's a compromise to KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 890 1 And then there was also an impairment to the 2 availability of what? 3 availability of news stories. 4 L.A. Times that day, you were not reading about Steny Hoyer. 5 You were reading about Chippy leet, and that's not what you set 6 out to do. 7 had a right to run their business and publish what they wanted, 8 which was read by multiple sets of eyes and all the other stuff 9 that you heard and have their website function making their 10 There was an impairment to the Because if you were reading the That's not what the L.A. Times intended, and they news available. 11 And think of the damage that would have occurred if 12 they had succeeded in their Count Three attempt. 13 front page would have been unavailable to readers. 14 impairment to the integrity of information, certainly to 15 readers. 16 The entire That's an There is -- you will search these instructions high and 17 low for anything that says that if a back-up is available, the 18 data is not impaired. 19 law. 20 21 22 Okay? And it's not there because it's not the The law is any impairment. And that argument -- well, and certainly the system is impaired because anybody can get in through all the back doors. It's also been argued that there's no -- that you have 23 to ignore Fox Mulder, and this is all prejudicial and this sort 24 of stuff. 25 That's not true. There is no instruction to ignore Fox Mulder. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 891 1 And if you think about the reason why those e-mails are 2 there, remember, in this time you saw he's carved all this 3 back-door access, right, to the CMS. 4 gone. 5 to the CMS to get these. 6 please. 7 The system integrity is And you've seen the get commands that he's transmitting And let's look at 303, page 4, So when you look at page 4, here he is bringing down 8 that -- well, a little farther up, please. 9 Thank you. 10 That's great. So here he is transmitting a get command to the e-mail 11 page on the CMS and bringing down 178 K worth of data, which 12 may not be impressive as a picture, but is impressive as a text 13 list. 14 the next page, on November 22nd. 15 That's the e-mail list. Right? And he does it again on And then what you have to think about for the Fox 16 Mulder e-mails is -- so now he's damaged the system. 17 carved back doors. 18 He's He's transmitting commands the whole time. Agent Cauthen testified that in his review of these 19 logs, he found that Keys had accessed these logs hundreds, if 20 not thousands of times. 21 CMS system. 22 It was like his job to mess with the And read the Fox Mulder e-mails. What they're 23 calculated to do, if you think about it, is to maximize the 24 amount of time that Tribune employees -- Mercer, Del Core, 25 Jedlinski, people you've never -- Sennet, who did not testify, KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 892 1 the lawyer -- maximize the amount of time that they were 2 responding to the incident, dealing with these e-mails. 3 Because not only did they have to deal with their 4 e-mail being hijacked, their e-mail list being hijacked and all 5 their customers hearing about how bad the company was, but -- 6 he didn't just do that. 7 there's another e-mail going out, I'm going to send an e-mail, 8 I'm going to send an e-mail. 9 even have to get dressed. What he would do is he would say And everybody is -- he doesn't Right? He's sitting on a computer 10 somewhere, and everybody is in this tiny newsroom spinning 11 around, calling Chicago, we've got a data breach. 12 your data is not secure. 13 Right? 14 These are legit. Check on your CMS. So the object is not just to communicate whatever the 15 scandal at Fox 40 is. 16 have everybody dancing, and he succeeded in that. 17 The object is to get people spinning, to And when it wasn't good enough for him, then he starts 18 jacking with Samantha Cohen's e-mail. 19 a few minutes. 20 You know, And we'll get to that in There just isn't any instruction to ignore Fox Mulder 21 because those commands were all transmitted when? In the time 22 period charged for Count Two, and that is between October 28th, 23 2010, when he was fired or quit or whatever happened -- oh, 24 thanks -- between October 28th of 2010 and January 5th of 2011. 25 When you get jury instruction 21, you will see this. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 893 1 That's within -- no, I've given up. But that's jury 2 instruction 21. 3 e-mails are within that time range, all that back-door access. 4 Those dates are in there, all those Fox Mulder And then you have to ask, well, what's a reasonable 5 response? 6 loss is, again, something that is defined right here. 7 What was their reasonable response to this? And You know, it's been said it wasn't reasonable for Tim 8 Rodriguez to spend all that time trying to figure out what was 9 compromised because he should have known that all they could 10 really do was, ah, make modifications to the website. 11 Tim Rodriguez told you that he spent 40 hours -- I 12 don't even think it was 40 hours. 13 to the slide that shows you how much time it was, trying to 14 figure out if he compromised payment systems. 15 what are they supposed to do, take the hacker's word for it? 16 All we really got was your e-mail system. 17 that be? 18 That would be stupid. He spent time, and I'll get Right? Because How negligent would Right? So they shut down everybody's password. Right? Not 19 just all these old user accounts, but anybody. 20 blast e-mails out to all of Tribune from Jedlinski's office. 21 They do that. 22 You saw these And then Rodriguez says have they compromised the 23 system that decides -- that puts stuff on the plates? Right? 24 The plates meaning the -- that go on the printing press. 25 is computer driven, what actually gets printed. That We need to KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 894 1 make sure that there is integrity of that system because who 2 knows what else they got into. 3 Right? 4 That is entirely reasonable. If somebody gets into your house, and let's say they 5 take one ring out your jewelry box. 6 you get home. 7 want to figure out what else they got into, and you want to 8 make sure that they're not going to be able to come back. 9 Right? The door is open. Right? And you know -- There is stuff missing. You're going to clear the house. 10 still be in there. 11 could be hiding in your kids' closet. 12 other systems that might be compromised. 13 primary job. You I mean, they could They could be hiding in your closet. They It's finding all the That was Rodriguez's 14 And, sure enough, it's not just that the loss is what 15 you as the jury are empowered to find was any reasonable cost 16 to any victim. 17 right there. 18 The jury instruction and the law says that it's reasonable to 19 conduct a damage assessment. 20 But, look, conducting a damage assessment is It's right there. That is a reasonable cost. Responding to an offense, that's reasonable. And 21 indeed that's what Keys wanted them to do because he thought he 22 was anonymous. 23 this layer of anonymity of saying we are overseas and using the 24 Fox Mulder e-mail, by using a Yahoo dot UK address, by using 25 Overplay to create a layer of anonymity. He thought he was protected. He thought he had When he's anonymous, KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 895 1 2 when he thinks he's got a mask on, that's how he behaves. Now another jury instruction that just doesn't say what 3 the defense wants it to say is the one about circumstantial 4 evidence. 5 there's any inference to be drawn, always, you know, put a 6 finger on the scale to favor the defense. 7 That instruction does not say always favor -- if You guys are the jury. It doesn't say that. The law makes no distinction 8 between the weight to be given either to direct or 9 circumstantial evidence. 10 11 It's for you to decide how much weight to give that evidence. And, Ladies and Gentlemen, I would suggest you read all 12 the evidence together. 13 circumstantial evidence, do it in light of the fact that he 14 confessed. 15 dispute about the reasonable inferences that could be drawn 16 from the circumstantial evidence when there's a confession? 17 Look, he was in the CMS system like it was his job. 18 the chat room doing his best to get them to mess things up. 19 And when you're reading the Were we in the same courtroom? Is there some He was in And when he was on the phone with Brandon Mercer, and 20 when he thinks he's safe, what does he do? 21 have anything to do with any e-mails. 22 e-mails in a long time. 23 going to happen at the L.A. Times. 24 how to stop it. 25 could have said -- even through the Fox Mulder identities, if Right? He says, I don't I haven't sent you But I'll tell you something big is I'm not going to tell you Because he knew how to stop it. He KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 896 1 he wanted the thing to stop, he could have said they have super 2 user accounts for the CMS. 3 all happened, but -- but this is going to happen. 4 I'm not going to tell you how it What that conversation with Brandon Mercer was about 5 was a two-fer. Right? Matthew Keys wanted a two-fer. 6 wanted pay back against Tribune because he was angry and hurt 7 after the conversation with Mercer, and he wanted to mess with 8 them and make them spin their wheels. 9 words, incited this crime, he wanted to be, you know, the press And then having, in his 10 man to break -- to be the first to break the story. 11 only one who has gotten access. 12 there's a call from PC Magazine. 13 Only I know this. 14 about this. 15 He I'm the I've been talking to PBS. Something is going to happen. Maybe you guys want to go up on a story It's not that he was trying to be a journalist. It's 16 that it's all about Matthew Keys. 17 agenda of pay back and personal self-promotion for being the 18 one -- it's like the fireman/arsonist. 19 stuff is going to happen, and I'll be here to put it out. 20 Well, it's like the web vandal/journalist. 21 Oh, He is just advancing his There's been an attack on loss. Right? I'm the -- this Right? The defense 22 claims that you haven't gotten proof beyond a reasonable doubt 23 of the loss. 24 Look at the Mercer e-mail, Defense Exhibit G as in golf. 25 Mercer says a couple of things in there. Look at the defense exhibits for this. Okay. He says we KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 897 1 need $5,000 and everybody should document their time. 2 also says, by the way, because of all the manager time and 3 everything, we've probably got it already. 4 the stand, you know, that that was related to sloppy 5 recordkeeping. 6 this not have burned that much time for all these people? 7 was the whole point of this campaign. 8 9 But he And he testified on Look at -- and it's not even sloppy. How could It And then think of all the people -- if you want to think about how conservative these estimates are, I do 10 encourage you to think by Del Core. 11 down, you heard, and his estimate cut down to the lowest amount 12 possible. 13 people's benefits. 14 went in, and they gave you testimony that really hasn't been 15 impeached. Right? Right? Del Core was sat And none of these estimates accounted for People were under oath. Right? And they 16 And I think it's worth -- unless it seems that they 17 were not telling the truth, I mean, it's for you, the jury. 18 It's -- you can credit that testimony. 19 decide whether people are telling the truth. 20 look like they were, you know, misremembering or fibbing or any 21 of that? 22 You are the people who Did any of them I mean, the big two they attack are Jerry Del Core -- 23 and really all they say about Jerry Del Core is don't listen to 24 the first thing he said, listen to the conservative estimate 25 that the government has presented. Right? But that's all KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 898 1 we're asking you to believe is that he worked seven hours. 2 And then they attack Sam Cohen. And this is their big 3 argument on Sam Cohen, well, she could have been doing other 4 things. 5 Mulder e-mails are going to the newsroom. 6 first half of December of 2010. 7 I mean, are you kidding? This is when all the Fox This is all the And then how often -- if her password is constantly 8 being deactivated, how often is she supposed to be checking in? 9 Are they assuming that she's getting kind of immediate tech 10 support, that she's the only person in the Tribune universe? 11 Read the e-mail. Let's look at Government Exhibit 112, 12 which is her e-mail, at page 3. 13 is not a complete account of all the times that her password 14 was messed with. 15 She testified that this e-mail Now let's look at page 3 of this one. Here she says the password for Scholbrock 2, this is 16 the alternative one, has been working for the last three hours, 17 a new record. 18 was e-mailing but there were other -- other password resets, 19 and basically all week her password was being messed with. 20 Right? That corroborates her testimony that she There's no reason to doubt her. 21 at Tribune any more. 22 station. 23 reason to shade her testimony to favor Tribune? 24 out like that. 25 Right? She doesn't even work What does she care? She's at some other television Why is she -- does she have any Her testimony was the truth. Nothing came This happened. Let's look at the next page. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 899 1 MR. JAFFE: This is not the redacted version. 2 THE COURT: Mr. Segal, please kill the screen. 3 MR. SEGAL: What's the problem? 4 THE COURT: If you can show only what's been admitted, MR. SEGAL: This has been admitted. 5 you may. 6 They've asked us 7 to redact some other passage in this thing after court. 8 them we'll accommodate them, but I'm not sure -- 9 THE COURT: I told Well, if there was any dispute, the Court 10 was to have resolved those. So I would suggest you just argue. 11 MR. SEGAL: 12 If you look at the bottom of page 5 on this one, you Okay. 13 will see, Ladies and Gentlemen, I'm not sure why it keeps 14 reverting. 15 Samantha Cohen was telling the truth. Right? This is happening over and over, so 16 Now, the next thing that the defense wants you to think 17 is, well, the testimony, ah, didn't distinguish between closing 18 all the back doors, checking the windows, whatever, and then 19 building a new house and putting a stronger door on. 20 not true. 21 to distinguish between exactly those two kinds of conduct. 22 That is The entire purpose of that testimony was to get them The numbers you heard -- think about Dylan Kulesza. 23 Right? What the defense would have you think is that the 24 government put on Kulesza to say that he has 40 hours of time. 25 Not so. Let's look at the chart with Kulesza's loss on it, the KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 900 1 global loss chart. 2 Kulesza was asked about those things, but what Kulesza 3 said actually was that his time spent on closing back doors and 4 responding was 8 to 16 hours. 5 recorded, not -- it was the time incident response and damage 6 assessment. 7 That's what those numbers And look at all these people. 8 worked for 20 hours. 9 conservative estimate. Jason Jedlinski says I I mean, that's not even -- that's a Right? That's not even counting the 10 entire team that Jason Jedlinski said he had working for him 11 pulling 5,000 pages of server logs. 12 says that. 13 midnight on the 15th. 14 the president of Tribune Company. 15 You'll see an exhibit that Ordering in dinner that night. Working until Being present when Steve Gable called This estimate, Ladies and Gentlemen, from the evidence 16 you've heard, is conservative. 17 time -- in burned down time, which is exactly what he wanted, 18 from Count Two. 19 There was easily $5,000 in burn Now, the burden of proof is always on the government. 20 But as you consider whether to credit this testimony, it's also 21 true that this -- you know, the big missing expert witness, 22 whatever they could have said, the defendant could have called 23 an expert witness, too. 24 said. 25 actually seen. Who knows what that person would have What you're left with is the evidence that you've Don't speculate about what some other witness KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 901 1 would have said if some party had called them. 2 3 The defendant could have subpoenaed records from Tribune Company and presented them, too. 4 MR. LEIDERMAN: 5 THE COURT: 6 Objection, that is burden shifting. Sustained. The jury shall disregard this last argument. 7 MR. SEGAL: Ladies and Gentlemen, the only evidence in 8 front of you is the testimony of these witnesses, and they told 9 the truth, and their testimony is uncontested. 10 there were a lot of people there on those lists. 11 them said that that pizza party didn't happen. 12 There was -Not one of And then the next thing is was it reasonable -- was it 13 reasonably foreseeable to Keys? 14 103. 15 to Brandon Mercer when Fox Mulder is -- maybe it's Cancer 16 Man -- is talking about how expensive it is to figure out who 17 the hackers are, especially when they might be in a foreign 18 country, which he was pretending to be in. 19 Keys knew it was expensive. 20 him. 21 Think about Government Exhibit Government Exhibit 103 is one of the Fox Mulder e-mails Keys knew that. It was reasonably foreseeable to And then in the phone call with Brandon Mercer, you 22 remember he says, oh, yeah, you know, why don't call Cal 23 Forensics. 24 me. 25 tech support for people at Fox 40, he knew their computer They tried to figure out something about my ex and They're really expensive. I mean, Keys was doing informal KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 902 1 system, and he knew that this stuff was expensive to figure 2 out. Of course $5,000 of loss was reasonably foreseeable to 3 him. That was part of the -- he's accountable for that when he 4 essentially calls an Internet street gang and says go mess 5 stuff up. 6 to cause exactly the loss that he knew was involved when you 7 get these computer whiz guys involved burning their time. 8 9 It's reasonably foreseeable to him that that's going And then when you say go F stuff up, it's within the scope of your agreement. 10 So, wrapping up now, I want to -- the core thing about 11 this case is that Keys is always doing as much as he can. 12 Right? 13 builds some back doors, does what he has the technical 14 capability to do. 15 After he gets fired, he downloads their e-mail system, And then he still wants more, and he reaches out to 16 Anonymous. 17 to be the guy on the scene and predict the attacks that, of 18 course, he has made possible, and he gets more damage. 19 And from that, he gets a two-fer. Right? He gets But he's not -- he's not acting -- well, first, it's 20 not really a defense that he also was writing about this, but 21 he was not acting as a journalist, Ladies and Gentlemen. 22 Let's look at -- let's play 229, please. 23 24 25 (Audio recording played, not reported.) MR. SEGAL: organization. This offense was committed against a news And let's see what kind of journalistic values KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 903 1 Matthew Keys was trying to promote when he was in the chat 2 room. 3 Let's look at Government Exhibit 607, please. You guys heard that what Anonymous' big beef was is 4 they were angry about WikiLeaks and the rest of this, and Keys 5 knows that, too. 6 flag in front of a bull. 7 must be demolished. 8 Times and says it's about why the WikiLeakers are not quite 9 Rosa Parks. And in order to hurt Tribune, he waves a red He says yet, another reason the Times And then he links to a story by the L.A. 10 In other words, he's calling out to this mob basically 11 and saying the L.A. Times is saying stuff you guys don't like, 12 demolish them. 13 Mercer, and he says something is going to happen at the L.A. 14 Times. 15 Yeah. And then three days later, he goes to Brandon This is what happened. The last tape I'm going to play you is Government 16 Exhibit 210. 17 18 of it, that would be great. 18 And if we can somehow fast-forward it to minute (Audio recording played, not reported.) 19 MR. SEGAL: Can we -- stop it. 20 You may recall that what he said was: 21 What concerned me, you know -- I don't remember if it 22 was the night or if it was, you know, over the course of a 23 couple of days, but it became very clear to me -- and this is 24 something I told -- you know, I told Parmy, I told a couple of 25 other people. And it became very clear to me that these are KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 904 1 the people who are doing the most damage, the kind of things 2 you would hear about on the news, you know, which unfortunately 3 I was not contributing to news product at the time. 4 kind of was, and we'll get to that in a second, but for the 5 most part I wasn't. 6 mean, it's -- even just thinking about the gravity of the skill 7 that was going on in there. I mean, I It was -- a few things stressed me out. 8 That was 211. 9 He says: My game was to find out what was going on, 10 and my attention quickly shifted from let's give these hackers 11 to -- get these hackers that don't get caught and do some 12 damage. 13 He incited this incident. He made this thing happen by 14 telling them this is what you want to target. And, of course, 15 you know he did it because he said he did it. And you know it 16 was -- that the loss was within the scope of the agreement 17 because you have the words of the conspiracy right in the IRC 18 chat channels, and you know it was reasonably foreseeable to 19 Keys. 20 I You know the loss happened because the witnesses told 21 the truth. And you know that the attempt exceeded $5,000 22 because, if this was the response to just a single front 23 page edit -- story edit in Los Angeles Times, having multiple 24 front page layouts across Tribune go up would have been a bomb. 25 And this was a bomb. It was a bomb not only for what you could KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 905 1 see, but, as Tim Rodriguez said, it was a bomb for what you 2 didn't know. 3 Right? They came home and found, you know, that somebody had 4 spray-painted something on the wall of their bedroom, and they 5 were terrified because they didn't know what other rooms and 6 what other things they had gotten into and whether they could 7 get back in. 8 doesn't give sufficient respect to the harm that it did to a 9 news organization, to the panic that it caused, and to the huge And to call this a juvenile prank, it just -- it 10 uncertainty that necessitated a damage assessment because God 11 knows what else they would have gotten into. 12 Keys knew would happen and what Keys intended. 13 And that's what And so we ask you to convict him of conspiracy, of 14 transmission of a malicious code and of attempt because these 15 things happened, he did them, and they had the effects on the 16 victims that you heard about. 17 Thank you. 18 THE COURT: All right. Ladies and Gentlemen, that 19 concludes the government's closing argument and the parties' 20 closing arguments. 21 to -- I believe I have just enough time to get through the 22 closing instructions. 23 would bear with me. 24 25 I need to instruct you, and so I am going I may go a few minutes past 1:30, if you The final instructions, so you know, are in the binders you have. You are not required to follow along. You'll take KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 906 1 those binders with you into the jury room. 2 have the preliminary instructions I gave to you at the 3 beginning of the case and the photos of witnesses just to help 4 you recall who testified and what their names were. 5 The binders also So, Members of the Jury, now that you have heard all 6 the evidence, it is my duty to instruct you on the law that 7 applies to this case. 8 available in the jury room, in your binders as I said. 9 A copy of these instructions will be It is your duty to weigh and to evaluate all the 10 evidence received in the case and, in that process, to decide 11 the facts. 12 to you to the facts, as you find them, whether you agree with 13 the law or not. 14 It is also your duty to apply the law as I give it You must decide the case solely on the evidence and the 15 law, and you must not be influenced by any personal likes or 16 dislikes, opinions, prejudices or sympathy. 17 you took an oath promising to do so at the beginning of the 18 case. 19 20 You'll recall that You must follow all these instructions and not single out some and ignore others. 21 They are all important. Please do not read into these instructions or to 22 anything I may have said or done any suggestion as to what 23 verdict you should return. 24 you. 25 That is a matter entirely up to The superseding indictment, the charging document, is KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 907 1 not evidence. 2 the charges. 3 and until the government proves the defendant guilty beyond a 4 reasonable doubt. 5 The defendant Mr. Keys has pleaded not guilty to The defendant is presumed to be innocent unless You are here only to determine whether the defendant is 6 guilty or not guilty of the charges in the superseding 7 indictment. 8 conduct or offense not charged in the superseding indictment. 9 The defendant Mr. Keys is not on trial for any Because of the presumption of innocence, a defendant 10 does not have to prove innocence. 11 always on the government and never shifts to the defendant. 12 The burden of proof is The burden on the government is to prove every element 13 of the charges beyond a reasonable doubt. 14 reasonable doubt is proof that leaves you firmly convinced that 15 the defendant is guilty. 16 government prove guilt beyond all possible doubt. 17 Proof beyond a It is not required that the A reasonable doubt is a doubt based upon reason and 18 common sense and is not based purely on speculation. 19 arise from a careful and impartial conversation of all the 20 evidence or from lack of evidence. 21 It may If, after a careful and impartial consideration of all 22 the evidence, you are not convinced beyond a reasonable doubt 23 that a defendant is guilty, it is your duty to find that 24 defendant not guilty. 25 impartial consideration of all the evidence, you are convinced However, if, after a careful and KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 908 1 beyond a reasonable doubt that the defendant is guilty, it is 2 your duty to find that defendant guilty. 3 A defendant in a criminal case has a constitutional 4 right not to testify. 5 kind from the fact that the defendant did not testify. 6 You may not draw any inference of any The evidence you are to consider in deciding what the 7 facts are consists of: 8 witnesses; two, the exhibits received into evidence; and, 9 three, any facts to which the parties have agreed. 10 Number one, the sworn testimony of any In reaching your verdict, you may consider only the 11 testimony and exhibits received into evidence. 12 things are not evidence, and you may not consider them in 13 deciding what the facts are. 14 15 16 The following And this is reviewing some of what I told you on the first day. Number one, questions, statements, objections and 17 arguments by the lawyers are not evidence. 18 witnesses. 19 understand the answers of a witness, the lawyer's questions are 20 not evidence. 21 The lawyers are not Although you must consider a lawyer's questions to Similarly, what the lawyers have said in their opening 22 statements, closing arguments and at other times is intended to 23 help you interpret the evidence, but is not evidence. 24 facts as you remember them differ from the way the lawyers 25 state them, your memory of the facts controls. If the KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 909 1 Secondly, any testimony that I have excluded, stricken 2 or instructed you to disregard is not evidence. 3 some evidence was received only for a limited purpose. 4 have instructed you to consider certain evidence in a limited 5 way, you must do so. 6 In addition, When I Third, charts and summaries were shown to you in order 7 to help explain the evidence. These charts and summaries have 8 not been admitted into evidence and will not go into the jury 9 room with you. They are not themselves evidence or proof of 10 any facts. 11 figures shown by the evidence in the case, you should disregard 12 the charts and summaries and determine the facts from the 13 underlying evidence. 14 If they do not correctly reflect the facts or Fourth, anything you may have seen or heard when court 15 was not in session is not evidence. 16 solely on the evidence received here at trial. 17 You are to decide the case Now, to review the charts and summaries, during the 18 trial, certain charts and summaries were shown to you in order 19 to help explain the evidence. 20 summaries were not admitted in evidence and will not go into 21 the jury room with you. 22 proof any facts. 23 figures shown by the evidence, you should disregard the charts 24 and summaries and, again, determine the facts from the 25 underlying evidence. Again, those charts and They are not themselves evidence or If they do not correctly reflect the facts or KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 910 1 2 Now regarding evidence and whether it's direct or circumstantial. 3 Evidence may be direct or circumstantial. 4 evidence is direct proof of a fact such as testimony by a 5 witness about what that witness personally saw or heard or did. 6 Circumstantial evidence is indirect evidence; that is, it is 7 proof of one or more facts from which you could find another 8 fact. 9 Direct You are to consider both direct and circumstantial 10 evidence. 11 makes no distinction between the weight to be given to either 12 direct or circumstantial evidence. 13 much weight to give to any evidence. 14 Either can be used to prove any fact. The laws It is for you to decide how By way of example, if you wake up in the morning and 15 see that the sidewalk is wet, you may find from that fact that 16 it rained during the night. 17 turned-on garden hose may provide an explanation for the water 18 on the sidewalk. 19 been proved by circumstantial evidence, you must consider all 20 the evidence in the light of reason, experience and common 21 sense. 22 However, other evidence such as a Therefore, before you decide that a fact has Now, in deciding the facts in this case, you may have 23 to decide which testimony to believe and which testimony not to 24 believe. 25 it or none of it. You may believe everything a witness says or part of KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 911 1 2 3 In considering the testimony of any witness, you may take into account the following: No. 1, the witness's opportunity and ability to see or 4 hear or know the things testified to; No. 2, the witness's 5 memory; No. 3, the witness's manner while testifying; No. 4, 6 the witness's interest in the outcome of the case, if any; No. 7 5, the witness's bias or prejudice, if any; No. 6, whether 8 other evidence contradicted the witness's testimony; No. 7, the 9 reasonableness of the witness's testimony in light of all the 10 evidence; and, No. 8, any other factors that bear on 11 believability. 12 The weight of the evidence as to a fact does not 13 necessarily depend on the number of witnesses who testify. 14 What is important is how believable the witnesses were and how 15 much weight you think their testimony deserves. 16 You are here only to determine whether the defendant is 17 guilty or not guilty of the charges in the superseding 18 indictment. 19 offense not charged in the superseding indictment. The defendant is not on trial for any conduct or 20 Instruction No. 11 if you are following along. 21 You have heard testimony that the defendant made 22 statements. It is for you to decide, No. 1, whether the 23 defendant made the statement; and, No. 2, if so, how much 24 weight to give to them. 25 consider all the evidence about the statements, including the In making those decisions, you should KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 912 1 circumstances under which the defendant may have made them. 2 Evidence may have been introduced containing statements 3 regarding the law. 4 you. 5 something about the law does not mean that it is an accurate 6 statement. 7 the jury instructions. 8 9 You must follow the law as I explain it to Just because a witness or a document in evidence has said To determine what the law is, you may rely only on You have heard testimony that the defendant was recorded without his knowledge during the government's 10 investigation in this case. Federal law enforcement officials 11 may make surreptitious recordings and may have others make 12 surreptitious recordings in order to investigate criminal 13 activities. 14 Now regarding the counts charged. 15 The defendant is charged in Count One of the 16 superseding indictment with conspiracy to cause damage to a 17 protected computer in violation of Title 18 of the U.S. Code, 18 Section 371; in Count Two, with transmission of malicious code 19 in violation of Title 18 of the U.S. Code, Section 20 1030(a)(5)(A) and (c)(4)(B); and in Count Three with attempted 21 transmission of a malicious code in violation of 18 U.S. Code 22 1030(a)(5)(A) and 1030(b). 23 Instructions on the elements that the government must 24 prove with respect to each count follow. Now instruction 15, 25 beginning instructions regarding Count One. KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 913 1 The defendant is charged in Count One with the 2 conspiracy to commit an offense against the United States, 3 namely to cause damage to a protected computer in violation of 4 Section 371 of Title 18 of the U.S. Code. 5 defendant to be found guilty of that charge, the government 6 must prove each of the following elements beyond a reasonable 7 doubt: 8 9 In order for the First, between on or about December 8th, 2010, and on or about December 15th, 2010, there was an agreement between 10 two or more persons to transmit a program, code, command or 11 information to a computer intending to make unauthorized 12 changes to websites that Tribune Company used to communicate 13 news features to the public and to damage the computer 14 management systems used by Tribune Company. 15 in the next instruction. 16 Damage is defined Second, the defendant became a member of the conspiracy 17 knowing of at least one of its objects and intending to help 18 accomplish it. 19 Third, one of the members of the conspiracy performed 20 at least one overt act on or after December 8th, 2010, for the 21 purpose of carrying out the conspiracy. 22 A conspiracy is a kind of criminal partnership, an 23 agreement of two or more persons to commit one or more crimes. 24 The crime of conspiracy is the agreement to do something 25 unlawful. It does not matter whether the crime agreed upon was KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 914 1 2 committed. For a conspiracy to have existed, it is not necessary 3 that the conspirators made a formal agreement or that they 4 agreed on every detail of the conspiracy. 5 however, that they simply met, discussed matters of common 6 interest, acted in similar ways or perhaps helped one another. 7 You must find that there was a plan to commit an offense 8 against the United States in any manner or for any purpose as 9 an object of the conspiracy with all of you agreeing as to the It is not enough, 10 particular crime which the conspirators agreed to commit. 11 One becomes a member of a conspiracy by willfully 12 participating in the unlawful plan with the intent to advance 13 or further some object or purpose of the conspiracy, even 14 though the person does not have full knowledge of all the 15 details of the conspiracy. 16 Furthermore, one who willfully joins an existing 17 conspiracy is as responsible for it as the originators. 18 other hand, one who has no knowledge of the conspiracy, but 19 happens to act in a way which furthers some object or purpose 20 of the conspiracy does not thereby become a conspirator. 21 On the Similarly, a person does not become a conspirator 22 merely by associating with one or more persons who are 23 conspirators, nor merely by knowing that a conspiracy exists. 24 25 An overt act does not itself have to be unlawful. A lawful act maybe an element of a conspiracy if it was done for KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 915 1 the purpose of carrying out the conspiracy. 2 not required to prove that the defendant personally did one of 3 overt acts. 4 5 6 The government is Now, instructions Nos. 16 through 20, which also apply to Count One. Regarding the term "damage," damage means any 7 impairment to the integrity or availability of data, a program, 8 a system or information. 9 An act is done knowingly if the defendant is aware of 10 the act and does not act through ignorance, mistake or 11 accident. 12 defendant knew that his acts or omissions were unlawful. 13 may consider evidence of the defendant's words, acts or 14 omissions along with all the other evidence in deciding whether 15 the defendant acted knowingly. 16 The government is not required to prove that the You A conspiracy may continue for a long period of time and 17 may include the performance of many transactions. It is not 18 necessary that all members of the conspiracy join it at the 19 same time. 20 full knowledge of all the details of the unlawful scheme or the 21 names, identities or locations of all of the other members. And one may become a member of a conspiracy without 22 Even though a defendant did not directly conspire with 23 other conspirators in the overall scheme, the defendant has in 24 effect agreed to participate in the conspiracy if the 25 government proves each of the following beyond a reasonable KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 916 1 2 doubt: That, No. 1, the defendant directly conspired with one 3 or more conspirators to carry out at least one of the objects 4 of the conspiracy; No. 2, the defendant knew or had reason to 5 know that other conspirators were involved with those with whom 6 the defendant directly conspired; and, No. 3, the defendant had 7 reason to believe that whatever benefits the defendant might 8 get from the conspiracy were probably dependent upon the 9 success of the entire venture. 10 11 12 It is not a defense that a person's participation in a conspiracy was minor or for a short period of time. If you find beyond a reasonable doubt that the 13 defendant committed the offense charge in Count One, you must 14 then decide whether the government has proved beyond a 15 reasonable doubt, either: 16 reasonably foresee that the conspiracy could cause $5,000 or 17 more in loss to the Tribune Company; or, No. 2, causing $5,000 18 or more in loss to the Tribune Company fell within the scope of 19 the defendant's particular agreement with his co-conspirators. 20 21 22 23 24 25 That, No. 1, the defendant could In determining this question, please reference the definition of loss in the next instruction. For Count One, the government is not required to prove that any loss was actually caused. Now that definition of loss. Loss is any reasonable cost to any victim, including the cost to responding to an KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 917 1 offense, conducting a damage assessment and restoring the data, 2 program, system or information to its condition prior to the 3 offense. 4 Regarding Count Two, the defendant is charged in Count 5 Two specifically with knowingly causing the transmission of a 6 program, information, code or command and, as a result of such 7 conduct, intentionally causing damage without authorization to 8 a protected computer in violation of Section 1030(a)(5) of 9 Title 18 of the United States Code. 10 And this is between on or about October 28th, 2010 and on or about January 5th, 2011. 11 In order for the defendant to be found guilty of this 12 charge, the government must prove each of the following 13 elements beyond a reasonable doubt: 14 First, the person knowingly caused the transmission of 15 at least one program, code, command or information to a 16 computer; second, as a result of the transmission, the person 17 intentionally damaged a computer; and, third, the computer was 18 used in or affected interstate or foreign commerce or 19 communication. 20 21 Instruction 22, which follows, also applies to Count Two. 22 If you find beyond a reasonable doubt that the 23 defendant committed the offense charged in Count Two, you must 24 then decide whether the government has proved beyond a 25 reasonable doubt that the offense caused loss to the Tribune KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 918 1 Company adding up to at least $5,000. 2 previously instructed in instruction No. 20. 3 Loss is defined as Now regarding Count Three, the defendant Mr. Keys is 4 charged in Count Three specifically with knowingly attempting 5 to cause the transmission of a program, information, code and 6 command and, as a result of such conduct, intentionally causing 7 damage without authorization to a protected computer in 8 violation of 18 U.S. Code Section 1030(a)(5)(A) on or about 9 December 15th,, 2010. 10 In order for the defendant to be found guilty of this 11 charge, the government must prove each following elements 12 beyond a reasonable doubt: 13 First, the defendant intended to transmit a program, 14 code, command or information to a computer and caused the 15 damage without authorization; and second, the defendant did 16 something that was a substantial step toward committing the 17 crime. 18 Mere preparation is not a substantial step toward 19 committing the crime. 20 defendant's act or actions must demonstrate that the crime will 21 take place unless interrupted by independent circumstances. 22 To constitute a substantial step, a Now, damage as used in this instruction is defined as 23 previously instructed in instruction No. 16. And it doesn't 24 say at the bottom of this page, but the next instruction, 25 instruction No. 24, also applies to Count Three, as I believe KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 919 1 2 it's clear from the content of instruction No. 24 itself. If you find beyond a reasonable doubt that the 3 defendant committed the offense charged in Count Three of the 4 superseding indictment, you must then decide whether the 5 government has proved beyond a reasonable doubt that, if that 6 offense had been completed, it would have caused loss adding up 7 to at least $5,000 to the Tribune Company. 8 9 10 Here again, loss is defined as previously instructed in instruction No. 20. A defendant may be found guilty of the crime charged in 11 Counts Two and Three even if the defendant personally did not 12 commit the act or acts constituting the crimes, but aided and 13 abetted in their commission. 14 aiding and abetting, the government must prove beyond a 15 reasonable doubt: 16 To prove a defendant guilty of First, each crime charged with committed by someone; 17 second, the defendant knowingly and intentionally aided, 18 counseled, commanded, induced or procured that person to commit 19 each element of the crime; and, third, the defendant acted 20 before the crime was completed. 21 It is not enough that the defendant merely associated 22 with the person committing the crime, or unknowingly or 23 unintentionally did things that were helpful to that person, or 24 was present at the scene of the crime. 25 beyond a reasonable doubt that the defendant acted with the The evidence must show KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 920 1 knowledge and intention of helping that person commit the crime 2 charged. 3 Count Three. 4 And it's really the crime charged in Count Two or The government is not required to prove precisely which 5 person actually committed the crime and which person aided 6 and/or abetted. 7 A separate crime is charged against the defendant in 8 each count. 9 verdict on one count should not control your verdict on any 10 11 You must decide each count separately. Your other count. When you begin your deliberations, elect one member of 12 the jury as your foreperson, who will preside over the 13 deliberations and speak for you here in court. 14 discuss the case with your fellow jurors to reach agreement, if 15 you can do so. 16 must be unanimous. 17 You will then Your verdict, whether guilty or not guilty, Either of you must decide for yourself, but you should 18 do so only after you have considered all the evidence, 19 discussed it fully with the other jurors, and listened to the 20 views of your fellow jurors. 21 Do not be afraid to change your opinion if the 22 discussion persuades you that you should, but do not come to a 23 decision simply because other jurors think it is right. 24 important that you attempt to reach a unanimous verdict but, of 25 course, only if each of you can do so after having made your It is KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 921 1 own conscientious decision. 2 about the weight and effect of the evidence simply to reach a 3 verdict. 4 Do not change an honest belief Because you must base your verdict only on the evidence 5 received in the case and on these instructions, I remind you 6 that you must not be exposed to any other information about the 7 case or the issues it involves. 8 the case with your fellow jurors during deliberations, do not 9 communicate with anyone in any way and do not let anyone else So now, except for discussing 10 communicate with you in any way about the merits of the case or 11 anything to do with it. 12 person, in writing, by phone or electronic means, by e-mail, 13 text messaging or any Internet chat room, blog, website or 14 other feature. 15 members, your employer, the media or press, and the people 16 involved in the trial. 17 This includes discussing the case in This applies to communicating with your family If you are asked or approached in any way about your 18 jury service or anything about this case, you must respond that 19 you have been ordered not to discuss the matter and report that 20 contact to me immediately. 21 Do not read, watch or listen to any news or media 22 accounts or commentary about the case or anything to do with 23 it. 24 searching the Internet or using other reference materials. 25 do not make any investigation or in any other way try to learn Do not do any research, such as consulting dictionaries, And KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 922 1 2 about the case on your own. The law requires these restrictions to ensure the 3 parties have a fair trial based on the same evidence that each 4 party has had an opportunity to address here in court. 5 who violates these restrictions jeopardizes the fairness of 6 these proceedings, and a mistrial could result that would 7 require the entire trial process to start over. 8 learn that any juror has been exposed to any outside 9 information, please notify me immediately. A juror So if you 10 Again, your verdict must be based solely on the 11 evidence and on the law as I have given to you in these 12 instructions. 13 intending to suggest what your verdict should be. 14 entirely for you to decide. 15 16 17 However, nothing I have said or done is That is Ladies and Gentlemen, those are your instructions. As you retire, here's some additional clarification. A verdict form will be provided to you. The exhibits 18 will be provided to you as promptly as we can get them into the 19 jury room. 20 are still sitting with us. 21 although you will not retire with the jury. 22 report tomorrow morning, if you can report to the fourth floor. 23 We have not had to draw on our alternates. They We need you to remain available, And so, when you And the instructions to you are that you should not 24 talk between the two of you about the case. The ground rules 25 I've been instructing you on apply to the two of you. And we KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 923 1 appreciate your continuing service in that way. 2 The twelve constituting our jury will retire with the 3 security officer. 4 so that he can escort you to the jury room. 5 Ms. Streeter is going to swear that officer We understand that you'll be leaving immediately after 6 you retire today. 7 THE JURY: 8 THE COURT: All right. 10 MR. SEGAL: Your Honor? 11 THE COURT: Yes. 12 MR. SEGAL: I think the Court may not have read 9 13 Is the time 8:30 or 9:00 tomorrow morning? 8:30. We'll be available starting at 8:30. instructions 29 and 30. 14 I don't know -- THE COURT: Well, they may have ended up not in my 16 THE CLERK: Yeah, I've got them. 17 THE COURT: They did feel truncated. 15 18 packet. something. All right. I was handed Thank you. 19 Sorry about that. 20 MR. SEGAL: Sorry. 21 THE COURT: -- pages. 22 I wondered about that, but relied on what was in front 23 of me. 24 before. 25 There are actually four more -- So these are instructions, some of them you have heard Some of you have taken notes during the trial. Whether KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 924 1 or not you took notes, you should rely on your own memory of 2 what was said. 3 not be overly influenced by your notes or those of your fellow 4 jurors. 5 Notes only to assist your memory. You should The punishment provided by law for this crime is for 6 the Court to decide, if I need to. 7 punishment in deciding whether the government has proved its 8 case against the defendant beyond a reasonable doubt. 9 You may not consider The verdict form I just mentioned has been prepared for 10 you. 11 your foreperson should complete the verdict form according to 12 your deliberations, sign and date it, and advise the clerk that 13 you are ready to return to the courtroom. 14 After you have reached unanimous agreement on a verdict, As I indicated previously, if it does become necessary 15 to communicate with me now during deliberations, you may send a 16 note through the security officer who will be assigned to you, 17 signed by any one or more of you. 18 ever attempt to communicate with me except by a signed writing. 19 And I will respond to the jury concerning the case only in 20 writing or here in open court. 21 No member of the jury should If you do send out a question, I will consult with the 22 lawyers before answering it, which may take some time. 23 continue your deliberations while waiting for the answer to any 24 question. 25 You may Remember that you are not to tell anyone, including me, KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 925 1 how the jury stands, numerically or otherwise -- I should never 2 learn a vote count -- on any question submitted to you, 3 including the question of the guilt of the defendant, until 4 after you have reached a unanimous verdict or have been 5 discharged. 6 So that does complete your instructions. You have all 7 of those instructions in your binder, for those of you who were 8 following along? 9 10 All right. Now, Ms. Streeter, could you please swear the security officer? 11 12 All right. THE CLERK: Yes. (Oath administered to Court Security Officer.) 13 THE COURT SECURITY OFFICER: 14 THE CLERK: Thank you. 15 THE COURT: All right. 16 17 18 You may now follow the security officer. Do the alternates need to retrieve any personal items from the jury room? 19 UNIDENTIFIED JUROR: 20 THE COURT: 21 You may take the binders now. 22 23 24 25 I do. Yes. So you can do that, and then move on. You may take your notepads. Leave the binders here on your chair with the notepad. They will be there if you need them. THE CLERK: All the exhibits and the verdict form will KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 926 1 be in the jury room in the morning when you come in. 2 (Jury not present.) 3 THE COURT: 4 Any exhibit disputes I need to resolve? 5 MR. HEMESATH: 6 MR. LEIDERMAN: 7 THE COURT: 8 So if you can be on call starting at 8:30 tomorrow 9 morning. full lunch break. 11 through lunch. 12 until 5:00. 14 15 16 17 So 8:30. No. No, right? All right. Very good. We'll keep you posted, let you know if they take a 10 13 All right. Sometimes they do, sometimes they work At this point, I would expect to remain on call MR. SEGAL: So if they're on lunch break, we're gone from the courthouse. THE COURT: Otherwise we'll be around. My rule is stay within 10 minutes of the courthouse when they are working. MR. HEMESATH: And one note from my part, Your Honor, 18 that tomorrow I will not be around here. 19 more than -- 20 THE COURT: 21 MR. HEMESATH: 22 Mr. Segal will be All right. -- adequate. (Off-the-record discussion with Courtroom Deputy.) 23 MR. LEIDERMAN: 24 I am presently scheduled to fly out tomorrow afternoon, 25 Your Honor, one more thing. I may change that -- or tomorrow late afternoon, I may change KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 927 1 that depending upon what goes on tomorrow. 2 Thursday, there is a reasonable possibility that I will turn 3 this over to Mr. Jaffe. 4 5 6 THE COURT: All right. But if it goes into If that's acceptable to Mr. Keys. MR. SEGAL: I'll just say, if there's a conviction, 7 we're not going to move to remand him, so that may help inform 8 who they want to keep around. 9 10 11 MR. LEIDERMAN: MR. SEGAL: That -- We might ask for a modification of a release condition, but that's all, if that -- 12 THE COURT: All right. 13 MR. LEIDERMAN: 14 MR. SEGAL: We'll talk about it. 15 THE COURT: I am currently scheduled to fly out at 5:58 What did you have in mind? 16 tomorrow, but I'm not if we don't have some resolution here, so 17 we will see. All right. 18 MR. SEGAL: Thank you, Your Honor. 19 THE COURT: We'll see you tomorrow. 20 (Proceedings were adjourned at 1:44 p.m.) 21 ---o0o--- 22 23 24 25 KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347 1 2 I certify that the foregoing is a correct transcript from the record of proceedings in the above-entitled matter. 3 4 5 /s/ Kathy L. Swinhart KATHY L. SWINHART, CSR #10150 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 KATHY L. SWINHART, OFFICIAL COURT REPORTER, USDC -- (916) 446-1347