Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 1 of 100 1 2 UNITED STATES DISTRICT COURT WESTERN DISTRICT OF TEXAS SAN ANTONIO DIVISION 3 UNITED STATES OF AMERICA, ) ) 4 v. ) Docket No. 5:18-CR-43-DAE ) 5 (1) RICHARD NIKOLAI GRATKOWSKI, ) San Antonio, Texas ) August 24, 2018 6 Defendant. ) ________________________________) 7 TRANSCRIPT OF MOTION HEARING 8 BEFORE THE HONORABLE DAVID A. EZRA UNITED STATES DISTRICT JUDGE 9 A P P E A R A N C E S: 10 FOR THE GOVERNMENT: 11 UNITED STATES ATTORNEY'S OFFICE By: Tracy Thompson, Esquire 12 601 N.W. Loop 410, Suite 600 San Antonio, TX 78216 13 FOR THE DEFENDANT: 14 FEDERAL PUBLIC DEFENDER'S OFFICE By: Marina Thais Douenat, Esquire 15 By: Hina Chheda, Esquire 727 East Cesar E. Chavez Blvd., Room B-207 16 San Antonio, TX 78206 17 COURT REPORTER: CHRIS POAGE 18 United States Court Reporter 655 East Cesar E. Chavez Blvd., Suite G-65 19 San Antonio, TX 78206 Telephone: (210) 244-5036 20 chris_poage@txwd.uscourts.gov 21 Proceedings reported by stenotype, transcript produced by computer-aided transcription. 22 23 24 25 2 Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 2 of 100 1 WITNESS INDEX 2 PAGE 3 JAMES THOMPSON 4 Direct Examination by Ms. Thompson .......................32 5 Cross-Examination by Ms. Douenat .........................69 6 7 EXHIBIT INDEX 8 Government's Exhibit Nos. 2, 3 and 4 admitted ............66 9 Government's Exhibit No. 1 admitted ......................91 10 Defendant's Exhibit No. 4 admitted .......................92 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 3 of 100 1 2 3 (Open court) COURTROOM DEPUTY: SA:18-CR-43, United States of 3 America versus Richard Gratkowski. 4 MS. THOMPSON: Good afternoon, Your Honor. Tracy 5 Thompson appearing on behalf of the United States, and we're 6 ready to proceed. 7 THE COURT: All right. Good afternoon. 8 MS. DOUENAT: Good afternoon, Your Honor. Marina 9 Douenat on behalf of Mr. Gratowski with Hina Chheda, and we're 10 here, ready to proceed. 11 THE COURT: All right. Good afternoon. Okay. 12 MS. THOMPSON: Your Honor, prior to starting, it's my 13 understanding that in order -- I'd like to clarify what -- I 14 know the defense is asking to suppress all the evidence seized 15 as well as the defendant's statements. At some point in one of 16 her responses she states that the statements should be 17 suppressed as fruit of the poisonous tree. 18 THE COURT: Right. 19 MS. THOMPSON: And so I just want to clarify that 20 there's no allegation that the statements were not made 21 voluntarily or that there's any other attack on law enforcement 22 obtaining those statements. That'll determine how much of that 23 testimony I inquire with the agent. 24 THE COURT: Do you have some kind of a Miranda attack 25 or something? Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 4 of 100 1 4 MS. DOUENAT: Well, Your Honor, we do have an attack 2 on the fact that he wasn't free to leave and -3 THE COURT: Was he Mirandized? 4 MS. DOUENAT: Later. Much later. 5 THE COURT: Well -- 6 MS. THOMPSON: I can go through everything, but 7 nowhere is that set out in their motion. 8 THE COURT: I didn't see that. 9 MS. DOUENAT: That's correct. It's not. 10 THE COURT: So that's not the motion then. 11 MS. THOMPSON: The other motion to suppress the 12 evidence, I think I've wrapped my mind around what their 13 allegations are. 14 THE COURT: Well, it's a bit confusing, because we 15 have three different motions here, it looks like. And why we 16 don't have one motion, I don't know. But we've got three 17 motions. And it -- we've got a motion -- a sealed motion to 18 suppress evidence and -- which includes a motion for discovery, 19 a sealed motion to suppress evidence and a request for a Franks 20 hearing, and then a supplemental motion to suppress. 21 MS. DOUENAT: So, Your Honor, it's two different 22 motions. It's a motion to suppress the evidence and the 23 statements based on -- there's no probable cause and the lack 24 of -- I mean, that they used investigative tool, techniques and 25 did searches. Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 5 of 100 1 5 And then the second part, which is a separate motion -- 2 it's a Franks motion, just because that's the -- just the 3 affidavit itself, if you look at the affidavit, the four 4 corners of the affidavit. And that's separate in the sense 5 that, was there enough information there, or was there 6 misleading information there for the Court to sign off on it 7 for probable cause? So that's a separate Franks -8 THE COURT: Well, you claim that -- you claim that 9 there was untruthful information. 10 MS. DOUENAT: That's correct. Misleading, untruthful 11 omissions made -12 THE COURT: Just a minute. I've got -- my pen fell 13 out here. And I was searching for it down here, and I think 14 I've seen it. I have to crawl under here to get it. 15 MS. DOUENAT: But it's the same -- 16 THE COURT: Here we go. 17 MS. DOUENAT: The Carpenter -- the supplemental motion 18 dealt with Carpenter, which is just supplementing the original 19 first motion. It's just an additional argument to the original 20 first motion. So it's just two. 21 THE COURT: All right. 22 MS. DOUENAT: Two motions, Your Honor. 23 THE COURT: Okay. 24 MS. THOMPSON: With regard to the Franks hearing, the 25 defense has to make a substantial preliminary showing that the Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 6 of 100 6 1 agent knowingly and intentionally, or with reckless disregard 2 for the truth, made a false statement in the search warrant 3 affidavit. And then the remaining portion of the affidavit 4 would be insufficient to support a finding of probable cause. 5 I understand her second argument, the second portion of 6 that and disagree with it. But there's no substantial showing 7 that anything in the affidavit is untrue. And so the 8 government's asking that we not have a Franks hearing. She 9 hasn't met the standard to have a Franks hearing. 10 THE COURT: Yeah. I looked at what it is that you 11 claim is untrue, and it doesn't actually say what you said it 12 said. Let me -- let me get to that part. Now, you argue that 13 Special Agent Thompson's search warrant affidavit violates the 14 Fourth Amendment because it contains false statements and 15 misrepresentations that were necessary to the magistrate 16 judge's probable cause determination. And that is -- let me 17 get over here. 18 Okay. You say, and I quote, "Between June 6" -- the 19 affidavit says that "between June 6, 2016 and May 2nd, 2017, 20 six bitcoin transactions were made within the website" -- we 21 don't know what website. It's just called -- I'm just using 22 the term "the website" -- "by Richard Gratkowski, and those 23 transactions were used to purchase child pornography from the 24 website." 25 When, in actuality, here's what he actually said. He said, Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 7 of 100 7 1 Between June 6 and May 2nd BTC -- which is the bitcoin account 2 number, and it has the account number -- engaged in six 3 transactions with BTC address within the website cluster. 4 Those bitcoin transactions with BTC addresses within the 5 website cluster are consistent with accounts that are used as 6 payments for points on the website, which were used to purchase 7 child pornography -- downloads from the website, not that he 8 did, but that that's what the bitcoin transaction -- in other 9 words, it's circumstantial evidence. 10 And so you make the allegation that he said flat out that 11 they had evidence that he used the bitcoin transaction to 12 purchase. And what he said was, not that, but rather, they had 13 evidence that he made these transactions, and that these 14 transactions are the kind of transactions that are used to -15 on this website to purchase pornography using bitcoin. 16 So it isn't a false statement at all. 17 MS. DOUENAT: Okay, Your Honor. I would argue -- 18 THE COURT: Well, it isn't. 19 MS. DOUENAT: I would just argue that the ultimate 20 conclusion the Court just said out loud was that those 21 transactions are used to buy child pornography on this website. 22 THE COURT: Well -- 23 MS. DOUENAT: And there's no -- 24 THE COURT: -- but they have evidence to that effect. 25 MS. DOUENAT: That's what we're arguing; that there is Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 8 of 100 8 1 no evidence to that effect. 2 THE COURT: Okay. 3 MS. THOMPSON: In order to get a Franks hearing, 4 though, there has to be a knowingly and intentionally false 5 statement made. She's conceding this isn't a false statement. 6 MS. DOUENAT: I'm saying that it is a false statement 7 that that wallet by -- that they can prove that that wallet was 8 associated with buying child pornography on that website. 9 THE COURT: No. I don't think that's what it said. 10 What it said was that that wallet did X number of transactions, 11 which they do have evidence of, and that it is through those 12 kinds of transactions that -- using bitcoin, that you purchase 13 pornography. 14 MS. DOUENAT: Well, that's the point. 15 THE COURT: But it's circumstantial evidence, and it's 16 very strong circumstantial evidence. 17 MS. DOUENAT: Well, there's a lot of omitted 18 information there. And that's not -- and that's also part -- I 19 mean, part of Franks v. Delaware is you can't -- you can't come 20 back and say, Well, we knew this information, but it wasn't 21 inside the affidavit, and that's what led us to this. 22 THE COURT: No. That's not -- I don't think that's 23 right. 24 Basically, what she's saying is the affidavit doesn't say 25 how they knew that bitcoin was used to purchase pornography. Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 9 of 100 1 9 MS. THOMPSON: I understand the probable cause 2 argument for that; that her argument eventually is that the 3 warrant was so lacking in probable cause, that it shouldn't 4 have been signed. 5 THE COURT: Right. 6 MS. THOMPSON: But with regard to the Franks hearing, 7 to accuse a law enforcement officer of lying is a very, very 8 serious accusation. And it has affected the agent's ability to 9 testify in some other cases. He has to report that to his 10 superiors, even just the mere allegation. 11 THE COURT: Okay. I've already ruled that the 12 statement is not a lie. Okay? Done. Finished. 13 MS. THOMPSON: Right. 14 THE COURT: Let's get away from that already. All 15 right? 16 MS. THOMPSON: Thank you, Your Honor. 17 THE COURT: She says one thing. It doesn't say that. 18 What now she is arguing is that other parts of the 19 affidavit don't support the circumstantial evidence. Okay? So 20 what other parts of the evidence support the circumstantial 21 evidence, if any? 22 MS. THOMPSON: Well, I can -- I'm happy to put Special 23 Agent Thompson on to testify. 24 THE COURT: No. We're looking just at the affidavit 25 now, which I don't have right in front of me right now. Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 10 of 100 1 10 MS. THOMPSON: Your Honor, I have a copy marked for 2 the Court. 3 THE COURT: Yeah. So this is just argument. Okay? 4 We don't need Special Agent Thompson here. We just need you to 5 point out to me where it is. 6 MS. THOMPSON: Basically what the affidavit says is 7 that here is a website that is predominantly child pornography. 8 THE COURT: Right. In fact, the website apparently 9 does have some adult pornography in it. But I understand that 10 right at the beginning of the website it says, Do not upload 11 adult pornography. 12 MS. THOMPSON: Correct. 13 THE COURT: So that would be a fairly substantial 14 suggestion that it's a child pornography website. Do not 15 upload adult pornography. I mean, this is not like a publicly 16 available -- we've talked about this, because there's been a 17 lot of this -- there's a lot of this floating around on the 18 web, and we've had cases involving it, where there is a 19 publicly available website, and within a publicly available 20 website, which is probably 98 percent adult pornography, some 21 Russian has stuck some web video in there that somebody can 22 access that's got a 15-year-old in it, and some guy clicks on 23 it and looks at it. That's not what we're talking about here. 24 I mean, you can't really convict somebody on that. What we're 25 talking about is -- and it'd be impossible probably for law Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 11 of 100 11 1 enforcement to even find that. 2 What we're talking about here is a Tor accessible website. 3 That's already a red flag, number one. These adult -- publicly 4 available adult websites that somebody would just type a search 5 in and get to are not Tor accessible. They're web accessible. 6 And you don't see child pornography on web accessible websites. 7 I mean, predominantly child pornography sites -- that would be 8 something that would be the bonanza for law enforcement if that 9 ever happened. But it's Tor accessible only, number one. 10 Number two, you have to sign up to get into this website, 11 apparently, according to what I've read in your papers. And in 12 doing so, you have to provide a form of payment information, 13 which is bitcoin. I don't think you pay cash. Can you? 14 MS. THOMPSON: No. 15 THE COURT: You can't like give them your bank account 16 number or give them a credit card. It has to be bitcoin, 17 right? 18 MS. THOMPSON: Yes. 19 THE COURT: That's the only way you can pay for this 20 stuff is through bitcoin? 21 MS. THOMPSON: Yes. 22 THE COURT: So he goes on there, and he makes six 23 bitcoin transactions. So what is he buying? 24 25 MS. THOMPSON: That's the question. And I want to just point out that the affidavit does not Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 12 of 100 12 1 say that there is adult pornography on the website. In 2 paragraph 29, when it starts with the details of the 3 investigation, it says, While there may be images depicting 4 adult pornography, that's not the purpose. It's predominantly 5 child pornography. It's just that people are uploading to the 6 website constantly. So they can't monitor the content of the 7 website all the time. Nobody would know what the total content 8 of the website is the whole time. And that's why the affidavit 9 put information in there. The website contains seven and a 10 half terabytes of information at the time this warrant was 11 written. 12 And so there may be adult pornography on there. There's 13 definitely child pornography and child erotica. That's what 14 was seen, and that's what's detailed. And Special Agent 15 Thompson will testify he's been to the website on at least two, 16 if not three, occasions, never saw adult pornography but saw 17 child pornography. 18 So there's -- the conclusion that this is sort of a 19 half-and-half, half adult, half child, is not accurate at all 20 based on what's written in the affidavit and what the website 21 was hosting at the time. 22 THE COURT: And my understanding is that most of this 23 material -- I mean, we're not talking about eastern European 24 17- or 18-year-olds with small breasts who are being portrayed 25 as children. We're talking about very small children. Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 13 of 100 13 1 MS. THOMPSON: Correct. Infants and toddlers. 2 THE COURT: Very small children. Yeah. So there's no 3 question about it. 4 MS. THOMPSON: So yes, I think the affidavit sets out 5 what the website is -6 THE COURT: So let's go through the affidavit. You 7 show me where these various things are. All right? 8 MS. THOMPSON: Paragraph 29 is where they start 9 detailing the investigation and what is on the website. That's 10 where it says there may be -11 THE COURT: You're talking about his affidavit? 12 MS. THOMPSON: Yes, in the search warrant affidavit. 13 I'm sorry. 14 THE COURT: Yeah. All right. Just a minute. It's 15 called "the website 3," right? 16 MS. THOMPSON: Or just "the website." We didn't want 17 the name it at that point because there is still an ongoing 18 investigation of this -19 THE COURT: Well, I don't know what the "3" is. 20 What's the "3"? 21 MS. THOMPSON: Oh, that is a bad footnote. The 3 is 22 just a footnote down to the bottom. 23 THE COURT: Oh, I see. Yeah. Okay. 24 MS. THOMPSON: And so paragraph 29 talks about -- is 25 where I just describe that there may be some images of adult Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 14 of 100 14 1 pornography. 2 THE COURT: Yeah. Right. Okay. 3 MS. THOMPSON: The overwhelming majority is child 4 pornography. 5 THE COURT: Right. 6 MS. THOMPSON: And then paragraph 30 explains that a 7 user can create a free account by providing a username and 8 password. And only with an account can you then go in and look 9 at the material on the website. 10 THE COURT: But you got to download it? 11 MS. THOMPSON: No. 12 THE COURT: You have to buy it to download it? 13 MS. THOMPSON: Right. You have to acquire points and 14 use those points in order to -15 THE COURT: And that's established in here, because 16 I've seen it. 17 MS. THOMPSON: Yes, Your Honor. That's part of 18 paragraph 30 on the next page, is you can upload videos, your 19 own videos, and get points that way. 20 THE COURT: Right. 21 MS. THOMPSON: Or you can pay for a VIP account for 22 six months, which is what law enforcement did, and you get 23 unlimited downloads, or you can just pay for points a little at 24 a time, incrementally, which is what the defendant did in this 25 case. Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 15 of 100 1 15 THE COURT: Okay. Let's get to his conduct. All 2 right? 3 MS. THOMPSON: Additional paragraphs in that same 4 section show the type of material that's available -5 THE COURT: Right, right, right. 6 MS. THOMPSON: -- and what people are searching for, 7 to also establish it's almost exclusively child pornography. 8 Then paragraph 39, which is at issue in the defendant's 9 motion, is part of the investigation into the website cluster; 10 that the FBI used a third-party company to do an analysis of 11 the blockchain, which helped determine which accounts were 12 owned by the child pornography website. 13 After that, when we got that analysis -- and that was my 14 point of, every single bitcoin transaction that's made in the 15 history of the world, whether you're buying drugs, child 16 pornography or clothing -- every bitcoin transaction is 17 recorded and is publicly available for everybody. There's no 18 secret information. It is all contained in that blockchain. 19 And -20 THE COURT: But who belongs to that number is not 21 publicly available? You have to get a subpoena? 22 MS. THOMPSON: Right. And that's part of the analysis 23 they do to see which accounts are clustered together, which 24 ones go together, which ones are being used together. And 25 when -- so then a subpoena was sent. When the analysis -- Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 16 of 100 16 1 THE COURT: To the company that does this? 2 MS. THOMPSON: The company that did that was hired by 3 law enforcement to do the analysis. 4 THE COURT: Right. 5 MS. THOMPSON: And they came back with a list of 6 accounts or wallets that were being used by the child 7 pornography website. 8 THE COURT: And that information is all publicly 9 available? 10 MS. THOMPSON: It's all publicly available. The 11 analysis part is -- it's like paying for a forensic accountant 12 or a CPA to do their analysis. 13 THE COURT: Right. I'm not worried about that. I'm 14 talking about whether -- see, it's a lot different than going 15 into somebody's bank account. You have to have a warrant to do 16 that. 17 MS. THOMPSON: Right. No. All of this is public. 18 And there's -19 THE COURT: Because somebody's bank account 20 information is not publicly available. 21 MS. THOMPSON: Right. No. These are all publicly 22 available, and there's not personally identifiable information, 23 for the most part, exchanged. 24 There is an allegation in the motion to suppress about FBI 25 using a NIT or acquiring some type of private information. Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 17 of 100 17 1 There was no NIT used. A NIT is a network investigative 2 technique, for the record. And Your Honor wrote the first 3 opinion in the Western District of Texas in the Playpen 4 operation, where they did actually use a NIT -5 THE COURT: Right. 6 MS. THOMPSON: -- and sent it out to get the IP 7 address. Nothing like that happened here. None of that -8 THE COURT: I think I said that was private. I can't 9 remember. 10 MS. THOMPSON: Yes. 11 THE COURT: But I did -- that they needed a warrant 12 for that. 13 MS. DOUENAT: Right. 14 MS. THOMPSON: And they had a warrant, but it was from 15 the magistrate judge, not a district court judge. 16 THE COURT: Right. 17 MS. THOMPSON: And at that time the magistrate judge 18 didn't have authority. 19 THE COURT: Didn't have authority to do it. Correct. 20 MS. THOMPSON: Nothing like that happened in this 21 case. They used a third-party company to analyze the 22 blockchain. And then, based on that, they sent a subpoena to 23 Coinbase, which is located in the United States. So they have 24 to abide by and respond to a law enforcement subpoena because 25 they're in the United States. And that's who gave us the Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 18 of 100 18 1 information that -2 THE COURT: Now, why don't they need a warrant to get 3 the information from Coinbase, in your view? 4 MS. THOMPSON: There's no -- that's like any other -- 5 there's no reasonable expectation of privacy in that 6 information. He voluntarily turned that over to Coinbase. 7 THE COURT: Well, you voluntarily turn your 8 information over to your bank. 9 MS. THOMPSON: And I can subpoena a lot of information 10 from your bank. 11 THE COURT: Right. 12 MS. THOMPSON: So it's the same premise. The 13 information he turned over to Coinbase in order to get an 14 account is the information Coinbase then gave us. It was -15 THE COURT: So he has to -- see, that -- he has to 16 give that information to Coinbase in order to open a bit 17 count -- in order to purchase bitcoin? 18 MS. THOMPSON: Right. Now, he could have purchased 19 bitcoin in other ways. But he chose to use this current -- he 20 chose to use Coinbase. And Coinbase -- because once you give 21 bitcoin, you can't get it back. There's no -- it doesn't -22 there's nothing tangible. 23 THE COURT: So if I go -- let me give you -- let me 24 give you an analogy, if I may, that is not exactly on point, 25 but it's not too far off. Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 19 of 100 1 19 Let's say I go to the airport and I'm flying to France and 2 I need euros and I only have dollars and I go to a window to 3 purchase euros, because that's what you do. It's actually 4 called purchasing. You purchase X number of euros in exchange 5 for X number of dollars to pay them the exchange rate, less 6 their commission, right? 7 And most of those places will require you to provide 8 information as to who you are. Right? 9 MS. THOMPSON: This is exactly that same thing. 10 THE COURT: And that information is not private. 11 MS. THOMPSON: Correct. And this is exactly that. 12 They just -- Coinbase requires you to provide a lot of 13 information in order to prevent identity theft. Because, 14 again, once they give out the value, it's gone. 15 And so he provided -- voluntarily provided all of that 16 information to Coinbase in order to get an account. There's no 17 expectation of privacy in the information he provided to that 18 third party. And it was reasonably related to the 19 investigation, which is why they could obtain it. Actually, 20 they used a federal grand jury subpoena. 21 THE COURT: Okay. So the question is, not what you're 22 telling me here, but is any of this information here 23 (indicating)? 24 MS. THOMPSON: Yes. 25 THE COURT: Okay. Because it's what the magistrate -- Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 20 of 100 20 1 what Magistrate Chestney had before her, when she signed the 2 warrant, that counts. 3 MS. THOMPSON: Right. And then section -- paragraph 4 40 starts with the users of the child pornography website, 5 specifically the defendant, and how -6 THE COURT: Is he the Morning Fog person? 7 MS. THOMPSON: Yes. That is his home address. 8 And so that starts with -- the subpoena return to Coinbase 9 gave us his name, date of birth. Coinbase requires a lot of 10 verified information in order to get an account. And so all of 11 that was provided. 12 And then we learned through the subpoena return that six 13 transactions were made within the website cluster on various 14 dates. And those are the ones that are consistent with buying 15 coins on the website. From law enforcement's investigation of 16 how this website works and how you can obtain points, this 17 activity is consistent with purchasing access to child 18 pornography. 19 We don't know what -- at this point -- we know now. But at 20 this point we did not know that he downloaded anything or what 21 he downloaded. But he voluntarily went to the darknet, which 22 is not easy to do. He found the child pornography website on 23 the Tor, which is not easy to do. He signed up using a 24 username and created a password for an account for an almost 25 exclusively child pornography website, and then paid money six Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 21 of 100 21 1 times to that website on various dates. 2 THE COURT: And that's in this affidavit because I've 3 seen it. 4 MS. THOMPSON: That's what the affidavit says. 5 THE COURT: All right. 6 MS. THOMPSON: And from that point, whether he 7 downloaded anything -8 THE COURT: And that, you believe -- that, you 9 believe, provides probable cause to believe that he was using 10 those transactions to purchase child pornography? 11 MS. THOMPSON: Yes. 12 THE COURT: Because they don't sell ice cream bars on 13 that website? 14 15 MS. THOMPSON: Correct. And, in fact, the Fifth Circuit case of United States 16 versus Froman, which is cited in my response, clearly states 17 that membership into a child pornography website leads to the 18 commonsense conclusion that somebody is at least possessing or 19 accessing child pornography. 20 The problem with the defense argument is they're equating 21 probable cause to certainty. And it's "probable" cause. It's 22 a fair probability. And Froman, and there's another case of 23 U.S. v. Flanders in the Fifth Circuit, U.S. v. Gourde from the 24 Ninth Circuit, go into detail about memberships in child 25 pornography websites and how that provides ample probable cause Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 22 of 100 22 1 to go search the defendant's home, even though there's -- I 2 mean, the defendant lives there, but there's no IP address that 3 comes back, necessarily. 4 But if someone is going to go to the effort of joining a 5 predominantly child pornography website, there's a fair 6 probability that they're going to have evidence of child 7 pornography. It's not -8 THE COURT: Well, I'll be honest -- I'll be honest 9 with you. I'd be more -- you may be right. I mean, why would 10 somebody join a child pornography website if they weren't 11 interested in looking at child pornography? 12 But I think where the strength of your case lies with 13 respect to the warrant is not just that he joined the website, 14 but he actually -- you had evidence, and the evidence is laid 15 out in the affidavit, that he actually engaged in bitcoin 16 transactions with that website. 17 Yes? 18 MS. DOUENAT: Yes, Your Honor. And that's where I 19 would argue that there is no proof of such because -20 THE COURT: He doesn't have to have proof. They have 21 to have probable cause. 22 MS. DOUENAT: Right. And even on probable cause, Your 23 Honor -24 THE COURT: Where are you saying that -- so when you 25 say there's no proof -- they had in the affidavit that he Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 23 of 100 23 1 engaged in these transactions. 2 MS. DOUENAT: What they have in the affidavit is that 3 six transactions with bitcoins from a wallet was made, and 4 they're claiming to this cluster they say belongs to the 5 website -6 THE COURT: Right. 7 MS. DOUENAT: -- which was done by a private company. 8 And we don't know how that was analyzed and how they even know 9 that those wallets belong to that website. We don't even know 10 how they can guarantee that those wallets belong to that 11 website. What we do know is, if you look at the wallet -12 THE COURT: Well, they had his name. And they 13 associated it with the bitcoin account that made those 14 purchases. 15 MS. DOUENAT: The wallets -- there was 221 wallets 16 from this cluster, which they claim belonged to that website, 17 which they went to Coinbase and said, Hey, we have this vendor 18 who has, we think, these wallets, these 221 wallets. Now we 19 want you to look at all your clients, Coinbase, every single 20 one of them, and find out who there transacted with these 21 wallets. 22 THE COURT: Okay. 23 MS. DOUENAT: So it's not, We want to know 24 specifically because we think Gratkowski is involved in illegal 25 activity. I want you to look at his wallets and find out all Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 24 of 100 24 1 the transactions he did to these 221 wallets. 2 THE COURT: Well, you don't represent 220 of them. 3 You only represent one. So you have no standing to argue for 4 them. 5 MS. DOUENAT: That one wasn't even on there. That one 6 wasn't even on there. Because the subpoena was issued -- so 7 the 221 wallets they served Coinbase, those are, according to 8 them, xxxxx xxxxx xxxxxx wallets, not our client's wallets. 9 They didn't have our client's transactions or wallets at all in 10 that subpoena. Those were xxxxx xxxxx xxxxxx wallets. They 11 said, Hey, we have xxxxx xxxxx xxxxxx wallets. We want to know 12 who in your database transacted at all with these wallets. And 13 that's one thing. 14 15 The other thing is -THE COURT: Well, I'm not -- I'm not seeing a big 16 problem with that. 17 MS. DOUENAT: Well, if I -- if I were to go to Bank of 18 America and say, I want to know who's written checks to HEB 19 because HEB is drug dealing and so, therefore, they might be 20 involved with drug dealing, look through all your clients and 21 every single database and find out who's written checks to HEB 22 during this time, and I'm going to -- I'm going to start 23 investigating that. 24 THE COURT: Well, the scenario that you've just given 25 me is grossly overbroad. But we're talking about 221 out of Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 25 of 100 25 1 how many subscribers of this thing? 2 MS. DOUENAT: This is one individual that they're 3 claiming has 221 wallets. 4 THE COURT: Yeah. 5 MS. DOUENAT: They're saying that the blockchain 6 analysis figured out that these clusters belonged to Xxxxx 7 xxxxx xxxxxx. 8 THE COURT: Okay. All right. You want to -- 9 MS. DOUENAT: And we don't know even how that was able 10 to be -11 THE COURT: All right. Just a minute. Let her 12 respond to that. All right? 13 MS. DOUENAT: Sure. 14 MS. THOMPSON: Yes. The blockchain analysis led us to 15 the conclusion -- or concluded that "the website" -- and I 16 would ask that the name of the website be redacted because 17 there is an ongoing investigation still, and leads have not 18 been -19 THE COURT: It's called "the website." I don't know. 20 That's what I have. 21 MS. THOMPSON: Defense counsel keeps naming the actual 22 site. 23 MS. DOUENAT: Your Honor, I will now refer to it as 24 "the website." 25 THE COURT: All right. Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 26 of 100 1 26 MS. THOMPSON: And that they are all -- they are owned 2 by the website. And that's done so that each person can 3 have -- that's not all of them. Those are the ones that 4 Coinbase had. There are other -5 THE COURT: Basically what she's suggesting is that 6 you had a shotgun approach, and you just happened to come 7 across the defendant. 8 MS. THOMPSON: Kind of. We knew that these wallets 9 were being used by a child pornography website. And so we 10 asked Coinbase, because they're located in the United States 11 and will respond to our subpoena, unlike a company in Korea -12 THE COURT: Bulgaria. 13 MS. THOMPSON: Right. And they said -- 14 THE COURT: I had that, too. 15 MS. THOMPSON: -- Here are -- Here are the owners of 16 the accounts that have transacted with your wallets. And Agent 17 Thompson does a better job explaining. But if I'm selling 18 cupcakes and -- I can't just have one wallet that everybody 19 sends bitcoin to because then I don't know how many cupcakes 20 you bought. 21 So when you sign up on my website and order two cupcakes, I 22 give you a wallet that I own but you put money in it. And I 23 give defense counsel another wallet, so that when she orders 24 cupcakes -- so I know who's paid for cupcakes. 25 It's all of those that were owned by the child pornography Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 27 of 100 27 1 website, that we asked Coinbase about. Who are the owners of 2 accounts that have transacted -- that have sent money to this 3 child pornography website. And then in that list the defendant 4 came up. Until then, we didn't know his association. We 5 didn't know most of those people's association. 6 Paragraphs 36 through 39 explain the reliability of the 7 analysis; that they had accounts where, based on the wallet 8 number and the username, they could connect them. So we knew 9 from that that the analysis that was done was correct; that 10 those wallets were being used by people to pay for child 11 pornography. 12 And so that was our reasonable belief to go to Coinbase and 13 say, Who's putting money in these wallets? Who is paying this 14 child pornography website? Because you have to be a member in 15 order to get an account in order to send the money. And they 16 provided information on all of those. And law enforcement 17 looked and saw the defendant and all of his information, and 18 that six transactions were made at various dates and times. 19 That's when then they did research -- or investigation into 20 him, found out that he was a special agent with Homeland 21 Security. It was Homeland Security and IRS that were the 22 original agencies investigating the child pornography website. 23 But because he had access to the Homeland Security 24 Investigation database, they reached out to the FBI in 25 San Antonio and asked them to take over this part of the Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 28 of 100 28 1 investigation, to avoid any conflict. And that information was 2 all sent to Special Agent Thompson. 3 THE COURT: You know, it seems quite analogous to a 4 situation which occurred on the East Coast where you have a 5 madam running a very large prostitution, call -- we used to 6 call call girl ring. Is it call woman ring now? I don't know. 7 I want to be politically correct here. 8 And this person keeps records, keeps books of who the 9 customers are. And there may be hundreds, may be thousands. 10 And law enforcement subpoenas those records. Well, they've got 11 the information. They've got the names. They've got the 12 addresses. They've got the numbers of times this individual 13 has been there. The fact that it's extensive, I don't think 14 these people have an expectation of privacy in illegal 15 prostitution rings' books. 16 MS. DOUENAT: So, Your Honor, as far as the books for 17 the website, those were not subpoenaed to find out who has 18 usernames and passwords and what their wallets are. 19 THE COURT: Yeah. But -- 20 MS. DOUENAT: So -- 21 THE COURT: -- where is the -- where has your client's 22 expectation of privacy been violated here, specifically? You 23 tell me. Where? 24 MS. DOUENAT: Well, for one, they asked for -- to look 25 into his accounts at a bank, Coinbase. He's got -- Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 29 of 100 1 THE COURT: It's not a bank. 2 MS. DOUENAT: -- Coinbase. 3 THE COURT: Coinbase is not a bank. Coinbase is a 29 4 processing service. It's not a bank. 5 MS. DOUENAT: And they asked that -- Coinbase to run 6 its own little search to find out -- not just give us 7 So-and-so's information and find out who he's transacted with. 8 They said, I want every single person who's ever transacted 9 with this website. I want you to give me that information. 10 THE COURT: Well, because they had -- there we are. 11 We're right back to the prostitution ring. They already have 12 information in hand that -- unlike HEB, which you gave me, 13 which sells legitimate groceries and then you're saying 14 somebody in HEB might be peddling drugs on the side. What 15 we've got here is an organization, i.e. the child pornography 16 website, that does exclusively one thing, and it's illegal. 17 MS. DOUENAT: Well, it's not -- child erotica is not 18 illegal. So it's not exclusively -- and also, the agent did 19 testify there was adult pornography on that website at the 20 preliminary hearing. It's not in the affidavit. But he did 21 testify to that. So I'm not saying that it's not more child 22 pornography or not. I don't know. What I do know is that 23 there's child erotica, child pornography. Child erotica is 24 legal. Child pornography isn't. 25 But what I'm also wanting the Court to know is I'm not even Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 30 of 100 30 1 acknowledging that those wallets belong to the website. 2 Because there's no -- they have not made that link. They just 3 said that some blockchain analysis firm, a third party, does 4 some kind of analysis of this huge ledger and are able to form 5 clusters and decide, Oh, those may belong to this. But the 6 accuracy of that, we do not know. We don't know if that's 7 accurate. 8 I do know another thing; that if you do a transaction from 9 the wallets that they have, the 221 wallets that they gave to 10 Coinbase, and you put those wallets inside Blockchain Finder to 11 find out where it's been, there is no direct link between what 12 they're saying was the transactions that Mr. Gratowski made to 13 that website. There is no direct link that this money went 14 straight into this wallet. That is not true. 15 This transaction made multiple transactions with other 16 wallets before it even reached to this wallet. So we don't 17 know what goods or services this transaction paid. But in some 18 point in this link that wallet number is in there. And that's 19 where it's not listed. They're making it sound like it's just 20 a direct buy. So I am buying and putting money from this 21 account to this account, period. And that's not the case. 22 MS. THOMPSON: I'm not sure where she gets that 23 information. That's not the understanding I have or that's set 24 forth in the search warrant affidavit. And Special Agent 25 Thompson is happy to testify about how this whole process Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 31 of 100 31 1 worked, because I don't believe that that is accurate. I don't 2 know where that information comes from. 3 THE COURT: Well, right now I'm just trying to decide 4 whether there's enough information -- enough smoke for a Franks 5 hearing. So I'm just looking at the affidavit right now. I 6 can't look outside the affidavit. 7 And I don't think, right now, from what I've seen, that 8 there's enough smoke to create a Franks hearing request. I 9 just don't see it here. I think they had plenty of probable 10 cause. And I'm going to deny the Franks hearing on the 11 affidavit. There just isn't enough here for a Franks hearing. 12 Now, Counsel, you know I hold no brief for the government. 13 I ruled against them in the pigpen [sic] case, and that was a 14 big ruling, where I felt that they needed to get a warrant. 15 But I'm not seeing it here. It just isn't here. 16 17 So what is your next argument? MS. DOUENAT: My next argument, Your Honor, is that -- 18 exactly what I argued also in the Franks hearing just now, is 19 that the way blockchain analysis works, we don't have a 20 certainty that those wallets belong to that website, and we 21 have no certainty that those transactions, they're alleging 22 were made by Mr. Gratkowski, went to buy anything -23 THE COURT: All right. Well -- 24 MS. DOUENAT: -- illegal or that it went directly to 25 that wallet. Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 32 of 100 32 Thompson - Direct 1 2 THE COURT: I understand your argument. Why don't you call your witness, and let's hear what he has 3 to say. All right? 4 MS. THOMPSON: Thank you, Your Honor. Government 5 calls Special Agent Jim Thompson. 6 7 8 COURTROOM DEPUTY: Please raise your right hand. (The oath was administered) COURTROOM DEPUTY: Thank you. Be seated. 9 JAMES THOMPSON, GOVERNMENT'S WITNESS, SWORN 10 DIRECT EXAMINATION 11 BY MS. THOMPSON: 12 Q. Special Agent Thompson, where are you employed? 13 A. At the FBI here in San Antonio. 14 Q. How long have you had that employment? 15 A. I've been in the FBI since -- this is my 15th year, in 16 November. I've been in San Antonio since 2009. 17 Q. What did you do prior to joining the FBI? 18 A. I was a network engineer in the private sector. 19 Q. What is your educational background? 20 A. I have a bachelor of science from Georgia Tech and a master 21 of arts from the University of Tennessee, and ABD Ph.D., didn't 22 finish Ph.D., from Tennessee. 23 Q. What's your current assignment within the FBI? 24 A. I'm dedicated to crimes against -- Violent Crimes Against 25 Children squad as an investigator. Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 33 of 100 33 Thompson - Direct 1 Q. And what are your duties with regard to that assignment? 2 A. We investigate child pornography and obscenity-type crimes 3 as well as human trafficking and those types of violations. 4 Q. Do you have training specifically related to crimes against 5 children investigations? 6 A. I do. 7 Q. Do you have training and experience related to computer 8 forensics? 9 A. I do. 10 Q. Describe that, please. 11 A. I'm certified by the FBI as a digital extraction 12 technician. That's part of the CART program, the computer 13 readiness team program. 14 Q. Do you have experience related to the darknet and Tor? 15 A. Through investigations that we have had, I've dealt with 16 Tor and darknet material. 17 Q. Is there any sophistication required to access -- to use 18 Tor? 19 A. Certainly, you have to download specialized software. And 20 then you have to be able to find the particular websites. So 21 you generally have to know of indexing services that contain 22 information that are going to lead you to child pornography 23 websites or forums where you can get these types of links. You 24 have to go out of your way to find them, for sure. 25 THE COURT: Let me ask you a question, Agent, because Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 34 of 100 34 Thompson - Direct 1 I think it needs to be on the record. I have heard this 2 testimony before, but I don't know -- I mean, that's not in 3 this record. My understanding is that well in excess of 99 4 percent of all child pornography that can be accessed on the 5 web is accessed through one of these darknet websites. Is that 6 true? 7 THE WITNESS: I mean, I don't know that I want to -- 8 THE COURT: Except for person-to-person transfers. 9 THE WITNESS: Right. 10 THE COURT: So John knows Bill. And so he sends over 11 stuff to Bill. And then Bill sends it back to John. 12 THE WITNESS: Right. So that peer-to-peer software. 13 THE COURT: Peer-to-peer stuff, yeah. But outside of 14 that, they don't -- you don't find child pornography generally 15 on one of these publicly accessible adult websites? 16 THE WITNESS: Correct. It's very dangerous to do that 17 for whoever's operating that website. They would have to live 18 in a country where law enforcement would not contact them about 19 that. 20 THE COURT: Yeah. I would think. And so am I right 21 that 99 -- because I am told -- I was told by -- and I think it 22 was either -- it was your case I think. An FBI agent or -- I 23 don't know whether it was -- what's the other agency that 24 investigates this? 25 MS. THOMPSON: Homeland Security investigates. Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 35 of 100 35 Thompson - Direct 1 THE COURT: Homeland Security agent, that they 2 concentrate their activities on these Tor-type browsers. 3 THE WITNESS: Certainly. And certainly it's the more 4 sophisticated, technologically savvy people -5 THE COURT: Well, that's the point she's trying to 6 make, is that if you're there, you're there for a purpose. 7 THE WITNESS: Right. 8 THE COURT: Now, I'm sure there are people who just go 9 on the Tor network because they're privacy advocates, and they 10 believe that the whole world is chasing them around, you know. 11 And so they want to hide their activities from government or 12 something like that. But with respect to websites that have 13 pornography on them, is it likely that you would find regular, 14 legal adult pornography in a Tor website? 15 THE WITNESS: There is legal pornography on the Tor 16 website. It does exist. So yes. Well, I don't want to 17 comment outside that. But yeah, it does exist on the darknet. 18 But certainly you're right, that the majority of illegal 19 content that's hosted via web browser, web accessible, would be 20 darknet-type material. 21 THE COURT: Darknet. 22 THE WITNESS: Because it's too hard to operate it in 23 the clear. 24 25 THE COURT: Right. Okay. Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 36 of 100 36 Thompson - Direct 1 BY MS. THOMPSON: 2 Q. And how are websites named? Like, if I'm using the regular 3 internet, I can Google "movies" and get a list of movies, or I 4 can Google "HEB." How would I find a child pornography website 5 on the Tor? 6 A. Well, you know it's a Tor website because the URL, the 7 address, is going to end in .onion. So that's going to -8 that's going to let the Tor browser know that I'm supposed to 9 handle this request. 10 But then all the letters and strings of characters in front 11 of the .onion are generally pseudorandom or gibberish 12 characters because they really represent cryptography. And so 13 they're difficult to remember long strings of characters 14 .onion. 15 So generally the way people will find these sites -- or a 16 way people find these sites is through indexing sites that are 17 present on both the clearnet and the darknet, that categorize 18 what's available on the darknet in terms of categories for 19 drugs, for child pornography, for illicit weapon sales, that 20 type of thing, and that will have links to child pornography 21 websites that way. 22 Q. Someone has to do some research? 23 A. Yeah. You have to -- you have to -- you have to either 24 know someone on a forum, a message board who's posting links to 25 this stuff, or find indexing sites. Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 37 of 100 37 Thompson - Direct 1 THE COURT: So you're not going to be able to go on 2 Google? 3 THE WITNESS: Correct. You cannot Google search, 4 right. 5 BY MS. THOMPSON: 6 Q. Is it common to stumble across a child pornography website? 7 A. I think -- you have to go out of your way to find it, and 8 then -- you have to install the Tor browser first, and then 9 have that onion link, and then use Tor to go -- so no. 10 Q. How did this case come to your attention? 11 A. So it was brought to our attention through DHS and IRS who 12 were conducting an investigation of the captioned child 13 pornography website. 14 Q. And you were specifically chosen by your supervisor? 15 A. Correct. 16 Q. You testified you had familiarity with bitcoin and a 17 technical background? 18 A. Right. 19 Q. What information were you provided when you received the 20 investigation? 21 A. Well, this investigation came on the heels of an almost 22 identical investigation where this same investigative technique 23 had been used to undercover a Border Patrol agent who was a 24 member of the same website. And so we had just corroborated 25 all that information. Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 38 of 100 38 Thompson - Direct 1 But basically, IRS Criminal Investigations Division gave us 2 the fruits of their investigation, which was the result of 3 their subpoenas to Coinbase, the results of their own -- their 4 own blockchain analysis, plus the third party blockchain 5 analysis that had been done. 6 Q. So DHS and -- or HSI and IRS had already identified the 7 defendant as a suspect? 8 A. Correct. 9 Q. And that's why the FBI was asked to handle the case? 10 A. Yes. 11 Q. Along with the Border Patrol agent? 12 A. Right. 13 Q. Describe what you knew in general terms about the child 14 pornography website that they had been investigating. 15 A. So I visited the website to confirm that what they said was 16 child pornography agreed with my definition of that. And it 17 did comport with that. 18 I will say, I visited the website on three different 19 occasions to document the contents of the website for the file, 20 and I never saw adult pornography, nor did I see child erotica 21 in my three times visiting the site. It was exclusively child 22 pornography. 23 THE COURT: Well, okay. Maybe you can identify. What 24 is -- because defense counsel made a point of this. What is 25 the difference between child erotica and child pornography? Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 39 of 100 39 Thompson - Direct 1 THE WITNESS: So the erotica might be -- you might see 2 it in terms of young children in sexually suggestive poses but 3 who are clothed or wearing bathing suits. It's sometimes 4 called modeling sites. Some of this material might also take 5 the form of animated or drawn images of children, that type of 6 thing. 7 THE COURT: Okay. 8 BY MS. THOMPSON: 9 Q. Did you draft the search warrant affidavit that's the 10 subject of today's hearing? 11 A. I did. 12 Q. Is that information contained in the affidavit true and 13 correct such that it would be your testimony today? 14 A. It is. 15 Q. Does the content of the website change? 16 A. It does. 17 Q. How? 18 A. Users upload new content to the website, which the 19 administrators then put on the website so it will rotate 20 through the various features. 21 Q. And one of the ways I can acquire points on the website is 22 to upload videos to the website that are then available to 23 other people? 24 A. Correct. 25 Q. Could I upload the same video numerous times? Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 40 of 100 40 Thompson - Direct 1 A. No. The website had a hash check. So every file can be 2 put through a mathematical formula, which generates a hash 3 value which is unique to that file. And so the website would 4 check the file you were attempting to upload against their 5 existing database of files. And if it already existed, it 6 would not allow you to upload it. 7 Q. And the upload page of the website gives what instruction 8 with regard to adult pornography? 9 A. It says in red bold type, Do not upload adult porn. 10 Q. How does one create an account? How do I become a member? 11 A. You simply register a username and password with the 12 website. 13 Q. Based on the investigation of the website, are those 14 verified at all? 15 A. No. There's no email address like you might have on 16 conventional websites. You simply pick a username and a 17 password to let you in. 18 Q. So my username could be RexMiller? 19 A. Yeah. It could be anything. Yes. 20 THE COURT: I hope there's not a Rex Miller around. I 21 was teasing. I know exactly who he is. 22 MS. THOMPSON: I usually use Sarah. I thought I'd 23 give her a break. 24 THE COURT: You'd give her a break. 25 MS. WANNARKA: Thank you. Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 41 of 100 41 Thompson - Direct 1 THE COURT: I know who Agent Miller is. 2 BY MS. THOMPSON: 3 Q. Can you view the information on the website without 4 becoming a member? 5 A. No. You have to register with the username and password -6 or you had to. It doesn't exist anymore. 7 Q. And so once I have a membership, a username and a password, 8 what do I get to see? 9 A. Then you can then view the various sections of the website. 10 So I'm just going off memory, but they had a section called -11 I think it was called "best," which had, I think, the most 12 popular videos. And then they had -- I'm not -- I'd have to 13 look at my notes to see exactly which sections. But there were 14 various categories that you could access. 15 Q. Am I limited by time? Am I kicked off after ten minutes or 16 an hour? 17 A. No. You can view as many of the thumbnails of the videos 18 as you wanted. There's no time limit. 19 THE COURT: Are they downloadable, file's longer 20 versions? Are the thumbnails teasers? 21 THE WITNESS: Correct. So it's generally videos. And 22 so you have the still thumbnail of the video. And then when 23 you downloaded it, you would get the video. 24 THE COURT: Oh, so you don't actually get the video. 25 You just get a little teaser? Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 42 of 100 42 Thompson - Direct 1 THE WITNESS: Correct. You get a still image or a set 2 of images from the -3 THE COURT: Okay. 4 BY MS. THOMPSON: 5 Q. Before I purchase anything, if I just establish a 6 membership, I can go on and see a series of still images of 7 what that video's going to show me? 8 A. Correct. 9 Q. Maybe 16 at a time or something? 10 A. And some of them are just one still image. But others were 11 like a grid of still images that showed you various points in 12 time. But a video, you would download. 13 Q. And if I wanted the entire video, I had to pay for that? 14 A. Right. You had to have points. And those points would be 15 used for downloads. 16 THE COURT: So if somebody's just watching the video, 17 obviously, that's not legal either, but very difficult to catch 18 that person versus somebody that's actually downloaded it? 19 THE WITNESS: I don't know that there's a difference 20 between the two as far as -- I actually don't know if you could 21 just play the video right there on the page or download it as a 22 file. I'm not sure about how that happens. 23 THE COURT: But you wouldn't pay for it if you were 24 just watching it? 25 THE WITNESS: Yeah. You would have to pay for it in Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 43 of 100 43 Thompson - Direct 1 order -2 THE COURT: Oh, you would have to pay for it in order 3 to watch it? 4 THE WITNESS: Correct. The only thing -- 5 THE COURT: So in that case you would have the same 6 evidence? 7 THE WITNESS: Yeah. 8 THE COURT: But if you didn't have to pay for it, then 9 there would be no way for you to really trace them, would 10 there? 11 THE WITNESS: Correct. Right. 12 THE COURT: Yeah. But they paid for it to watch it? 13 THE WITNESS: Right. 14 MS. THOMPSON: Correct. 15 THE COURT: Okay. All right. I did not -- I did not 16 understand that. 17 BY MS. THOMPSON: 18 Q. So without paying for anything, if I just open a 19 membership, give them a username and password, I see 20 thumbnails? 21 A. Correct. 22 Q. The still images of what is going to be on that video? 23 A. Right. 24 Q. But I don't get to play the video? 25 A. Correct. Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 44 of 100 44 Thompson - Direct 1 THE COURT: So if you click on the thumbnail, it's 2 going to ask you to deposit your payment? 3 THE WITNESS: For points, right. 4 THE COURT: Points. I see. Okay. And then you could 5 either view it or download. It would be the same cost? 6 THE WITNESS: Like I said, I'm not sure because I 7 never actually played any of the videos. So I'm not sure if it 8 would play in your browser or download as a file to your 9 computer. I don't know which one it did. 10 BY MS. THOMPSON: 11 Q. And there were different -12 THE COURT: Well, the allegations here is that the 13 videos were downloaded, aren't there? 14 MS. THOMPSON: Well, the allegation in the search 15 warrant is that he made six payments to that website. We don't 16 know whether -- at the time the affidavit was written, we don't 17 know if he downloaded anything. 18 THE COURT: Okay. 19 MS. THOMPSON: We know he made six payments on six 20 different dates. 21 THE COURT: You contend now that he did, though? 22 MS. THOMPSON: Yes, we know now he did. Yes. 23 Since the execution of the search warrant in this case in 24 January, I think it was in March or April that the website was 25 taken down. It was located in Seoul, Korea. And so law Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 45 of 100 45 Thompson - Direct 1 enforcement has been able to take down the website. But they 2 hadn't taken it down yet at the time that this search warrant 3 was done. It was still operational. 4 THE COURT: Viable. 5 BY MS. THOMPSON: 6 Q. How do I get points, because I can't put money -- send 7 money directly to the website? So how do I get points? 8 A. So when you register with that username and password, the 9 website issues you a bitcoin address to send payments to. So 10 that address belongs to you. It's owned by the website, but 11 you are instructed to send payments to that specific address. 12 Q. Is that also known as a "wallet"? 13 A. Yes. And so that -- yes. That address is a wallet. And 14 you are instructed to send payments in bitcoin to that specific 15 address. That way you can be credited for points to the 16 website. 17 Q. Can individuals upload videos of child pornography in order 18 to obtain points? 19 A. Yes. There was an upload section. 20 Q. For the record, let's talk about bitcoin. What is it? 21 A. So bitcoin is a virtual currency. So it's run on a 22 peer-to-peer network where all the nodes participate in 23 authenticating transactions to the network. 24 Q. Are there various types of virtual currency? 25 A. So bitcoin's probably the most well known and the original Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 46 of 100 46 Thompson - Direct 1 virtual currency, but there are other alternate 2 cryptocurrencies that are out there now. Litecoin, Ethereum. 3 There's hundreds at this point. 4 Q. And when someone buys bitcoin, how do they use it? How 5 does that work? 6 A. You can use bitcoin as an investment. So it's worth -- on 7 any given day it's worth a certain amount of U.S. dollars or 8 euros or whatever your currency is, or some online stores will 9 accept bitcoin as payment. More commonly I think bitcoin is 10 used in the criminal underground as a method to pay for illicit 11 goods and services. 12 Q. How do I buy it? Where do I go? 13 A. There's a number of ways you can buy bitcoin. You can 14 go -- probably the most common way for a generic American 15 person to buy bitcoin is to go to a place like Coinbase where 16 they are willing to exchange dollars for bitcoins. 17 THE COURT: How do you sell bitcoin, let's say if you 18 were using it for an investment? You go back to them? 19 THE WITNESS: Right. So that would probably be the 20 most common for -- if you're investing in it, you would 21 probably go to a service like a Coinbase. And so you buy it at 22 a certain point and hold it for a certain amount of time, 23 hoping that the value goes up, and then sell it. 24 THE COURT: And they would take a commission? 25 THE WITNESS: They take a commission on every sale, Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 47 of 100 47 Thompson - Direct 1 yes. 2 THE COURT: All right. Now, let's make it clear. My 3 understanding is that there is nothing inherently illegal about 4 buying or selling bitcoin or about possessing bitcoin or using 5 bitcoin? 6 THE WITNESS: That's correct. 7 THE COURT: For legal purposes? 8 THE WITNESS: Right. 9 THE COURT: Okay. Just like there's no -- nothing 10 inherently illegal about using United States currency. There's 11 something illegal about using United States currency to 12 purchase illegal goods, drugs, pornography, but there's nothing 13 illegal about going to the grocery store and buying a can of 14 milk? 15 THE WITNESS: That's absolutely correct. Bitcoin 16 itself is not illegal. 17 THE COURT: It's what you do with it? 18 THE WITNESS: Correct. 19 BY MS. THOMPSON: 20 Q. And there are various ways to buy it. Could I buy -- I 21 could buy it online, or I could buy it at a building that is a 22 currency exchange down on San Pedro? 23 A. That's correct. There are -- there are in-person places 24 where you can buy bitcoin for cash like that as well. 25 Q. Now, the currency exchanges like Coinbase are -- well, is Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 48 of 100 48 Thompson - Direct 1 Coinbase -- Coinbase has specific requirements that they ask 2 you to meet in order to sell you bitcoin; is that right? 3 A. That's correct. Selling bitcoins is inherently risky, 4 because once you -- once the transaction happens, you can't get 5 it back via some automated method. The only way to get your 6 money back is if you get the person you sold it to to willingly 7 give it back to you. So it's a one-way transaction. So once 8 the bitcoin leaves your possession and goes into another 9 wallet, it's final. 10 And so in general, if you're going to buy bitcoin, an 11 organization like Coinbase needs you to link your bank account 12 or prove your -- to prove you're not using a stolen credit card 13 or some other shady method of payment. 14 Q. Is it difficult to obtain a Coinbase account, or can it be 15 difficult to obtain a Coinbase account? 16 A. It certainly has been in the recent -- you know, in the 17 recent year bitcoin rose to almost $20,000. During that time a 18 lot of people wanted to purchase bitcoin as an investment and 19 overwhelmed services like Coinbase so that it took days or 20 sometimes weeks for them to process your new account and 21 approve it. 22 Q. What identifying information was used by Mr. Gratkowski in 23 order to obtain his Coinbase account? 24 A. So his true bank account at USAA, as well as I believe 25 credit cards through USAA. Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 49 of 100 49 Thompson - Direct 1 Q. Were you made aware of -- or did he also use his driver's 2 license? 3 A. Correct. Yes. 4 Q. Did he also use his government issued passport? 5 A. I've not seen that, but that is what IRS CI provided to me 6 as how he was identified as a government employee and a person 7 of interest in this case, was his official government passport 8 was used as identification. 9 THE COURT: Is that different from a typical passport 10 that a person would get? 11 THE WITNESS: Right. That's a U.S. government -- 12 well, I guess a personal one is as well. But it's an official 13 passport that indicates you're on official U.S. government 14 business for the government. 15 BY MS. THOMPSON: 16 Q. Are you aware of an FBI agent in San Antonio that was 17 unable to acquire a Coinbase account for quite sometime? 18 A. There may have been members on our squad who have attempted 19 that. 20 Q. Even though they have top secret clearance? 21 A. Correct. And that was, again, due the volume of people who 22 were all trying to establish accounts in the rush up for 23 bitcoin. 24 Q. It's not always an easy process? 25 A. Correct. Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 50 of 100 50 Thompson - Direct 1 Q. How do -- technically, how do I pay using bitcoin? How do 2 I send that to somebody and know that they get it? 3 A. There's a variety of ways to hold bitcoin. So let's go 4 through the most common scenario where you're using Coinbase. 5 In that instance Coinbase is going to hold the bitcoin on your 6 behalf. So you're going to have a username and password to 7 your Coinbase account, and you'll log into that to make the 8 transaction. 9 The original way to trade and use bitcoins is to install 10 the bitcoin software on your computer. And when you do that, 11 it downloads the entire blockchain for bitcoin and stores it 12 locally on your computer. And your computer participates in 13 the peer-to-peer transactions that is the bitcoin network. 14 When you do that, your wallet is stored locally on your 15 computer, and your wallet is cryptographically secure. And you 16 have -- there's an interface that you can use to send payments 17 to another wallet. So it literally has a send function. And 18 you paste in the person -- the wallet address that you want to 19 send payments to and click "send." 20 Q. Why would I use Coinbase if I could download the bitcoin 21 software and do it myself on my computer? 22 A. That's a certain amount of technical understanding and know 23 how that's required to store it locally on your own computer. 24 You adopt some risk storing bitcoin locally on your own 25 computer. If your hard drive crashes, that bitcoin is lost Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 51 of 100 51 Thompson - Direct 1 forever. On the other hand, if you use a service like Coinbase 2 to store your coins, you have to trust Coinbase, that they 3 won't run off with your coins or get hacked and have bitcoins 4 stolen, which has happened to other sites, not Coinbase. 5 Q. Are bitcoin transactions recorded? 6 A. Yes. All bitcoin transactions are recorded in that public 7 ledger that's called the blockchain. And that's what's 8 downloaded -- when you install that bitcoin software on your 9 computer, that's what's downloaded, the entire blockchain, the 10 entire ledger of every transaction that has ever happened. 11 Q. And that must be enormous? 12 A. It's very large. I think -- I forget how many gigabytes it 13 is at this point, but I think it's around 150 plus. 14 Q. So that would be another reason to use Coinbase instead 15 of -16 A. Yeah. If you don't want that big file existing on your 17 computer, yeah, you use Coinbase. 18 THE COURT: Now, Coinbase is not insured by the 19 Federal Deposit Insurance Corporation, is it? 20 THE WITNESS: I don't know off the top of my head. 21 THE COURT: Okay. It's not a -- it's not a bank? 22 THE WITNESS: I don't -- I don't believe it's 23 government insured, but I can't say for sure without -- I'd 24 have to do some research. 25 THE COURT: Okay. Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 52 of 100 52 Thompson - Direct 1 BY MS. THOMPSON: 2 Q. I know that if they're operating in the United States, they 3 have to collect identifying information about their customers 4 and verify their identity under the Bank Secrecy Act, but I 5 don't think it's -6 THE COURT: FDIC insured. 7 MS. THOMPSON: I don't think they're insured. 8 THE COURT: I don't think so either. 9 BY MS. THOMPSON: 10 Q. What is blockchain analysis? 11 A. So the -- since the blockchain contains every bitcoin 12 transaction that's ever occurred, you can use software to 13 analyze those transactions. And so you can make conclusions 14 from that. So do you want me to kind of go into how criminal 15 schemes may operate? 16 Q. Yes. And how it worked in this case. 17 A. Okay. So it may be common in, say, criminal use of bitcoin 18 to pay for criminal services, for the criminal element to 19 generate a number of unique wallets that belong to them, so in 20 this case the website, but that are assigned to individual 21 users of the website. So each of those wallets, while 22 technically controlled by the website, are assigned to users of 23 the website where they can deposit bitcoin for credits. 24 And so it's possible through blockchain analysis to -- so 25 the website entity controls, let's say, hundreds of individual Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 53 of 100 53 Thompson - Direct 1 wallets. At a certain point the owners of the website are 2 probably -- I'm not saying -- and this is a hypothetical 3 because I did not do the blockchain analysis, and I do not 4 necessarily understand exactly how the third party blockchain 5 analysis works its magic either. 6 But I can make some assumptions, and so these are those; 7 that if you control hundreds of wallets, what will happen is at 8 a certain point you are going to flush those wallets into a 9 central wallet that you control so you can exchange those for 10 cash. And so those would produce noticeable patterns on the 11 blockchain where we can see that all of these wallets 12 eventually contributed their money to one wallet. 13 Now, they may have other middle wallets in between those 14 two as well. In fact, it's very common for the criminal 15 element to use something called a bitcoin mixer service. 16 That's common on the underground. And what that tries to do is 17 thwart blockchain analysis by funneling transactions through 18 multiple different bitcoin wallet before they get to their 19 final -- their final destination. 20 And so the use of bitcoin mixers is to attempt to throw off 21 third-party services that do blockchain analysis, which is why 22 you may see a circuitous route from Point A to Point B. 23 Q. Was the blockchain analysis that was done in this case 24 shown to be reliable? 25 A. Right. So that was the part of the affidavit where I was Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 54 of 100 54 Thompson - Direct 1 trying to show that it had proved -- it'd proven historically 2 accurate in the past. And like I said, we had just come off 3 the heels of the other Border Patrol case with this exact same 4 website and the exact same set of investigators that gave me 5 the information that they gave me. 6 But we also show in the affidavit that we were -- the 7 blockchain analysis company has been historically correct in 8 their analysis, and that they were specifically correct in the 9 results of subpoenas from Coinbase that showed us users that 10 were attributable as providing bitcoin to wallets controlled by 11 the website cluster. 12 Q. And those are the paragraphs 38 and 39? 13 A. Right. 14 Q. You're familiar with the FBI's investigation of what was 15 eventually called Playpen? 16 A. Yes. 17 Q. Or Pacifier. 18 The network investigative technique that was used in that 19 case, was anything like that used in this investigation? 20 A. No. 21 Q. Prior to you obtaining the case, did law enforcement agents 22 download child pornography from the website? 23 A. They did. 24 Q. Did that happen on multiple occasions? 25 A. It did. Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 55 of 100 55 Thompson - Direct 1 Q. What did you do when you received the information that 2 you've described? 3 A. We do various database checks. I did attempt -- did visit 4 the website in question to verify that it did contain child 5 pornography. We did normal pre-surveillance-type activities 6 and that type of thing. 7 Q. And were you able to verify the information that the 8 defendant gave to Coinbase as far as his address and date of 9 birth and driver's license number? 10 A. Correct. 11 Q. If someone sends bitcoin to this child pornography website 12 to obtain points, are those points transferable to any other 13 website that you know of? 14 A. No. That system was unique to this website. It's not 15 another virtual currency. It's points specifically for this 16 website. 17 Q. And how many times, based on the information you had, did 18 the defendant buy points on the child pornography website? 19 A. There was six different occasions. 20 Q. Did you know his username on the website? 21 A. No. We didn't need to know the username, so that all we 22 needed to know was the wallet that was controlled by the 23 defendant's Coinbase account was used to transfer bitcoin to 24 the wallets controlled by the website. 25 Q. You knew he had bought points on the child pornography Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 56 of 100 56 Thompson - Direct 1 website six times. Did you know whether or not he had 2 downloaded any material at that time? 3 A. We did not. 4 Q. Have you since been made aware of whether he's downloaded 5 material? 6 A. Yes. We have that information now. 7 MS. THOMPSON: Your Honor, I believe that's all I have 8 with regard to the -- oh, no. That's not all I have. 9 BY MS. THOMPSON: 10 Q. You drafted the search warrant application? 11 A. I did. 12 Q. Was it sent to Magistrate Judge Chestney's chambers on 13 January 2nd of 2018, probably some time after 5:00? 14 A. That sounds correct. I'd have to look at my notes to 15 verify it for sure. But yes, that sounds right. 16 Q. Did you appear in her chambers on January 3rd? 17 A. Yes. 18 Q. Did she sign the search warrant? 19 A. She did. 20 Q. Did she ask you any questions about it? 21 A. I don't think so. I don't recall any questions that were 22 asked. 23 Q. Did you provide any additional information to her prior to 24 her signing the search warrant? 25 A. No. Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 57 of 100 57 Thompson - Direct 1 Q. After she signed the search warrant, was there a 2 conversation about the defendant being a law enforcement 3 officer? 4 A. I remember we remarked upon the seriousness of him being a 5 law enforcement agent. 6 Q. Was that the only conversation with the judge at the time 7 the search warrant was signed, that you recall? 8 A. That's all I recall. 9 Q. When she signed the search warrant, what did that mean to 10 you? 11 A. That we were authorized to execute the warrant. 12 Q. And that was a search warrant for the defendant himself, 13 his house and his vehicles? 14 A. Yes. I believe that's right. 15 THE COURT: Not his computers? 16 THE WITNESS: I think the computers were included as 17 part of what -18 THE COURT: She didn't say that. I thought it was 19 computers, too. 20 BY MS. THOMPSON: 21 Q. Oh, the person of him and any devices found on him? 22 A. That sounds -- yes. That sounds correct. 23 Q. And did you execute -- you and other agents acting under 24 your authority execute the warrant the very next day, on 25 January 4th? Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 58 of 100 58 Thompson - Direct 1 A. That's correct. 2 Q. Were you part of the execution team for the search warrant 3 at the residence? 4 A. No, I was not. I was part of the team that interviewed the 5 defendant. 6 Q. So agents went to two different locations? Some went to 7 the residence listed in the search warrant, and others went to 8 go meet the defendant? 9 A. Correct. 10 Q. Where did you end up meeting up with the defendant? 11 A. At the facilities at ICE OPR. 12 Q. Before I get to that interview, the team that executed the 13 search warrant at the residence, was there an external hard 14 drive recovered from that residence that contained child 15 pornography? 16 A. There was. 17 Q. Why did you meet with the defendant at the HSI OPR office? 18 A. There was a security concern because the defendant was a 19 federal agent and was proficient with firearms. We knew him to 20 be a tactical person. So he was into MMA fighting and a 21 very -- a tactical person and we didn't want any accidents or 22 any violence or any conflict. 23 So we knew, through working with DHS OIG, that he was 24 supposed to be a witness in a separate OPR investigation 25 involving someone else. And so -- that he would be expected to Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 59 of 100 59 Thompson - Direct 1 make a statement to OPR about that investigation; and that part 2 of the standard protocol at ICE OPR is to lock up your firearm 3 outside the office before you come in. And so we used that 4 circumstance to render the scene safe so that we would be 5 addressing the defendant unarmed. 6 Q. Where was he when you first encountered him -- or when he 7 was first encountered by FBI? 8 A. In a conference room at ICE OPR. 9 Q. Was he alone? 10 A. No. There were ICE -- or DHS OIG, I think, representatives 11 were with him. 12 Q. And what happened when you got there? 13 A. He was asked to fill out a brief biographical sheet, name 14 and address. And while he was doing that, Agent Baker, myself 15 and then a DHS OIG agent walked into the conference room, and 16 the other people left. 17 Q. Did you identify yourselves? 18 A. We did. 19 Q. Why did you tell him you were there? 20 A. We told him we were there because we were investigating a 21 child pornography website and specifically Tor on the darknet, 22 and that we knew he had been involved in that activity. 23 Q. What was his response? 24 A. He was very truthful and honest with us about his 25 activities there. He said he wanted to cooperate, and told us Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 60 of 100 60 Thompson - Direct 1 the truth, that he had in fact been visiting those websites. 2 Q. Was he -- did you tell him anything about whether he was 3 under arrest? 4 A. We told him at the outset that he was not under arrest at 5 that moment. And so at the outset he was not under arrest. 6 Q. Had you considered the various scenarios of what would 7 happen when you spoke with a federal agent whose agency works 8 child pornography cases? 9 A. Yeah. Certainly, I had thought about various 10 possibilities. I had secretly hoped that there was an 11 explanation for all of this; that it was going to come out that 12 it was an undercover or something like that. Another 13 possibility was that there would be nothing said to us, and 14 which I thought was probably most likely. And then the third, 15 that the defendant would be cooperative, as he was. 16 Q. How did you feel about having to investigate a fellow 17 federal law enforcement officer? 18 A. I mean, it was a hard -- it was a hard thing to deal with. 19 And it was -- there was a lot of anxiety leading up to the 20 investigation. Again, as I said, I'd hoped that there was an 21 explanation -- that there was going to be a reasonable 22 explanation to explain away the whole thing. 23 Q. What was his demeanor during the interview? 24 A. He was very calm, forthcoming. And I believe he was honest 25 with us. Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 61 of 100 61 Thompson - Direct 1 Q. Did anybody raise their voice at any time? 2 A. No. 3 Q. How long did the interview last? 4 A. I'd say approximately an hour. And then there was a break. 5 And then he agreed to take a polygraph examination at that 6 point. 7 Q. Did he ever mention anything about a lawyer? 8 A. He did at the outset. He said, I'm a federal agent, and I 9 know I should be asking for an attorney, but I'm not going to 10 do that because I want to -- I want to cooperate with your 11 investigation. 12 Q. Based on the information he gave you, were you able to make 13 a conclusion as to whether he was being honest with you? 14 A. I felt that he was forthcoming and honest with us in his 15 responses. No one's ever completely honest about everything. 16 But I felt that he was very forthcoming, truthful and wanted to 17 cooperate with our investigation. 18 Q. Did he have a cellphone on him at the time you encountered 19 him? 20 A. Yes. 21 Q. Did you seize that? 22 A. Yes. 23 Q. Did he voluntarily provide the password -24 A. Yes. 25 Q. -- passcode to it? Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 62 of 100 62 Thompson - Direct 1 A. Yes. 2 Q. And did he make admissions that he had visited the website 3 that you were investigating, as well as others? 4 A. Yes. So he said -- he confirmed that he had used the 5 website that's in the affidavit, as well as two other Tor, 6 darknet, child pornography websites. 7 Q. At any time did he ask to stop the interview? 8 A. No. 9 Q. At any time did he refuse to answer any questions? 10 A. No. 11 Q. Did he ever ask for anything during the interview, that you 12 remember, to use the restroom or to get a drink of water or 13 something to eat? 14 A. I believe he had a bottle of water with him, that he had 15 brought with him. 16 Q. Do you recall him ever asking for something that was not 17 provided? 18 A. No. 19 Q. Did he ever ask to talk to anybody else that wasn't in the 20 room? 21 A. No. 22 Q. Did he appear to understand the questions you were asking? 23 A. Yes. 24 Q. Did his answers seem appropriate given the questions? 25 A. Yes. Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 63 of 100 63 Thompson - Direct 1 Q. Did he give you -- did he say anything or give you any 2 indication he did not want to speak with you at any time during 3 the interview? 4 A. No. 5 Q. How did the issue of taking a polygraph examination come 6 up? 7 A. That's a typical procedure that we'll use to -- we try to 8 use it to see if there's -- especially if there's been any 9 hands-on contact. And so we will typically, at the conclusion 10 of our initial interview, ask subjects to take a polygraph 11 exam. 12 Q. And the defendant has two minor children? 13 A. Correct. 14 Q. And was he asked about whether he had engaged in any sexual 15 activity with those children? 16 A. He was, and he was adamant that he had not. 17 Q. And is that part of the reason he agreed to take the 18 polygraph? 19 A. Yes. I think so. 20 Q. That took place on the same day? 21 A. Correct. Yes, in the same facility. 22 Q. How did you get from the OPR office to the FBI? 23 A. For the polygraph? 24 Q. Yes. 25 A. The polygraph was done in ICE OPR, in the same facility. Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 64 of 100 64 Thompson - Direct 1 So we took him out of the conference room. I believe at that 2 point we did offer a bathroom break, or if he needed any sort 3 of break at that point. And he was taken into another office 4 that had been provided to us to use for the polygraph. 5 Q. Do you view that interview and that process? 6 A. I did not view that interview just because the office did 7 not have any kind of facility to view it. 8 Q. He spoke with the polygrapher? 9 A. Yes. 10 Q. Is it standard to be given his rights against 11 self-incrimination prior to that interview? 12 A. Right. So the polygrapher will always give Miranda rights, 13 which are signed. 14 Q. Is he also asked to sign a consent to take a polygraph 15 examination? 16 A. Yes. 17 Q. And do you recall him signing both of those documents? 18 A. Yes. That's correct. 19 Q. How long approximately, if you know, did he speak with the 20 polygrapher in the pre-polygraph interview? 21 A. I'd have to look at the notes. I don't know off the top of 22 my head. 23 Q. There's a preinterview, and then they do the actual exam? 24 A. Right. 25 Q. And then was there a post-exam interview? Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 65 of 100 65 Thompson - Direct 1 A. I'd have to look at the polygrapher's notes. I just don't 2 know off the top of my head. 3 MS. THOMPSON: Your Honor, may I approach? 4 BY MS. THOMPSON: 5 Q. I'm going to show you what I will mark as Exhibit 2. Do 6 you recognize that? 7 A. That's the advice of rights form. 8 Q. And what about what I'll mark as Exhibit 3? 9 A. The consent to interview with polygraph. 10 Q. Are those the two forms that Mr. Gratkowski signed on 11 January 4th? 12 A. Yes. 13 Q. I'm now showing you the polygraph examination report and a 14 document marked "statement" to refresh your recollection. Do 15 you recognize those? 16 A. Yes. 17 Q. You can review those to refresh your recollection. 18 A. Okay. 19 Q. Do you recall now whether Mr. Gratkowski gave a post-exam 20 interview? 21 A. So that would be -- you're referring to the statement? 22 Q. Yes. 23 A. Yes. Yes. 24 Q. That occurs after he's been -25 A. Correct. Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 66 of 100 66 Thompson - Direct 1 Q. -- polygraphed? 2 And did he give a verbal statement as well as a written 3 statement? 4 A. Yes. 5 Q. Is the document I showed you entitled "statement" the 6 written statement that Mr. Gratkowski gave on January 4th? 7 A. Correct. 8 MS. THOMPSON: Government will offer Exhibits 2, 3 and 9 4. 10 MS. DOUENAT: No objections, Your Honor. 11 THE COURT: Be received. 12 (Government's Exhibit Nos. 2, 3 and 4 admitted) 13 BY MS. THOMPSON: 14 Q. Was there also a conversation with the defendant about him 15 residing in an apartment currently? 16 A. Yes. That's correct. 17 Q. Was he asked for consent to search the apartment? 18 A. He was. And he granted that. 19 Q. When did that occur? 20 A. That occurred during the interview with Agent Baker and I, 21 when we were talking to him. 22 Q. Prior to the polygraph? 23 A. Correct. 24 Q. After he was given his rights against self-incrimination 25 and taken the polygraph, did he ever revoke the consent to Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 67 of 100 67 Thompson - Direct 1 search his apartment? 2 A. No. 3 THE COURT: Did you ever -- now, when you interviewed 4 him, you immediately told him he wasn't under arrest? 5 THE WITNESS: Yes. We usually say that at the outset, 6 that -7 THE COURT: All right. And did you ever take him into 8 custody and move him to another office, or did you interview 9 him right where he stood? 10 THE WITNESS: Right there. He was taken into custody 11 at the totality -- after everything, all the interviews, 12 polygraphs were done. 13 THE COURT: That's when you took him into custody and 14 arrested him? 15 THE WITNESS: Correct. Yes. 16 BY MS. THOMPSON: 17 Q. Is that after he provided Exhibit 4, the written statement? 18 A. Yes. 19 Q. At that time what did you tell him? 20 A. That he was under arrest and that we would be transporting 21 him to the FBI for processing. 22 Q. What was his reaction? 23 A. I think he understood that that was going to happen. 24 Q. Had you had a conversation about whether he would go to 25 prison for this offense, during the interview? Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 68 of 100 68 Thompson - Direct 1 A. We did have that conversation. I can't remember if it was 2 during the interview or after, in the car, on the way, where we 3 discussed -- I think it was more he remarked on the fact that 4 he was going to prison. 5 Q. Did he inquire ever about what charges may be filed in this 6 case? 7 A. We did talk about what the types of charges would be and 8 that -- yes. 9 Q. Was that prior to him being arrested, or don't you 10 remember? 11 A. I think it was probably in the vehicle on -- either on the 12 way to the FBI office or on the way to the holding facility. 13 THE COURT: So that was already after he was arrested? 14 THE WITNESS: I believe so. 15 BY MS. THOMPSON: 16 Q. Because he's arrested at the OPR office? 17 A. Correct. 18 Q. And is he then brought to the FBI office for processing? 19 A. That's right. 20 Q. And then, from there, he's brought down to the federal 21 courthouse, or was he -22 A. We transported him directly to the GEO holding facility. 23 24 25 MS. THOMPSON: Okay. Thank you. I have nothing further, Your Honor. THE COURT: All right. Let's take a very brief Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 69 of 100 69 Thompson - Cross 1 recess, and then we'll come right back. It'll be about five 2 minutes or so. 3 (Recess) 4 (Open court) 5 6 THE COURT: Please be seated. All right. Counsel, you can proceed. 7 MS. DOUENAT: Thank you, Your Honor. 8 CROSS-EXAMINATION 9 BY MS. DOUENAT: 10 Q. Agent Thomas? 11 A. Thompson, yes. 12 Q. Thompson. Sorry. It's Thompson, right? 13 A. That's correct. 14 Q. Yes. 15 You mentioned that you started this investigation later, 16 somebody else had investigated the case first; is that correct? 17 A. That's correct. 18 Q. And so you got on -- you started this investigation in 19 December or before that? 20 A. December. That's right. 21 Q. So before December, other individuals had done some 22 investigation? 23 A. That's correct. 24 Q. But you got on it around the 19th of December; is that 25 correct? Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 70 of 100 70 Thompson - Cross 1 A. That sounds right. 2 Q. Okay. So before that, it was either the IRS or Department 3 of Homeland Security; is that correct? 4 A. Correct. 5 Q. And part of their investigation was about the website; is 6 that correct? 7 A. That's right. 8 Q. And some third party agency did a blockchain analysis; is 9 that right? 10 A. So in this particular case the blockchain analysis was done 11 by both members of the IRS and a third-party agency, yes. 12 Q. Do you know if they used a specific software to do that 13 blockchain analysis? 14 A. I believe, but do not know for certain, that they used the 15 company Chainalysis. 16 Q. So Chainalysis, right, works for the IRS mainly; is that 17 correct? Do you know that? 18 A. My impression is that they work as a private sector company 19 for everybody, but I'm not intimately familiar with the -20 Q. Correct. And they contract with a government agency, the 21 IRS? 22 A. That may be the case, yeah. 23 Q. And so they have a very complex software that is able to go 24 through these huge terabytes of the ledger that you mentioned, 25 the blockchain ledger? Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 71 of 100 71 Thompson - Cross 1 A. I don't think the blockchain is a terabyte yet. So I think 2 it's still measured in gigabytes. I think it's 150ish. But 3 I'd have to download the latest to -4 Q. But it's a lot of information? 5 A. It is a lot of information. That's correct. 6 Q. And most of it is crypto -- you called it crypto-language 7 where you said it was like gibberish and then .onion or -- I 8 mean, there's a lot of different characters, strings of 9 characters; is that correct? 10 A. Bitcoin itself is based on cryptography. So there's a lot 11 of math involved. The ledger itself is text, I believe. But 12 I'm not -- I don't -- myself, I've not done a blockchain 13 analysis. So I'm -14 Q. Have you seen the ledger? 15 A. I have downloaded the ledger. 16 Q. Okay. So you know there is no usernames, no passwords, no 17 addresses, no emails, nothing on the ledger; is that correct? 18 A. Well, that would not be part of the bitcoin protocol in the 19 first place. 20 Q. Right. 21 A. So yes, definitely not in the ledger. 22 Q. So there is nothing that identifies anyone on those 23 ledgers? 24 A. Well, you can put that information in the blockchain if you 25 want to. So that information can be included as part of Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 72 of 100 72 Thompson - Cross 1 bitcoin transactions. 2 Q. But it's not in the ledger; is that correct? 3 A. That information can be. It depends upon -- when people 4 transact in bitcoin, you can append information to that 5 transaction. There's also a lot of use of the blockchain 6 technology in general for all kinds of crazy projects like 7 CryptoKitties and various other issues that are -- that may be 8 part of the blockchain. 9 Q. And it analyzes, basically, patterns and just different -10 it doesn't -- it just tries to look for patterns; is that 11 correct? 12 A. Well, I don't -13 Q. When somebody does the analysis, not the ledger itself. 14 A. Right. So blockchain analysis would do -- would look for 15 patterns in the blockchain, yes. 16 Q. And it does that with a software that helps them do that, 17 because it would take years to do that if you just were doing 18 it with your eye, and very difficult without math; is that 19 correct? 20 A. I don't know about the math part. You would definitely 21 have to use some kind of software to interact with the 22 blockchain file on your computer, yes. 23 Q. And you mentioned the IRS did that analysis as well as a 24 third-party agency; is that correct? 25 A. Correct. Yes. Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 73 of 100 73 Thompson - Cross 1 Q. And you weren't privy to that analysis? 2 A. I did not, myself, perform that analysis. That's correct. 3 Q. And so you don't know how that analysis was done to come up 4 with this 221 different wallets that belonged -- that they 5 claim belonged to the website; is that correct? 6 A. Right. I have -- I would call it a general understanding 7 of how that type of analysis may be done. But since I did not 8 do that exact analysis, I don't want to say how they did 9 theirs. 10 Q. Because you're unaware of how they did theirs? 11 A. That's correct. 12 Q. They just ended up giving you 221 different wallets that 13 may have been associated with that website, pursuant to this 14 analysis that was made; is that correct? 15 A. Well, that was part of the information that was in their 16 subpoena. Mostly what they gave us was the investigative 17 package regarding the defendant, which would include all the 18 subpoena results and as well as their summary of their 19 information. 20 Q. So the summary of their information included 221 wallets 21 that they claimed were a part of this website; is that correct? 22 A. Well, that was in their subpoena to Coinbase, was why those 23 were included. 24 Q. Correct. And in that subpoena to Coinbase, they don't say 25 it belongs to the website? Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 74 of 100 74 Thompson - Cross 1 A. In the subpoena itself? 2 Q. Right. 3 A. When they -- when they -- for the demand to Coinbase? 4 Q. Yes. 5 A. No. They wouldn't make any attributions of where it is. 6 Q. All they asked in that subpoena was, Please look in all of 7 your accounts and find out who's transacted with these 221 8 wallets? 9 A. Correct. 10 Q. And so at that point Coinbase did their own analysis and 11 search and located what they could find to give -- forward to, 12 I guess, either the IRS or Homeland Security; is that correct? 13 A. Right. 14 MS. DOUENAT: Okay. Your Honor, may I approach? 15 THE COURT: Sure. 16 MS. DOUENAT: Sorry. That's actually -- I can't 17 approach. 18 That's been tendered to the Court already as an exhibit. 19 But we also have it in CD format as Defense Exhibit Number 4. 20 And it's basically the Coinbase ledger. And we have a copy for 21 all parties, including the Court. And we're just going to talk 22 about it. But I'm going to give a copy to the Court. 23 MS. THOMPSON: Is it being offered? 24 MS. DOUENAT: It will be offered, yes. 25 THE COURT: What is it? Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 75 of 100 75 Thompson - Cross 1 MS. DOUENAT: It's the actual Coinbase ledger that was 2 given to law enforcement. 3 BY MS. DOUENAT: 4 Q. And so on there, there is -- there is several -- there is 5 identifying information about Mr. Gratkowski; is that correct? 6 A. I don't know what's on the material that you provided, but 7 I do know the information that was given to me by IRS agents 8 had identifying information for Mr. Gratkowski. 9 Q. Okay. So I'm going to show you what was given to us. Is 10 this what was given to you by law enforcement? 11 A. Yes. That's correct. 12 Q. Okay. And this is what's Government Exhibit Number 4 13 [sic]. 14 And so there is information on -- there's two Excel 15 spreadsheets; is that correct? 16 A. Yes. 17 Q. Okay. And there is information with Mr. Gratkowski's name 18 up there; is that correct? 19 A. That's right. 20 Q. And then there's four wallets and one Excel spreadsheet. 21 Can you just go down to that? Is that correct? Is that 22 accurate? So those are Bitcoin wallets? 23 MS. THOMPSON: For the record, Your Honor, this is 24 Defense Exhibit 4 that has not yet been offered, not Government 25 Exhibit 4. Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 76 of 100 76 Thompson - Cross 1 MS. DOUENAT: I'm sorry. Defense Exhibit 4. 2 THE WITNESS: Yes. Those are Bitcoin wallet 3 addresses, or they appear to be. 4 BY MS. DOUENAT: 5 Q. Okay. And this is what you were given by the IRS? 6 A. That's correct. 7 MS. DOUENAT: Okay. At this time, Your Honor, we 8 would like to tender this into evidence so we can talk about it 9 during cross-examination. 10 MS. THOMPSON: I don't have an objection to the 11 Court -- the admission of the Excel spreadsheet that was 12 provided to defense counsel, but I don't know what's on this. 13 Provided it's the same, I don't have an objection. But I don't 14 know what's on here. 15 THE COURT: All right. 16 MS. DOUENAT: And yes, Your Honor. It is the same, 17 and it has not been altered. 18 BY MS. DOUENAT: 19 Q. There are portions in this document that say "redacted." A 20 lot of stuff says "redacted" in there. I was wanting to know 21 who did -- who did those modifications, whether it was Coinbase 22 or whether it was law enforcement. 23 A. I'm assuming it was Coinbase -24 Q. Okay. 25 A. -- because that is as it was given to me by IRS. Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 77 of 100 77 Thompson - Cross 1 Q. And the IRS mentioned to you that they're not the ones that 2 altered it; that Coinbase gave it to you that way? 3 A. We did not discuss that. 4 Q. Okay. So those wallets, did you do an analysis yourself to 5 find out if those linked to -- at all to the wallets that were 6 given to Coinbase? 7 A. I did not. 8 Q. The 221? 9 A. I did not. 10 Q. Okay. So you don't know how those wallets link to the 221 11 wallets on Coinbase -- I mean, on the website that were given 12 to Coinbase; is that correct? 13 A. I'm assuming that this is the response given to us from 14 Coinbase based on the IRS subpoena. So this would be in 15 response to -- this would be one of the customers that was 16 identified as transacting with those wallets that you referred 17 to. 18 Q. So you mentioned earlier Bitcoin goes through different 19 transactions before it goes -- part of the blockchain analysis 20 tries to analyze those different transactions because they go 21 through different transactions before ending in a certain 22 wallet; is that correct? 23 A. They can, yes. 24 Q. And part of the analysis is to decipher who really owns the 25 money? Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 78 of 100 78 Thompson - Cross 1 A. Or that an entity controls multiple wallets, for example. 2 Q. Right. 3 And the way you were able to verify the accuracy of that is 4 that you mentioned that there was another investigation that 5 was identical to this, almost identical, which the results were 6 accurate; is that correct? 7 A. Well, that was one of the data points, yes. But there were 8 others that I reference in the affidavit regarding the accuracy 9 of the third-party company that were used to justify its use. 10 Q. Other investigations? 11 A. No. Other points of data that had shown the company to be 12 accurate in the past. 13 Q. Okay. And so are there investigations that you worked on 14 that this company -- you mentioned you don't even know the 15 company who did the blockchain analysis; is that correct? 16 A. I do know that IRS specifically did some of it, and I do 17 know that they used Chainalysis, amongst other companies, to do 18 blockchain analysis. 19 Q. So the IRS has their own software? 20 A. I think they are probably using the available open source 21 tools that you can use to analyze the blockchain. I did not in 22 detail go over with the IRS agent exactly how he did his 23 blockchain analysis. 24 Q. So let's talk about open source tools. There's one that's 25 called, actually, I think blockchain.com; is that correct? Or Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 79 of 100 79 Thompson - Cross 1 do you know of it? 2 A. I'm not familiar with that. 3 MS. THOMPSON: Your Honor, I'm going to object to this 4 line of questioning as irrelevant. 5 THE COURT: Yeah. I think it's -- I don't know where 6 you're going with this, but it is irrelevant. 7 MS. DOUENAT: Your Honor, if you could give me some 8 leeway, I could show you where this is going. 9 THE COURT: Well, all right. 10 BY MS. DOUENAT: 11 Q. So have you ever used any of the open tools to do any kind 12 of blockchain analysis yourself? 13 A. I have not, myself. 14 Q. But you are aware that if you put a wallet inside one, it 15 just goes to various different transactions? 16 A. I don't think that's generally correct, but it can be 17 correct. But I don't think -- as a general statement I don't 18 know that that's correct, but I think it can be. So, in other 19 words, a bitcoin transaction can go through multiple wallets. 20 Yes, I would definitely agree to that. 21 Q. And you have no idea how many wallets these bitcoin 22 transactions have been through because you didn't do it 23 yourself? 24 A. That is correct. 25 Q. Okay. In fact, you mentioned that you opened an account, Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 80 of 100 80 Thompson - Cross 1 yourself, on this website? 2 A. Yes. No, that is correct. Yes. 3 Q. And that you actually did a cataloging of how many images 4 there were; is that correct? 5 A. I didn't do a totality. So I didn't look at every image 6 that was on there. I visited to determine that child 7 pornography existed. 8 Q. You, in fact, opened a VIP account? 9 A. No. I just registered a username and password. 10 Q. So you didn't spend any money? 11 A. That's correct. 12 Q. But you did mention earlier that law enforcement had 13 downloaded some images? 14 A. That's correct. Prior to me, IRS and DHS had opened their 15 own accounts and done that. 16 Q. And that was part of your packet? 17 A. Yes. That's correct. 18 Q. Okay. And so DHS and IRS had opened accounts and purchased 19 bitcoins? 20 A. Well, they had purchased bitcoins. So that's separate. 21 And then they had also registered a username and password on 22 the website. 23 Q. And to download, they had to actually use bitcoins; is that 24 correct? 25 A. That's correct. Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 81 of 100 81 Thompson - Cross 1 Q. And so part of the bitcoin ledger would also include law 2 enforcement transactions? 3 A. Yes. Absolutely. 4 Q. But those specific bitcoins can't -- you can't in the 5 ledger find out what was downloaded or what was not downloaded; 6 is that correct? 7 A. In the blockchain ledger? That is absolutely correct. 8 Q. So you can't identify what specific images or what specific 9 videos were downloaded? 10 A. Correct. Now, we have identified that subsequent based 11 upon the seizure of the website. 12 Q. Subsequent. Not before the search warrant? 13 A. Absolutely. 14 Q. Now, would you be surprised that Coinbase says that they're 15 federally insured for their U.S. residents? 16 A. I did not know that. 17 Q. Would it surprise you if they were? 18 A. No. 19 Q. You mentioned in your affidavit that you ended up then 20 doing a search by uploaders? 21 A. IRS did that, yes. 22 Q. So the IRS did that, and you put it in your affidavit; is 23 that right? 24 A. That's right. 25 Q. And that they identified two usernames who had uploaded Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 82 of 100 82 Thompson - Cross 1 child pornography; is that correct? 2 A. Yes. That is correct. 3 Q. And none of those usernames are Mr. Gratkowski; is that 4 correct? 5 A. That is correct. 6 Q. And one of them actually was an administrator? 7 A. That, I'm unsure of. Might be. 8 Q. So when you came into the investigation on 12/19, the only 9 information you had on Mr. Gratkowski is that he had a Coinbase 10 account with certain wallets; is that right? 11 A. That was part of the information that we had on him, yes. 12 Q. That were somehow linked to some wallets that could belong 13 to the website; is that right? 14 A. We had information that -- the information I put in the 15 affidavit concerned one wallet that was controlled at Coinbase 16 for Mr. Gratkowski, that had interacted six times with what the 17 third party and IRS had identified as wallets connected to the 18 website. 19 Q. But because you didn't do the analysis, you don't know how 20 many times -- how many wallets it had interacted with 21 beforehand; is that right? 22 A. That's correct. 23 Q. And you didn't have a username from that account from the 24 website that belonged to Mr. Gratkowski? 25 A. That is also correct. Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 83 of 100 83 Thompson - Cross 1 Q. You didn't have any downloaded images by Mr. Gratkowski 2 that you were aware of? 3 A. Correct. 4 Q. And you didn't have any -- you had no known images that 5 were purchased by Mr. Gratkowski; is that correct? 6 A. That's correct. 7 8 MS. DOUENAT: Give me one second, Your Honor. (Discussion off the record) 9 BY MS. DOUENAT: 10 Q. You mentioned that -- so you didn't have any information on 11 what he had downloaded or if he had downloaded anything. And 12 then you were made aware that he was law enforcement. So you 13 wanted to secure the safety of all parties; is that correct? 14 A. That's correct. 15 Q. Okay. And so in that process Mr. Gratkowski was asked to 16 come to do a witness interview at OPR; is that correct? 17 A. That's right. 18 Q. So he went to OPR under the belief that he was going to be 19 giving a statement about a case that he was a witness to? 20 A. That's correct. 21 Q. At that point, when he arrived, he was put in a secure -22 well, he was put in a room; is that correct? 23 A. Yes. 24 Q. And in that room he was there with two other individuals? 25 A. I don't know exactly how many people were in the room with Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 84 of 100 84 Thompson - Cross 1 him before I entered. I don't remember. 2 Q. It was like a conference room -3 THE COURT: You used the term "put in a room." Are 4 you suggesting that he was under arrest; that he was taken to a 5 room? He walked into a room. 6 MS. DOUENAT: He walked into a room with two 7 individuals; is that correct? 8 THE COURT: He thought were part of a group? 9 MS. DOUENAT: He was going to be interviewed about a 10 case he had been a witness to; is that correct? 11 THE COURT: Right. 12 THE WITNESS: Right. 13 MS. DOUENAT: So it was in a conference room? 14 THE WITNESS: Yep. It was a conference room. 15 MS. DOUENAT: Okay. And shortly thereafter -- 16 THE COURT: We're going to have to take a very brief 17 recess. All right? I've got a call from Judge Garcia I've got 18 to take. 19 (Recess) 20 (Open court) 21 22 THE COURT: Please be seated. This is the problem with Apple watches. See, in the old 23 days I would have -- I had my cellphone off. I would have 24 never known that Judge Garcia called, and I would have just got 25 it later. Instead, my wrist goes crazy, and I look down. It's Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 85 of 100 85 Thompson - Cross 1 Judge Garcia. So I have to go. Sorry. 2 Go ahead, Counsel. 3 MS. DOUENAT: Sure, Your Honor. 4 THE COURT: You know, I'm having a big problem here 5 with this. And I keep falling down. So let me fix this, lest 6 you lose me entirely. There we go. Okay. 7 BY MS. DOUENAT: 8 Q. Agent Thompson, so we had mentioned the fact that he was 9 called to go to OPR to talk about a witness interview? 10 A. Correct. 11 Q. And when you came into the room, he was already in the room 12 with several agents from Homeland Security and OPR; is that 13 correct? 14 A. He was definitely in the room with other people. I'm not 15 sure exactly what all their affiliations were. My impression 16 was it was going to be either DHS OIG or OPR elements. 17 Q. But there was more than one person; is that right? 18 A. Yeah. That's right. 19 Q. And he was filling out biographical information about his 20 current address; is that correct? 21 A. That's correct. 22 Q. Because he lives in an apartment. He wasn't living with 23 his wife; is that correct? 24 A. That's right. 25 Q. And so that was information y'all needed to also ask for Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 86 of 100 86 Thompson - Cross 1 another search warrant; is that correct? 2 A. We got consent from him. 3 Q. Right. 4 Or to get another search warrant. It was either one or the 5 other. That's why you asked for that biographical information; 6 is that correct? 7 A. That's correct. 8 Q. When you entered the room, you entered the room with 9 another agent; is that right? 10 A. Another agent from FBI and one from DHS OIG. So there were 11 three of us total. 12 Q. So three agents in the room and Mr. Gratowski; is that 13 right? 14 A. That's right. And we also had -- our intelligence analyst 15 was sitting against the wall. 16 Q. So four? 17 A. Right. 18 Q. Okay. And did y'all have your service weapons on? 19 A. We did. 20 Q. And his was not there, because when you go to OPR, you have 21 to put yours in a locker; is that correct? 22 A. That's correct. 23 Q. Okay. At that point his keys were taken because, as you 24 mentioned, he is a tactical unit agent, so he had weapons in 25 his vehicle, is that correct, and they needed to secure those? Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 87 of 100 87 Thompson - Cross 1 A. Those were secured at some point during -- but not during 2 our -- I don't think that happened during the interview where 3 Agent Baker and I talked to him. I think that happened later 4 in time. 5 Q. It happened before the polygraph; is that right? 6 A. It could have. I don't remember exactly when the keys were 7 taken. 8 Q. And at that point y'all also informed him that a search 9 warrant was actually being at that time executed at his home; 10 is that right? 11 A. That's right. 12 Q. This was at the same time that y'all were interviewing him? 13 A. Right. 14 Q. I'm going to go back and ask you -- and at this point no 15 Mirandas were given; is that right? 16 A. Correct. He was told he was not under arrest. 17 Q. Right. 18 But there were at least four agents in the room, and 19 there's only one door to the place, and he was being 20 questioned; is that right? 21 A. There was three agents and one intel analyst. So the intel 22 analyst was not armed and is not an agent herself. 23 Q. But three of them were, and they were in the room with him; 24 is that right? 25 A. That's right. Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 88 of 100 88 Thompson - Cross 1 Q. Okay. I'm going to go back a little bit and ask you about 2 the information -- the packet you were given by IRS, DHS. That 3 was given to you December 19th of this year; is that right? 4 A. That would have been December of -5 Q. 2017. Sorry. This year? 6 A. Yes. Exactly. 7 Q. Of last year. I apologize. 8 So the blockchain analysis was about the website. At that 9 point, when you had that analysis and that part of the packet, 10 there was nothing identifying Mr. Gratkowski at all, is that 11 correct, in the blockchain analysis? 12 A. Well, I didn't actually get the blockchain analysis. All I 13 got was the work product from IRS showing the results of the 14 subpoenas that they sent to Coinbase -15 Q. Okay. 16 A. -- and the Coinbase transactions. 17 Q. Okay. So there was a blockchain analysis done that gave 18 several wallets that belonged to the website; is that correct? 19 Or at least purported to belong to the website in this 20 analysis; is that right? 21 A. That's my understanding, yes. 22 Q. Right. 23 And so what you received was the actual subpoena to 24 Coinbase? 25 A. Yes. I did receive that, yes. Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 89 of 100 89 Thompson - Cross 1 Q. Right. 2 And so because of the subpoena to Coinbase, you were able 3 to get Mr. Gratkowski's name; is that correct? 4 A. So that had already -- that work had already been done by 5 IRS. So they gave me the results of their subpoenas, which did 6 have his name and address, yes. 7 Q. And based on the Coinbase subpoena; is that right? 8 A. That's correct. 9 Q. And that included his passport? 10 A. It did not. That was a verbal anecdote they shared with me 11 as to how they identified Mr. Gratkowski as a federal agent. 12 Q. And that was a verbal anecdote based on -- they received 13 that information Coinbase? 14 A. That's correct. That's my understanding. 15 Q. So it was as a result of the Coinbase subpoena that they 16 were able to get a picture of Mr. Gratkowski's federal 17 passport; is that right? 18 A. I believe so, yes. 19 Q. And his, also, USAA bank account number? 20 A. Yes. 21 Q. And his address? 22 A. Correct. 23 Q. And his email address? 24 A. Yes. 25 Q. And one second. Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 90 of 100 90 Thompson - Cross 1 (Discussion off the record) 2 BY MS. DOUENAT: 3 Q. Oh, and also credit card -4 A. Yep. Yes. 5 Q. -- accounts. Anything else? 6 A. I believe his driver's license number was in there. 7 Q. Okay. And that was from the, again, Coinbase subpoena? 8 A. That's correct. 9 Q. Okay. Before that, there was nothing, correct? You didn't 10 have any information, before the Coinbase subpoena, that gave 11 you Mr. Gratkowski's information? 12 A. Before the IRS investigative packet, I did not have 13 information. 14 Q. Right. 15 But all that was based on the Coinbase subpoena, that they 16 received that information; is that right? 17 A. They did multiple -- so yes, they subpoenaed Coinbase. 18 They subpoenaed USAA. 19 (Discussion off the record) 20 BY MS. DOUENAT: 21 Q. And, again, before you issued the search warrant -- or 22 actually took the search warrant to be executed by -- or signed 23 by the magistrate, you had no knowledge of what photographs or 24 videos were accessed by Mr. Gratkowski, if any? 25 A. That is correct. Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 91 of 100 1 MS. DOUENAT: Pass the witness. 2 MS. THOMPSON: I have nothing further, Your Honor. 3 THE COURT: Okay. You can step down. 4 91 Do you have any other witnesses? 5 MS. THOMPSON: No. The government rests. 6 THE COURT: Do you have a witness? 7 MS. DOUENAT: No, Your Honor. 8 MS. THOMPSON: Actually, before I rest, I will offer 9 Government's Exhibit 1, which is a certified copy of the search 10 warrant. 11 12 THE COURT: All right. That'll be received. (Government's Exhibit No. 1 admitted) 13 MS. DOUENAT: No objections. No objections, Your 14 Honor. 15 THE COURT: I'm sure you didn't. 16 MS. DOUENAT: And we offered Exhibit 4, Your Honor, 17 which was the Coinbase ledger. And I know the government said, 18 if it's not altered. 19 THE COURT: Well, I'm sure that -- I'll receive it. 20 And then if the government sees that there's some changes in it 21 or some alteration or something, you can let me know. 22 MS. THOMPSON: I just want to state for the record 23 it's not the analysis. It's the subpoena return from Coinbase. 24 THE COURT: Right. I do understand that. 25 MS. THOMPSON: What are you saying Exhibit 4 is? Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 92 of 100 1 92 MS. DOUENAT: It's the ledger we received from you 2 that says it was what Coinbase gave you. 3 MS. THOMPSON: Right. 4 THE COURT: That's what she just said. 5 MS. DOUENAT: Right. That's exactly it. Yes. 6 7 (Defendant's Exhibit No. 4 admitted) THE COURT: Okay. Now, I don't need any further 8 argument. I understand what the issues are after 30 years. 9 I've done plenty of motions to suppress. But what I would like 10 is I do have a couple of -- I have one question, actually, for 11 defense counsel. 12 At one point one of your motions was really a motion to 13 compel, but then documents were turned over. So my 14 understanding is that that's moot. You got your documents now. 15 Am I right? 16 MS. DOUENAT: Well, the only document I received was 17 the Coinbase subpoena return and the actual subpoena to 18 Coinbase. We were also asking what blockchain analysis 19 software they use to do the blockchain analysis of the website, 20 to see if it accurately reflects what they're saying it 21 reflects. 22 MS. THOMPSON: If she's asking for the software that 23 was used to do the blockchain analysis, I don't have that. 24 That was a third-party company that did that analysis. 25 In her motion for discovery she wants any evidence of the Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 93 of 100 93 1 NIT. There is none. 2 The subpoenas and warrants sought in connection with 3 Mr. Gratkowski. That has been all turned over. 4 The subpoena or warrants sought in connection with the 5 investigation of the bitcoin ledger, Coinbase or investigation 6 of the website. The Coinbase subpoena and subpoena return and 7 the work product done by law enforcement has all been turned 8 over. 9 And then the bitcoin ledger used to conduct the financial 10 analysis, that's public. 11 And the software, we don't have. 12 THE COURT: You don't have it. 13 MS. DOUENAT: So the summary that was given to the IRS 14 from the blockchain analysis third-party company, they gave a 15 report to the IRS. We don't have that report of the blockchain 16 analysis done. So they must have given something to the IRS, 17 identifying these wallets as part of the website. That's what 18 we don't have. 19 MS. THOMPSON: That is in the government's control. 20 It's not in mine. And I will look into what that contains and 21 if there's any argument on behalf of the government for a 22 reason why that should not be turned over. Otherwise, I'll 23 obtain it and turn it over. 24 THE COURT: That's fine. But it doesn't really have 25 any direct -- I certainly understand why that might be Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 94 of 100 94 1 something of import for the defense down the road, but it 2 doesn't really have any direct implication for the legal issues 3 here, because we know what it is. So that isn't going to, you 4 know, hold up my ruling on this motion in any way, shape or 5 form. 6 MS. THOMPSON: Correct. With regard to the motion to 7 suppress, the government's position is it's completely 8 irrelevant. 9 THE COURT: But if there's something there and you get 10 it, and it later turns out to be some kind of a critical piece 11 of information, then I would certainly allow you to reopen. 12 All right? Okay? 13 MS. DOUENAT: Thank you, Your Honor. 14 THE COURT: I'm trying to be fair here. 15 MS. DOUENAT: Yes. I understand. I'm -- 16 THE COURT: Now, counsel did make mention of a 17 relatively recent Supreme Court case. And the name escapes me 18 at this -19 MS. DOUENAT: Carpenter. 20 THE COURT: Carpenter. Yeah. I've actually read the 21 case, of course. I don't know how applicable it is because 22 Carpenter's a very narrow ruling. Even the Supreme Court 23 indicated it was a narrow ruling, because it dealt with 24 cellphones and cellphone towers and ubiquitous nature of 25 cellphones and all kinds of stuff. Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 95 of 100 1 95 But, you know, counsel has made an argument. I think it's 2 a creative argument. I don't know that it's a winning 3 argument, but it's a creative argument. You haven't responded 4 to it, other than to say, we'll hear from the agent. But that 5 doesn't help me with respect to the legal analysis. 6 MS. THOMPSON: I did file a response to that on August 7 2nd. It was -8 THE COURT: What did you say? 9 MS. THOMPSON: -- short. But that the defense -- the 10 defense reference to the -- their argument that the information 11 contained in the public ledger -- that he has an expectation of 12 privacy in that is ridiculous. The whole ledger is public. So 13 he has no expectation of privacy -14 THE COURT: All right. But what I want you to do, 15 Ms. Thompson, is please give me a very short response in 16 writing and address the legal issues in Carpenter and tell me 17 why it doesn't apply in your view. Can you do that? 18 MS. THOMPSON: I will. Basically, there is an 19 expectation of privacy in the information with regard to the 20 cellphone records and your location in Carpenter. 21 THE COURT: Well, I understand that's your argument, 22 but I want you to look into it and give me a short memorandum. 23 All right? 24 MS. THOMPSON: Yes, Your Honor. 25 THE COURT: So I can have that to look at. And Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 96 of 100 96 1 provide it to counsel. I know what her position is. You know, 2 she did a rather thorough job of going over Carpenter. And I'm 3 not suggesting you didn't do a thorough job. I'm just -- I'm 4 just -- I'm just saying that I just didn't get a -- you know, a 5 legal response, other than, It doesn't -- In my view it doesn't 6 apply because there's no expectation of privacy. And in the 7 final analysis that may be the right answer. But I think you 8 need to look at it and try to distinguish it because it is a 9 new Supreme Court case. 10 And if I rule against the defense on this motion, I can 11 assure you the Fifth Circuit's going to want something in 12 writing if he gets -- well, I don't know. He's essentially 13 confessed. And then I've got to get past the question of 14 whether he needed to be Mirandized. So I'll have to address 15 that one as well. 16 So I know what your arguments are about that. Okay? I 17 don't need to hear further allocution. 18 MS. DOUENAT: If the Court wants briefing on it, I 19 could brief it -- I could brief the Court -20 THE COURT: On what? 21 MS. DOUENAT: On the Miranda issue, Your Honor, if the 22 Court wants, on the statements and -- the statements. 23 THE COURT: Well, I'll give you an opportunity to do 24 it if you want to do it. 25 MS. DOUENAT: Sure, Your Honor. I have no problems. Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 97 of 100 1 THE COURT: You want to -- 2 MS. THOMPSON: I want to point out that that wasn't 97 3 even -- that's what we talked about at the beginning of the 4 hearing, is that that wasn't even noticed by the defense as an 5 issue. 6 7 THE COURT: Well, it is now. In your memorandum to me on the Carpenter issue give me 8 your view as to why -- I think I already know why. You 9 believe, you know, you have to look at the totality of the 10 circumstances. He's a trained agent. He was told he wasn't 11 under arrest. He should know that he was free to leave at any 12 time. Although they didn't tell him specifically that, your 13 view is that he should know that. 14 On the other hand, his view is that he was -- three agents 15 and some woman who's an intelligence agent or officer or 16 something are sitting in there, and he's totally intimidated, 17 and he can't get up and leave. He doesn't think he can get up 18 and leave reasonably. 19 Am I getting these arguments right? 20 MS. DOUENAT: That's correct, Your Honor. 21 THE COURT: That's what 30 years of hearing motions to 22 suppress will do for you. You can make both sides of the 23 argument. 24 Anyway, I will allow you both to address that. And give me 25 some -- give me some case law, if you can find it, to support Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 98 of 100 98 1 your position. All right? 2 MS. THOMPSON: Yes, Your Honor. 3 THE COURT: And what I'm most -- or what's most 4 important to me is not case law that involves people who are 5 not sophisticated in the law. 6 MS. DOUENAT: Yes. 7 THE COURT: Yeah. You know, because it doesn't do me 8 any good to -- you know, a ten-year-old boy is going to be very 9 different than somebody who is a trained lawyer, for instance, 10 in criminal law, criminal lawyer. So I need -- let's kind of 11 narrow it to factual scenarios that are somewhat similar to 12 ours. Okay? 13 All right. Have a good weekend. I'm going to take -- 14 (At the bench off the record) 15 THE COURT: Yeah. I'd like to have your memoranda -- 16 actually, I'm going to be out of town next week. Myself, Judge 17 Yaeckle and I think a few other Western District judges are 18 going to be at the midwinter conference of district judges, 19 it's an educational program, next week. But I think I come 20 back on Friday. So I'll give you until Friday, okay, of next 21 week because I'm not going to be here anyway. 22 MS. THOMPSON: Thank you, Your Honor. 23 MS. DOUENAT: Thank you, Your Honor. 24 THE COURT: Actually, I think I fly in on Saturday 25 morning, early. Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 99 of 100 1 COURTROOM DEPUTY: Saturday. 2 THE COURT: Yeah. But, I mean, for your purposes, 3 Friday. So you can have until Friday afternoon, and maybe, 4 say, 2:00 so we make sure that we can get it -- we got it. 5 Okay? Is that all right, Counsel? 6 MS. DOUENAT: Yes, Your Honor. Thank you very much. 7 THE COURT: All right. Okay. Well, thank you very 8 much. Have a nice weekend. 9 * ** 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 (Hearing adjourned) 99 Case 5:18-cr-00043-DAE Document 46 Filed 08/27/18 Page 100 of 100 1 2 100 -oOoI certify that the foregoing is a correct transcript from 3 the record of proceedings in the above-entitled matter. 4 5 Date: 8/27/2018 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 /s/ Chris Poage United States Court Reporter 655 East Cesar E. Chavez Blvd., Rm. G-65 San Antonio, TX 78206 Telephone: (210) 244-5036